packages feed

crypton 0.31 → 0.32

raw patch · 211 files changed

+11692/−11686 lines, 211 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

CHANGELOG.md view
@@ -1,3 +1,9 @@+## 0.32++* All C symbols now have the "crypton_" prefix.+  [#7](https://github.com/kazu-yamamoto/crypton/pull/7)+  [#8](https://github.com/kazu-yamamoto/crypton/pull/8)+ ## 0.31  * Crypton is forked from cryptonite with the original authors permission.
Crypto/Cipher/AES/Primitive.hs view
@@ -566,80 +566,80 @@                         withCCMKeyAndCopySt ctx ccm (c_aes_ccm_finish (castPtr t)) >> return ()  -------------------------------------------------------------------------foreign import ccall "cryptonite_aes.h cryptonite_aes_initkey"+foreign import ccall "crypton_aes.h crypton_aes_initkey"     c_aes_init :: Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ecb"+foreign import ccall "crypton_aes.h crypton_aes_encrypt_ecb"     c_aes_encrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_ecb"+foreign import ccall "crypton_aes.h crypton_aes_decrypt_ecb"     c_aes_decrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_cbc"+foreign import ccall "crypton_aes.h crypton_aes_encrypt_cbc"     c_aes_encrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_cbc"+foreign import ccall "crypton_aes.h crypton_aes_decrypt_cbc"     c_aes_decrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_xts"+foreign import ccall "crypton_aes.h crypton_aes_encrypt_xts"     c_aes_encrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_xts"+foreign import ccall "crypton_aes.h crypton_aes_decrypt_xts"     c_aes_decrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gen_ctr"+foreign import ccall "crypton_aes.h crypton_aes_gen_ctr"     c_aes_gen_ctr :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO () -foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_gen_ctr_cont"+foreign import ccall unsafe "crypton_aes.h crypton_aes_gen_ctr_cont"     c_aes_gen_ctr_cont :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ctr"+foreign import ccall "crypton_aes.h crypton_aes_encrypt_ctr"     c_aes_encrypt_ctr :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_c32"+foreign import ccall "crypton_aes.h crypton_aes_encrypt_c32"     c_aes_encrypt_c32 :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_init"+foreign import ccall "crypton_aes.h crypton_aes_gcm_init"     c_aes_gcm_init :: Ptr AESGCM -> Ptr AES -> Ptr Word8 -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_aad"+foreign import ccall "crypton_aes.h crypton_aes_gcm_aad"     c_aes_gcm_aad :: Ptr AESGCM -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_encrypt"+foreign import ccall "crypton_aes.h crypton_aes_gcm_encrypt"     c_aes_gcm_encrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_decrypt"+foreign import ccall "crypton_aes.h crypton_aes_gcm_decrypt"     c_aes_gcm_decrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_finish"+foreign import ccall "crypton_aes.h crypton_aes_gcm_finish"     c_aes_gcm_finish :: CString -> Ptr AESGCM -> Ptr AES -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_init"+foreign import ccall "crypton_aes.h crypton_aes_ocb_init"     c_aes_ocb_init :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_aad"+foreign import ccall "crypton_aes.h crypton_aes_ocb_aad"     c_aes_ocb_aad :: Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_encrypt"+foreign import ccall "crypton_aes.h crypton_aes_ocb_encrypt"     c_aes_ocb_encrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_decrypt"+foreign import ccall "crypton_aes.h crypton_aes_ocb_decrypt"     c_aes_ocb_decrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_finish"+foreign import ccall "crypton_aes.h crypton_aes_ocb_finish"     c_aes_ocb_finish :: CString -> Ptr AESOCB -> Ptr AES -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_init"+foreign import ccall "crypton_aes.h crypton_aes_ccm_init"     c_aes_ccm_init :: Ptr AESCCM -> Ptr AES -> Ptr Word8 -> CUInt -> CUInt -> CInt -> CInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_aad"+foreign import ccall "crypton_aes.h crypton_aes_ccm_aad"     c_aes_ccm_aad :: Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_encrypt"+foreign import ccall "crypton_aes.h crypton_aes_ccm_encrypt"     c_aes_ccm_encrypt :: CString -> Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_decrypt"+foreign import ccall "crypton_aes.h crypton_aes_ccm_decrypt"     c_aes_ccm_decrypt :: CString -> Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_finish"+foreign import ccall "crypton_aes.h crypton_aes_ccm_finish"     c_aes_ccm_finish :: CString -> Ptr AESCCM -> Ptr AES -> IO ()
Crypto/Cipher/AESGCMSIV.hs view
@@ -80,13 +80,13 @@ polyvalFinalize (Polyval ctx) = B.alloc 16 $ \dst ->     B.withByteArray ctx $ \pctx -> c_aes_polyval_finalize pctx dst -foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_polyval_init"+foreign import ccall unsafe "crypton_aes.h crypton_aes_polyval_init"     c_aes_polyval_init :: Ptr Polyval -> CString -> IO () -foreign import ccall "cryptonite_aes.h cryptonite_aes_polyval_update"+foreign import ccall "crypton_aes.h crypton_aes_polyval_update"     c_aes_polyval_update :: Ptr Polyval -> CString -> CUInt -> IO () -foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_polyval_finalize"+foreign import ccall unsafe "crypton_aes.h crypton_aes_polyval_finalize"     c_aes_polyval_finalize :: Ptr Polyval -> CString -> IO ()
Crypto/Cipher/ChaCha.hs view
@@ -48,7 +48,7 @@         stPtr <- B.alloc 132 $ \stPtr ->             B.withByteArray nonce $ \noncePtr  ->             B.withByteArray key   $ \keyPtr ->-                ccryptonite_chacha_init stPtr  nbRounds kLen keyPtr nonceLen noncePtr+                ccrypton_chacha_init stPtr  nbRounds kLen keyPtr nonceLen noncePtr         return $ State stPtr   where kLen     = B.length key         nonceLen = B.length nonce@@ -64,7 +64,7 @@     | otherwise = unsafeDoIO $ do         stPtr <- B.alloc 64 $ \stPtr ->                     B.withByteArray seed $ \seedPtr ->-                        ccryptonite_chacha_init_core stPtr 32 seedPtr 8 (seedPtr `plusPtr` 32)+                        ccrypton_chacha_init_core stPtr 32 seedPtr 8 (seedPtr `plusPtr` 32)         return $ StateSimple stPtr   where     sLen = B.length seed@@ -81,7 +81,7 @@         (out, st) <- B.copyRet prevStMem $ \ctx ->             B.alloc (B.length src) $ \dstPtr ->             B.withByteArray src    $ \srcPtr ->-                ccryptonite_chacha_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)+                ccrypton_chacha_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)         return (out, State st)  -- | Generate a number of bytes from the ChaCha output directly@@ -94,7 +94,7 @@     | otherwise = unsafeDoIO $ do         (out, st) <- B.copyRet prevStMem $ \ctx ->             B.alloc len $ \dstPtr ->-                ccryptonite_chacha_generate dstPtr ctx (fromIntegral len)+                ccrypton_chacha_generate dstPtr ctx (fromIntegral len)         return (out, State st)  -- | similar to 'generate' but assume certains values@@ -106,21 +106,21 @@     newSt  <- B.copy prevSt (\_ -> return ())     output <- B.alloc nbBytes $ \dstPtr ->         B.withByteArray newSt $ \stPtr ->-            ccryptonite_chacha_random 8 dstPtr stPtr (fromIntegral nbBytes)+            ccrypton_chacha_random 8 dstPtr stPtr (fromIntegral nbBytes)     return (output, StateSimple newSt) -foreign import ccall "cryptonite_chacha_init_core"-    ccryptonite_chacha_init_core :: Ptr StateSimple -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()+foreign import ccall "crypton_chacha_init_core"+    ccrypton_chacha_init_core :: Ptr StateSimple -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_chacha_init"-    ccryptonite_chacha_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()+foreign import ccall "crypton_chacha_init"+    ccrypton_chacha_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_chacha_combine"-    ccryptonite_chacha_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()+foreign import ccall "crypton_chacha_combine"+    ccrypton_chacha_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO () -foreign import ccall "cryptonite_chacha_generate"-    ccryptonite_chacha_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()+foreign import ccall "crypton_chacha_generate"+    ccrypton_chacha_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO () -foreign import ccall "cryptonite_chacha_random"-    ccryptonite_chacha_random :: Int -> Ptr Word8 -> Ptr StateSimple -> CUInt -> IO ()+foreign import ccall "crypton_chacha_random"+    ccrypton_chacha_random :: Int -> Ptr Word8 -> Ptr StateSimple -> CUInt -> IO ()
Crypto/Cipher/RC4.hs view
@@ -39,13 +39,13 @@     deriving (ByteArrayAccess,NFData)  -- | C Call for initializing the encryptor-foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_init"+foreign import ccall unsafe "crypton_rc4.h crypton_rc4_init"     c_rc4_init :: Ptr Word8 -- ^ The rc4 key                -> Word32    -- ^ The key length                -> Ptr State -- ^ The context                -> IO () -foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_combine"+foreign import ccall unsafe "crypton_rc4.h crypton_rc4_combine"     c_rc4_combine :: Ptr State        -- ^ Pointer to the permutation                   -> Ptr Word8      -- ^ Pointer to the clear text                   -> Word32         -- ^ Length of the clear text
Crypto/Cipher/Salsa.hs view
@@ -40,7 +40,7 @@         stPtr <- B.alloc 132 $ \stPtr ->             B.withByteArray nonce $ \noncePtr  ->             B.withByteArray key   $ \keyPtr ->-                ccryptonite_salsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr+                ccrypton_salsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr         return $ State stPtr   where kLen     = B.length key         nonceLen = B.length nonce@@ -57,7 +57,7 @@         (out, st) <- B.copyRet prevStMem $ \ctx ->             B.alloc (B.length src) $ \dstPtr ->             B.withByteArray src    $ \srcPtr -> do-                ccryptonite_salsa_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)+                ccrypton_salsa_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)         return (out, State st)  -- | Generate a number of bytes from the Salsa output directly@@ -70,14 +70,14 @@     | otherwise = unsafeDoIO $ do         (out, st) <- B.copyRet prevStMem $ \ctx ->             B.alloc len $ \dstPtr ->-                ccryptonite_salsa_generate dstPtr ctx (fromIntegral len)+                ccrypton_salsa_generate dstPtr ctx (fromIntegral len)         return (out, State st) -foreign import ccall "cryptonite_salsa_init"-    ccryptonite_salsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()+foreign import ccall "crypton_salsa_init"+    ccrypton_salsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_salsa_combine"-    ccryptonite_salsa_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()+foreign import ccall "crypton_salsa_combine"+    ccrypton_salsa_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO () -foreign import ccall "cryptonite_salsa_generate"-    ccryptonite_salsa_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()+foreign import ccall "crypton_salsa_generate"+    ccrypton_salsa_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
Crypto/Cipher/XSalsa.hs view
@@ -40,7 +40,7 @@         stPtr <- B.alloc 132 $ \stPtr ->             B.withByteArray nonce $ \noncePtr  ->             B.withByteArray key   $ \keyPtr ->-                ccryptonite_xsalsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr+                ccrypton_xsalsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr         return $ State stPtr   where kLen     = B.length key         nonceLen = B.length nonce@@ -64,12 +64,12 @@     | otherwise = unsafeDoIO $ do         stPtr <- B.copy stPtr' $ \stPtr ->             B.withByteArray nonce $ \noncePtr  ->-                ccryptonite_xsalsa_derive stPtr nonceLen noncePtr+                ccrypton_xsalsa_derive stPtr nonceLen noncePtr         return $ State stPtr   where nonceLen = B.length nonce -foreign import ccall "cryptonite_xsalsa_init"-    ccryptonite_xsalsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()+foreign import ccall "crypton_xsalsa_init"+    ccrypton_xsalsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_xsalsa_derive"-    ccryptonite_xsalsa_derive :: Ptr State -> Int -> Ptr Word8 -> IO ()+foreign import ccall "crypton_xsalsa_derive"+    ccrypton_xsalsa_derive :: Ptr State -> Int -> Ptr Word8 -> IO ()
Crypto/ECC/Edwards25519.hs view
@@ -283,86 +283,86 @@         withByteArray p  $ \pp  ->              ed25519_base_double_scalarmul_vartime out ps1 pp ps2 -foreign import ccall unsafe "cryptonite_ed25519_scalar_eq"+foreign import ccall unsafe "crypton_ed25519_scalar_eq"     ed25519_scalar_eq :: Ptr Scalar                       -> Ptr Scalar                       -> IO CInt -foreign import ccall unsafe "cryptonite_ed25519_scalar_encode"+foreign import ccall unsafe "crypton_ed25519_scalar_encode"     ed25519_scalar_encode :: Ptr Word8                           -> Ptr Scalar                           -> IO () -foreign import ccall unsafe "cryptonite_ed25519_scalar_decode_long"+foreign import ccall unsafe "crypton_ed25519_scalar_decode_long"     ed25519_scalar_decode_long :: Ptr Scalar                                -> Ptr Word8                                -> CSize                                -> IO () -foreign import ccall unsafe "cryptonite_ed25519_scalar_add"+foreign import ccall unsafe "crypton_ed25519_scalar_add"     ed25519_scalar_add :: Ptr Scalar -- sum                        -> Ptr Scalar -- a                        -> Ptr Scalar -- b                        -> IO () -foreign import ccall unsafe "cryptonite_ed25519_scalar_mul"+foreign import ccall unsafe "crypton_ed25519_scalar_mul"     ed25519_scalar_mul :: Ptr Scalar -- out                        -> Ptr Scalar -- a                        -> Ptr Scalar -- b                        -> IO () -foreign import ccall unsafe "cryptonite_ed25519_point_encode"+foreign import ccall unsafe "crypton_ed25519_point_encode"     ed25519_point_encode :: Ptr Word8                          -> Ptr Point                          -> IO () -foreign import ccall unsafe "cryptonite_ed25519_point_decode_vartime"+foreign import ccall unsafe "crypton_ed25519_point_decode_vartime"     ed25519_point_decode_vartime :: Ptr Point                                  -> Ptr Word8                                  -> IO CInt -foreign import ccall unsafe "cryptonite_ed25519_point_eq"+foreign import ccall unsafe "crypton_ed25519_point_eq"     ed25519_point_eq :: Ptr Point                      -> Ptr Point                      -> IO CInt -foreign import ccall "cryptonite_ed25519_point_has_prime_order"+foreign import ccall "crypton_ed25519_point_has_prime_order"     ed25519_point_has_prime_order :: Ptr Point                                   -> IO CInt -foreign import ccall unsafe "cryptonite_ed25519_point_negate"+foreign import ccall unsafe "crypton_ed25519_point_negate"     ed25519_point_negate :: Ptr Point -- minus_a                          -> Ptr Point -- a                          -> IO () -foreign import ccall unsafe "cryptonite_ed25519_point_add"+foreign import ccall unsafe "crypton_ed25519_point_add"     ed25519_point_add :: Ptr Point -- sum                       -> Ptr Point -- a                       -> Ptr Point -- b                       -> IO () -foreign import ccall unsafe "cryptonite_ed25519_point_double"+foreign import ccall unsafe "crypton_ed25519_point_double"     ed25519_point_double :: Ptr Point -- two_a                          -> Ptr Point -- a                          -> IO () -foreign import ccall unsafe "cryptonite_ed25519_point_mul_by_cofactor"+foreign import ccall unsafe "crypton_ed25519_point_mul_by_cofactor"     ed25519_point_mul_by_cofactor :: Ptr Point -- eight_a                                   -> Ptr Point -- a                                   -> IO () -foreign import ccall "cryptonite_ed25519_point_base_scalarmul"+foreign import ccall "crypton_ed25519_point_base_scalarmul"     ed25519_point_base_scalarmul :: Ptr Point  -- scaled                                  -> Ptr Scalar -- scalar                                  -> IO () -foreign import ccall "cryptonite_ed25519_point_scalarmul"+foreign import ccall "crypton_ed25519_point_scalarmul"     ed25519_point_scalarmul :: Ptr Point  -- scaled                             -> Ptr Point  -- base                             -> Ptr Scalar -- scalar                             -> IO () -foreign import ccall "cryptonite_ed25519_base_double_scalarmul_vartime"+foreign import ccall "crypton_ed25519_base_double_scalarmul_vartime"     ed25519_base_double_scalarmul_vartime :: Ptr Point  -- combo                                           -> Ptr Scalar -- scalar1                                           -> Ptr Point  -- base2
Crypto/Hash/Blake2.hs view
@@ -72,11 +72,11 @@     hashInternalUpdate        = c_blake2s_update     hashInternalFinalize p    = c_blake2s_finalize p (integralNatVal (Proxy :: Proxy bitlen)) -foreign import ccall unsafe "cryptonite_blake2s_init"+foreign import ccall unsafe "crypton_blake2s_init"     c_blake2s_init :: Ptr (Context a) -> Word32 -> IO ()-foreign import ccall "cryptonite_blake2s_update"+foreign import ccall "crypton_blake2s_update"     c_blake2s_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()-foreign import ccall unsafe "cryptonite_blake2s_finalize"+foreign import ccall unsafe "crypton_blake2s_finalize"     c_blake2s_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()  -- | Fast cryptographic hash.@@ -107,11 +107,11 @@     hashInternalUpdate        = c_blake2b_update     hashInternalFinalize p    = c_blake2b_finalize p (integralNatVal (Proxy :: Proxy bitlen)) -foreign import ccall unsafe "cryptonite_blake2b_init"+foreign import ccall unsafe "crypton_blake2b_init"     c_blake2b_init :: Ptr (Context a) -> Word32 -> IO ()-foreign import ccall "cryptonite_blake2b_update"+foreign import ccall "crypton_blake2b_update"     c_blake2b_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()-foreign import ccall unsafe "cryptonite_blake2b_finalize"+foreign import ccall unsafe "crypton_blake2b_finalize"     c_blake2b_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()  data Blake2sp (bitlen :: Nat) = Blake2sp@@ -130,11 +130,11 @@     hashInternalUpdate        = c_blake2sp_update     hashInternalFinalize p    = c_blake2sp_finalize p (integralNatVal (Proxy :: Proxy bitlen)) -foreign import ccall unsafe "cryptonite_blake2sp_init"+foreign import ccall unsafe "crypton_blake2sp_init"     c_blake2sp_init :: Ptr (Context a) -> Word32 -> IO ()-foreign import ccall "cryptonite_blake2sp_update"+foreign import ccall "crypton_blake2sp_update"     c_blake2sp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()-foreign import ccall unsafe "cryptonite_blake2sp_finalize"+foreign import ccall unsafe "crypton_blake2sp_finalize"     c_blake2sp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()  data Blake2bp (bitlen :: Nat) = Blake2bp@@ -154,9 +154,9 @@     hashInternalFinalize p    = c_blake2bp_finalize p (integralNatVal (Proxy :: Proxy bitlen))  -foreign import ccall unsafe "cryptonite_blake2bp_init"+foreign import ccall unsafe "crypton_blake2bp_init"     c_blake2bp_init :: Ptr (Context a) -> Word32 -> IO ()-foreign import ccall "cryptonite_blake2bp_update"+foreign import ccall "crypton_blake2bp_update"     c_blake2bp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()-foreign import ccall unsafe "cryptonite_blake2bp_finalize"+foreign import ccall unsafe "crypton_blake2bp_finalize"     c_blake2bp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Blake2b.hs view
@@ -98,11 +98,11 @@     hashInternalFinalize p    = c_blake2b_finalize p 512  -foreign import ccall unsafe "cryptonite_blake2b_init"+foreign import ccall unsafe "crypton_blake2b_init"     c_blake2b_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_blake2b_update"+foreign import ccall "crypton_blake2b_update"     c_blake2b_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_blake2b_finalize"+foreign import ccall unsafe "crypton_blake2b_finalize"     c_blake2b_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Blake2bp.hs view
@@ -38,11 +38,11 @@     hashInternalFinalize p    = c_blake2bp_finalize p 512  -foreign import ccall unsafe "cryptonite_blake2bp_init"+foreign import ccall unsafe "crypton_blake2bp_init"     c_blake2bp_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_blake2bp_update"+foreign import ccall "crypton_blake2bp_update"     c_blake2bp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_blake2bp_finalize"+foreign import ccall unsafe "crypton_blake2bp_finalize"     c_blake2bp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Blake2s.hs view
@@ -68,11 +68,11 @@     hashInternalFinalize p    = c_blake2s_finalize p 256  -foreign import ccall unsafe "cryptonite_blake2s_init"+foreign import ccall unsafe "crypton_blake2s_init"     c_blake2s_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_blake2s_update"+foreign import ccall "crypton_blake2s_update"     c_blake2s_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_blake2s_finalize"+foreign import ccall unsafe "crypton_blake2s_finalize"     c_blake2s_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Blake2sp.hs view
@@ -53,11 +53,11 @@     hashInternalFinalize p    = c_blake2sp_finalize p 256  -foreign import ccall unsafe "cryptonite_blake2sp_init"+foreign import ccall unsafe "crypton_blake2sp_init"     c_blake2sp_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_blake2sp_update"+foreign import ccall "crypton_blake2sp_update"     c_blake2sp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_blake2sp_finalize"+foreign import ccall unsafe "crypton_blake2sp_finalize"     c_blake2sp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Keccak.hs view
@@ -83,11 +83,11 @@     hashInternalFinalize p    = c_keccak_finalize p 512  -foreign import ccall unsafe "cryptonite_keccak_init"+foreign import ccall unsafe "crypton_keccak_init"     c_keccak_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_keccak_update"+foreign import ccall "crypton_keccak_update"     c_keccak_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_keccak_finalize"+foreign import ccall unsafe "crypton_keccak_finalize"     c_keccak_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/MD2.hs view
@@ -34,11 +34,11 @@     hashInternalUpdate        = c_md2_update     hashInternalFinalize      = c_md2_finalize -foreign import ccall unsafe "cryptonite_md2_init"+foreign import ccall unsafe "crypton_md2_init"     c_md2_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_md2_update"+foreign import ccall "crypton_md2_update"     c_md2_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_md2_finalize"+foreign import ccall unsafe "crypton_md2_finalize"     c_md2_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
Crypto/Hash/MD4.hs view
@@ -34,11 +34,11 @@     hashInternalUpdate        = c_md4_update     hashInternalFinalize      = c_md4_finalize -foreign import ccall unsafe "cryptonite_md4_init"+foreign import ccall unsafe "crypton_md4_init"     c_md4_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_md4_update"+foreign import ccall "crypton_md4_update"     c_md4_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_md4_finalize"+foreign import ccall unsafe "crypton_md4_finalize"     c_md4_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
Crypto/Hash/MD5.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix MD5 where     hashInternalFinalizePrefix = c_md5_finalize_prefix -foreign import ccall unsafe "cryptonite_md5_init"+foreign import ccall unsafe "crypton_md5_init"     c_md5_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_md5_update"+foreign import ccall "crypton_md5_update"     c_md5_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_md5_finalize"+foreign import ccall unsafe "crypton_md5_finalize"     c_md5_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_md5_finalize_prefix"+foreign import ccall "crypton_md5_finalize_prefix"     c_md5_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/RIPEMD160.hs view
@@ -34,11 +34,11 @@     hashInternalUpdate        = c_ripemd160_update     hashInternalFinalize      = c_ripemd160_finalize -foreign import ccall unsafe "cryptonite_ripemd160_init"+foreign import ccall unsafe "crypton_ripemd160_init"     c_ripemd160_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_ripemd160_update"+foreign import ccall "crypton_ripemd160_update"     c_ripemd160_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_ripemd160_finalize"+foreign import ccall unsafe "crypton_ripemd160_finalize"     c_ripemd160_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA1.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix SHA1 where     hashInternalFinalizePrefix = c_sha1_finalize_prefix -foreign import ccall unsafe "cryptonite_sha1_init"+foreign import ccall unsafe "crypton_sha1_init"     c_sha1_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_sha1_update"+foreign import ccall "crypton_sha1_update"     c_sha1_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha1_finalize"+foreign import ccall unsafe "crypton_sha1_finalize"     c_sha1_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_sha1_finalize_prefix"+foreign import ccall "crypton_sha1_finalize_prefix"     c_sha1_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA224.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix SHA224 where     hashInternalFinalizePrefix = c_sha224_finalize_prefix -foreign import ccall unsafe "cryptonite_sha224_init"+foreign import ccall unsafe "crypton_sha224_init"     c_sha224_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_sha224_update"+foreign import ccall "crypton_sha224_update"     c_sha224_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha224_finalize"+foreign import ccall unsafe "crypton_sha224_finalize"     c_sha224_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_sha224_finalize_prefix"+foreign import ccall "crypton_sha224_finalize_prefix"     c_sha224_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA256.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix SHA256 where     hashInternalFinalizePrefix = c_sha256_finalize_prefix -foreign import ccall unsafe "cryptonite_sha256_init"+foreign import ccall unsafe "crypton_sha256_init"     c_sha256_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_sha256_update"+foreign import ccall "crypton_sha256_update"     c_sha256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha256_finalize"+foreign import ccall unsafe "crypton_sha256_finalize"     c_sha256_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_sha256_finalize_prefix"+foreign import ccall "crypton_sha256_finalize_prefix"     c_sha256_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA3.hs view
@@ -83,11 +83,11 @@     hashInternalFinalize p    = c_sha3_finalize p 512  -foreign import ccall unsafe "cryptonite_sha3_init"+foreign import ccall unsafe "crypton_sha3_init"     c_sha3_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_sha3_update"+foreign import ccall "crypton_sha3_update"     c_sha3_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha3_finalize"+foreign import ccall unsafe "crypton_sha3_finalize"     c_sha3_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA384.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix SHA384 where     hashInternalFinalizePrefix = c_sha384_finalize_prefix -foreign import ccall unsafe "cryptonite_sha384_init"+foreign import ccall unsafe "crypton_sha384_init"     c_sha384_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_sha384_update"+foreign import ccall "crypton_sha384_update"     c_sha384_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha384_finalize"+foreign import ccall unsafe "crypton_sha384_finalize"     c_sha384_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_sha384_finalize_prefix"+foreign import ccall "crypton_sha384_finalize_prefix"     c_sha384_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA512.hs view
@@ -37,14 +37,14 @@ instance HashAlgorithmPrefix SHA512 where     hashInternalFinalizePrefix = c_sha512_finalize_prefix -foreign import ccall unsafe "cryptonite_sha512_init"+foreign import ccall unsafe "crypton_sha512_init"     c_sha512_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_sha512_update"+foreign import ccall "crypton_sha512_update"     c_sha512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha512_finalize"+foreign import ccall unsafe "crypton_sha512_finalize"     c_sha512_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO () -foreign import ccall "cryptonite_sha512_finalize_prefix"+foreign import ccall "crypton_sha512_finalize_prefix"     c_sha512_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHA512t.hs view
@@ -53,11 +53,11 @@     hashInternalFinalize p    = c_sha512t_finalize p 256  -foreign import ccall unsafe "cryptonite_sha512t_init"+foreign import ccall unsafe "crypton_sha512t_init"     c_sha512t_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_sha512t_update"+foreign import ccall "crypton_sha512t_update"     c_sha512t_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha512t_finalize"+foreign import ccall unsafe "crypton_sha512t_finalize"     c_sha512t_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/SHAKE.hs view
@@ -115,17 +115,17 @@     mask = (1 `shiftL` bits) - 1     (index, bits) = integralNatVal d `divMod` 8 -foreign import ccall unsafe "cryptonite_sha3_init"+foreign import ccall unsafe "crypton_sha3_init"     c_sha3_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_sha3_update"+foreign import ccall "crypton_sha3_update"     c_sha3_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_sha3_finalize_shake"+foreign import ccall unsafe "crypton_sha3_finalize_shake"     c_sha3_finalize_shake :: Ptr (Context a) -> IO () -foreign import ccall unsafe "cryptonite_sha3_finalize_cshake"+foreign import ccall unsafe "crypton_sha3_finalize_cshake"     c_sha3_finalize_cshake :: Ptr (Context a) -> IO () -foreign import ccall unsafe "cryptonite_sha3_output"+foreign import ccall unsafe "crypton_sha3_output"     c_sha3_output :: Ptr (Context a) -> Ptr (Digest a) -> Word32 -> IO ()
Crypto/Hash/Skein256.hs view
@@ -53,11 +53,11 @@     hashInternalFinalize p    = c_skein256_finalize p 256  -foreign import ccall unsafe "cryptonite_skein256_init"+foreign import ccall unsafe "crypton_skein256_init"     c_skein256_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_skein256_update"+foreign import ccall "crypton_skein256_update"     c_skein256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_skein256_finalize"+foreign import ccall unsafe "crypton_skein256_finalize"     c_skein256_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Skein512.hs view
@@ -83,11 +83,11 @@     hashInternalFinalize p    = c_skein512_finalize p 512  -foreign import ccall unsafe "cryptonite_skein512_init"+foreign import ccall unsafe "crypton_skein512_init"     c_skein512_init :: Ptr (Context a) -> Word32 -> IO () -foreign import ccall "cryptonite_skein512_update"+foreign import ccall "crypton_skein512_update"     c_skein512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_skein512_finalize"+foreign import ccall unsafe "crypton_skein512_finalize"     c_skein512_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
Crypto/Hash/Tiger.hs view
@@ -34,11 +34,11 @@     hashInternalUpdate        = c_tiger_update     hashInternalFinalize      = c_tiger_finalize -foreign import ccall unsafe "cryptonite_tiger_init"+foreign import ccall unsafe "crypton_tiger_init"     c_tiger_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_tiger_update"+foreign import ccall "crypton_tiger_update"     c_tiger_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_tiger_finalize"+foreign import ccall unsafe "crypton_tiger_finalize"     c_tiger_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
Crypto/Hash/Whirlpool.hs view
@@ -34,11 +34,11 @@     hashInternalUpdate        = c_whirlpool_update     hashInternalFinalize      = c_whirlpool_finalize -foreign import ccall unsafe "cryptonite_whirlpool_init"+foreign import ccall unsafe "crypton_whirlpool_init"     c_whirlpool_init :: Ptr (Context a)-> IO () -foreign import ccall "cryptonite_whirlpool_update"+foreign import ccall "crypton_whirlpool_update"     c_whirlpool_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO () -foreign import ccall unsafe "cryptonite_whirlpool_finalize"+foreign import ccall unsafe "crypton_whirlpool_finalize"     c_whirlpool_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
Crypto/KDF/Argon2.hs view
@@ -147,7 +147,7 @@ csizeOfInt :: Int -> CSize csizeOfInt = fromIntegral -foreign import ccall unsafe "cryptonite_argon2_hash"+foreign import ccall unsafe "crypton_argon2_hash"     argon2_hash :: Word32 -> Word32 -> Word32                 -> Ptr Pass -> CSize                 -> Ptr Salt -> CSize
Crypto/KDF/PBKDF2.hs view
@@ -116,7 +116,7 @@     B.allocAndFreeze (outputLength params) $ \outPtr ->     B.withByteArray password $ \passPtr ->     B.withByteArray salt $ \saltPtr ->-        c_cryptonite_fastpbkdf2_hmac_sha1+        c_crypton_fastpbkdf2_hmac_sha1             passPtr (fromIntegral $ B.length password)             saltPtr (fromIntegral $ B.length salt)             (fromIntegral $ iterCounts params)@@ -131,7 +131,7 @@     B.allocAndFreeze (outputLength params) $ \outPtr ->     B.withByteArray password $ \passPtr ->     B.withByteArray salt $ \saltPtr ->-        c_cryptonite_fastpbkdf2_hmac_sha256+        c_crypton_fastpbkdf2_hmac_sha256             passPtr (fromIntegral $ B.length password)             saltPtr (fromIntegral $ B.length salt)             (fromIntegral $ iterCounts params)@@ -146,29 +146,29 @@     B.allocAndFreeze (outputLength params) $ \outPtr ->     B.withByteArray password $ \passPtr ->     B.withByteArray salt $ \saltPtr ->-        c_cryptonite_fastpbkdf2_hmac_sha512+        c_crypton_fastpbkdf2_hmac_sha512             passPtr (fromIntegral $ B.length password)             saltPtr (fromIntegral $ B.length salt)             (fromIntegral $ iterCounts params)             outPtr (fromIntegral $ outputLength params)  -foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha1"-    c_cryptonite_fastpbkdf2_hmac_sha1 :: Ptr Word8 -> CSize+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha1"+    c_crypton_fastpbkdf2_hmac_sha1 :: Ptr Word8 -> CSize                                       -> Ptr Word8 -> CSize                                       -> CUInt                                       -> Ptr Word8 -> CSize                                       -> IO () -foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha256"-    c_cryptonite_fastpbkdf2_hmac_sha256 :: Ptr Word8 -> CSize+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha256"+    c_crypton_fastpbkdf2_hmac_sha256 :: Ptr Word8 -> CSize                                         -> Ptr Word8 -> CSize                                         -> CUInt                                         -> Ptr Word8 -> CSize                                         -> IO () -foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha512"-    c_cryptonite_fastpbkdf2_hmac_sha512 :: Ptr Word8 -> CSize+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha512"+    c_crypton_fastpbkdf2_hmac_sha512 :: Ptr Word8 -> CSize                                         -> Ptr Word8 -> CSize                                         -> CUInt                                         -> Ptr Word8 -> CSize
Crypto/KDF/Scrypt.hs view
@@ -35,8 +35,8 @@     , outputLength :: Int    -- ^ the number of bytes to generate out of Scrypt     } -foreign import ccall "cryptonite_scrypt_smix"-    ccryptonite_scrypt_smix :: Ptr Word8 -> Word32 -> Word64 -> Ptr Word8 -> Ptr Word8 -> IO ()+foreign import ccall "crypton_scrypt_smix"+    ccrypton_scrypt_smix :: Ptr Word8 -> Word32 -> Word64 -> Ptr Word8 -> Ptr Word8 -> IO ()  -- | Generate the scrypt key derivation data generate :: (ByteArrayAccess password, ByteArrayAccess salt, ByteArray output)@@ -55,7 +55,7 @@             allocaBytesAligned (128*(fromIntegral $ n params)*(r params)) 8 $ \v ->             allocaBytesAligned (256*r params + 64) 8 $ \xy -> do                 forM_ [0..(p params-1)] $ \i ->-                    ccryptonite_scrypt_smix (bPtr `plusPtr` (i * 128 * (r params)))+                    ccrypton_scrypt_smix (bPtr `plusPtr` (i * 128 * (r params)))                                             (fromIntegral $ r params) (n params) v xy          return $ PBKDF2.generate prf (PBKDF2.Parameters 1 (outputLength params)) password (newSalt :: B.Bytes)
Crypto/MAC/Poly1305.hs view
@@ -57,13 +57,13 @@ instance Eq Auth where     (Auth a1) == (Auth a2) = B.constEq a1 a2 -foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_init"+foreign import ccall unsafe "crypton_poly1305.h crypton_poly1305_init"     c_poly1305_init :: Ptr State -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_poly1305.h cryptonite_poly1305_update"+foreign import ccall "crypton_poly1305.h crypton_poly1305_update"     c_poly1305_update :: Ptr State -> Ptr Word8 -> CUInt -> IO () -foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_finalize"+foreign import ccall unsafe "crypton_poly1305.h crypton_poly1305_finalize"     c_poly1305_finalize :: Ptr Word8 -> Ptr State -> IO ()  -- | initialize a Poly1305 context
Crypto/PubKey/Curve25519.hs view
@@ -100,7 +100,7 @@     B.allocAndFreeze 32        $ \result ->     withByteArray sec          $ \psec   ->     withByteArray pub          $ \ppub   ->-        ccryptonite_curve25519 result psec ppub+        ccrypton_curve25519 result psec ppub {-# NOINLINE dh #-}  -- | Create a public key from a secret key@@ -108,7 +108,7 @@ toPublic (SecretKey sec) = PublicKey <$>     B.allocAndFreeze 32     $ \result ->     withByteArray sec       $ \psec   ->-        ccryptonite_curve25519 result psec basePoint+        ccrypton_curve25519 result psec basePoint   where         basePoint = Ptr "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"# {-# NOINLINE toPublic #-}@@ -125,8 +125,8 @@     modifyByte :: Ptr Word8 -> Int -> (Word8 -> Word8) -> IO ()     modifyByte p n f = peekByteOff p n >>= pokeByteOff p n . f -foreign import ccall "cryptonite_curve25519_donna"-    ccryptonite_curve25519 :: Ptr Word8 -- ^ public+foreign import ccall "crypton_curve25519_donna"+    ccrypton_curve25519 :: Ptr Word8 -- ^ public                            -> Ptr Word8 -- ^ secret                            -> Ptr Word8 -- ^ basepoint                            -> IO ()
Crypto/PubKey/Curve448.hs view
@@ -104,13 +104,13 @@ x448_bytes :: Int x448_bytes = 448 `quot` 8 -foreign import ccall "cryptonite_decaf_x448"+foreign import ccall "crypton_decaf_x448"     decaf_x448 :: Ptr Word8 -- ^ public                -> Ptr Word8 -- ^ basepoint                -> Ptr Word8 -- ^ secret                -> IO () -foreign import ccall "cryptonite_decaf_x448_derive_public_key"+foreign import ccall "crypton_decaf_x448_derive_public_key"     decaf_x448_derive_public_key :: Ptr Word8 -- ^ public                                  -> Ptr Word8 -- ^ secret                                  -> IO ()
Crypto/PubKey/ECC/P256.hs view
@@ -105,19 +105,19 @@     | scalarIsZero s = error "cannot create point from zero"     | otherwise      =         withNewPoint $ \px py -> withScalar s $ \p ->-            ccryptonite_p256_basepoint_mul p px py+            ccrypton_p256_basepoint_mul p px py  -- | Add a point to another point pointAdd :: Point -> Point -> Point pointAdd a b = withNewPoint $ \dx dy ->     withPoint a $ \ax ay -> withPoint b $ \bx by ->-        ccryptonite_p256e_point_add ax ay bx by dx dy+        ccrypton_p256e_point_add ax ay bx by dx dy  -- | Negate a point pointNegate :: Point -> Point pointNegate a = withNewPoint $ \dx dy ->     withPoint a $ \ax ay ->-        ccryptonite_p256e_point_negate ax ay dx dy+        ccrypton_p256e_point_negate ax ay dx dy  -- | Multiply a point by a scalar --@@ -125,7 +125,7 @@ pointMul :: Scalar -> Point -> Point pointMul scalar p = withNewPoint $ \dx dy ->     withScalar scalar $ \n -> withPoint p $ \px py ->-        ccryptonite_p256e_point_mul n px py dx dy+        ccrypton_p256e_point_mul n px py dx dy  -- | Similar to 'pointMul', serializing the x coordinate as binary. -- When scalar is multiple of point order the result is all zero.@@ -133,8 +133,8 @@ pointDh scalar p =     B.unsafeCreate scalarSize $ \dst -> withTempPoint $ \dx dy -> do         withScalar scalar $ \n -> withPoint p $ \px py ->-            ccryptonite_p256e_point_mul n px py dx dy-        ccryptonite_p256_to_bin (castPtr dx) dst+            ccrypton_p256e_point_mul n px py dx dy+        ccrypton_p256_to_bin (castPtr dx) dst  -- | multiply the point @p with @n2 and add a lifted to curve value @n1 --@@ -144,12 +144,12 @@ pointsMulVarTime :: Scalar -> Scalar -> Point -> Point pointsMulVarTime n1 n2 p = withNewPoint $ \dx dy ->     withScalar n1 $ \pn1 -> withScalar n2 $ \pn2 -> withPoint p $ \px py ->-        ccryptonite_p256_points_mul_vartime pn1 pn2 px py dx dy+        ccrypton_p256_points_mul_vartime pn1 pn2 px py dx dy  -- | Check if a 'Point' is valid pointIsValid :: Point -> Bool pointIsValid p = unsafeDoIO $ withPoint p $ \px py -> do-    r <- ccryptonite_p256_is_valid_point px py+    r <- ccrypton_p256_is_valid_point px py     return (r /= 0)  -- | Check if a 'Point' is the point at infinity@@ -163,7 +163,7 @@     | otherwise           = Just $         withNewScalarFreeze $ \d    ->         withPoint p         $ \px _ ->-            ccryptonite_p256_mod ccryptonite_SECP256r1_n (castPtr px) (castPtr d)+            ccrypton_p256_mod ccrypton_SECP256r1_n (castPtr px) (castPtr d)  -- | Convert a point to (x,y) Integers pointToIntegers :: Point -> (Integer, Integer)@@ -171,9 +171,9 @@     allocTemp 32 (serialize (castPtr px) (castPtr py))   where     serialize px py temp = do-        ccryptonite_p256_to_bin px temp+        ccrypton_p256_to_bin px temp         x <- os2ip temp scalarSize-        ccryptonite_p256_to_bin py temp+        ccrypton_p256_to_bin py temp         y <- os2ip temp scalarSize         return (x,y) @@ -192,13 +192,13 @@             then error "pointFromIntegers: filling failed"             else return ()         -- then fill dest with the P256 scalar from temp-        ccryptonite_p256_from_bin temp dest+        ccrypton_p256_from_bin temp dest  -- | Convert a point to a binary representation pointToBinary :: ByteArray ba => Point -> ba pointToBinary p = B.unsafeCreate pointSize $ \dst -> withPoint p $ \px py -> do-    ccryptonite_p256_to_bin (castPtr px) dst-    ccryptonite_p256_to_bin (castPtr py) (dst `plusPtr` 32)+    ccrypton_p256_to_bin (castPtr px) dst+    ccrypton_p256_to_bin (castPtr py) (dst `plusPtr` 32)  -- | Convert from binary to a valid point pointFromBinary :: ByteArrayAccess ba => ba -> CryptoFailable Point@@ -215,8 +215,8 @@     | B.length ba /= pointSize = CryptoFailed CryptoError_PublicKeySizeInvalid     | otherwise                =         CryptoPassed $ withNewPoint $ \px py -> B.withByteArray ba $ \src -> do-            ccryptonite_p256_from_bin src                        (castPtr px)-            ccryptonite_p256_from_bin (src `plusPtr` scalarSize) (castPtr py)+            ccrypton_p256_from_bin src                        (castPtr px)+            ccrypton_p256_from_bin (src `plusPtr` scalarSize) (castPtr py)  ------------------------------------------------------------------------ -- Scalar methods@@ -233,7 +233,7 @@  -- | The scalar representing 0 scalarZero :: Scalar-scalarZero = withNewScalarFreeze $ \d -> ccryptonite_p256_init d+scalarZero = withNewScalarFreeze $ \d -> ccrypton_p256_init d  -- | The scalar representing the curve order scalarN :: Scalar@@ -242,7 +242,7 @@ -- | Check if the scalar is 0 scalarIsZero :: Scalar -> Bool scalarIsZero s = unsafeDoIO $ withScalar s $ \d -> do-    result <- ccryptonite_p256_is_zero d+    result <- ccrypton_p256_is_zero d     return $ result /= 0  -- | Perform addition between two scalars@@ -251,7 +251,7 @@ scalarAdd :: Scalar -> Scalar -> Scalar scalarAdd a b =     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->-        ccryptonite_p256e_modadd ccryptonite_SECP256r1_n pa pb d+        ccrypton_p256e_modadd ccrypton_SECP256r1_n pa pb d  -- | Perform subtraction between two scalars --@@ -259,7 +259,7 @@ scalarSub :: Scalar -> Scalar -> Scalar scalarSub a b =     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->-        ccryptonite_p256e_modsub ccryptonite_SECP256r1_n pa pb d+        ccrypton_p256e_modsub ccrypton_SECP256r1_n pa pb d  -- | Perform multiplication between two scalars --@@ -267,7 +267,7 @@ scalarMul :: Scalar -> Scalar -> Scalar scalarMul a b =     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->-         ccryptonite_p256_modmul ccryptonite_SECP256r1_n pa 0 pb d+         ccrypton_p256_modmul ccrypton_SECP256r1_n pa 0 pb d  -- | Give the inverse of the scalar --@@ -277,7 +277,7 @@ scalarInv :: Scalar -> Scalar scalarInv a =     withNewScalarFreeze $ \b -> withScalar a $ \pa ->-        ccryptonite_p256_modinv_vartime ccryptonite_SECP256r1_n pa b+        ccrypton_p256_modinv_vartime ccrypton_SECP256r1_n pa b  -- | Give the inverse of the scalar using safe exponentiation --@@ -285,13 +285,13 @@ scalarInvSafe :: Scalar -> Scalar scalarInvSafe a =     withNewScalarFreeze $ \b -> withScalar a $ \pa ->-        ccryptonite_p256e_scalar_invert pa b+        ccrypton_p256e_scalar_invert pa b  -- | Compare 2 Scalar scalarCmp :: Scalar -> Scalar -> Ordering scalarCmp a b = unsafeDoIO $     withScalar a $ \pa -> withScalar b $ \pb -> do-        v <- ccryptonite_p256_cmp pa pb+        v <- ccrypton_p256_cmp pa pb         return $ compare v 0  -- | convert a scalar from binary@@ -300,13 +300,13 @@     | B.length ba /= scalarSize = CryptoFailed CryptoError_SecretKeySizeInvalid     | otherwise                 =         CryptoPassed $ withNewScalarFreeze $ \p -> B.withByteArray ba $ \b ->-            ccryptonite_p256_from_bin b p+            ccrypton_p256_from_bin b p {-# NOINLINE scalarFromBinary #-}  -- | convert a scalar to binary scalarToBinary :: ByteArray ba => Scalar -> ba scalarToBinary s = B.unsafeCreate scalarSize $ \b -> withScalar s $ \p ->-    ccryptonite_p256_to_bin p b+    ccrypton_p256_to_bin p b {-# NOINLINE scalarToBinary #-}  -- | Convert from an Integer to a P256 Scalar@@ -356,72 +356,72 @@ ------------------------------------------------------------------------ -- Foreign bindings -------------------------------------------------------------------------foreign import ccall "&cryptonite_SECP256r1_n"-    ccryptonite_SECP256r1_n :: Ptr P256Scalar-foreign import ccall "&cryptonite_SECP256r1_p"-    ccryptonite_SECP256r1_p :: Ptr P256Scalar-foreign import ccall "&cryptonite_SECP256r1_b"-    ccryptonite_SECP256r1_b :: Ptr P256Scalar+foreign import ccall "&crypton_SECP256r1_n"+    ccrypton_SECP256r1_n :: Ptr P256Scalar+foreign import ccall "&crypton_SECP256r1_p"+    ccrypton_SECP256r1_p :: Ptr P256Scalar+foreign import ccall "&crypton_SECP256r1_b"+    ccrypton_SECP256r1_b :: Ptr P256Scalar -foreign import ccall "cryptonite_p256_init"-    ccryptonite_p256_init :: Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_is_zero"-    ccryptonite_p256_is_zero :: Ptr P256Scalar -> IO CInt-foreign import ccall "cryptonite_p256_clear"-    ccryptonite_p256_clear :: Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256e_modadd"-    ccryptonite_p256e_modadd :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_add_d"-    ccryptonite_p256_add_d :: Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> IO CInt-foreign import ccall "cryptonite_p256e_modsub"-    ccryptonite_p256e_modsub :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_cmp"-    ccryptonite_p256_cmp :: Ptr P256Scalar -> Ptr P256Scalar -> IO CInt-foreign import ccall "cryptonite_p256_mod"-    ccryptonite_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_modmul"-    ccryptonite_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256e_scalar_invert"-    ccryptonite_p256e_scalar_invert :: Ptr P256Scalar -> Ptr P256Scalar -> IO ()---foreign import ccall "cryptonite_p256_modinv"---    ccryptonite_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_modinv_vartime"-    ccryptonite_p256_modinv_vartime :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()-foreign import ccall "cryptonite_p256_base_point_mul"-    ccryptonite_p256_basepoint_mul :: Ptr P256Scalar+foreign import ccall "crypton_p256_init"+    ccrypton_p256_init :: Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_is_zero"+    ccrypton_p256_is_zero :: Ptr P256Scalar -> IO CInt+foreign import ccall "crypton_p256_clear"+    ccrypton_p256_clear :: Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256e_modadd"+    ccrypton_p256e_modadd :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_add_d"+    ccrypton_p256_add_d :: Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> IO CInt+foreign import ccall "crypton_p256e_modsub"+    ccrypton_p256e_modsub :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_cmp"+    ccrypton_p256_cmp :: Ptr P256Scalar -> Ptr P256Scalar -> IO CInt+foreign import ccall "crypton_p256_mod"+    ccrypton_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_modmul"+    ccrypton_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256e_scalar_invert"+    ccrypton_p256e_scalar_invert :: Ptr P256Scalar -> Ptr P256Scalar -> IO ()+--foreign import ccall "crypton_p256_modinv"+--    ccrypton_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_modinv_vartime"+    ccrypton_p256_modinv_vartime :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_base_point_mul"+    ccrypton_p256_basepoint_mul :: Ptr P256Scalar                                    -> Ptr P256X -> Ptr P256Y                                    -> IO () -foreign import ccall "cryptonite_p256e_point_add"-    ccryptonite_p256e_point_add :: Ptr P256X -> Ptr P256Y+foreign import ccall "crypton_p256e_point_add"+    ccrypton_p256e_point_add :: Ptr P256X -> Ptr P256Y                                 -> Ptr P256X -> Ptr P256Y                                 -> Ptr P256X -> Ptr P256Y                                 -> IO () -foreign import ccall "cryptonite_p256e_point_negate"-    ccryptonite_p256e_point_negate :: Ptr P256X -> Ptr P256Y+foreign import ccall "crypton_p256e_point_negate"+    ccrypton_p256e_point_negate :: Ptr P256X -> Ptr P256Y                                    -> Ptr P256X -> Ptr P256Y                                    -> IO ()  -- compute (out_x,out_y) = n * (in_x,in_y)-foreign import ccall "cryptonite_p256e_point_mul"-    ccryptonite_p256e_point_mul :: Ptr P256Scalar -- n+foreign import ccall "crypton_p256e_point_mul"+    ccrypton_p256e_point_mul :: Ptr P256Scalar -- n                                 -> Ptr P256X -> Ptr P256Y -- in_{x,y}                                 -> Ptr P256X -> Ptr P256Y -- out_{x,y}                                 -> IO ()  -- compute (out_x,out,y) = n1 * G + n2 * (in_x,in_y)-foreign import ccall "cryptonite_p256_points_mul_vartime"-    ccryptonite_p256_points_mul_vartime :: Ptr P256Scalar -- n1+foreign import ccall "crypton_p256_points_mul_vartime"+    ccrypton_p256_points_mul_vartime :: Ptr P256Scalar -- n1                                         -> Ptr P256Scalar -- n2                                         -> Ptr P256X -> Ptr P256Y -- in_{x,y}                                         -> Ptr P256X -> Ptr P256Y -- out_{x,y}                                         -> IO ()-foreign import ccall "cryptonite_p256_is_valid_point"-    ccryptonite_p256_is_valid_point :: Ptr P256X -> Ptr P256Y -> IO CInt+foreign import ccall "crypton_p256_is_valid_point"+    ccrypton_p256_is_valid_point :: Ptr P256X -> Ptr P256Y -> IO CInt -foreign import ccall "cryptonite_p256_to_bin"-    ccryptonite_p256_to_bin :: Ptr P256Scalar -> Ptr Word8 -> IO ()+foreign import ccall "crypton_p256_to_bin"+    ccrypton_p256_to_bin :: Ptr P256Scalar -> Ptr Word8 -> IO () -foreign import ccall "cryptonite_p256_from_bin"-    ccryptonite_p256_from_bin :: Ptr Word8 -> Ptr P256Scalar -> IO ()+foreign import ccall "crypton_p256_from_bin"+    ccrypton_p256_from_bin :: Ptr Word8 -> Ptr P256Scalar -> IO ()
Crypto/PubKey/Ed25519.hs view
@@ -88,7 +88,7 @@ toPublic (SecretKey sec) = PublicKey <$>     B.allocAndFreeze publicKeySize $ \result ->     withByteArray sec              $ \psec   ->-        ccryptonite_ed25519_publickey psec result+        ccrypton_ed25519_publickey psec result {-# NOINLINE toPublic #-}  -- | Sign a message using the key pair@@ -98,7 +98,7 @@         withByteArray secret  $ \sec ->         withByteArray public  $ \pub ->         withByteArray message $ \msg ->-             ccryptonite_ed25519_sign msg (fromIntegral msgLen) sec pub sig+             ccrypton_ed25519_sign msg (fromIntegral msgLen) sec pub sig   where     !msgLen = B.length message @@ -108,7 +108,7 @@     withByteArray signatureVal $ \sig ->     withByteArray public       $ \pub ->     withByteArray message      $ \msg -> do-      r <- ccryptonite_ed25519_sign_open msg (fromIntegral msgLen) pub sig+      r <- ccrypton_ed25519_sign_open msg (fromIntegral msgLen) pub sig       return (r == 0)   where     !msgLen = B.length message@@ -129,20 +129,20 @@ signatureSize :: Int signatureSize = 64 -foreign import ccall "cryptonite_ed25519_publickey"-    ccryptonite_ed25519_publickey :: Ptr SecretKey -- secret key+foreign import ccall "crypton_ed25519_publickey"+    ccrypton_ed25519_publickey :: Ptr SecretKey -- secret key                                   -> Ptr PublicKey -- public key                                   -> IO () -foreign import ccall "cryptonite_ed25519_sign_open"-    ccryptonite_ed25519_sign_open :: Ptr Word8     -- message+foreign import ccall "crypton_ed25519_sign_open"+    ccrypton_ed25519_sign_open :: Ptr Word8     -- message                                   -> CSize         -- message len                                   -> Ptr PublicKey -- public                                   -> Ptr Signature -- signature                                   -> IO CInt -foreign import ccall "cryptonite_ed25519_sign"-    ccryptonite_ed25519_sign :: Ptr Word8     -- message+foreign import ccall "crypton_ed25519_sign"+    ccrypton_ed25519_sign :: Ptr Word8     -- message                              -> CSize         -- message len                              -> Ptr SecretKey -- secret                              -> Ptr PublicKey -- public
Crypto/PubKey/Ed448.hs view
@@ -136,12 +136,12 @@ no_context :: Ptr Word8 no_context = nullPtr -- not supported yet -foreign import ccall "cryptonite_decaf_ed448_derive_public_key"+foreign import ccall "crypton_decaf_ed448_derive_public_key"     decaf_ed448_derive_public_key :: Ptr PublicKey -- public key                                   -> Ptr SecretKey -- secret key                                   -> IO () -foreign import ccall "cryptonite_decaf_ed448_sign"+foreign import ccall "crypton_decaf_ed448_sign"     decaf_ed448_sign :: Ptr Signature -- signature                      -> Ptr SecretKey -- secret                      -> Ptr PublicKey -- public@@ -152,7 +152,7 @@                      -> Word8         -- context len                      -> IO () -foreign import ccall "cryptonite_decaf_ed448_verify"+foreign import ccall "crypton_decaf_ed448_verify"     decaf_ed448_verify :: Ptr Signature -- signature                        -> Ptr PublicKey -- public                        -> Ptr Word8     -- message
Crypto/Random/Entropy/RDRand.hs view
@@ -15,10 +15,10 @@ import Data.Word (Word8) import Crypto.Random.Entropy.Source -foreign import ccall unsafe "cryptonite_cpu_has_rdrand"+foreign import ccall unsafe "crypton_cpu_has_rdrand"    c_cpu_has_rdrand :: IO CInt -foreign import ccall unsafe "cryptonite_get_rand_bytes"+foreign import ccall unsafe "crypton_get_rand_bytes"   c_get_rand_bytes :: Ptr Word8 -> CInt -> IO CInt  -- | Fake handle to Intel RDRand entropy CPU instruction
Crypto/Random/Entropy/Unsafe.hs view
@@ -22,11 +22,11 @@ -- If the buffer cannot be refill after 3 loopings, this will raise -- an User Error exception replenish :: Int -> [EntropyBackend] -> Ptr Word8 -> IO ()-replenish _        []       _   = fail "cryptonite: random: cannot get any source of entropy on this system"+replenish _        []       _   = fail "crypton: random: cannot get any source of entropy on this system" replenish poolSize backends ptr = loop 0 backends ptr poolSize   where loop :: Int -> [EntropyBackend] -> Ptr Word8 -> Int -> IO ()         loop _     _  _ 0 = return ()-        loop retry [] p n | retry == 3 = error "cryptonite: random: cannot fully replenish"+        loop retry [] p n | retry == 3 = error "crypton: random: cannot fully replenish"                           | otherwise  = loop (retry+1) backends p n         loop retry (b:bs) p n = do             r <- gatherBackend b p n
Crypto/System/CPU.hs view
@@ -5,7 +5,7 @@ -- Stability   : experimental -- Portability : unknown ----- Gives information about cryptonite runtime environment.+-- Gives information about crypton runtime environment. -- {-# LANGUAGE CPP #-} {-# LANGUAGE DeriveDataTypeable #-}@@ -42,7 +42,7 @@ -- current CPU. processorOptions :: [ProcessorOption] processorOptions = unsafeDoIO $ do-    p <- cryptonite_aes_cpu_init+    p <- crypton_aes_cpu_init     options <- traverse (getOption p) aesOptions     rdrand  <- hasRDRand     return (decodeOptions options ++ [ RDRAND | rdrand ])@@ -60,5 +60,5 @@ hasRDRand = return False #endif -foreign import ccall unsafe "cryptonite_aes_cpu_init"-    cryptonite_aes_cpu_init :: IO (Ptr Word8)+foreign import ccall unsafe "crypton_aes_cpu_init"+    crypton_aes_cpu_init :: IO (Ptr Word8)
Crypto/Tutorial.hs view
@@ -1,4 +1,4 @@--- | Examples of how to use @cryptonite@.+-- | Examples of how to use @crypton@. module Crypto.Tutorial     ( -- * API design       -- $api_design@@ -15,11 +15,11 @@  -- $api_design ----- APIs in cryptonite are often based on type classes from package+-- APIs in crypton are often based on type classes from package -- <https://hackage.haskell.org/package/memory memory>, notably -- 'Data.ByteArray.ByteArrayAccess' and 'Data.ByteArray.ByteArray'. -- Module "Data.ByteArray" provides many primitives that are useful to--- work with cryptonite types.  For example function 'Data.ByteArray.convert'+-- work with crypton types.  For example function 'Data.ByteArray.convert' -- can transform one 'Data.ByteArray.ByteArrayAccess' concrete type like -- 'Crypto.Hash.Digest' to a 'Data.ByteString.ByteString'. --
README.md view
@@ -3,7 +3,7 @@ crypton ========== -Crypton is a fork from cryptonite with the original authoer's permission.+Crypton is a fork from cryptonite with the original author's permission.  Crypton is a haskell repository of cryptographic primitives. Each crypto algorithm has specificities that are hard to wrap in common APIs and types,
cbits/aes/block128.h view
@@ -31,8 +31,8 @@ #ifndef BLOCK128_H #define BLOCK128_H -#include <cryptonite_bitfn.h>-#include <cryptonite_align.h>+#include <crypton_bitfn.h>+#include <crypton_align.h>  typedef union {        uint64_t q[2];
cbits/aes/generic.c view
@@ -32,8 +32,8 @@  #include <stdint.h> #include <stdlib.h>-#include <cryptonite_aes.h>-#include <cryptonite_bitfn.h>+#include <crypton_aes.h>+#include <crypton_bitfn.h>  static uint8_t sbox[256] = { 	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe,@@ -405,7 +405,7 @@ 	t[2] = f[8]; t[6] = f[9]; t[10] = f[10]; t[14] = f[11]; \ 	t[3] = f[12]; t[7] = f[13]; t[11] = f[14]; t[15] = f[15] -void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input)+void crypton_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input) { 	uint32_t block[4]; 	uint8_t *iptr, *optr, *bptr;@@ -418,7 +418,7 @@ 	swap_block(optr, bptr); } -void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input)+void crypton_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input) { 	uint32_t block[4]; 	uint8_t *iptr, *optr, *bptr;@@ -431,7 +431,7 @@ 	swap_block(optr, bptr); } -void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size)+void crypton_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size) { 	int esz;
cbits/aes/generic.h view
@@ -27,8 +27,8 @@  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF  * SUCH DAMAGE.  */-#include "cryptonite_aes.h"+#include "crypton_aes.h" -void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input);-void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input);-void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size);+void crypton_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input);+void crypton_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input);+void crypton_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size);
cbits/aes/gf.c view
@@ -30,12 +30,12 @@  #include <stdio.h> #include <stdint.h>-#include <cryptonite_cpu.h>+#include <crypton_cpu.h> #include <aes/gf.h> #include <aes/x86ni.h>  /* inplace GFMUL for xts mode */-void cryptonite_aes_generic_gf_mulx(block128 *a)+void crypton_aes_generic_gf_mulx(block128 *a) { 	const uint64_t gf_mask = cpu_to_le64(0x8000000000000000ULL); 	uint64_t r = ((a->q[1] & gf_mask) ? cpu_to_le64(0x87) : 0);@@ -95,7 +95,7 @@ }  /* initialize the 4-bit table given H */-void cryptonite_aes_generic_hinit(table_4bit htable, const block128 *h)+void crypton_aes_generic_hinit(table_4bit htable, const block128 *h) { 	block128 v, *p; 	int i, j;@@ -127,7 +127,7 @@ }  /* multiply a block with H */-void cryptonite_aes_generic_gf_mul(block128 *a, const table_4bit htable)+void crypton_aes_generic_gf_mul(block128 *a, const table_4bit htable) { 	block128 b; 	int i;
cbits/aes/gf.h view
@@ -27,16 +27,16 @@  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF  * SUCH DAMAGE.  */-#ifndef CRYPTONITE_AES_GF128MUL_H-#define CRYPTONITE_AES_GF128MUL_H+#ifndef CRYPTON_AES_GF128MUL_H+#define CRYPTON_AES_GF128MUL_H  #include "aes/block128.h"  typedef block128 table_4bit[16]; -void cryptonite_aes_generic_gf_mulx(block128 *a);+void crypton_aes_generic_gf_mulx(block128 *a); -void cryptonite_aes_generic_hinit(table_4bit htable, const block128 *h);-void cryptonite_aes_generic_gf_mul(block128 *a, const table_4bit htable);+void crypton_aes_generic_hinit(table_4bit htable, const block128 *h);+void crypton_aes_generic_gf_mul(block128 *a, const table_4bit htable);  #endif
cbits/aes/x86ni.c view
@@ -33,8 +33,8 @@ #include <wmmintrin.h> #include <tmmintrin.h> #include <string.h>-#include <cryptonite_aes.h>-#include <cryptonite_cpu.h>+#include <crypton_aes.h>+#include <crypton_cpu.h> #include <aes/gf.h> #include <aes/x86ni.h> #include <aes/block128.h>@@ -67,7 +67,7 @@ }  TARGET_AESNI-void cryptonite_aesni_init(aes_key *key, uint8_t *ikey, uint8_t size)+void crypton_aesni_init(aes_key *key, uint8_t *ikey, uint8_t size) { 	__m128i k[28]; 	uint64_t *out = (uint64_t *) key->data;@@ -167,7 +167,7 @@ { 	aes_block _t ALIGNMENT(16); 	_mm_store_si128((__m128i *) &_t, tag);-	cryptonite_aes_generic_gf_mul(&_t, htable);+	crypton_aes_generic_gf_mul(&_t, htable); 	tag = _mm_load_si128((__m128i *) &_t); 	return tag; }@@ -180,7 +180,7 @@ /* See Intel carry-less-multiplication-instruction-in-gcm-mode-paper.pdf  *  * Adapted from figure 5, with additional byte swapping so that interface- * is simimar to cryptonite_aes_generic_gf_mul.+ * is simimar to crypton_aes_generic_gf_mul.  */ TARGET_AESNI_PCLMUL static __m128i gfmul_pclmuldq(__m128i a, const table_4bit htable)@@ -236,7 +236,7 @@ 	return _mm_shuffle_epi8(tmp6, bswap_mask); } -void cryptonite_aesni_hinit_pclmul(table_4bit htable, const block128 *h)+void crypton_aesni_hinit_pclmul(table_4bit htable, const block128 *h) { 	/* When pclmul is active we don't need to fill the table.  Instead we just 	 * store H at index 0.  It is written in reverse order, so function@@ -247,7 +247,7 @@ }  TARGET_AESNI_PCLMUL-void cryptonite_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable)+void crypton_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable) { 	__m128i _a, _b; 	_a = _mm_loadu_si128((__m128i *) a);@@ -255,7 +255,7 @@ 	_mm_storeu_si128((__m128i *) a, _b); } -void cryptonite_aesni_init_pclmul(void)+void crypton_aesni_init_pclmul(void) { 	gfmul_branch_ptr = gfmul_pclmuldq; }
cbits/aes/x86ni.h view
@@ -37,7 +37,7 @@  #include <wmmintrin.h> #include <tmmintrin.h>-#include <cryptonite_aes.h>+#include <crypton_aes.h> #include <aes/block128.h>  #ifdef WITH_TARGET_ATTRIBUTES@@ -58,35 +58,35 @@ } #endif -void cryptonite_aesni_init(aes_key *key, uint8_t *origkey, uint8_t size);-void cryptonite_aesni_encrypt_block128(aes_block *out, aes_key *key, aes_block *in);-void cryptonite_aesni_encrypt_block256(aes_block *out, aes_key *key, aes_block *in);-void cryptonite_aesni_decrypt_block128(aes_block *out, aes_key *key, aes_block *in);-void cryptonite_aesni_decrypt_block256(aes_block *out, aes_key *key, aes_block *in);-void cryptonite_aesni_encrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);-void cryptonite_aesni_encrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);-void cryptonite_aesni_decrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);-void cryptonite_aesni_decrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);-void cryptonite_aesni_encrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);-void cryptonite_aesni_encrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);-void cryptonite_aesni_decrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);-void cryptonite_aesni_decrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);-void cryptonite_aesni_encrypt_ctr128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);-void cryptonite_aesni_encrypt_ctr256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);-void cryptonite_aesni_encrypt_c32_128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);-void cryptonite_aesni_encrypt_c32_256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);-void cryptonite_aesni_encrypt_xts128(aes_block *out, aes_key *key1, aes_key *key2,+void crypton_aesni_init(aes_key *key, uint8_t *origkey, uint8_t size);+void crypton_aesni_encrypt_block128(aes_block *out, aes_key *key, aes_block *in);+void crypton_aesni_encrypt_block256(aes_block *out, aes_key *key, aes_block *in);+void crypton_aesni_decrypt_block128(aes_block *out, aes_key *key, aes_block *in);+void crypton_aesni_decrypt_block256(aes_block *out, aes_key *key, aes_block *in);+void crypton_aesni_encrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void crypton_aesni_encrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void crypton_aesni_decrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void crypton_aesni_decrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void crypton_aesni_encrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void crypton_aesni_encrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void crypton_aesni_decrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void crypton_aesni_decrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void crypton_aesni_encrypt_ctr128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void crypton_aesni_encrypt_ctr256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void crypton_aesni_encrypt_c32_128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void crypton_aesni_encrypt_c32_256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void crypton_aesni_encrypt_xts128(aes_block *out, aes_key *key1, aes_key *key2,                            aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks);-void cryptonite_aesni_encrypt_xts256(aes_block *out, aes_key *key1, aes_key *key2,+void crypton_aesni_encrypt_xts256(aes_block *out, aes_key *key1, aes_key *key2,                            aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks); -void cryptonite_aesni_gcm_encrypt128(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);-void cryptonite_aesni_gcm_encrypt256(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);+void crypton_aesni_gcm_encrypt128(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);+void crypton_aesni_gcm_encrypt256(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);  #ifdef WITH_PCLMUL-void cryptonite_aesni_init_pclmul(void);-void cryptonite_aesni_hinit_pclmul(table_4bit htable, const block128 *h);-void cryptonite_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable);+void crypton_aesni_init_pclmul(void);+void crypton_aesni_hinit_pclmul(table_4bit htable, const block128 *h);+void crypton_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable); #endif  #endif
cbits/aes/x86ni_impl.c view
@@ -29,7 +29,7 @@  */  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_block)(aes_block *out, aes_key *key, aes_block *in)+void SIZED(crypton_aesni_encrypt_block)(aes_block *out, aes_key *key, aes_block *in) { 	__m128i *k = (__m128i *) key->data; 	PRELOAD_ENC(k);@@ -39,7 +39,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_decrypt_block)(aes_block *out, aes_key *key, aes_block *in)+void SIZED(crypton_aesni_decrypt_block)(aes_block *out, aes_key *key, aes_block *in) { 	__m128i *k = (__m128i *) key->data; 	PRELOAD_DEC(k);@@ -49,7 +49,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)+void SIZED(crypton_aesni_encrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks) { 	__m128i *k = (__m128i *) key->data; @@ -62,7 +62,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_decrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)+void SIZED(crypton_aesni_decrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks) { 	__m128i *k = (__m128i *) key->data; @@ -76,7 +76,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)+void SIZED(crypton_aesni_encrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks) { 	__m128i *k = (__m128i *) key->data; 	__m128i iv = _mm_loadu_si128((__m128i *) _iv);@@ -93,7 +93,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_decrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)+void SIZED(crypton_aesni_decrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks) { 	__m128i *k = (__m128i *) key->data; 	__m128i iv = _mm_loadu_si128((__m128i *) _iv);@@ -113,7 +113,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_ctr)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)+void SIZED(crypton_aesni_encrypt_ctr)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len) { 	__m128i *k = (__m128i *) key->data; 	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);@@ -159,7 +159,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_c32_)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)+void SIZED(crypton_aesni_encrypt_c32_)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len) { 	__m128i *k = (__m128i *) key->data; 	__m128i one        = _mm_set_epi32(0,0,0,1);@@ -201,7 +201,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_encrypt_xts)(aes_block *out, aes_key *key1, aes_key *key2,+void SIZED(crypton_aesni_encrypt_xts)(aes_block *out, aes_key *key1, aes_key *key2,                                aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks) { 	__m128i tweak = _mm_loadu_si128((__m128i *) _tweak);@@ -232,7 +232,7 @@ }  TARGET_AESNI-void SIZED(cryptonite_aesni_gcm_encrypt)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+void SIZED(crypton_aesni_gcm_encrypt)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length) { 	__m128i *k = (__m128i *) key->data; 	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);
cbits/argon2/argon2.c view
@@ -22,7 +22,7 @@ #include "argon2.h" #include "core.c" -int cryptonite_argon2_ctx(argon2_context *context, argon2_type type) {+int crypton_argon2_ctx(argon2_context *context, argon2_type type) {     /* 1. Validate all inputs */     int result = validate_inputs(context);     uint32_t memory_blocks, segment_length;@@ -79,7 +79,7 @@     return ARGON2_OK; } -int cryptonite_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,+int crypton_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,                 const uint32_t parallelism, const void *pwd,                 const size_t pwdlen, const void *salt, const size_t saltlen,                 void *hash, const size_t hashlen, argon2_type type,@@ -121,7 +121,7 @@     context.flags = ARGON2_DEFAULT_FLAGS;     context.version = version; -    result = cryptonite_argon2_ctx(&context, type);+    result = crypton_argon2_ctx(&context, type);      if (result != ARGON2_OK) {         clear_internal_memory(out, hashlen);
cbits/argon2/argon2.h view
@@ -233,7 +233,7 @@  * @param  context  Pointer to the Argon2 internal structure  * @return Error code if smth is wrong, ARGON2_OK otherwise  */-ARGON2_PUBLIC int cryptonite_argon2_ctx(argon2_context *context, argon2_type type);+ARGON2_PUBLIC int crypton_argon2_ctx(argon2_context *context, argon2_type type);  /**  * Hashes a password with Argon2i, producing a raw hash by allocating memory at@@ -252,7 +252,7 @@  */  /* generic function underlying the above ones */-ARGON2_PUBLIC int cryptonite_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,+ARGON2_PUBLIC int crypton_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,                               const uint32_t parallelism, const void *pwd,                               const size_t pwdlen, const void *salt,                               const size_t saltlen, void *hash,
cbits/argon2/core.c view
@@ -83,25 +83,25 @@     } while ((void)0, 0)      if (outlen <= BLAKE2B_OUTBYTES) {-        TRY(_cryptonite_blake2b_init(&blake_state, outlen));-        TRY(_cryptonite_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));-        TRY(_cryptonite_blake2b_update(&blake_state, in, inlen));-        TRY(_cryptonite_blake2b_final(&blake_state, out, outlen));+        TRY(_crypton_blake2b_init(&blake_state, outlen));+        TRY(_crypton_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));+        TRY(_crypton_blake2b_update(&blake_state, in, inlen));+        TRY(_crypton_blake2b_final(&blake_state, out, outlen));     } else {         uint32_t toproduce;         uint8_t out_buffer[BLAKE2B_OUTBYTES];         uint8_t in_buffer[BLAKE2B_OUTBYTES];-        TRY(_cryptonite_blake2b_init(&blake_state, BLAKE2B_OUTBYTES));-        TRY(_cryptonite_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));-        TRY(_cryptonite_blake2b_update(&blake_state, in, inlen));-        TRY(_cryptonite_blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES));+        TRY(_crypton_blake2b_init(&blake_state, BLAKE2B_OUTBYTES));+        TRY(_crypton_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));+        TRY(_crypton_blake2b_update(&blake_state, in, inlen));+        TRY(_crypton_blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES));         memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2);         out += BLAKE2B_OUTBYTES / 2;         toproduce = (uint32_t)outlen - BLAKE2B_OUTBYTES / 2;          while (toproduce > BLAKE2B_OUTBYTES) {             memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES);-            TRY(_cryptonite_blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer,+            TRY(_crypton_blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer,                         BLAKE2B_OUTBYTES, NULL, 0));             memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2);             out += BLAKE2B_OUTBYTES / 2;@@ -109,7 +109,7 @@         }          memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES);-        TRY(_cryptonite_blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL,+        TRY(_crypton_blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL,                     0));         memcpy(out, out_buffer, toproduce);     }@@ -597,31 +597,31 @@         return;     } -    _cryptonite_blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH);+    _crypton_blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH);      store32(&value, context->lanes);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, context->outlen);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, context->m_cost);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, context->t_cost);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, context->version);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, (uint32_t)type);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      store32(&value, context->pwdlen);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      if (context->pwd != NULL) {-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->pwd,+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->pwd,                        context->pwdlen);          if (context->flags & ARGON2_FLAG_CLEAR_PASSWORD) {@@ -631,18 +631,18 @@     }      store32(&value, context->saltlen);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      if (context->salt != NULL) {-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->salt,+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->salt,                        context->saltlen);     }      store32(&value, context->secretlen);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      if (context->secret != NULL) {-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->secret,+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->secret,                        context->secretlen);          if (context->flags & ARGON2_FLAG_CLEAR_SECRET) {@@ -652,14 +652,14 @@     }      store32(&value, context->adlen);-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));      if (context->ad != NULL) {-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->ad,+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->ad,                        context->adlen);     } -    _cryptonite_blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH);+    _crypton_blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH); } static int initialize(argon2_instance_t *instance, argon2_context *context) {
cbits/blake2/ref/blake2.h view
@@ -142,51 +142,51 @@   };    /* Streaming API */-  int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen );-  int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P );-  int _cryptonite_blake2s_update( blake2s_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen );+  int _crypton_blake2s_init( blake2s_state *S, size_t outlen );+  int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P );+  int _crypton_blake2s_update( blake2s_state *S, const void *in, size_t inlen );+  int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen );-  int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P );-  int _cryptonite_blake2b_update( blake2b_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen );+  int _crypton_blake2b_init( blake2b_state *S, size_t outlen );+  int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P );+  int _crypton_blake2b_update( blake2b_state *S, const void *in, size_t inlen );+  int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen );-  int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );+  int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen );+  int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );+  int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen );-  int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );+  int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen );+  int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );+  int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );    /* Variable output length API */-  int _cryptonite_blake2xs_init( blake2xs_state *S, const size_t outlen );-  int _cryptonite_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);+  int _crypton_blake2xs_init( blake2xs_state *S, const size_t outlen );+  int _crypton_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );+  int _crypton_blake2xs_final(blake2xs_state *S, void *out, size_t outlen); -  int _cryptonite_blake2xb_init( blake2xb_state *S, const size_t outlen );-  int _cryptonite_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);+  int _crypton_blake2xb_init( blake2xb_state *S, const size_t outlen );+  int _crypton_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );+  int _crypton_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);    /* Simple API */-  int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ); -  int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ); -  int _cryptonite_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );    /* This is simply an alias for blake2b */-  int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );  #if defined(__cplusplus) }
cbits/blake2/ref/blake2b-ref.c view
@@ -78,7 +78,7 @@ }  /* init xors IV with input parameter block */-int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P )+int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P ) {   const uint8_t *p = ( const uint8_t * )( P );   size_t i;@@ -95,7 +95,7 @@   -int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen )+int _crypton_blake2b_init( blake2b_state *S, size_t outlen ) {   blake2b_param P[1]; @@ -113,11 +113,11 @@   memset( P->reserved, 0, sizeof( P->reserved ) );   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2b_init_param( S, P );+  return _crypton_blake2b_init_param( S, P ); }  -int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen ) {   blake2b_param P[1]; @@ -138,13 +138,13 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  if( _cryptonite_blake2b_init_param( S, P ) < 0 ) return -1;+  if( _crypton_blake2b_init_param( S, P ) < 0 ) return -1;    {     uint8_t block[BLAKE2B_BLOCKBYTES];     memset( block, 0, BLAKE2B_BLOCKBYTES );     memcpy( block, key, keylen );-    _cryptonite_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );+    _crypton_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }   return 0;@@ -218,7 +218,7 @@ #undef G #undef ROUND -int _cryptonite_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )+int _crypton_blake2b_update( blake2b_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   if( inlen > 0 )@@ -245,7 +245,7 @@   return 0; } -int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen )+int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen ) {   uint8_t buffer[BLAKE2B_OUTBYTES] = {0};   size_t i;@@ -270,7 +270,7 @@ }  /* inlen, at least, should be uint64_t. Others can be size_t. */-int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   blake2b_state S[1]; @@ -287,26 +287,26 @@    if( keylen > 0 )   {-    if( _cryptonite_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;+    if( _crypton_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;   }   else   {-    if( _cryptonite_blake2b_init( S, outlen ) < 0 ) return -1;+    if( _crypton_blake2b_init( S, outlen ) < 0 ) return -1;   } -  _cryptonite_blake2b_update( S, ( const uint8_t * )in, inlen );-  _cryptonite_blake2b_final( S, out, outlen );+  _crypton_blake2b_update( S, ( const uint8_t * )in, inlen );+  _crypton_blake2b_final( S, out, outlen );   return 0; } -int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {-  return _cryptonite_blake2b(out, outlen, in, inlen, key, keylen);+int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {+  return _crypton_blake2b(out, outlen, in, inlen, key, keylen); }  #if defined(SUPERCOP) int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) {-  return _cryptonite_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );+  return _crypton_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 ); } #endif @@ -329,9 +329,9 @@   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )   {     uint8_t hash[BLAKE2B_OUTBYTES];-    _cryptonite_blake2b( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );+    _crypton_blake2b( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES ); -    if( 0 != memcmp( hash, _cryptonite_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )+    if( 0 != memcmp( hash, _crypton_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )     {       goto fail;     }@@ -346,25 +346,25 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2b_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2b_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2b_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2b_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {         goto fail;       } -      if (0 != memcmp(hash, _cryptonite_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES)) {+      if (0 != memcmp(hash, _crypton_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES)) {         goto fail;       }     }
cbits/blake2/ref/blake2bp-ref.c view
@@ -36,7 +36,7 @@ */ static int blake2bp_init_leaf_param( blake2b_state *S, const blake2b_param *P ) {-  int err = _cryptonite_blake2b_init_param(S, P);+  int err = _crypton_blake2b_init_param(S, P);   S->outlen = P->inner_length;   return err; }@@ -74,11 +74,11 @@   memset( P->reserved, 0, sizeof( P->reserved ) );   memset( P->salt, 0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2b_init_param( S, P );+  return _crypton_blake2b_init_param( S, P ); }  -int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen )+int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen ) {   size_t i; @@ -99,7 +99,7 @@   return 0; } -int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen ) {   size_t i; @@ -125,7 +125,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );      secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }@@ -133,7 +133,7 @@ }  -int _cryptonite_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )+int _crypton_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   size_t left = S->buflen;@@ -145,7 +145,7 @@     memcpy( S->buf + left, in, fill );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );      in += fill;     inlen -= fill;@@ -168,7 +168,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )     {-      _cryptonite_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;     }@@ -184,7 +184,7 @@   return 0; } -int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )+int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];   size_t i;@@ -201,19 +201,19 @@        if( left > BLAKE2B_BLOCKBYTES ) left = BLAKE2B_BLOCKBYTES; -      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );     } -    _cryptonite_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );   }    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES ); -  return _cryptonite_blake2b_final( S->R, out, S->outlen );+  return _crypton_blake2b_final( S->R, out, S->outlen ); } -int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];   blake2b_state S[PARALLELISM_DEGREE][1];@@ -243,7 +243,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );      secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }@@ -264,7 +264,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )     {-      _cryptonite_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;     }@@ -273,10 +273,10 @@     {       const size_t left = inlen__ - i * BLAKE2B_BLOCKBYTES;       const size_t len = left <= BLAKE2B_BLOCKBYTES ? left : BLAKE2B_BLOCKBYTES;-      _cryptonite_blake2b_update( S[i], in__, len );+      _crypton_blake2b_update( S[i], in__, len );     } -    _cryptonite_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );   }    if( blake2bp_init_root( FS, outlen, keylen ) < 0 )@@ -285,9 +285,9 @@   FS->last_node = 1; /* Mark as last node */    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES ); -  return _cryptonite_blake2b_final( FS, out, outlen );;+  return _crypton_blake2b_final( FS, out, outlen );; }  #if defined(BLAKE2BP_SELFTEST)@@ -326,21 +326,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2bp_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2bp_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2bp_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2bp_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/ref/blake2s-ref.c view
@@ -73,7 +73,7 @@ }  /* init2 xors IV with input parameter block */-int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P )+int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P ) {   const unsigned char *p = ( const unsigned char * )( P );   size_t i;@@ -90,7 +90,7 @@   /* Sequential blake2s initialization */-int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen )+int _crypton_blake2s_init( blake2s_state *S, size_t outlen ) {   blake2s_param P[1]; @@ -109,10 +109,10 @@   /* memset(P->reserved, 0, sizeof(P->reserved) ); */   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2s_init_param( S, P );+  return _crypton_blake2s_init_param( S, P ); } -int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen ) {   blake2s_param P[1]; @@ -133,13 +133,13 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  if( _cryptonite_blake2s_init_param( S, P ) < 0 ) return -1;+  if( _crypton_blake2s_init_param( S, P ) < 0 ) return -1;    {     uint8_t block[BLAKE2S_BLOCKBYTES];     memset( block, 0, BLAKE2S_BLOCKBYTES );     memcpy( block, key, keylen );-    _cryptonite_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );+    _crypton_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }   return 0;@@ -211,7 +211,7 @@ #undef G #undef ROUND -int _cryptonite_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )+int _crypton_blake2s_update( blake2s_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   if( inlen > 0 )@@ -238,7 +238,7 @@   return 0; } -int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen )+int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen ) {   uint8_t buffer[BLAKE2S_OUTBYTES] = {0};   size_t i;@@ -262,7 +262,7 @@   return 0; } -int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   blake2s_state S[1]; @@ -279,22 +279,22 @@    if( keylen > 0 )   {-    if( _cryptonite_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;+    if( _crypton_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;   }   else   {-    if( _cryptonite_blake2s_init( S, outlen ) < 0 ) return -1;+    if( _crypton_blake2s_init( S, outlen ) < 0 ) return -1;   } -  _cryptonite_blake2s_update( S, ( const uint8_t * )in, inlen );-  _cryptonite_blake2s_final( S, out, outlen );+  _crypton_blake2s_update( S, ( const uint8_t * )in, inlen );+  _crypton_blake2s_final( S, out, outlen );   return 0; }  #if defined(SUPERCOP) int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) {-  return _cryptonite_blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 );+  return _crypton_blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 ); } #endif @@ -317,7 +317,7 @@   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )   {     uint8_t hash[BLAKE2S_OUTBYTES];-    _cryptonite_blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );+    _crypton_blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );      if( 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )     {@@ -334,21 +334,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2s_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2s_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2s_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2s_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/ref/blake2sp-ref.c view
@@ -35,7 +35,7 @@ */ static int blake2sp_init_leaf_param( blake2s_state *S, const blake2s_param *P ) {-  int err = _cryptonite_blake2s_init_param(S, P);+  int err = _crypton_blake2s_init_param(S, P);   S->outlen = P->inner_length;   return err; }@@ -71,11 +71,11 @@   P->inner_length = BLAKE2S_OUTBYTES;   memset( P->salt, 0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2s_init_param( S, P );+  return _crypton_blake2s_init_param( S, P ); }  -int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen )+int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen ) {   size_t i; @@ -96,7 +96,7 @@   return 0; } -int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen ) {   size_t i; @@ -122,7 +122,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );      secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }@@ -130,7 +130,7 @@ }  -int _cryptonite_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )+int _crypton_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   size_t left = S->buflen;@@ -142,7 +142,7 @@     memcpy( S->buf + left, in, fill );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );      in += fill;     inlen -= fill;@@ -164,7 +164,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )     {-      _cryptonite_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;     }@@ -181,7 +181,7 @@ }  -int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )+int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];   size_t i;@@ -198,20 +198,20 @@        if( left > BLAKE2S_BLOCKBYTES ) left = BLAKE2S_BLOCKBYTES; -      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );     } -    _cryptonite_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );   }    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES ); -  return _cryptonite_blake2s_final( S->R, out, S->outlen );+  return _crypton_blake2s_final( S->R, out, S->outlen ); }  -int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];   blake2s_state S[PARALLELISM_DEGREE][1];@@ -241,7 +241,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );      secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }@@ -262,7 +262,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )     {-      _cryptonite_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;     }@@ -271,10 +271,10 @@     {       const size_t left = inlen__ - i * BLAKE2S_BLOCKBYTES;       const size_t len = left <= BLAKE2S_BLOCKBYTES ? left : BLAKE2S_BLOCKBYTES;-      _cryptonite_blake2s_update( S[i], in__, len );+      _crypton_blake2s_update( S[i], in__, len );     } -    _cryptonite_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );   }    if( blake2sp_init_root( FS, outlen, keylen ) < 0 )@@ -283,9 +283,9 @@   FS->last_node = 1;    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES ); -  return _cryptonite_blake2s_final( FS, out, outlen );+  return _crypton_blake2s_final( FS, out, outlen ); }  @@ -309,7 +309,7 @@   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )   {     uint8_t hash[BLAKE2S_OUTBYTES];-    _cryptonite_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );+    _crypton_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );      if( 0 != memcmp( hash, blake2sp_keyed_kat[i], BLAKE2S_OUTBYTES ) )     {@@ -326,21 +326,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2sp_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2sp_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2sp_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2sp_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/sse/blake2.h view
@@ -142,51 +142,51 @@   };    /* Streaming API */-  int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen );-  int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P );-  int _cryptonite_blake2s_update( blake2s_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen );+  int _crypton_blake2s_init( blake2s_state *S, size_t outlen );+  int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P );+  int _crypton_blake2s_update( blake2s_state *S, const void *in, size_t inlen );+  int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen );-  int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P );-  int _cryptonite_blake2b_update( blake2b_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen );+  int _crypton_blake2b_init( blake2b_state *S, size_t outlen );+  int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P );+  int _crypton_blake2b_update( blake2b_state *S, const void *in, size_t inlen );+  int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen );-  int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );+  int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen );+  int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );+  int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen ); -  int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen );-  int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );+  int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen );+  int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );+  int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );    /* Variable output length API */-  int _cryptonite_blake2xs_init( blake2xs_state *S, const size_t outlen );-  int _cryptonite_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);+  int _crypton_blake2xs_init( blake2xs_state *S, const size_t outlen );+  int _crypton_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );+  int _crypton_blake2xs_final(blake2xs_state *S, void *out, size_t outlen); -  int _cryptonite_blake2xb_init( blake2xb_state *S, const size_t outlen );-  int _cryptonite_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );-  int _cryptonite_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );-  int _cryptonite_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);+  int _crypton_blake2xb_init( blake2xb_state *S, const size_t outlen );+  int _crypton_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );+  int _crypton_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );+  int _crypton_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);    /* Simple API */-  int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ); -  int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ); -  int _cryptonite_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );-  int _cryptonite_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );    /* This is simply an alias for blake2b */-  int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );+  int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );  #if defined(__cplusplus) }
cbits/blake2/sse/blake2b.c view
@@ -74,7 +74,7 @@ }  /* init xors IV with input parameter block */-int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P )+int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P ) {   size_t i;   /*blake2b_init0( S ); */@@ -92,7 +92,7 @@   /* Some sort of default parameter block initialization, for sequential blake2b */-int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen )+int _crypton_blake2b_init( blake2b_state *S, size_t outlen ) {   blake2b_param P[1]; @@ -111,10 +111,10 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  return _cryptonite_blake2b_init_param( S, P );+  return _crypton_blake2b_init_param( S, P ); } -int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen ) {   blake2b_param P[1]; @@ -135,14 +135,14 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  if( _cryptonite_blake2b_init_param( S, P ) < 0 )+  if( _crypton_blake2b_init_param( S, P ) < 0 )     return 0;    {     uint8_t block[BLAKE2B_BLOCKBYTES];     memset( block, 0, BLAKE2B_BLOCKBYTES );     memcpy( block, key, keylen );-    _cryptonite_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );+    _crypton_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }   return 0;@@ -218,7 +218,7 @@ }  -int _cryptonite_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )+int _crypton_blake2b_update( blake2b_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   if( inlen > 0 )@@ -246,7 +246,7 @@ }  -int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen )+int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen ) {   if( out == NULL || outlen < S->outlen )     return -1;@@ -264,7 +264,7 @@ }  -int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   blake2b_state S[1]; @@ -281,26 +281,26 @@    if( keylen )   {-    if( _cryptonite_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;+    if( _crypton_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;   }   else   {-    if( _cryptonite_blake2b_init( S, outlen ) < 0 ) return -1;+    if( _crypton_blake2b_init( S, outlen ) < 0 ) return -1;   } -  _cryptonite_blake2b_update( S, ( const uint8_t * )in, inlen );-  _cryptonite_blake2b_final( S, out, outlen );+  _crypton_blake2b_update( S, ( const uint8_t * )in, inlen );+  _crypton_blake2b_final( S, out, outlen );   return 0; } -int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {-  return _cryptonite_blake2b(out, outlen, in, inlen, key, keylen);+int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {+  return _crypton_blake2b(out, outlen, in, inlen, key, keylen); }  #if defined(SUPERCOP) int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen ) {-  return _cryptonite_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );+  return _crypton_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 ); } #endif @@ -340,21 +340,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2b_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2b_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2b_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2b_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/sse/blake2bp.c view
@@ -36,7 +36,7 @@ */ static int blake2bp_init_leaf_param( blake2b_state *S, const blake2b_param *P ) {-  int err = _cryptonite_blake2b_init_param(S, P);+  int err = _crypton_blake2b_init_param(S, P);   S->outlen = P->inner_length;   return err; }@@ -74,11 +74,11 @@   memset( P->reserved, 0, sizeof( P->reserved ) );   memset( P->salt, 0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2b_init_param( S, P );+  return _crypton_blake2b_init_param( S, P ); }  -int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen )+int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen ) {   size_t i;   if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1;@@ -98,7 +98,7 @@   return 0; } -int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen ) {   size_t i; @@ -124,7 +124,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );      secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }@@ -132,7 +132,7 @@ }  -int _cryptonite_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )+int _crypton_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   size_t left = S->buflen;@@ -144,7 +144,7 @@     memcpy( S->buf + left, in, fill );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );      in += fill;     inlen -= fill;@@ -167,7 +167,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )     {-      _cryptonite_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;     }@@ -185,7 +185,7 @@   -int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )+int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];   size_t i;@@ -202,19 +202,19 @@        if( left > BLAKE2B_BLOCKBYTES ) left = BLAKE2B_BLOCKBYTES; -      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );     } -    _cryptonite_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );   }    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES ); -  return _cryptonite_blake2b_final( S->R, out, S->outlen );+  return _crypton_blake2b_final( S->R, out, S->outlen ); } -int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];   blake2b_state S[PARALLELISM_DEGREE][1];@@ -244,7 +244,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );      secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */   }@@ -265,7 +265,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )     {-      _cryptonite_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );+      _crypton_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;     }@@ -274,10 +274,10 @@     {       const size_t left = inlen__ - i * BLAKE2B_BLOCKBYTES;       const size_t len = left <= BLAKE2B_BLOCKBYTES ? left : BLAKE2B_BLOCKBYTES;-      _cryptonite_blake2b_update( S[i], in__, len );+      _crypton_blake2b_update( S[i], in__, len );     } -    _cryptonite_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );   }    if( blake2bp_init_root( FS, outlen, keylen ) < 0 )@@ -286,9 +286,9 @@   FS->last_node = 1; /* Mark as last node */    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );+    _crypton_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES ); -  return _cryptonite_blake2b_final( FS, out, outlen );+  return _crypton_blake2b_final( FS, out, outlen ); }  @@ -311,7 +311,7 @@   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )   {     uint8_t hash[BLAKE2B_OUTBYTES];-    _cryptonite_blake2bp( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );+    _crypton_blake2bp( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );      if( 0 != memcmp( hash, blake2bp_keyed_kat[i], BLAKE2B_OUTBYTES ) )     {@@ -328,21 +328,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2bp_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2bp_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2bp_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2bp_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/sse/blake2s.c view
@@ -72,7 +72,7 @@ }  /* init2 xors IV with input parameter block */-int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P )+int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P ) {   size_t i;   /*blake2s_init0( S ); */@@ -90,7 +90,7 @@   /* Some sort of default parameter block initialization, for sequential blake2s */-int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen )+int _crypton_blake2s_init( blake2s_state *S, size_t outlen ) {   blake2s_param P[1]; @@ -110,11 +110,11 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  return _cryptonite_blake2s_init_param( S, P );+  return _crypton_blake2s_init_param( S, P ); }  -int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen ) {   blake2s_param P[1]; @@ -136,14 +136,14 @@   memset( P->salt,     0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) ); -  if( _cryptonite_blake2s_init_param( S, P ) < 0 )+  if( _crypton_blake2s_init_param( S, P ) < 0 )     return -1;    {     uint8_t block[BLAKE2S_BLOCKBYTES];     memset( block, 0, BLAKE2S_BLOCKBYTES );     memcpy( block, key, keylen );-    _cryptonite_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );+    _crypton_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }   return 0;@@ -206,7 +206,7 @@   STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) ); } -int _cryptonite_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )+int _crypton_blake2s_update( blake2s_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   if( inlen > 0 )@@ -233,7 +233,7 @@   return 0; } -int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen )+int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen ) {   uint8_t buffer[BLAKE2S_OUTBYTES] = {0};   size_t i;@@ -275,15 +275,15 @@    if( keylen > 0 )   {-    if( _cryptonite_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;+    if( _crypton_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;   }   else   {-    if( _cryptonite_blake2s_init( S, outlen ) < 0 ) return -1;+    if( _crypton_blake2s_init( S, outlen ) < 0 ) return -1;   } -  _cryptonite_blake2s_update( S, ( const uint8_t * )in, inlen );-  _cryptonite_blake2s_final( S, out, outlen );+  _crypton_blake2s_update( S, ( const uint8_t * )in, inlen );+  _crypton_blake2s_final( S, out, outlen );   return 0; } @@ -330,21 +330,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2s_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2s_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2s_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2s_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {         goto fail;       }
cbits/blake2/sse/blake2sp.c view
@@ -35,7 +35,7 @@ */ static int blake2sp_init_leaf_param( blake2s_state *S, const blake2s_param *P ) {-  int err = _cryptonite_blake2s_init_param(S, P);+  int err = _crypton_blake2s_init_param(S, P);   S->outlen = P->inner_length;   return err; }@@ -71,11 +71,11 @@   P->inner_length = BLAKE2S_OUTBYTES;   memset( P->salt, 0, sizeof( P->salt ) );   memset( P->personal, 0, sizeof( P->personal ) );-  return _cryptonite_blake2s_init_param( S, P );+  return _crypton_blake2s_init_param( S, P ); }  -int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen )+int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen ) {   size_t i; @@ -96,7 +96,7 @@   return 0; } -int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )+int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen ) {   size_t i; @@ -122,7 +122,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );      secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }@@ -130,7 +130,7 @@ }  -int _cryptonite_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )+int _crypton_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen ) {   const unsigned char * in = (const unsigned char *)pin;   size_t left = S->buflen;@@ -142,7 +142,7 @@     memcpy( S->buf + left, in, fill );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );      in += fill;     inlen -= fill;@@ -165,7 +165,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )     {-      _cryptonite_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;     }@@ -182,7 +182,7 @@ }  -int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )+int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];   size_t i;@@ -199,20 +199,20 @@        if( left > BLAKE2S_BLOCKBYTES ) left = BLAKE2S_BLOCKBYTES; -      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );     } -    _cryptonite_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );   }    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES ); -  return _cryptonite_blake2s_final( S->R, out, S->outlen );+  return _crypton_blake2s_final( S->R, out, S->outlen ); }  -int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )+int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];   blake2s_state S[PARALLELISM_DEGREE][1];@@ -242,7 +242,7 @@     memcpy( block, key, keylen );      for( i = 0; i < PARALLELISM_DEGREE; ++i )-      _cryptonite_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );      secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */   }@@ -263,7 +263,7 @@      while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )     {-      _cryptonite_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );+      _crypton_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;     }@@ -272,10 +272,10 @@     {       const size_t left = inlen__ - i * BLAKE2S_BLOCKBYTES;       const size_t len = left <= BLAKE2S_BLOCKBYTES ? left : BLAKE2S_BLOCKBYTES;-      _cryptonite_blake2s_update( S[i], in__, len );+      _crypton_blake2s_update( S[i], in__, len );     } -    _cryptonite_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );   }    if( blake2sp_init_root( FS, outlen, keylen ) < 0 )@@ -284,9 +284,9 @@   FS->last_node = 1;    for( i = 0; i < PARALLELISM_DEGREE; ++i )-    _cryptonite_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );+    _crypton_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES ); -  return _cryptonite_blake2s_final( FS, out, outlen );+  return _crypton_blake2s_final( FS, out, outlen ); }  #if defined(BLAKE2SP_SELFTEST)@@ -308,7 +308,7 @@   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )   {     uint8_t hash[BLAKE2S_OUTBYTES];-    _cryptonite_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );+    _crypton_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );      if( 0 != memcmp( hash, blake2sp_keyed_kat[i], BLAKE2S_OUTBYTES ) )     {@@ -325,21 +325,21 @@       size_t mlen = i;       int err = 0; -      if( (err = _cryptonite_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {+      if( (err = _crypton_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {         goto fail;       }        while (mlen >= step) {-        if ( (err = _cryptonite_blake2sp_update(&S, p, step)) < 0 ) {+        if ( (err = _crypton_blake2sp_update(&S, p, step)) < 0 ) {           goto fail;         }         mlen -= step;         p += step;       }-      if ( (err = _cryptonite_blake2sp_update(&S, p, mlen)) < 0) {+      if ( (err = _crypton_blake2sp_update(&S, p, mlen)) < 0) {         goto fail;       }-      if ( (err = _cryptonite_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {+      if ( (err = _crypton_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {         goto fail;       }
+ cbits/crypton_aes.c view
@@ -0,0 +1,1109 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>++#include <crypton_cpu.h>+#include <crypton_aes.h>+#include <crypton_bitfn.h>++#include <aes/generic.h>+#include <aes/gf.h>+#include <aes/x86ni.h>++void crypton_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);+void crypton_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);+void crypton_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void crypton_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);++enum {+	/* init */+	INIT_128, INIT_192, INIT_256,+	/* single block */+	ENCRYPT_BLOCK_128, ENCRYPT_BLOCK_192, ENCRYPT_BLOCK_256,+	DECRYPT_BLOCK_128, DECRYPT_BLOCK_192, DECRYPT_BLOCK_256,+	/* ecb */+	ENCRYPT_ECB_128, ENCRYPT_ECB_192, ENCRYPT_ECB_256,+	DECRYPT_ECB_128, DECRYPT_ECB_192, DECRYPT_ECB_256,+	/* cbc */+	ENCRYPT_CBC_128, ENCRYPT_CBC_192, ENCRYPT_CBC_256,+	DECRYPT_CBC_128, DECRYPT_CBC_192, DECRYPT_CBC_256,+	/* ctr */+	ENCRYPT_CTR_128, ENCRYPT_CTR_192, ENCRYPT_CTR_256,+	/* ctr with 32-bit wrapping */+	ENCRYPT_C32_128, ENCRYPT_C32_192, ENCRYPT_C32_256,+	/* xts */+	ENCRYPT_XTS_128, ENCRYPT_XTS_192, ENCRYPT_XTS_256,+	DECRYPT_XTS_128, DECRYPT_XTS_192, DECRYPT_XTS_256,+	/* gcm */+	ENCRYPT_GCM_128, ENCRYPT_GCM_192, ENCRYPT_GCM_256,+	DECRYPT_GCM_128, DECRYPT_GCM_192, DECRYPT_GCM_256,+	/* ocb */+	ENCRYPT_OCB_128, ENCRYPT_OCB_192, ENCRYPT_OCB_256,+	DECRYPT_OCB_128, DECRYPT_OCB_192, DECRYPT_OCB_256,+	/* ccm */+	ENCRYPT_CCM_128, ENCRYPT_CCM_192, ENCRYPT_CCM_256,+	DECRYPT_CCM_128, DECRYPT_CCM_192, DECRYPT_CCM_256,+	/* ghash */+	GHASH_HINIT, GHASH_GF_MUL,+};++void *crypton_aes_branch_table[] = {+	/* INIT */+	[INIT_128]          = crypton_aes_generic_init,+	[INIT_192]          = crypton_aes_generic_init,+	[INIT_256]          = crypton_aes_generic_init,+	/* BLOCK */+	[ENCRYPT_BLOCK_128] = crypton_aes_generic_encrypt_block,+	[ENCRYPT_BLOCK_192] = crypton_aes_generic_encrypt_block,+	[ENCRYPT_BLOCK_256] = crypton_aes_generic_encrypt_block,+	[DECRYPT_BLOCK_128] = crypton_aes_generic_decrypt_block,+	[DECRYPT_BLOCK_192] = crypton_aes_generic_decrypt_block,+	[DECRYPT_BLOCK_256] = crypton_aes_generic_decrypt_block,+	/* ECB */+	[ENCRYPT_ECB_128]   = crypton_aes_generic_encrypt_ecb,+	[ENCRYPT_ECB_192]   = crypton_aes_generic_encrypt_ecb,+	[ENCRYPT_ECB_256]   = crypton_aes_generic_encrypt_ecb,+	[DECRYPT_ECB_128]   = crypton_aes_generic_decrypt_ecb,+	[DECRYPT_ECB_192]   = crypton_aes_generic_decrypt_ecb,+	[DECRYPT_ECB_256]   = crypton_aes_generic_decrypt_ecb,+	/* CBC */+	[ENCRYPT_CBC_128]   = crypton_aes_generic_encrypt_cbc,+	[ENCRYPT_CBC_192]   = crypton_aes_generic_encrypt_cbc,+	[ENCRYPT_CBC_256]   = crypton_aes_generic_encrypt_cbc,+	[DECRYPT_CBC_128]   = crypton_aes_generic_decrypt_cbc,+	[DECRYPT_CBC_192]   = crypton_aes_generic_decrypt_cbc,+	[DECRYPT_CBC_256]   = crypton_aes_generic_decrypt_cbc,+	/* CTR */+	[ENCRYPT_CTR_128]   = crypton_aes_generic_encrypt_ctr,+	[ENCRYPT_CTR_192]   = crypton_aes_generic_encrypt_ctr,+	[ENCRYPT_CTR_256]   = crypton_aes_generic_encrypt_ctr,+	/* CTR with 32-bit wrapping */+	[ENCRYPT_C32_128]   = crypton_aes_generic_encrypt_c32,+	[ENCRYPT_C32_192]   = crypton_aes_generic_encrypt_c32,+	[ENCRYPT_C32_256]   = crypton_aes_generic_encrypt_c32,+	/* XTS */+	[ENCRYPT_XTS_128]   = crypton_aes_generic_encrypt_xts,+	[ENCRYPT_XTS_192]   = crypton_aes_generic_encrypt_xts,+	[ENCRYPT_XTS_256]   = crypton_aes_generic_encrypt_xts,+	[DECRYPT_XTS_128]   = crypton_aes_generic_decrypt_xts,+	[DECRYPT_XTS_192]   = crypton_aes_generic_decrypt_xts,+	[DECRYPT_XTS_256]   = crypton_aes_generic_decrypt_xts,+	/* GCM */+	[ENCRYPT_GCM_128]   = crypton_aes_generic_gcm_encrypt,+	[ENCRYPT_GCM_192]   = crypton_aes_generic_gcm_encrypt,+	[ENCRYPT_GCM_256]   = crypton_aes_generic_gcm_encrypt,+	[DECRYPT_GCM_128]   = crypton_aes_generic_gcm_decrypt,+	[DECRYPT_GCM_192]   = crypton_aes_generic_gcm_decrypt,+	[DECRYPT_GCM_256]   = crypton_aes_generic_gcm_decrypt,+	/* OCB */+	[ENCRYPT_OCB_128]   = crypton_aes_generic_ocb_encrypt,+	[ENCRYPT_OCB_192]   = crypton_aes_generic_ocb_encrypt,+	[ENCRYPT_OCB_256]   = crypton_aes_generic_ocb_encrypt,+	[DECRYPT_OCB_128]   = crypton_aes_generic_ocb_decrypt,+	[DECRYPT_OCB_192]   = crypton_aes_generic_ocb_decrypt,+	[DECRYPT_OCB_256]   = crypton_aes_generic_ocb_decrypt,+	/* CCM */+	[ENCRYPT_CCM_128]   = crypton_aes_generic_ccm_encrypt,+	[ENCRYPT_CCM_192]   = crypton_aes_generic_ccm_encrypt,+	[ENCRYPT_CCM_256]   = crypton_aes_generic_ccm_encrypt,+	[DECRYPT_CCM_128]   = crypton_aes_generic_ccm_decrypt,+	[DECRYPT_CCM_192]   = crypton_aes_generic_ccm_decrypt,+	[DECRYPT_CCM_256]   = crypton_aes_generic_ccm_decrypt,+	/* GHASH */+	[GHASH_HINIT]       = crypton_aes_generic_hinit,+	[GHASH_GF_MUL]      = crypton_aes_generic_gf_mul,+};++typedef void (*init_f)(aes_key *, uint8_t *, uint8_t);+typedef void (*ecb_f)(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+typedef void (*cbc_f)(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+typedef void (*ctr_f)(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);+typedef void (*xts_f)(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit, uint32_t spoint, aes_block *input, uint32_t nb_blocks);+typedef void (*gcm_crypt_f)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+typedef void (*ocb_crypt_f)(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+typedef void (*ccm_crypt_f)(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);+typedef void (*block_f)(aes_block *output, aes_key *key, aes_block *input);+typedef void (*hinit_f)(table_4bit htable, const block128 *h);+typedef void (*gf_mul_f)(block128 *a, const table_4bit htable);++#ifdef WITH_AESNI+#define GET_INIT(strength) \+	((init_f) (crypton_aes_branch_table[INIT_128 + strength]))+#define GET_ECB_ENCRYPT(strength) \+	((ecb_f) (crypton_aes_branch_table[ENCRYPT_ECB_128 + strength]))+#define GET_ECB_DECRYPT(strength) \+	((ecb_f) (crypton_aes_branch_table[DECRYPT_ECB_128 + strength]))+#define GET_CBC_ENCRYPT(strength) \+	((cbc_f) (crypton_aes_branch_table[ENCRYPT_CBC_128 + strength]))+#define GET_CBC_DECRYPT(strength) \+	((cbc_f) (crypton_aes_branch_table[DECRYPT_CBC_128 + strength]))+#define GET_CTR_ENCRYPT(strength) \+	((ctr_f) (crypton_aes_branch_table[ENCRYPT_CTR_128 + strength]))+#define GET_C32_ENCRYPT(strength) \+	((ctr_f) (crypton_aes_branch_table[ENCRYPT_C32_128 + strength]))+#define GET_XTS_ENCRYPT(strength) \+	((xts_f) (crypton_aes_branch_table[ENCRYPT_XTS_128 + strength]))+#define GET_XTS_DECRYPT(strength) \+	((xts_f) (crypton_aes_branch_table[DECRYPT_XTS_128 + strength]))+#define GET_GCM_ENCRYPT(strength) \+	((gcm_crypt_f) (crypton_aes_branch_table[ENCRYPT_GCM_128 + strength]))+#define GET_GCM_DECRYPT(strength) \+	((gcm_crypt_f) (crypton_aes_branch_table[DECRYPT_GCM_128 + strength]))+#define GET_OCB_ENCRYPT(strength) \+	((ocb_crypt_f) (crypton_aes_branch_table[ENCRYPT_OCB_128 + strength]))+#define GET_OCB_DECRYPT(strength) \+	((ocb_crypt_f) (crypton_aes_branch_table[DECRYPT_OCB_128 + strength]))+#define GET_CCM_ENCRYPT(strength) \+	((ccm_crypt_f) (crypton_aes_branch_table[ENCRYPT_CCM_128 + strength]))+#define GET_CCM_DECRYPT(strength) \+	((ccm_crypt_f) (crypton_aes_branch_table[DECRYPT_CCM_128 + strength]))+#define crypton_aes_encrypt_block(o,k,i) \+	(((block_f) (crypton_aes_branch_table[ENCRYPT_BLOCK_128 + k->strength]))(o,k,i))+#define crypton_aes_decrypt_block(o,k,i) \+	(((block_f) (crypton_aes_branch_table[DECRYPT_BLOCK_128 + k->strength]))(o,k,i))+#define crypton_hinit(t,h) \+	(((hinit_f) (crypton_aes_branch_table[GHASH_HINIT]))(t,h))+#define crypton_gf_mul(a,t) \+	(((gf_mul_f) (crypton_aes_branch_table[GHASH_GF_MUL]))(a,t))+#else+#define GET_INIT(strenght) crypton_aes_generic_init+#define GET_ECB_ENCRYPT(strength) crypton_aes_generic_encrypt_ecb+#define GET_ECB_DECRYPT(strength) crypton_aes_generic_decrypt_ecb+#define GET_CBC_ENCRYPT(strength) crypton_aes_generic_encrypt_cbc+#define GET_CBC_DECRYPT(strength) crypton_aes_generic_decrypt_cbc+#define GET_CTR_ENCRYPT(strength) crypton_aes_generic_encrypt_ctr+#define GET_C32_ENCRYPT(strength) crypton_aes_generic_encrypt_c32+#define GET_XTS_ENCRYPT(strength) crypton_aes_generic_encrypt_xts+#define GET_XTS_DECRYPT(strength) crypton_aes_generic_decrypt_xts+#define GET_GCM_ENCRYPT(strength) crypton_aes_generic_gcm_encrypt+#define GET_GCM_DECRYPT(strength) crypton_aes_generic_gcm_decrypt+#define GET_OCB_ENCRYPT(strength) crypton_aes_generic_ocb_encrypt+#define GET_OCB_DECRYPT(strength) crypton_aes_generic_ocb_decrypt+#define GET_CCM_ENCRYPT(strength) crypton_aes_generic_ccm_encrypt+#define GET_CCM_DECRYPT(strength) crypton_aes_generic_ccm_decrypt+#define crypton_aes_encrypt_block(o,k,i) crypton_aes_generic_encrypt_block(o,k,i)+#define crypton_aes_decrypt_block(o,k,i) crypton_aes_generic_decrypt_block(o,k,i)+#define crypton_hinit(t,h) crypton_aes_generic_hinit(t,h)+#define crypton_gf_mul(a,t) crypton_aes_generic_gf_mul(a,t)+#endif++#define CPU_AESNI        0+#define CPU_PCLMUL       1+#define CPU_OPTION_COUNT 2++static uint8_t crypton_aes_cpu_options[CPU_OPTION_COUNT] = {};++#if defined(ARCH_X86) && defined(WITH_AESNI)+static void initialize_table_ni(int aesni, int pclmul)+{+	if (!aesni)+		return;+	crypton_aes_cpu_options[CPU_AESNI] = 1;++	crypton_aes_branch_table[INIT_128] = crypton_aesni_init;+	crypton_aes_branch_table[INIT_256] = crypton_aesni_init;++	crypton_aes_branch_table[ENCRYPT_BLOCK_128] = crypton_aesni_encrypt_block128;+	crypton_aes_branch_table[DECRYPT_BLOCK_128] = crypton_aesni_decrypt_block128;+	crypton_aes_branch_table[ENCRYPT_BLOCK_256] = crypton_aesni_encrypt_block256;+	crypton_aes_branch_table[DECRYPT_BLOCK_256] = crypton_aesni_decrypt_block256;+	/* ECB */+	crypton_aes_branch_table[ENCRYPT_ECB_128] = crypton_aesni_encrypt_ecb128;+	crypton_aes_branch_table[DECRYPT_ECB_128] = crypton_aesni_decrypt_ecb128;+	crypton_aes_branch_table[ENCRYPT_ECB_256] = crypton_aesni_encrypt_ecb256;+	crypton_aes_branch_table[DECRYPT_ECB_256] = crypton_aesni_decrypt_ecb256;+	/* CBC */+	crypton_aes_branch_table[ENCRYPT_CBC_128] = crypton_aesni_encrypt_cbc128;+	crypton_aes_branch_table[DECRYPT_CBC_128] = crypton_aesni_decrypt_cbc128;+	crypton_aes_branch_table[ENCRYPT_CBC_256] = crypton_aesni_encrypt_cbc256;+	crypton_aes_branch_table[DECRYPT_CBC_256] = crypton_aesni_decrypt_cbc256;+	/* CTR */+	crypton_aes_branch_table[ENCRYPT_CTR_128] = crypton_aesni_encrypt_ctr128;+	crypton_aes_branch_table[ENCRYPT_CTR_256] = crypton_aesni_encrypt_ctr256;+	/* CTR with 32-bit wrapping */+	crypton_aes_branch_table[ENCRYPT_C32_128] = crypton_aesni_encrypt_c32_128;+	crypton_aes_branch_table[ENCRYPT_C32_256] = crypton_aesni_encrypt_c32_256;+	/* XTS */+	crypton_aes_branch_table[ENCRYPT_XTS_128] = crypton_aesni_encrypt_xts128;+	crypton_aes_branch_table[ENCRYPT_XTS_256] = crypton_aesni_encrypt_xts256;+	/* GCM */+	crypton_aes_branch_table[ENCRYPT_GCM_128] = crypton_aesni_gcm_encrypt128;+	crypton_aes_branch_table[ENCRYPT_GCM_256] = crypton_aesni_gcm_encrypt256;+	/* OCB */+	/*+	crypton_aes_branch_table[ENCRYPT_OCB_128] = crypton_aesni_ocb_encrypt128;+	crypton_aes_branch_table[ENCRYPT_OCB_256] = crypton_aesni_ocb_encrypt256;+	*/+#ifdef WITH_PCLMUL+	if (!pclmul)+		return;+	crypton_aes_cpu_options[CPU_PCLMUL] = 1;++	/* GHASH */+	crypton_aes_branch_table[GHASH_HINIT]     = crypton_aesni_hinit_pclmul,+	crypton_aes_branch_table[GHASH_GF_MUL]    = crypton_aesni_gf_mul_pclmul,+	crypton_aesni_init_pclmul();+#endif+}+#endif++uint8_t *crypton_aes_cpu_init(void)+{+#if defined(ARCH_X86) && defined(WITH_AESNI)+	crypton_aesni_initialize_hw(initialize_table_ni);+#endif+	return crypton_aes_cpu_options;+}++void crypton_aes_initkey(aes_key *key, uint8_t *origkey, uint8_t size)+{+	switch (size) {+	case 16: key->nbr = 10; key->strength = 0; break;+	case 24: key->nbr = 12; key->strength = 1; break;+	case 32: key->nbr = 14; key->strength = 2; break;+	}+	crypton_aes_cpu_init();+	init_f _init = GET_INIT(key->strength);+	_init(key, origkey, size);+}++void crypton_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	ecb_f e = GET_ECB_ENCRYPT(key->strength);+	e(output, key, input, nb_blocks);+}++void crypton_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	ecb_f d = GET_ECB_DECRYPT(key->strength);+	d(output, key, input, nb_blocks);+}++void crypton_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	cbc_f e = GET_CBC_ENCRYPT(key->strength);+	e(output, key, iv, input, nb_blocks);+}++void crypton_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	cbc_f d = GET_CBC_DECRYPT(key->strength);+	d(output, key, iv, input, nb_blocks);+}++void crypton_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {+		crypton_aes_encrypt_block(output, key, &block);+	}+}++void crypton_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {+		crypton_aes_encrypt_block(output, key, &block);+	}++	/* copy back the IV */+	block128_copy(iv, &block);+}++void crypton_aes_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	ctr_f e = GET_CTR_ENCRYPT(key->strength);+	e(output, key, iv, input, len);+}++void crypton_aes_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	ctr_f e = GET_C32_ENCRYPT(key->strength);+	e(output, key, iv, input, len);+}++void crypton_aes_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	xts_f e = GET_XTS_ENCRYPT(k1->strength);+	e(output, k1, k2, dataunit, spoint, input, nb_blocks);+}++void crypton_aes_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	crypton_aes_generic_decrypt_xts(output, k1, k2, dataunit, spoint, input, nb_blocks);+}++void crypton_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	gcm_crypt_f e = GET_GCM_ENCRYPT(key->strength);+	e(output, gcm, key, input, length);+}++void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	gcm_crypt_f d = GET_GCM_DECRYPT(key->strength);+	d(output, gcm, key, input, length);+}++void crypton_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)+{+	ccm_crypt_f e = GET_CCM_ENCRYPT(key->strength);+	e(output, ccm, key, input, length);+}++void crypton_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)+{+	ccm_crypt_f d = GET_CCM_DECRYPT(key->strength);+	d(output, ccm, key, input, length);+}++void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_crypt_f e = GET_OCB_ENCRYPT(key->strength);+	e(output, ocb, key, input, length);+}++void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_crypt_f d = GET_OCB_DECRYPT(key->strength);+	d(output, ocb, key, input, length);+}++static void gcm_ghash_add(aes_gcm *gcm, block128 *b)+{+	block128_xor(&gcm->tag, b);+	crypton_gf_mul(&gcm->tag, gcm->htable);+}++void crypton_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len)+{+	block128 h;+	gcm->length_aad = 0;+	gcm->length_input = 0;++	block128_zero(&h);+	block128_zero(&gcm->tag);+	block128_zero(&gcm->iv);++	/* prepare H : encrypt_K(0^128) */+	crypton_aes_encrypt_block(&h, key, &h);+	crypton_hinit(gcm->htable, &h);++	if (len == 12) {+		block128_copy_bytes(&gcm->iv, iv, 12);+		gcm->iv.b[15] = 0x01;+	} else {+		uint32_t origlen = len << 3;+		int i;+		for (; len >= 16; len -= 16, iv += 16) {+			block128_xor(&gcm->iv, (block128 *) iv);+			crypton_gf_mul(&gcm->iv, gcm->htable);+		}+		if (len > 0) {+			block128_xor_bytes(&gcm->iv, iv, len);+			crypton_gf_mul(&gcm->iv, gcm->htable);+		}+		for (i = 15; origlen; --i, origlen >>= 8)+			gcm->iv.b[i] ^= (uint8_t) origlen;+		crypton_gf_mul(&gcm->iv, gcm->htable);+	}++	block128_copy_aligned(&gcm->civ, &gcm->iv);+}++void crypton_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length)+{+	gcm->length_aad += length;+	for (; length >= 16; input += 16, length -= 16) {+		gcm_ghash_add(gcm, (block128 *) input);+	}+	if (length > 0) {+		aes_block tmp;+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		gcm_ghash_add(gcm, &tmp);+	}++}++void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key)+{+	aes_block lblock;+	int i;++	/* tag = (tag-1 xor (lenbits(a) | lenbits(c)) ) . H */+	lblock.q[0] = cpu_to_be64(gcm->length_aad << 3);+	lblock.q[1] = cpu_to_be64(gcm->length_input << 3);+	gcm_ghash_add(gcm, &lblock);++	crypton_aes_encrypt_block(&lblock, key, &gcm->iv);+	block128_xor_aligned(&gcm->tag, &lblock);++	for (i = 0; i < 16; i++) {+		tag[i] = gcm->tag.b[i];+	}+}++static inline uint8_t ccm_b0_flags(uint32_t has_adata, uint32_t m, uint32_t l)+{+	return 8*m + l + (has_adata? 64: 0);+}++/* depends on input size */+static void ccm_encode_b0(block128* output, aes_ccm* ccm, uint32_t has_adata)+{+	int last = 15;+	uint32_t m = ccm->length_M;+	uint32_t l = ccm->length_L;+	uint32_t msg_len = ccm->length_input;++	block128_zero(output);+	block128_copy_aligned(output, &ccm->nonce);+	output->b[0] = ccm_b0_flags(has_adata, (m-2)/2, l-1);+	while (msg_len > 0) {+		output->b[last--] = msg_len & 0xff;+		msg_len >>= 8;+	}+}++/* encode adata length */+static int ccm_encode_la(block128* output, uint32_t la)+{+	if (la < ( (1 << 16) - (1 << 8)) ) {+		output->b[0] = (la >> 8) & 0xff;+		output->b[1] = la        & 0xff;+		return 2;+	} else {+		output->b[0] = 0xff;+		output->b[1] = 0xfe;+		output->b[2] = (la >> 24) & 0xff;+		output->b[3] = (la >> 16) & 0xff;+		output->b[4] = (la >>  8) & 0xff;+		output->b[5] = la         & 0xff;+		return 6;+	}+}++static void ccm_encode_ctr(block128* out, aes_ccm* ccm, unsigned int cnt)+{+	int last = 15;+	block128_copy_aligned(out, &ccm->nonce);+	out->b[0] = ccm->length_L - 1;++	while (cnt > 0) {+		out->b[last--] = cnt & 0xff;+		cnt >>= 8;+	}+}++static void ccm_cbcmac_add(aes_ccm* ccm, aes_key* key, block128* bi)+{+	block128_xor_aligned(&ccm->xi, bi);+	crypton_aes_encrypt_block(&ccm->xi, key, &ccm->xi);+}++/* even though it is possible to support message size as large as 2^64, we support up to 2^32 only */+void crypton_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t nonce_len, uint32_t input_size, int m, int l)+{+	memset(ccm, 0, sizeof(aes_ccm));++	if (l < 2 || l > 4) return;+	if (m != 4 && m != 6 && m != 8 && m != 10+		   && m != 12 && m != 14 && m != 16) return;++	if (nonce_len > 15 - l) {+		nonce_len = 15 - l;+	}++	if (l <= 4) {+		if (input_size >= (1ull << (8*l))) return;+	}++	ccm->length_L = l;+	ccm->length_M = m;+	ccm->length_input = input_size;++	memcpy(&ccm->nonce.b[1], nonce, nonce_len);++	ccm_encode_b0(&ccm->b0, ccm, 1); /* assume aad is present */+	crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);+}++/* even though l(a) can be as large as 2^64, we only handle aad up to 2 ^ 32 for practical reasons.+  Also we don't support incremental aad add, because the 1st encoded adata has length information+ */+void crypton_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)+{+	block128 tmp;++	if (ccm->length_aad != 0) return;++	ccm->length_aad = length;+	int len_len;++	block128_zero(&tmp);+	len_len = ccm_encode_la(&tmp, length);++	if (length < 16 - len_len) {+		memcpy(&tmp.b[len_len], input, length);+		length = 0;+	} else {+		memcpy(&tmp.b[len_len], input, 16 - len_len);+		input += 16 - len_len;+		length -= 16 - len_len;+	}++	ccm_cbcmac_add(ccm, key, &tmp);++	for (; length >= 16; input += 16, length -= 16) {+		block128_copy(&tmp, (block128*)input);+		ccm_cbcmac_add(ccm, key, &tmp);++	}+	if (length > 0) {+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		ccm_cbcmac_add(ccm, key, &tmp);+	}+	block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);+}++void crypton_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key)+{+	block128 iv, s0;++	block128_zero(&iv);+	ccm_encode_ctr(&iv, ccm, 0);+	crypton_aes_encrypt_block(&s0, key, &iv);+	block128_vxor((block128*)tag, &ccm->xi, &s0);+}++static inline void ocb_block_double(block128 *d, block128 *s)+{+	unsigned int i;+	uint8_t tmp = s->b[0];++	for (i=0; i<15; i++)+		d->b[i] = (s->b[i] << 1) | (s->b[i+1] >> 7);+	d->b[15] = (s->b[15] << 1) ^ ((tmp >> 7) * 0x87);+}++static void ocb_get_L_i(block128 *l, block128 *lis, unsigned int i)+{+#define L_CACHED 4+	i = bitfn_ntz(i);+	if (i < L_CACHED) {+		block128_copy(l, &lis[i]);+	} else {+		i -= (L_CACHED - 1);+		block128_copy(l, &lis[L_CACHED - 1]);+		while (i--) {+			ocb_block_double(l, l);+		}+	}+#undef L_CACHED+}++void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)+{+	block128 tmp, nonce, ktop;+	unsigned char stretch[24];+	unsigned bottom, byteshift, bitshift, i;++	/* we don't accept more than 15 bytes, any bytes higher will be ignored. */+	if (len > 15) {+		len = 15;+	}++	/* create L*, and L$,L0,L1,L2,L3 */+	block128_zero(&tmp);+	crypton_aes_encrypt_block(&ocb->lstar, key, &tmp);++	ocb_block_double(&ocb->ldollar, &ocb->lstar);+	ocb_block_double(&ocb->li[0], &ocb->ldollar);+	ocb_block_double(&ocb->li[1], &ocb->li[0]);+	ocb_block_double(&ocb->li[2], &ocb->li[1]);+	ocb_block_double(&ocb->li[3], &ocb->li[2]);++	/* create strech from the nonce */+	block128_zero(&nonce);+	memcpy(nonce.b + 4, iv, 12);+	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);+	nonce.b[16-12-1] |= 0x01;+	bottom = nonce.b[15] & 0x3F;+	nonce.b[15] &= 0xC0;+	crypton_aes_encrypt_block(&ktop, key, &nonce);+	memcpy(stretch, ktop.b, 16);++	memcpy(tmp.b, ktop.b + 1, 8);+	block128_xor_aligned(&tmp, &ktop);+	memcpy(stretch + 16, tmp.b, 8);++	/* initialize the encryption offset from stretch */+	byteshift = bottom / 8;+	bitshift = bottom % 8;+	if (bitshift != 0)+		for (i = 0; i < 16; i++)+			ocb->offset_enc.b[i] = (stretch[i+byteshift] << bitshift)+			                     | (stretch[i+byteshift+1] >> (8-bitshift));+	else+		for (i = 0; i < 16; i++)+			ocb->offset_enc.b[i] = stretch[i+byteshift];+	/* initialize checksum for aad and encryption, and the aad offset */+	block128_zero(&ocb->sum_aad);+	block128_zero(&ocb->sum_enc);+	block128_zero(&ocb->offset_aad);+}++void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	block128 tmp;+	unsigned int i;++	for (i=1; i<= length/16; i++, input=input+16) {+		ocb_get_L_i(&tmp, ocb->li, i);+		block128_xor_aligned(&ocb->offset_aad, &tmp);++		block128_vxor(&tmp, &ocb->offset_aad, (block128 *) input);+		crypton_aes_encrypt_block(&tmp, key, &tmp);+		block128_xor_aligned(&ocb->sum_aad, &tmp);+	}++	length = length % 16; /* Bytes in final block */+	if (length > 0) {+		block128_xor_aligned(&ocb->offset_aad, &ocb->lstar);+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		tmp.b[length] = 0x80;+		block128_xor_aligned(&tmp, &ocb->offset_aad);+		crypton_aes_encrypt_block(&tmp, key, &tmp);+		block128_xor_aligned(&ocb->sum_aad, &tmp);+	}+}++void crypton_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key)+{+	block128 tmp;++	block128_vxor_aligned(&tmp, &ocb->sum_enc, &ocb->offset_enc);+	block128_xor_aligned(&tmp, &ocb->ldollar);+	crypton_aes_encrypt_block((block128 *) tag, key, &tmp);+	block128_xor((block128 *) tag, &ocb->sum_aad);+}++void crypton_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	for ( ; nb_blocks-- > 0; input++, output++) {+		crypton_aes_generic_encrypt_block(output, key, input);+	}+}++void crypton_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	for ( ; nb_blocks-- > 0; input++, output++) {+		crypton_aes_generic_decrypt_block(output, key, input);+	}+}++void crypton_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);+	for ( ; nb_blocks-- > 0; input++, output++) {+		block128_xor(&block, (block128 *) input);+		crypton_aes_generic_encrypt_block(&block, key, &block);+		block128_copy((block128 *) output, &block);+	}+}++void crypton_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *ivini, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, blocko;+	aes_block iv;++	/* preload IV in block */+	block128_copy(&iv, ivini);+	for ( ; nb_blocks-- > 0; input++, output++) {+		block128_copy(&block, (block128 *) input);+		crypton_aes_generic_decrypt_block(&blocko, key, &block);+		block128_vxor((block128 *) output, &blocko, &iv);+		block128_copy(&iv, &block);+	}+}++void crypton_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	aes_block block, o;+	uint32_t nb_blocks = len / 16;+	int i;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; block128_inc_be(&block), output += 16, input += 16) {+		crypton_aes_encrypt_block(&o, key, &block);+		block128_vxor((block128 *) output, &o, (block128 *) input);+	}++	if ((len % 16) != 0) {+		crypton_aes_encrypt_block(&o, key, &block);+		for (i = 0; i < (len % 16); i++) {+			*output = ((uint8_t *) &o)[i] ^ *input;+			output++;+			input++;+		}+	}+}++void crypton_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	aes_block block, o;+	uint32_t nb_blocks = len / 16;+	int i;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; block128_inc32_le(&block), output += 16, input += 16) {+		crypton_aes_encrypt_block(&o, key, &block);+		block128_vxor((block128 *) output, &o, (block128 *) input);+	}++	if ((len % 16) != 0) {+		crypton_aes_encrypt_block(&o, key, &block);+		for (i = 0; i < (len % 16); i++) {+			*output = ((uint8_t *) &o)[i] ^ *input;+			output++;+			input++;+		}+	}+}++void crypton_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, tweak;++	/* load IV and encrypt it using k2 as the tweak */+	block128_copy(&tweak, dataunit);+	crypton_aes_encrypt_block(&tweak, k2, &tweak);++	/* TO OPTIMISE: this is really inefficient way to do that */+	while (spoint-- > 0)+		crypton_aes_generic_gf_mulx(&tweak);++	for ( ; nb_blocks-- > 0; input++, output++, crypton_aes_generic_gf_mulx(&tweak)) {+		block128_vxor(&block, input, &tweak);+		crypton_aes_encrypt_block(&block, k1, &block);+		block128_vxor(output, &block, &tweak);+	}+}++void crypton_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, tweak;++	/* load IV and encrypt it using k2 as the tweak */+	block128_copy(&tweak, dataunit);+	crypton_aes_encrypt_block(&tweak, k2, &tweak);++	/* TO OPTIMISE: this is really inefficient way to do that */+	while (spoint-- > 0)+		crypton_aes_generic_gf_mulx(&tweak);++	for ( ; nb_blocks-- > 0; input++, output++, crypton_aes_generic_gf_mulx(&tweak)) {+		block128_vxor(&block, input, &tweak);+		crypton_aes_decrypt_block(&block, k1, &block);+		block128_vxor(output, &block, &tweak);+	}+}++void crypton_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	aes_block out;++	gcm->length_input += length;+	for (; length >= 16; input += 16, output += 16, length -= 16) {+		block128_inc32_be(&gcm->civ);++		crypton_aes_encrypt_block(&out, key, &gcm->civ);+		block128_xor(&out, (block128 *) input);+		gcm_ghash_add(gcm, &out);+		block128_copy((block128 *) output, &out);+	}+	if (length > 0) {+		aes_block tmp;+		int i;++		block128_inc32_be(&gcm->civ);+		/* create e(civ) in out */+		crypton_aes_encrypt_block(&out, key, &gcm->civ);+		/* initialize a tmp as input and xor it to e(civ) */+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		block128_xor_bytes(&tmp, out.b, length);++		gcm_ghash_add(gcm, &tmp);++		for (i = 0; i < length; i++) {+			output[i] = tmp.b[i];+		}+	}+}++void crypton_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	aes_block out;++	gcm->length_input += length;+	for (; length >= 16; input += 16, output += 16, length -= 16) {+		block128_inc32_be(&gcm->civ);++		crypton_aes_encrypt_block(&out, key, &gcm->civ);+		gcm_ghash_add(gcm, (block128 *) input);+		block128_xor(&out, (block128 *) input);+		block128_copy((block128 *) output, &out);+	}+	if (length > 0) {+		aes_block tmp;+		int i;++		block128_inc32_be(&gcm->civ);++		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		gcm_ghash_add(gcm, &tmp);++		crypton_aes_encrypt_block(&out, key, &gcm->civ);+		block128_xor_bytes(&tmp, out.b, length);++		for (i = 0; i < length; i++) {+			output[i] = tmp.b[i];+		}+	}+}++static void ocb_generic_crypt(uint8_t *output, aes_ocb *ocb, aes_key *key,+                              uint8_t *input, uint32_t length, int encrypt)+{+	block128 tmp, pad;+	unsigned int i;++	for (i = 1; i <= length/16; i++, input += 16, output += 16) {+		/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */+		ocb_get_L_i(&tmp, ocb->li, i);+		block128_xor_aligned(&ocb->offset_enc, &tmp);++		block128_vxor(&tmp, &ocb->offset_enc, (block128 *) input);+		if (encrypt) {+			crypton_aes_encrypt_block(&tmp, key, &tmp);+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);+			block128_xor(&ocb->sum_enc, (block128 *) input);+		} else {+			crypton_aes_decrypt_block(&tmp, key, &tmp);+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);+			block128_xor(&ocb->sum_enc, (block128 *) output);+		}+	}++	/* process the last partial block if any */+	length = length % 16;+	if (length > 0) {+		block128_xor_aligned(&ocb->offset_enc, &ocb->lstar);+		crypton_aes_encrypt_block(&pad, key, &ocb->offset_enc);++		if (encrypt) {+			block128_zero(&tmp);+			block128_copy_bytes(&tmp, input, length);+			tmp.b[length] = 0x80;+			block128_xor_aligned(&ocb->sum_enc, &tmp);+			block128_xor_aligned(&pad, &tmp);+			memcpy(output, pad.b, length);+			output += length;+		} else {+			block128_copy_aligned(&tmp, &pad);+			block128_copy_bytes(&tmp, input, length);+			block128_xor_aligned(&tmp, &pad);+			tmp.b[length] = 0x80;+			memcpy(output, tmp.b, length);+			block128_xor_aligned(&ocb->sum_enc, &tmp);+			input += length;+		}+	}+}++void crypton_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)+{+	block128 tmp, ctr;++	/* when aad is absent, reset b0 block */+	if (ccm->length_aad == 0) {+		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */+		crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);+		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);+	}++	if (length != ccm->length_input) {+		return;+	}++	ccm_encode_ctr(&ctr, ccm, 1);+	crypton_aes_encrypt_ctr(output, key, &ctr, input, length);++	for (;length >= 16; input += 16, length -= 16) {+		block128_copy(&tmp, (block128*)input);+		ccm_cbcmac_add(ccm, key, &tmp);+	}+	if (length > 0) {+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		ccm_cbcmac_add(ccm, key, &tmp);+	}+}++void crypton_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)+{+	block128 tmp, ctr;++	if (length != ccm->length_input) {+		return;+	}++	/* when aad is absent, reset b0 block */+	if (ccm->length_aad == 0) {+		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */+		crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);+		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);+	}++	ccm_encode_ctr(&ctr, ccm, 1);+	crypton_aes_encrypt_ctr(output, key, &ctr, input, length);+	block128_copy_aligned(&ccm->xi, &ccm->header_cbcmac);+	input = output;++	for (;length >= 16; input += 16, length -= 16) {+		block128_copy(&tmp, (block128*)input);+		ccm_cbcmac_add(ccm, key, &tmp);+	}+	if (length > 0) {+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		ccm_cbcmac_add(ccm, key, &tmp);+	}+}++void crypton_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_generic_crypt(output, ocb, key, input, length, 1);+}++void crypton_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_generic_crypt(output, ocb, key, input, length, 0);+}++static inline void gf_mulx_rev(block128 *a, const block128 *h)+{+	uint64_t v1 = cpu_to_le64(h->q[0]);+	uint64_t v0 = cpu_to_le64(h->q[1]);+	a->q[1] = cpu_to_be64(v1 >> 1 | v0 << 63);+	a->q[0] = cpu_to_be64(v0 >> 1 ^ ((0-(v1 & 1)) & 0xe100000000000000ULL));+}++void crypton_aes_polyval_init(aes_polyval *ctx, const aes_block *h)+{+	aes_block r;++	/* ByteReverse(S_0) = 0 */+	block128_zero(&ctx->s);++	/* ByteReverse(H) * x */+	gf_mulx_rev(&r, h);+	crypton_hinit(ctx->htable, &r);+}++void crypton_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length)+{+	aes_block r;+	const uint8_t *p;+	uint32_t sz;++	/* This automatically pads with zeros if input is not a multiple of the+	   block size. */+	for (p = input; length > 0; p += 16, length -= sz)+	{+		sz = length < 16 ? length : 16;++		/* ByteReverse(X_j) */+		block128_zero(&r);+		memcpy(&r, p, sz);+		block128_byte_reverse(&r);++		/* ByteReverse(S_{j-1}) + ByteReverse(X_j) */+		block128_xor_aligned(&ctx->s, &r);++		/* ByteReverse(S_j) */+		crypton_gf_mul(&ctx->s, ctx->htable);+	}+}++void crypton_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst)+{+	/* S_s */+	block128_copy_aligned(dst, &ctx->s);+	block128_byte_reverse(dst);+}
+ cbits/crypton_aes.h view
@@ -0,0 +1,130 @@+/*+ *	Copyright (C) 2008 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ * AES implementation+ */+#ifndef CRYPTON_AES_H+#define CRYPTON_AES_H++#include <stdint.h>+#include "aes/block128.h"++typedef block128 aes_block;++/* size = 456 */+typedef struct {+	uint8_t nbr; /* number of rounds: 10 (128), 12 (192), 14 (256) */+	uint8_t strength; /* 128 = 0, 192 = 1, 256 = 2 */+	uint8_t _padding[6];+	uint8_t data[16*14*2];+} aes_key;++/* size = 19*16+2*8= 320 */+typedef struct {+	aes_block tag;+	aes_block htable[16];+	aes_block iv;+	aes_block civ;+	uint64_t length_aad;+	uint64_t length_input;+} aes_gcm;++/* size = 4*16+4*4= 80 */+typedef struct {+	aes_block xi;+	aes_block header_cbcmac;+	aes_block b0;+	aes_block nonce;+	uint32_t length_aad;+	uint32_t length_input;+	uint32_t length_M;+	uint32_t length_L;+} aes_ccm;++typedef struct {+	block128 offset_aad;+	block128 offset_enc;+	block128 sum_aad;+	block128 sum_enc;+	block128 lstar;+	block128 ldollar;+	block128 li[4];+} aes_ocb;++/* size = 17*16= 272 */+typedef struct {+	aes_block htable[16];+	aes_block s;+} aes_polyval;++/* in bytes: either 16,24,32 */+void crypton_aes_initkey(aes_key *ctx, uint8_t *key, uint8_t size);++void crypton_aes_encrypt(aes_block *output, aes_key *key, aes_block *input);+void crypton_aes_decrypt(aes_block *output, aes_key *key, aes_block *input);++void crypton_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void crypton_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);++void crypton_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void crypton_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);++void crypton_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks);+void crypton_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks);++void crypton_aes_encrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void crypton_aes_decrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);++void crypton_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len);+void crypton_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length);+void crypton_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key);++void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);+void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key);++void crypton_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t len, uint32_t msg_size, int m, int l);+void crypton_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);+void crypton_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key);++uint8_t *crypton_aes_cpu_init(void);++void crypton_aes_polyval_init(aes_polyval *ctx, const aes_block *h);+void crypton_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length);+void crypton_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst);++#endif
+ cbits/crypton_align.h view
@@ -0,0 +1,140 @@+#ifndef CRYPTON_ALIGN_H+#define CRYPTON_ALIGN_H++#include "crypton_bitfn.h"++#if (defined(__i386__))+# define UNALIGNED_ACCESS_OK+#elif defined(__x86_64__)+# define UNALIGNED_ACCESS_OK+#else+# define UNALIGNED_ACCESS_FAULT+#endif++/* n need to be power of 2.+ * IS_ALIGNED(p,8) */+#define IS_ALIGNED(p,alignment) (((uintptr_t) (p)) & ((alignment)-1))++#ifdef WITH_ASSERT_ALIGNMENT+#include <stdio.h>+#include <stdlib.h>+#include <inttypes.h>+# define ASSERT_ALIGNMENT(up, alignment) \+	do { if (IS_ALIGNED(up, alignment)) \+	{ printf("ALIGNMENT-ASSERT-FAILURE: %s:%d: ptr=%p alignment=%d\n", __FILE__, __LINE__, (void *) up, (alignment)); \+	  exit(99); \+	}; } while (0)+#else+# define ASSERT_ALIGNMENT(p, n) do {} while (0)+#endif++#ifdef UNALIGNED_ACCESS_OK+#define need_alignment(p,n) (0)+#else+#define need_alignment(p,n) IS_ALIGNED(p,n)+#endif++static inline uint32_t load_le32_aligned(const uint8_t *p)+{+	return le32_to_cpu(*((uint32_t *) p));		+}++static inline void store_le32_aligned(uint8_t *dst, const uint32_t v)+{+	*((uint32_t *) dst) = cpu_to_le32(v);+}++static inline void xor_le32_aligned(uint8_t *dst, const uint32_t v)+{+	*((uint32_t *) dst) ^= cpu_to_le32(v);+}++static inline void store_be32_aligned(uint8_t *dst, const uint32_t v)+{+	*((uint32_t *) dst) = cpu_to_be32(v);+}++static inline void xor_be32_aligned(uint8_t *dst, const uint32_t v)+{+	*((uint32_t *) dst) ^= cpu_to_be32(v);+}++static inline void store_le64_aligned(uint8_t *dst, const uint64_t v)+{+	*((uint64_t *) dst) = cpu_to_le64(v);+}++static inline void store_be64_aligned(uint8_t *dst, const uint64_t v)+{+	*((uint64_t *) dst) = cpu_to_be64(v);+}++static inline void xor_be64_aligned(uint8_t *dst, const uint64_t v)+{+	*((uint64_t *) dst) ^= cpu_to_be64(v);+}++#ifdef UNALIGNED_ACCESS_OK+#define load_le32(a) load_le32_aligned(a)+#else+static inline uint32_t load_le32(const uint8_t *p)+{+	return ((uint32_t)p[0]) | ((uint32_t)p[1] <<  8) | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);+}+#endif++#ifdef UNALIGNED_ACCESS_OK+#define store_le32(a, b) store_le32_aligned(a, b)+#define xor_le32(a, b) xor_le32_aligned(a, b)+#else+static inline void store_le32(uint8_t *dst, const uint32_t v)+{+	dst[0] = v; dst[1] = v >> 8; dst[2] = v >> 16; dst[3] = v >> 24;+}+static inline void xor_le32(uint8_t *dst, const uint32_t v)+{+	dst[0] ^= v; dst[1] ^= v >> 8; dst[2] ^= v >> 16; dst[3] ^= v >> 24;+}+#endif++#ifdef UNALIGNED_ACCESS_OK+#define store_be32(a, b) store_be32_aligned(a, b)+#define xor_be32(a, b) xor_be32_aligned(a, b)+#else+static inline void store_be32(uint8_t *dst, const uint32_t v)+{+	dst[3] = v; dst[2] = v >> 8; dst[1] = v >> 16; dst[0] = v >> 24;+}+static inline void xor_be32(uint8_t *dst, const uint32_t v)+{+	dst[3] ^= v; dst[2] ^= v >> 8; dst[1] ^= v >> 16; dst[0] ^= v >> 24;+}+#endif++#ifdef UNALIGNED_ACCESS_OK+#define store_le64(a, b) store_le64_aligned(a, b)+#else+static inline void store_le64(uint8_t *dst, const uint64_t v)+{+	dst[0] = v      ; dst[1] = v >> 8 ; dst[2] = v >> 16; dst[3] = v >> 24;+	dst[4] = v >> 32; dst[5] = v >> 40; dst[6] = v >> 48; dst[7] = v >> 56;+}+#endif++#ifdef UNALIGNED_ACCESS_OK+#define store_be64(a, b) store_be64_aligned(a, b)+#define xor_be64(a, b) xor_be64_aligned(a, b)+#else+static inline void store_be64(uint8_t *dst, const uint64_t v)+{+	dst[7] = v      ; dst[6] = v >> 8 ; dst[5] = v >> 16; dst[4] = v >> 24;+	dst[3] = v >> 32; dst[2] = v >> 40; dst[1] = v >> 48; dst[0] = v >> 56;+}+static inline void xor_be64(uint8_t *dst, const uint64_t v)+{+	dst[7] ^= v      ; dst[6] ^= v >> 8 ; dst[5] ^= v >> 16; dst[4] ^= v >> 24;+	dst[3] ^= v >> 32; dst[2] ^= v >> 40; dst[1] ^= v >> 48; dst[0] ^= v >> 56;+}+#endif++#endif
+ cbits/crypton_bitfn.h view
@@ -0,0 +1,253 @@+/*+ * Copyright (C) 2006-2014 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef BITFN_H+#define BITFN_H+#include <stdint.h>++#ifndef NO_INLINE_ASM+/**********************************************************/+# if (defined(__i386__))+#  define ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}+/**********************************************************/+# elif (defined(__arm__))+#  define ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	uint32_t tmp = a;+	asm volatile ("eor %1, %0, %0, ror #16\n"+	              "bic %1, %1, #0xff0000\n"+	              "mov %0, %0, ror #8\n"+	              "eor %0, %0, %1, lsr #8\n"+	             : "=r" (a), "=r" (tmp) : "0" (a), "1" (tmp));+	return a;+}+/**********************************************************/+# elif defined(__x86_64__)+#  define ARCH_HAS_SWAP32+#  define ARCH_HAS_SWAP64+static inline uint32_t bitfn_swap32(uint32_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}++static inline uint64_t bitfn_swap64(uint64_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}++# endif+#endif /* NO_INLINE_ASM */+/**********************************************************/++#ifndef ARCH_HAS_ROL32+static inline uint32_t rol32(uint32_t word, uint32_t shift)+{+	return (word << shift) | (word >> (32 - shift));+}+#endif++#ifndef ARCH_HAS_ROR32+static inline uint32_t ror32(uint32_t word, uint32_t shift)+{+	return (word >> shift) | (word << (32 - shift));+}+#endif++#ifndef ARCH_HAS_ROL64+static inline uint64_t rol64(uint64_t word, uint32_t shift)+{+	return (word << shift) | (word >> (64 - shift));+}+#endif++#ifndef ARCH_HAS_ROR64+static inline uint64_t ror64(uint64_t word, uint32_t shift)+{+	return (word >> shift) | (word << (64 - shift));+}+#endif++#ifndef ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	return (a << 24) | ((a & 0xff00) << 8) | ((a >> 8) & 0xff00) | (a >> 24);+}+#endif++#ifndef ARCH_HAS_ARRAY_SWAP32+static inline void array_swap32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--)+		*d++ = bitfn_swap32(*s++);+}+#endif++#ifndef ARCH_HAS_SWAP64+static inline uint64_t bitfn_swap64(uint64_t a)+{+	return ((uint64_t) bitfn_swap32((uint32_t) (a >> 32))) |+	       (((uint64_t) bitfn_swap32((uint32_t) a)) << 32);+}+#endif++#ifndef ARCH_HAS_ARRAY_SWAP64+static inline void array_swap64(uint64_t *d, uint64_t *s, uint32_t nb)+{+	while (nb--)+		*d++ = bitfn_swap64(*s++);+}+#endif++#ifndef ARCH_HAS_MEMORY_ZERO+static inline void memory_zero(void *ptr, uint32_t len)+{+	uint32_t *ptr32 = ptr;+	uint8_t *ptr8;+	int i;++	for (i = 0; i < len / 4; i++)+		*ptr32++ = 0;+	if (len % 4) {+		ptr8 = (uint8_t *) ptr32;+		for (i = len % 4; i >= 0; i--)+			ptr8[i] = 0;+	}+}+#endif++#ifndef ARCH_HAS_ARRAY_COPY32+static inline void array_copy32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--) *d++ = *s++;+}+#endif++#ifndef ARCH_HAS_ARRAY_XOR32+static inline void array_xor32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--) *d++ ^= *s++;+}+#endif++#ifndef ARCH_HAS_ARRAY_COPY64+static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb)+{+	while (nb--) *d++ = *s++;+}+#endif++#ifdef __GNUC__+#define bitfn_ntz(n) __builtin_ctz(n)+#else+#error "define ntz for your platform"+#endif++#ifdef __MINGW32__+  # define LITTLE_ENDIAN 1234+  # define BYTE_ORDER    LITTLE_ENDIAN+#elif defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)+  # include <sys/endian.h>+#elif defined(__OpenBSD__) || defined(__SVR4)+  # include <sys/types.h>+#elif defined(__APPLE__)+  # include <machine/endian.h>+#elif defined( BSD ) && ( BSD >= 199103 )+  # include <machine/endian.h>+#elif defined( __QNXNTO__ ) && defined( __LITTLEENDIAN__ )+  # define LITTLE_ENDIAN 1234+  # define BYTE_ORDER    LITTLE_ENDIAN+#elif defined( __QNXNTO__ ) && defined( __BIGENDIAN__ )+  # define BIG_ENDIAN 1234+  # define BYTE_ORDER    BIG_ENDIAN+#elif defined( _AIX )+  # include <sys/machine.h>+#else+  # include <endian.h>+#endif+/* big endian to cpu */+#if LITTLE_ENDIAN == BYTE_ORDER++# define be32_to_cpu(a) bitfn_swap32(a)+# define cpu_to_be32(a) bitfn_swap32(a)+# define le32_to_cpu(a) (a)+# define cpu_to_le32(a) (a)+# define be64_to_cpu(a) bitfn_swap64(a)+# define cpu_to_be64(a) bitfn_swap64(a)+# define le64_to_cpu(a) (a)+# define cpu_to_le64(a) (a)++# define cpu_to_le32_array(d, s, l) array_copy32(d, s, l)+# define le32_to_cpu_array(d, s, l) array_copy32(d, s, l)+# define cpu_to_be32_array(d, s, l) array_swap32(d, s, l)+# define be32_to_cpu_array(d, s, l) array_swap32(d, s, l)++# define cpu_to_le64_array(d, s, l) array_copy64(d, s, l)+# define le64_to_cpu_array(d, s, l) array_copy64(d, s, l)+# define cpu_to_be64_array(d, s, l) array_swap64(d, s, l)+# define be64_to_cpu_array(d, s, l) array_swap64(d, s, l)++# define ror32_be(a, s) rol32(a, s)+# define rol32_be(a, s) ror32(a, s)++# define ARCH_IS_LITTLE_ENDIAN++#elif BIG_ENDIAN == BYTE_ORDER++# define be32_to_cpu(a) (a)+# define cpu_to_be32(a) (a)+# define be64_to_cpu(a) (a)+# define cpu_to_be64(a) (a)+# define le64_to_cpu(a) bitfn_swap64(a)+# define cpu_to_le64(a) bitfn_swap64(a)+# define le32_to_cpu(a) bitfn_swap32(a)+# define cpu_to_le32(a) bitfn_swap32(a)++# define cpu_to_le32_array(d, s, l) array_swap32(d, s, l)+# define le32_to_cpu_array(d, s, l) array_swap32(d, s, l)+# define cpu_to_be32_array(d, s, l) array_copy32(d, s, l)+# define be32_to_cpu_array(d, s, l) array_copy32(d, s, l)++# define cpu_to_le64_array(d, s, l) array_swap64(d, s, l)+# define le64_to_cpu_array(d, s, l) array_swap64(d, s, l)+# define cpu_to_be64_array(d, s, l) array_copy64(d, s, l)+# define be64_to_cpu_array(d, s, l) array_copy64(d, s, l)++# define ror32_be(a, s) ror32(a, s)+# define rol32_be(a, s) rol32(a, s)++# define ARCH_IS_BIG_ENDIAN++#else+# error "endian not supported"+#endif++#endif /* !BITFN_H */
+ cbits/crypton_blake2b.c view
@@ -0,0 +1,16 @@+#include "crypton_blake2b.h"++void crypton_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen)+{+	_crypton_blake2b_init(ctx, hashlen / 8);+}++void crypton_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len)+{+	_crypton_blake2b_update(ctx, data, len);+}++void crypton_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	_crypton_blake2b_final(ctx, out, hashlen / 8);+}
+ cbits/crypton_blake2b.h view
@@ -0,0 +1,12 @@+#ifndef CRYPTOHASH_BLAKE2B_H+#define CRYPTOHASH_BLAKE2B_H++#include "blake2.h"++typedef blake2b_state blake2b_ctx;++void crypton_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen);+void crypton_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_blake2bp.c view
@@ -0,0 +1,16 @@+#include "crypton_blake2bp.h"++void crypton_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen)+{+	_crypton_blake2bp_init(ctx, hashlen / 8);+}++void crypton_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len)+{+	_crypton_blake2bp_update(ctx, data, len);+}++void crypton_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	_crypton_blake2bp_final(ctx, out, hashlen / 8);+}
+ cbits/crypton_blake2bp.h view
@@ -0,0 +1,12 @@+#ifndef CRYPTOHASH_BLAKE2BP_H+#define CRYPTOHASH_BLAKE2BP_H++#include "blake2.h"++typedef blake2bp_state blake2bp_ctx;++void crypton_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen);+void crypton_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_blake2s.c view
@@ -0,0 +1,16 @@+#include "crypton_blake2s.h"++void crypton_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen)+{+	_crypton_blake2s_init(ctx, hashlen / 8);+}++void crypton_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len)+{+	_crypton_blake2s_update(ctx, data, len);+}++void crypton_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	_crypton_blake2s_final(ctx, out, hashlen / 8);+}
+ cbits/crypton_blake2s.h view
@@ -0,0 +1,12 @@+#ifndef CRYPTOHASH_BLAKE2S_H+#define CRYPTOHASH_BLAKE2S_H++#include "blake2.h"++typedef blake2s_state blake2s_ctx;++void crypton_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen);+void crypton_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_blake2sp.c view
@@ -0,0 +1,16 @@+#include "crypton_blake2sp.h"++void crypton_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen)+{+	_crypton_blake2sp_init(ctx, hashlen / 8);+}++void crypton_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len)+{+	_crypton_blake2sp_update(ctx, data, len);+}++void crypton_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	_crypton_blake2sp_final(ctx, out, hashlen / 8);+}
+ cbits/crypton_blake2sp.h view
@@ -0,0 +1,12 @@+#ifndef CRYPTOHASH_BLAKE2SP_H+#define CRYPTOHASH_BLAKE2SP_H++#include "blake2.h"++typedef blake2sp_state blake2sp_ctx;++void crypton_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen);+void crypton_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_chacha.c view
@@ -0,0 +1,288 @@+/*+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include "crypton_chacha.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include <stdio.h>++#define QR(a,b,c,d) \+	a += b; d = rol32(d ^ a,16); \+	c += d; b = rol32(b ^ c,12); \+	a += b; d = rol32(d ^ a, 8); \+	c += d; b = rol32(b ^ c, 7);++#define ALIGNED64(PTR) \+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)++static const uint8_t sigma[16] = "expand 32-byte k";+static const uint8_t tau[16] = "expand 16-byte k";++static void chacha_core(int rounds, block *out, const crypton_chacha_state *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];++	for (i = rounds; i > 0; i -= 2) {+		QR(x0, x4, x8, x12);+		QR(x1, x5, x9, x13);+		QR(x2, x6, x10, x14);+		QR(x3, x7, x11, x15);++		QR(x0, x5, x10, x15);+		QR(x1, x6, x11, x12);+		QR(x2, x7, x8, x13);+		QR(x3, x4, x9, x14);+	}++	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];++	out->d[0] = cpu_to_le32(x0);+	out->d[1] = cpu_to_le32(x1);+	out->d[2] = cpu_to_le32(x2);+	out->d[3] = cpu_to_le32(x3);+	out->d[4] = cpu_to_le32(x4);+	out->d[5] = cpu_to_le32(x5);+	out->d[6] = cpu_to_le32(x6);+	out->d[7] = cpu_to_le32(x7);+	out->d[8] = cpu_to_le32(x8);+	out->d[9] = cpu_to_le32(x9);+	out->d[10] = cpu_to_le32(x10);+	out->d[11] = cpu_to_le32(x11);+	out->d[12] = cpu_to_le32(x12);+	out->d[13] = cpu_to_le32(x13);+	out->d[14] = cpu_to_le32(x14);+	out->d[15] = cpu_to_le32(x15);+}++/* only 2 valids values are 256 (32) and 128 (16) */+void crypton_chacha_init_core(crypton_chacha_state *st,+                                 uint32_t keylen, const uint8_t *key,+                                 uint32_t ivlen, const uint8_t *iv)+{+	const uint8_t *constants = (keylen == 32) ? sigma : tau;++	ASSERT_ALIGNMENT(constants, 4);++	st->d[0] = load_le32_aligned(constants + 0);+	st->d[1] = load_le32_aligned(constants + 4);+	st->d[2] = load_le32_aligned(constants + 8);+	st->d[3] = load_le32_aligned(constants + 12);++	st->d[4] = load_le32(key + 0);+	st->d[5] = load_le32(key + 4);+	st->d[6] = load_le32(key + 8);+	st->d[7] = load_le32(key + 12);+	/* we repeat the key on 128 bits */+	if (keylen == 32)+		key += 16;+	st->d[8] = load_le32(key + 0);+	st->d[9] = load_le32(key + 4);+	st->d[10] = load_le32(key + 8);+	st->d[11] = load_le32(key + 12);+	st->d[12] = 0;+	switch (ivlen) {+	case 8:+		st->d[13] = 0;+		st->d[14] = load_le32(iv + 0);+		st->d[15] = load_le32(iv + 4);+		break;+	case 12:+		st->d[13] = load_le32(iv + 0);+		st->d[14] = load_le32(iv + 4);+		st->d[15] = load_le32(iv + 8);+	default:+		return;+	}+}++void crypton_chacha_init(crypton_chacha_context *ctx, uint8_t nb_rounds,+                            uint32_t keylen, const uint8_t *key,+                            uint32_t ivlen, const uint8_t *iv)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->nb_rounds = nb_rounds;+	crypton_chacha_init_core(&ctx->st, keylen, key, ivlen, iv);+}++void crypton_chacha_combine(uint8_t *dst, crypton_chacha_context *ctx, const uint8_t *src, uint32_t bytes)+{+	block out;+	crypton_chacha_state *st;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		src += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	/* xor new 64-bytes chunks and store the left over if any */+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		for (i = 0; i < 64; ++i)+			dst[i] = src[i] ^ out.b[i];+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = src[i] ^ out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++) {+			ctx->prev[i] = out.b[i];+		}+	}+}++void crypton_chacha_generate(uint8_t *dst, crypton_chacha_context *ctx, uint32_t bytes)+{+	crypton_chacha_state *st;+	block out;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	if (ALIGNED64(dst)) {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			chacha_core(ctx->nb_rounds, (block *) dst, st);+			st->d[12] += 1;+			if (st->d[12] == 0)+				st->d[13] += 1;+		}+	} else {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			chacha_core(ctx->nb_rounds, &out, st);+			st->d[12] += 1;+			if (st->d[12] == 0)+				st->d[13] += 1;++			for (i = 0; i < 64; ++i)+				dst[i] = out.b[i];+		}+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++)+			ctx->prev[i] = out.b[i];+	}+}++void crypton_chacha_random(uint32_t rounds, uint8_t *dst, crypton_chacha_state *st, uint32_t bytes)+{+	block out;++	if (!bytes)+		return;+	for (; bytes >= 16; bytes -= 16, dst += 16) {+		chacha_core(rounds, &out, st);+		memcpy(dst, out.b + 40, 16);+		crypton_chacha_init_core(st, 32, out.b, 8, out.b + 32);+	}+	if (bytes) {+		chacha_core(rounds, &out, st);+		memcpy(dst, out.b + 40, bytes);+		crypton_chacha_init_core(st, 32, out.b, 8, out.b + 32);+	}+}
+ cbits/crypton_chacha.h view
@@ -0,0 +1,54 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTON_CHACHA+#define CRYPTON_CHACHA++typedef union {+	uint64_t q[8];+	uint32_t d[16];+	uint8_t  b[64];+} block;++typedef block crypton_chacha_state;++typedef struct {+	crypton_chacha_state st;+	uint8_t prev[64];+	uint8_t prev_ofs;+	uint8_t prev_len;+	uint8_t nb_rounds;+} crypton_chacha_context;++void crypton_chacha_init_core(crypton_chacha_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void crypton_chacha_init(crypton_chacha_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void crypton_chacha_combine(uint8_t *dst, crypton_chacha_context *st, const uint8_t *src, uint32_t bytes);+void crypton_chacha_generate(uint8_t *dst, crypton_chacha_context *st, uint32_t bytes);++#endif
+ cbits/crypton_cpu.c view
@@ -0,0 +1,75 @@+/*+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ */+#include "crypton_cpu.h"+#include <stdint.h>++#ifdef ARCH_X86+static void cpuid(uint32_t info, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)+{+	*eax = info;+	asm volatile+		(+#ifdef __x86_64__+		 "mov %%rbx, %%rdi;"+#else+		 "mov %%ebx, %%edi;"+#endif+		 "cpuid;"+		 "mov %%ebx, %%esi;"+#ifdef __x86_64__+		 "mov %%rdi, %%rbx;"+#else+		 "mov %%edi, %%ebx;"+#endif+		 :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)+		 : :"edi");+}++#ifdef USE_AESNI+void crypton_aesni_initialize_hw(void (*init_table)(int, int))+{+	static int inited = 0;+	if (inited == 0) {+		uint32_t eax, ebx, ecx, edx;+		int aesni, pclmul;++		inited = 1;+		cpuid(1, &eax, &ebx, &ecx, &edx);+		aesni = (ecx & 0x02000000);+		pclmul = (ecx & 0x00000001);+		init_table(aesni, pclmul);+	}+}+#else+#define crypton_aesni_initialize_hw(init_table) 	(0)+#endif++#endif
+ cbits/crypton_cpu.h view
@@ -0,0 +1,45 @@+/*+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ */+#ifndef CPU_H+#define CPU_H++#if defined(__i386__) || defined(__x86_64__)+#define ARCH_X86+#define USE_AESNI+#endif++#ifdef USE_AESNI+void crypton_aesni_initialize_hw(void (*init_table)(int, int));+#else+#define crypton_aesni_initialize_hw(init_table) 	(0)+#endif++#endif
+ cbits/crypton_curve25519.h view
@@ -0,0 +1,6 @@+#ifndef CRYPTON_CURVE25519_H+#define CRYPTON_CURVE25519_H++int crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint);++#endif
+ cbits/crypton_hash_prefix.c view
@@ -0,0 +1,90 @@+/*+ * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <crypton_hash_prefix.h>++void CRYPTON_HASHED(finalize_prefix)(struct HASHED_LOWER(ctx) *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)+{+	uint64_t bits[HASHED(BITS_ELEMS)];+	uint8_t *p = (uint8_t *) &bits;+	uint32_t index, padidx, padlen, pos, out_mask;+	static const uint32_t cut_off = HASHED(BLOCK_SIZE) - sizeof(bits);++	/* Make sure n <= len */+	n += (len - n) & constant_time_lt(len, n);++	/* Initial index, based on current context state */+	index = CRYPTON_HASHED(get_index)(ctx);++	/* Final size after n bytes */+	CRYPTON_HASHED(incr_sz)(ctx, bits, n);++	/* Padding index and length */+	padidx = CRYPTON_HASHED(get_index)(ctx);+	padlen = HASHED(BLOCK_SIZE) + cut_off - padidx;+	padlen -= HASHED(BLOCK_SIZE) & constant_time_lt(padidx, cut_off);++	/* Initialize buffers because we will XOR into them */+	memset(ctx->buf + index, 0, HASHED(BLOCK_SIZE) - index);+	memset(out, 0, HASHED(DIGEST_SIZE));+	pos = 0;++	/* Iterate based on the full buffer length, regardless of n, and include+	 * the maximum overhead with padding and size bytes+	 */+	while (pos < len + HASHED(BLOCK_SIZE) + sizeof(bits)) {+		uint8_t b;++		/* Take as many bytes from the input buffer as possible */+		if (pos < len)+			b = *(data++) & (uint8_t) constant_time_lt(pos, n);+		else+			b = 0;++		/* First padding byte */+		b |= 0x80 & (uint8_t) constant_time_eq(pos, n);++		/* Size bytes are always at the end of a block */+		if (index >= cut_off)+			b |= p[index - cut_off] & (uint8_t) constant_time_ge(pos, n + padlen);++		/* Store this byte into the buffer */+		ctx->buf[index++] ^= b;+		pos++;++		/* Process a full block, at a boundary which is independent from n */+		if (index >= HASHED(BLOCK_SIZE)) {+			index = 0;+			HASHED_LOWER(do_chunk)(ctx, (void *) ctx->buf);+			memset(ctx->buf, 0, HASHED(BLOCK_SIZE));++			/* Try to store the result: this is a no-op except when we reach the+			 * actual size based on n, more iterations may continue after that+			 * when len is really larger+			 */+			out_mask = constant_time_eq(pos, n + padlen + sizeof(bits));+			CRYPTON_HASHED(select_digest)(ctx, out, out_mask);+		}+	}+}
+ cbits/crypton_hash_prefix.h view
@@ -0,0 +1,65 @@+/*+ * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *	notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *	notice, this list of conditions and the following disclaimer in the+ *	documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef CRYPTON_HASH_PREFIX_H+#define CRYPTON_HASH_PREFIX_H++#include <stdint.h>++static inline uint32_t constant_time_msb(uint32_t a)+{+	return 0 - (a >> 31);+}++static inline uint32_t constant_time_lt(uint32_t a, uint32_t b)+{+	return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));+}++static inline uint32_t constant_time_ge(uint32_t a, uint32_t b)+{+	return ~constant_time_lt(a, b);+}++static inline uint32_t constant_time_is_zero(uint32_t a)+{+	return constant_time_msb(~a & (a - 1));+}++static inline uint32_t constant_time_eq(uint32_t a, uint32_t b)+{+	return constant_time_is_zero(a ^ b);+}++static inline uint64_t constant_time_msb_64(uint64_t a)+{+	return 0 - (a >> 63);+}++static inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b)+{+	return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b)));+}++#endif
+ cbits/crypton_md2.c view
@@ -0,0 +1,136 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "crypton_bitfn.h"+#include "crypton_md2.h"++void crypton_md2_init(struct md2_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->sz = 0ULL;+}++static uint8_t S_table[]  = {+	0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, +	0x62, 0xA7, 0x05, 0xF3, 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, 0x82, 0xCA, +	0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, +	0xBE, 0x4E, 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, 0xBB, 0x2F, 0xEE, 0x7A, +	0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21,+	0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, +	0xFF, 0x19, 0x30, 0xB3, 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, 0xAA, 0xC6, +	0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, +	0x45, 0x9D, 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, 0xE6, 0x2D, 0xA8, 0x02, +	0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, +	0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, +	0x2C, 0x53, 0x0D, 0x6E, 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, 0x4D, 0x52, +	0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, +	0x78, 0x88, 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, 0x3B, 0x00, 0x1D, 0x39, +	0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, +	0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14+};++#define UBYTES(s) ((uint8_t *) s)+static uint8_t *padding_table[] = {+	UBYTES(""),+	UBYTES("\x1"),+	UBYTES("\x2\x2"),+	UBYTES("\x3\x3\x3"),+	UBYTES("\x4\x4\x4\x4"),+	UBYTES("\x5\x5\x5\x5\x5"),+	UBYTES("\x6\x6\x6\x6\x6\x6"),+	UBYTES("\x7\x7\x7\x7\x7\x7\x7"),+	UBYTES("\x8\x8\x8\x8\x8\x8\x8\x8"),+	UBYTES("\x9\x9\x9\x9\x9\x9\x9\x9\x9"),+	UBYTES("\xa\xa\xa\xa\xa\xa\xa\xa\xa\xa"),+	UBYTES("\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb"),+	UBYTES("\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc"),+	UBYTES("\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd"),+	UBYTES("\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe"),+	UBYTES("\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf"),+	UBYTES("\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10")+};++static void md2_do_chunk(struct md2_ctx *ctx, const uint8_t *buf)+{+	uint8_t i, j, t;+	uint8_t x[48];++	memcpy(x, ctx->h, 16);+	memcpy(x+16, buf, 16);++	for (i = 0; i < 16; i++)+		x[i+32] = ctx->h[i] ^ buf[i];++	for (t = i = 0; i < 18; i++) {+		for (j = 0; j < 48; j++)+			t = x[j] ^= S_table[t];+		t = (t + i) & 0xff;+	}++	memcpy(ctx->h, x, 16);++	t = ctx->cksum[15];+	for (i = 0; i < 16; i++)+		t = ctx->cksum[i] ^= S_table[buf[i] ^ t];+}++void crypton_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0xf);+	to_fill = 16 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md2_do_chunk(ctx, ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 16-block as possible */+	for (; len >= 16; len -= 16, data += 16)+		md2_do_chunk(ctx, data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_md2_finalize(struct md2_ctx *ctx, uint8_t *out)+{+	uint32_t index, padlen;++	index = ctx->sz & 0xf;+	padlen = 16 - index;++	crypton_md2_update(ctx, padding_table[padlen], padlen);+	crypton_md2_update(ctx, ctx->cksum, 16);+	memcpy(out, ctx->h, 16);+}
+ cbits/crypton_md2.h view
@@ -0,0 +1,44 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD2_H+#define CRYPTOHASH_MD2_H++#include <stdint.h>++struct md2_ctx+{+	uint64_t sz;+	uint8_t  buf[16];+	uint8_t  h[16];+	uint8_t  cksum[16];+};++#define MD2_DIGEST_SIZE		16+#define MD2_CTX_SIZE		sizeof(struct md2_ctx)++void crypton_md2_init(struct md2_ctx *ctx);+void crypton_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_md2_finalize(struct md2_ctx *ctx, uint8_t *out);++#endif
+ cbits/crypton_md4.c view
@@ -0,0 +1,174 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_md4.h"++void crypton_md4_init(struct md4_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->sz = 0ULL;+	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+}++#define f1(x, y, z)	((x & y) | ((~x) & z))+#define f2(x, y, z)	((x & y) | (x & z) | (y & z))+#define f3(x, y, z)	(x ^ y ^ z)++#define K1 	0x00000000+#define K2 	0x5A827999+#define K3 	0x6ED9EBA1+#define R(a,b,c,d,f,k,s,i) (a = rol32(a + f(b,c,d) + w[i] + k, s))++static void md4_do_chunk(struct md4_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, (uint32_t *) buf, 16);+#else+	uint32_t *w = buf;+#endif++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];++	R(a, b, c, d, f1, K1, 3, 0);+	R(d, a, b, c, f1, K1, 7, 1);+	R(c, d, a, b, f1, K1, 11, 2);+	R(b, c, d, a, f1, K1, 19, 3);+	R(a, b, c, d, f1, K1, 3, 4);+	R(d, a, b, c, f1, K1, 7, 5);+	R(c, d, a, b, f1, K1, 11, 6);+	R(b, c, d, a, f1, K1, 19, 7);+	R(a, b, c, d, f1, K1, 3, 8);+	R(d, a, b, c, f1, K1, 7, 9);+	R(c, d, a, b, f1, K1, 11, 10);+	R(b, c, d, a, f1, K1, 19, 11);+	R(a, b, c, d, f1, K1, 3, 12);+	R(d, a, b, c, f1, K1, 7, 13);+	R(c, d, a, b, f1, K1, 11, 14);+	R(b, c, d, a, f1, K1, 19, 15);++	R(a, b, c, d, f2, K2, 3, 0);+	R(d, a, b, c, f2, K2, 5, 4);+	R(c, d, a, b, f2, K2, 9, 8);+	R(b, c, d, a, f2, K2, 13, 12);+	R(a, b, c, d, f2, K2, 3, 1);+	R(d, a, b, c, f2, K2, 5, 5);+	R(c, d, a, b, f2, K2, 9, 9);+	R(b, c, d, a, f2, K2, 13, 13);+	R(a, b, c, d, f2, K2, 3, 2);+	R(d, a, b, c, f2, K2, 5, 6);+	R(c, d, a, b, f2, K2, 9, 10);+	R(b, c, d, a, f2, K2, 13, 14);+	R(a, b, c, d, f2, K2, 3, 3);+	R(d, a, b, c, f2, K2, 5, 7);+	R(c, d, a, b, f2, K2, 9, 11);+	R(b, c, d, a, f2, K2, 13, 15);++	R(a, b, c, d, f3, K3, 3, 0);+	R(d, a, b, c, f3, K3, 9, 8);+	R(c, d, a, b, f3, K3, 11, 4);+	R(b, c, d, a, f3, K3, 15, 12);+	R(a, b, c, d, f3, K3, 3, 2);+	R(d, a, b, c, f3, K3, 9, 10);+	R(c, d, a, b, f3, K3, 11, 6);+	R(b, c, d, a, f3, K3, 15, 14);+	R(a, b, c, d, f3, K3, 3, 1);+	R(d, a, b, c, f3, K3, 9, 9);+	R(c, d, a, b, f3, K3, 11, 5);+	R(b, c, d, a, f3, K3, 15, 13);+	R(a, b, c, d, f3, K3, 3, 3);+	R(d, a, b, c, f3, K3, 9, 11);+	R(c, d, a, b, f3, K3, 11, 7);+	R(b, c, d, a, f3, K3, 15, 15);++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+}++void crypton_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md4_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 4)) {+		uint32_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 4);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			md4_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			md4_do_chunk(ctx, (uint32_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_md4_finalize(struct md4_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_md4_update(ctx, padding, padlen);++	/* append length */+	crypton_md4_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	store_le32(out   , ctx->h[0]);+	store_le32(out+ 4, ctx->h[1]);+	store_le32(out+ 8, ctx->h[2]);+	store_le32(out+12, ctx->h[3]);+}
+ cbits/crypton_md4.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD4_H+#define CRYPTOHASH_MD4_H++#include <stdint.h>++struct md4_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[4];+};++#define MD4_DIGEST_SIZE		16+#define MD4_CTX_SIZE		sizeof(struct md4_ctx)++void crypton_md4_init(struct md4_ctx *ctx);+void crypton_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_md4_finalize(struct md4_ctx *ctx, uint8_t *out);++#endif
+ cbits/crypton_md5.c view
@@ -0,0 +1,214 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_md5.h"++void crypton_md5_init(struct md5_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->sz = 0ULL;+	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+}++#define f1(x, y, z)	(z ^ (x & (y ^ z)))+#define f2(x, y, z)	f1(z, x, y)+#define f3(x, y, z)	(x ^ y ^ z)+#define f4(x, y, z)	(y ^ (x | ~z))+#define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b++static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, buf, 16);+#else+	uint32_t *w = buf;+#endif+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];++	R(f1, a, b, c, d, 0, 0xd76aa478, 7);+	R(f1, d, a, b, c, 1, 0xe8c7b756, 12);+	R(f1, c, d, a, b, 2, 0x242070db, 17);+	R(f1, b, c, d, a, 3, 0xc1bdceee, 22);+	R(f1, a, b, c, d, 4, 0xf57c0faf, 7);+	R(f1, d, a, b, c, 5, 0x4787c62a, 12);+	R(f1, c, d, a, b, 6, 0xa8304613, 17);+	R(f1, b, c, d, a, 7, 0xfd469501, 22);+	R(f1, a, b, c, d, 8, 0x698098d8, 7);+	R(f1, d, a, b, c, 9, 0x8b44f7af, 12);+	R(f1, c, d, a, b, 10, 0xffff5bb1, 17);+	R(f1, b, c, d, a, 11, 0x895cd7be, 22);+	R(f1, a, b, c, d, 12, 0x6b901122, 7);+	R(f1, d, a, b, c, 13, 0xfd987193, 12);+	R(f1, c, d, a, b, 14, 0xa679438e, 17);+	R(f1, b, c, d, a, 15, 0x49b40821, 22);++	R(f2, a, b, c, d, 1, 0xf61e2562, 5);+	R(f2, d, a, b, c, 6, 0xc040b340, 9);+	R(f2, c, d, a, b, 11, 0x265e5a51, 14);+	R(f2, b, c, d, a, 0, 0xe9b6c7aa, 20);+	R(f2, a, b, c, d, 5, 0xd62f105d, 5);+	R(f2, d, a, b, c, 10, 0x02441453, 9);+	R(f2, c, d, a, b, 15, 0xd8a1e681, 14);+	R(f2, b, c, d, a, 4, 0xe7d3fbc8, 20);+	R(f2, a, b, c, d, 9, 0x21e1cde6, 5);+	R(f2, d, a, b, c, 14, 0xc33707d6, 9);+	R(f2, c, d, a, b, 3, 0xf4d50d87, 14);+	R(f2, b, c, d, a, 8, 0x455a14ed, 20);+	R(f2, a, b, c, d, 13, 0xa9e3e905, 5);+	R(f2, d, a, b, c, 2, 0xfcefa3f8, 9);+	R(f2, c, d, a, b, 7, 0x676f02d9, 14);+	R(f2, b, c, d, a, 12, 0x8d2a4c8a, 20);++	R(f3, a, b, c, d, 5, 0xfffa3942, 4);+	R(f3, d, a, b, c, 8, 0x8771f681, 11);+	R(f3, c, d, a, b, 11, 0x6d9d6122, 16);+	R(f3, b, c, d, a, 14, 0xfde5380c, 23);+	R(f3, a, b, c, d, 1, 0xa4beea44, 4);+	R(f3, d, a, b, c, 4, 0x4bdecfa9, 11);+	R(f3, c, d, a, b, 7, 0xf6bb4b60, 16);+	R(f3, b, c, d, a, 10, 0xbebfbc70, 23);+	R(f3, a, b, c, d, 13, 0x289b7ec6, 4);+	R(f3, d, a, b, c, 0, 0xeaa127fa, 11);+	R(f3, c, d, a, b, 3, 0xd4ef3085, 16);+	R(f3, b, c, d, a, 6, 0x04881d05, 23);+	R(f3, a, b, c, d, 9, 0xd9d4d039, 4);+	R(f3, d, a, b, c, 12, 0xe6db99e5, 11);+	R(f3, c, d, a, b, 15, 0x1fa27cf8, 16);+	R(f3, b, c, d, a, 2, 0xc4ac5665, 23);++	R(f4, a, b, c, d, 0, 0xf4292244, 6);+	R(f4, d, a, b, c, 7, 0x432aff97, 10);+	R(f4, c, d, a, b, 14, 0xab9423a7, 15);+	R(f4, b, c, d, a, 5, 0xfc93a039, 21);+	R(f4, a, b, c, d, 12, 0x655b59c3, 6);+	R(f4, d, a, b, c, 3, 0x8f0ccc92, 10);+	R(f4, c, d, a, b, 10, 0xffeff47d, 15);+	R(f4, b, c, d, a, 1, 0x85845dd1, 21);+	R(f4, a, b, c, d, 8, 0x6fa87e4f, 6);+	R(f4, d, a, b, c, 15, 0xfe2ce6e0, 10);+	R(f4, c, d, a, b, 6, 0xa3014314, 15);+	R(f4, b, c, d, a, 13, 0x4e0811a1, 21);+	R(f4, a, b, c, d, 4, 0xf7537e82, 6);+	R(f4, d, a, b, c, 11, 0xbd3af235, 10);+	R(f4, c, d, a, b, 2, 0x2ad7d2bb, 15);+	R(f4, b, c, d, a, 9, 0xeb86d391, 21);++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+}++void crypton_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md5_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 4)) {+		uint32_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 4);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			md5_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			md5_do_chunk(ctx, (uint32_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_md5_finalize(struct md5_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_md5_update(ctx, padding, padlen);++	/* append length */+	crypton_md5_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	store_le32(out   , ctx->h[0]);+	store_le32(out+ 4, ctx->h[1]);+	store_le32(out+ 8, ctx->h[2]);+	store_le32(out+12, ctx->h[3]);+}++#define HASHED(m) MD5_##m+#define HASHED_LOWER(m) md5_##m+#define CRYPTON_HASHED(m) crypton_md5_##m+#define MD5_BLOCK_SIZE 64+#define MD5_BITS_ELEMS 1++static inline uint32_t crypton_md5_get_index(const struct md5_ctx *ctx)+{+	return (uint32_t) (ctx->sz & 0x3f);+}++static inline void crypton_md5_incr_sz(struct md5_ctx *ctx, uint64_t *bits, uint32_t n)+{+	ctx->sz += n;+	*bits = cpu_to_le64(ctx->sz << 3);+}++static inline void crypton_md5_select_digest(const struct md5_ctx *ctx, uint8_t *out, uint32_t out_mask)+{+	xor_le32(out   , ctx->h[0] & out_mask);+	xor_le32(out+ 4, ctx->h[1] & out_mask);+	xor_le32(out+ 8, ctx->h[2] & out_mask);+	xor_le32(out+12, ctx->h[3] & out_mask);+}++#include <crypton_hash_prefix.c>
+ cbits/crypton_md5.h view
@@ -0,0 +1,44 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD5_H+#define CRYPTOHASH_MD5_H++#include <stdint.h>++struct md5_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[4];+};++#define MD5_DIGEST_SIZE		16+#define MD5_CTX_SIZE		sizeof(struct md5_ctx)++void crypton_md5_init(struct md5_ctx *ctx);+void crypton_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_md5_finalize(struct md5_ctx *ctx, uint8_t *out);+void crypton_md5_finalize_prefix(struct md5_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++#endif
+ cbits/crypton_pbkdf2.c view
@@ -0,0 +1,390 @@+/*+ * fast-pbkdf2 - Optimal PBKDF2-HMAC calculation+ * Written in 2015 by Joseph Birr-Pixton <jpixton@gmail.com>+ * Ported to crypton in 2017 by Nicolas Di Prima <nicolas@primetype.co.uk>+ *+ * To the extent possible under law, the author(s) have dedicated all+ * copyright and related and neighboring rights to this software to the+ * public domain worldwide. This software is distributed without any+ * warranty.+ *+ * You should have received a copy of the CC0 Public Domain Dedication+ * along with this software. If not, see+ * <http://creativecommons.org/publicdomain/zero/1.0/>.+ */++#include <assert.h>+#include <string.h>++#include "crypton_pbkdf2.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_sha1.h"+#include "crypton_sha256.h"+#include "crypton_sha512.h"++/* --- MSVC doesn't support C99 --- */+#ifdef _MSC_VER+#define restrict+#define _Pragma __pragma+#endif++/* --- Common useful things --- */+#define MIN(a, b) ((a) > (b)) ? (b) : (a)++/* Prepare block (of blocksz bytes) to contain md padding denoting a msg-size+ * message (in bytes).  block has a prefix of used bytes.+ *+ * Message length is expressed in 32 bits (so suitable for sha1, sha256, sha512). */+static inline void md_pad(uint8_t *block, size_t blocksz, size_t used, size_t msg)+{+  memset(block + used, 0, blocksz - used - 4);+  block[used] = 0x80;+  block += blocksz - 4;+  store_be32(block, (uint32_t) (msg * 8));+}++/* Internal function/type names for hash-specific things. */+#define HMAC_CTX(_name) HMAC_ ## _name ## _ctx+#define HMAC_INIT(_name) HMAC_ ## _name ## _init+#define HMAC_UPDATE(_name) HMAC_ ## _name ## _update+#define HMAC_FINAL(_name) HMAC_ ## _name ## _final++#define PBKDF2_F(_name) pbkdf2_f_ ## _name+#define PBKDF2(_name) pbkdf2_ ## _name++/* This macro expands to decls for the whole implementation for a given+ * hash function.  Arguments are:+ *+ * _name like 'sha1', added to symbol names+ * _blocksz block size, in bytes+ * _hashsz digest output, in bytes+ * _ctx hash context type+ * _init hash context initialisation function+ *    args: (_ctx *c)+ * _update hash context update function+ *    args: (_ctx *c, const void *data, size_t ndata)+ * _final hash context finish function+ *    args: (void *out, _ctx *c)+ * _xform hash context raw block update function+ *    args: (_ctx *c, const void *data)+ * _xcpy hash context raw copy function (only need copy hash state)+ *    args: (_ctx * restrict out, const _ctx *restrict in)+ * _xtract hash context state extraction+ *    args: args (_ctx *restrict c, uint8_t *restrict out)+ * _xxor hash context xor function (only need xor hash state)+ *    args: (_ctx *restrict out, const _ctx *restrict in)+ *+ * The resulting function is named PBKDF2(_name).+ */+#define DECL_PBKDF2(_name, _blocksz, _hashsz, _ctx,                           \+                    _init, _update, _xform, _final, _xcpy, _xtract, _xxor)    \+  typedef struct {                                                            \+    _ctx inner;                                                               \+    _ctx outer;                                                               \+  } HMAC_CTX(_name);                                                          \+                                                                              \+  static inline void HMAC_INIT(_name)(HMAC_CTX(_name) *ctx,                   \+                                      const uint8_t *key, size_t nkey)        \+  {                                                                           \+    /* Prepare key: */                                                        \+    uint8_t k[_blocksz];                                                      \+                                                                              \+    /* Shorten long keys. */                                                  \+    if (nkey > _blocksz)                                                      \+    {                                                                         \+      _init(&ctx->inner);                                                     \+      _update(&ctx->inner, key, nkey);                                        \+      _final(&ctx->inner, k);                                                 \+                                                                              \+      key = k;                                                                \+      nkey = _hashsz;                                                         \+    }                                                                         \+                                                                              \+    /* Standard doesn't cover case where blocksz < hashsz. */                 \+    assert(nkey <= _blocksz);                                                 \+                                                                              \+    /* Right zero-pad short keys. */                                          \+    if (k != key)                                                             \+      memcpy(k, key, nkey);                                                   \+    if (_blocksz > nkey)                                                      \+      memset(k + nkey, 0, _blocksz - nkey);                                   \+                                                                              \+    /* Start inner hash computation */                                        \+    uint8_t blk_inner[_blocksz];                                              \+    uint8_t blk_outer[_blocksz];                                              \+                                                                              \+    for (size_t i = 0; i < _blocksz; i++)                                     \+    {                                                                         \+      blk_inner[i] = 0x36 ^ k[i];                                             \+      blk_outer[i] = 0x5c ^ k[i];                                             \+    }                                                                         \+                                                                              \+    _init(&ctx->inner);                                                       \+    _update(&ctx->inner, blk_inner, sizeof blk_inner);                        \+                                                                              \+    /* And outer. */                                                          \+    _init(&ctx->outer);                                                       \+    _update(&ctx->outer, blk_outer, sizeof blk_outer);                        \+  }                                                                           \+                                                                              \+  static inline void HMAC_UPDATE(_name)(HMAC_CTX(_name) *ctx,                 \+                                        const void *data, size_t ndata)       \+  {                                                                           \+    _update(&ctx->inner, data, ndata);                                        \+  }                                                                           \+                                                                              \+  static inline void HMAC_FINAL(_name)(HMAC_CTX(_name) *ctx,                  \+                                       uint8_t out[_hashsz])                  \+  {                                                                           \+    _final(&ctx->inner, out);                                                 \+    _update(&ctx->outer, out, _hashsz);                                       \+    _final(&ctx->outer, out);                                                 \+  }                                                                           \+                                                                              \+                                                                              \+  /* --- PBKDF2 --- */                                                        \+  static inline void PBKDF2_F(_name)(const HMAC_CTX(_name) *startctx,         \+                                     uint32_t counter,                        \+                                     const uint8_t *salt, size_t nsalt,       \+                                     uint32_t iterations,                     \+                                     uint8_t *out)                            \+  {                                                                           \+    uint8_t countbuf[4];                                                      \+    store_be32(countbuf, counter);                                            \+                                                                              \+    /* Prepare loop-invariant padding block. */                               \+    uint8_t Ublock[_blocksz];                                                 \+    md_pad(Ublock, _blocksz, _hashsz, _blocksz + _hashsz);                    \+                                                                              \+    /* First iteration:                                                       \+     *   U_1 = PRF(P, S || INT_32_BE(i))                                      \+     */                                                                       \+    HMAC_CTX(_name) ctx = *startctx;                                          \+    HMAC_UPDATE(_name)(&ctx, salt, nsalt);                                    \+    HMAC_UPDATE(_name)(&ctx, countbuf, sizeof countbuf);                      \+    HMAC_FINAL(_name)(&ctx, Ublock);                                          \+    _ctx result = ctx.outer;                                                  \+                                                                              \+    /* Subsequent iterations:                                                 \+     *   U_c = PRF(P, U_{c-1})                                                \+     */                                                                       \+    for (uint32_t i = 1; i < iterations; i++)                                 \+    {                                                                         \+      /* Complete inner hash with previous U */                               \+      _xcpy(&ctx.inner, &startctx->inner);                                    \+      _xform(&ctx.inner, Ublock);                                             \+      _xtract(&ctx.inner, Ublock);                                            \+      /* Complete outer hash with inner output */                             \+      _xcpy(&ctx.outer, &startctx->outer);                                    \+      _xform(&ctx.outer, Ublock);                                             \+      _xtract(&ctx.outer, Ublock);                                            \+      _xxor(&result, &ctx.outer);                                             \+    }                                                                         \+                                                                              \+    /* Reform result into output buffer. */                                   \+    _xtract(&result, out);                                                    \+  }                                                                           \+                                                                              \+  static inline void PBKDF2(_name)(const uint8_t *pw, size_t npw,             \+                     const uint8_t *salt, size_t nsalt,                       \+                     uint32_t iterations,                                     \+                     uint8_t *out, size_t nout)                               \+  {                                                                           \+    assert(iterations);                                                       \+    assert(out && nout);                                                      \+                                                                              \+    /* Starting point for inner loop. */                                      \+    HMAC_CTX(_name) ctx;                                                      \+    HMAC_INIT(_name)(&ctx, pw, npw);                                          \+                                                                              \+    /* How many blocks do we need? */                                         \+    uint32_t blocks_needed = (uint32_t)(nout + _hashsz - 1) / _hashsz;        \+                                                                              \+    for (uint32_t counter = 1; counter <= blocks_needed; counter++)           \+    {                                                                         \+      uint8_t block[_hashsz];                                                 \+      PBKDF2_F(_name)(&ctx, counter, salt, nsalt, iterations, block);         \+                                                                              \+      size_t offset = (counter - 1) * _hashsz;                                \+      size_t taken = MIN(nout - offset, _hashsz);                             \+      memcpy(out + offset, block, taken);                                     \+    }                                                                         \+  }++static inline void sha1_extract(struct sha1_ctx *restrict ctx, uint8_t *restrict out)+{+	store_be32(out   , ctx->h[0]);+	store_be32(out+4 , ctx->h[1]);+	store_be32(out+8 , ctx->h[2]);+	store_be32(out+12, ctx->h[3]);+	store_be32(out+16, ctx->h[4]);+}++static inline void sha1_cpy(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)+{+  out->h[0] = in->h[0];+  out->h[1] = in->h[1];+  out->h[2] = in->h[2];+  out->h[3] = in->h[3];+  out->h[4] = in->h[4];+}++static inline void sha1_xor(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)+{+  out->h[0] ^= in->h[0];+  out->h[1] ^= in->h[1];+  out->h[2] ^= in->h[2];+  out->h[3] ^= in->h[3];+  out->h[4] ^= in->h[4];+}++void crypton_sha1_transform(struct sha1_ctx* ctx, uint8_t block[SHA1_BLOCK_SIZE])+{+  crypton_sha1_update(ctx, block, SHA1_BLOCK_SIZE);+}++DECL_PBKDF2(sha1,+            SHA1_BLOCK_SIZE,+            SHA1_DIGEST_SIZE,+            struct sha1_ctx,+            crypton_sha1_init,+            crypton_sha1_update,+            crypton_sha1_transform,+            crypton_sha1_finalize,+            sha1_cpy,+            sha1_extract,+            sha1_xor);++static inline void sha256_extract(struct sha256_ctx *restrict ctx, uint8_t *restrict out)+{+	store_be32(out   , ctx->h[0]);+	store_be32(out+4 , ctx->h[1]);+	store_be32(out+8 , ctx->h[2]);+	store_be32(out+12, ctx->h[3]);+	store_be32(out+16, ctx->h[4]);+	store_be32(out+20, ctx->h[5]);+	store_be32(out+24, ctx->h[6]);+	store_be32(out+28, ctx->h[7]);+}++static inline void sha256_cpy(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)+{+	out->h[0] = in->h[0];+	out->h[1] = in->h[1];+	out->h[2] = in->h[2];+	out->h[3] = in->h[3];+	out->h[4] = in->h[4];+	out->h[5] = in->h[5];+	out->h[6] = in->h[6];+	out->h[7] = in->h[7];+}++static inline void sha256_xor(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)+{+	out->h[0] ^= in->h[0];+	out->h[1] ^= in->h[1];+	out->h[2] ^= in->h[2];+	out->h[3] ^= in->h[3];+	out->h[4] ^= in->h[4];+	out->h[5] ^= in->h[5];+	out->h[6] ^= in->h[6];+	out->h[7] ^= in->h[7];+}++void crypton_sha256_transform(struct sha256_ctx* ctx, uint8_t block[SHA256_BLOCK_SIZE])+{+  crypton_sha256_update(ctx, block, SHA256_BLOCK_SIZE);+}++DECL_PBKDF2(sha256,+            SHA256_BLOCK_SIZE,+            SHA256_DIGEST_SIZE,+            struct sha256_ctx,+            crypton_sha256_init,+            crypton_sha256_update,+            crypton_sha256_transform,+            crypton_sha256_finalize,+            sha256_cpy,+            sha256_extract,+            sha256_xor);++static inline void sha512_extract(struct sha512_ctx *restrict ctx, uint8_t *restrict out)+{+	store_be64(out   , ctx->h[0]);+	store_be64(out+8 , ctx->h[1]);+	store_be64(out+16, ctx->h[2]);+	store_be64(out+24, ctx->h[3]);+	store_be64(out+32, ctx->h[4]);+	store_be64(out+40, ctx->h[5]);+	store_be64(out+48, ctx->h[6]);+	store_be64(out+56, ctx->h[7]);+}++static inline void sha512_cpy(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)+{+	out->h[0] = in->h[0];+	out->h[1] = in->h[1];+	out->h[2] = in->h[2];+	out->h[3] = in->h[3];+	out->h[4] = in->h[4];+	out->h[5] = in->h[5];+	out->h[6] = in->h[6];+	out->h[7] = in->h[7];+}++static inline void sha512_xor(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)+{+	out->h[0] ^= in->h[0];+	out->h[1] ^= in->h[1];+	out->h[2] ^= in->h[2];+	out->h[3] ^= in->h[3];+	out->h[4] ^= in->h[4];+	out->h[5] ^= in->h[5];+	out->h[6] ^= in->h[6];+	out->h[7] ^= in->h[7];+}++void crypton_sha512_transform(struct sha512_ctx* ctx, uint8_t block[SHA512_BLOCK_SIZE])+{+	crypton_sha512_update(ctx, block, SHA512_BLOCK_SIZE);+}++DECL_PBKDF2(sha512,+            SHA512_BLOCK_SIZE,+            SHA512_DIGEST_SIZE,+            struct sha512_ctx,+            crypton_sha512_init,+            crypton_sha512_update,+            crypton_sha512_transform,+            crypton_sha512_finalize,+            sha512_cpy,+            sha512_extract,+            sha512_xor);++void crypton_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw+                                    , const uint8_t *salt, size_t nsalt+                                    , uint32_t iterations+                                    , uint8_t *out, size_t nout+                                    )+{+  PBKDF2(sha1)(pw, npw, salt, nsalt, iterations, out, nout);+}++void crypton_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw+                                      , const uint8_t *salt, size_t nsalt+                                      , uint32_t iterations+                                      , uint8_t *out, size_t nout+                                      )+{+  PBKDF2(sha256)(pw, npw, salt, nsalt, iterations, out, nout);+}++void crypton_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw+                                      , const uint8_t *salt, size_t nsalt+                                      , uint32_t iterations+                                      , uint8_t *out, size_t nout+                                      )+{+  PBKDF2(sha512)(pw, npw, salt, nsalt, iterations, out, nout);+}
+ cbits/crypton_pbkdf2.h view
@@ -0,0 +1,31 @@+#ifndef CRYPTON_PBKDF2_H_+#define CRYPTON_PBKDF2_H_++#include <stdlib.h>+#include <stdint.h>++#ifdef __cplusplus+extern "C" {+#endif++void crypton_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw+                                    , const uint8_t *salt, size_t nsalt+                                    , uint32_t iterations+                                    , uint8_t *out, size_t nout+                                    );+void crypton_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw+                                      , const uint8_t *salt, size_t nsalt+                                      , uint32_t iterations+                                      , uint8_t *out, size_t nout+                                      );+void crypton_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw+                                      , const uint8_t *salt, size_t nsalt+                                      , uint32_t iterations+                                      , uint8_t *out, size_t nout+                                      );++#ifdef __cplusplus+}+#endif++#endif
+ cbits/crypton_poly1305.c view
@@ -0,0 +1,203 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ * The following code contains some code copied from and inspired by poly1305-donna+ * in poly1305_do_chunk and poly1305_finalize which is licensed under MIT or PUBLIC DOMAIN.+ * see [poly1305-donna](https://github.com/floodyberry/poly1305-donna)+ *+ */++#include <stdint.h>+#include <string.h>+#include "crypton_poly1305.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final)+{+	/* following is a cleanup copy of code available poly1305-donna */+	const uint32_t hibit = (final) ? 0 : (1 << 24); /* 1 << 128 */+	uint32_t r0,r1,r2,r3,r4;+	uint32_t s1,s2,s3,s4;+	uint32_t h0,h1,h2,h3,h4;+	uint64_t d0,d1,d2,d3,d4;+	uint32_t c;++	/* load r[i], h[i] */+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];+	r0 = ctx->r[0]; r1 = ctx->r[1]; r2 = ctx->r[2]; r3 = ctx->r[3]; r4 = ctx->r[4];++	/* s[i] = r[i] * 5 */+	s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5;++	while (blocks--) {+		h0 += (load_le32(data+ 0)     ) & 0x3ffffff;+		h1 += (load_le32(data+ 3) >> 2) & 0x3ffffff;+		h2 += (load_le32(data+ 6) >> 4) & 0x3ffffff;+		h3 += (load_le32(data+ 9) >> 6) & 0x3ffffff;+		h4 += (load_le32(data+12) >> 8) | hibit;++		d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1);+		d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2);+		d2 = ((uint64_t)h0 * r2) + ((uint64_t)h1 * r1) + ((uint64_t)h2 * r0) + ((uint64_t)h3 * s4) + ((uint64_t)h4 * s3);+		d3 = ((uint64_t)h0 * r3) + ((uint64_t)h1 * r2) + ((uint64_t)h2 * r1) + ((uint64_t)h3 * r0) + ((uint64_t)h4 * s4);+		d4 = ((uint64_t)h0 * r4) + ((uint64_t)h1 * r3) + ((uint64_t)h2 * r2) + ((uint64_t)h3 * r1) + ((uint64_t)h4 * r0);++		c = (uint32_t)(d0 >> 26); h0 = (uint32_t)d0 & 0x3ffffff;+		d1 += c;      c = (uint32_t)(d1 >> 26); h1 = (uint32_t)d1 & 0x3ffffff;+		d2 += c;      c = (uint32_t)(d2 >> 26); h2 = (uint32_t)d2 & 0x3ffffff;+		d3 += c;      c = (uint32_t)(d3 >> 26); h3 = (uint32_t)d3 & 0x3ffffff;+		d4 += c;      c = (uint32_t)(d4 >> 26); h4 = (uint32_t)d4 & 0x3ffffff;+		h0 += c * 5;  c =           (h0 >> 26); h0 = h0 & 0x3ffffff;+		h1 += c;++		data += 16;+	}++	/* store h[i] */+	ctx->h[0] = h0; ctx->h[1] = h1; ctx->h[2] = h2; ctx->h[3] = h3; ctx->h[4] = h4;+}++void crypton_poly1305_init(poly1305_ctx *ctx, poly1305_key *key)+{+	uint8_t *k = (uint8_t *) key;++	memset(ctx, 0, sizeof(poly1305_ctx));++	ctx->r[0] = (load_le32(&k[ 0])     ) & 0x3ffffff;+	ctx->r[1] = (load_le32(&k[ 3]) >> 2) & 0x3ffff03;+	ctx->r[2] = (load_le32(&k[ 6]) >> 4) & 0x3ffc0ff;+	ctx->r[3] = (load_le32(&k[ 9]) >> 6) & 0x3f03fff;+	ctx->r[4] = (load_le32(&k[12]) >> 8) & 0x00fffff;++	ctx->pad[0] = load_le32(&k[16]);+	ctx->pad[1] = load_le32(&k[20]);+	ctx->pad[2] = load_le32(&k[24]);+	ctx->pad[3] = load_le32(&k[28]);++	ctx->index = 0;+}++void crypton_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length)+{+	uint32_t to_fill, nb_blocks_bytes;++	to_fill = 16 - ctx->index;++	/* process partial buffer if there's enough data to make a block */+	if (ctx->index && length >= to_fill) {+		memcpy(ctx->buf + ctx->index, data, to_fill);+		poly1305_do_chunk(ctx, ctx->buf, 1, 0);+		ctx->index = 0;+		length -= to_fill;+		data += to_fill;+	}++	/* process as much 16-block as possible */+	nb_blocks_bytes = length & ~(16 - 1);+	poly1305_do_chunk(ctx, data, nb_blocks_bytes >> 4, 0);+	data += nb_blocks_bytes;+	length &= 0xf;++	/* fill the remaining bytes in the partial buffer */+	if (length) {+		memcpy(ctx->buf + ctx->index, data, length);+		ctx->index += length;+	}+}++void crypton_poly1305_finalize(poly1305_mac mac8, poly1305_ctx *ctx)+{+	uint32_t h0,h1,h2,h3,h4,c;+	uint32_t g0,g1,g2,g3,g4;+	uint64_t f;+	uint32_t mask;+	uint32_t *mac = (uint32_t *) mac8;+	int i;++	if (ctx->index) {+		/* append partial final buffer with 10* then process */+		ctx->buf[ctx->index] = 0x1;+		for (i = ctx->index + 1; i < 16; i++)+			ctx->buf[i] = 0x0;+		poly1305_do_chunk(ctx, ctx->buf, 1, 1);+	}++	/* following is a cleanup copy of code available poly1305-donna */++	/* fully carry h */+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];++	             c = h1 >> 26; h1 = h1 & 0x3ffffff;+	h2 +=     c; c = h2 >> 26; h2 = h2 & 0x3ffffff;+	h3 +=     c; c = h3 >> 26; h3 = h3 & 0x3ffffff;+	h4 +=     c; c = h4 >> 26; h4 = h4 & 0x3ffffff;+	h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;+	h1 +=     c;++	/* compute h + -p */+	g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;+	g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;+	g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;+	g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;+	g4 = h4 + c - (1 << 26);++	/* select h if h < p, or h + -p if h >= p */+	mask = (g4 >> ((sizeof(uint32_t) * 8) - 1)) - 1;+	g0 &= mask;+	g1 &= mask;+	g2 &= mask;+	g3 &= mask;+	g4 &= mask;+	mask = ~mask;+	h0 = (h0 & mask) | g0;+	h1 = (h1 & mask) | g1;+	h2 = (h2 & mask) | g2;+	h3 = (h3 & mask) | g3;+	h4 = (h4 & mask) | g4;++	/* h = h % (2^128) */+	h0 = ((h0      ) | (h1 << 26)) & 0xffffffff;+	h1 = ((h1 >>  6) | (h2 << 20)) & 0xffffffff;+	h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;+	h3 = ((h3 >> 18) | (h4 <<  8)) & 0xffffffff;++	/* mac = (h + pad) % (2^128) */+	f = (uint64_t)h0 + ctx->pad[0];+	mac[0] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h1 + ctx->pad[1] + (f >> 32);+	mac[1] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h2 + ctx->pad[2] + (f >> 32);+	mac[2] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h3 + ctx->pad[3] + (f >> 32);+	mac[3] = cpu_to_le32((uint32_t) f);+}
+ cbits/crypton_poly1305.h view
@@ -0,0 +1,50 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTON_POLY1305_H+# define CRYPTON_POLY1305_H++/* 8*8+1*16+1*4 = 84 */+typedef struct+{+	uint32_t r[5];+	uint32_t h[5];+	uint32_t pad[4];+	uint32_t index;+	uint8_t buf[16]; /* previous partial block */+} poly1305_ctx;++typedef uint8_t poly1305_mac[16];+typedef uint8_t poly1305_key[32];++void crypton_poly1305_init(poly1305_ctx *ctx, poly1305_key *key);+void crypton_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length);+void crypton_poly1305_finalize(poly1305_mac mac, poly1305_ctx *ctx);++#endif
+ cbits/crypton_rc4.c view
@@ -0,0 +1,63 @@+/* initial implementation by+ *   Peter White <peter@janrain.com>+ */++/* C Standard includes */+#include <stdlib.h>+#include <stdio.h>+#include <string.h>+#include <stdint.h>++/* Local include */+#include "crypton_rc4.h"++/* Swap array elements i=State[i] and b=State[j]. */+static void swap(uint8_t *i, uint8_t *j)+{+	uint8_t temp;++	temp = *i;+	*i = *j;+	*j = temp;+}++/* Key scheduling algorithm. Swap array elements based on the key. */+void crypton_rc4_init(uint8_t *key, uint32_t keylen, struct rc4_ctx *ctx)+{+	uint32_t i, j;+	memset(ctx, 0, sizeof(struct rc4_ctx));++	/* initialize context */+	for (i = 0; i < 256; i++)+		ctx->state[i] = i;+	for (i = j = 0; i < 256; i++) {+		j = (j + ctx->state[i] + key[i % keylen]) % 256;+		swap(&ctx->state[i], &ctx->state[j]);+	}+}++/* Combine the stream generated by the rc4 with some input */+void crypton_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output)+{+	uint32_t i = ctx->i;+	uint32_t j = ctx->j;+	uint32_t m;+	uint8_t si, sj;++	/* The RC4 algorithm */+	for (m = 0; m < len; m++) {+		i = (i + 1) & 0xff;+		si = ctx->state[i];+		j = (j + si) & 0xff;+		sj = ctx->state[j];+		/* swap(&state[i], &state[j]); */+		ctx->state[i] = sj;+		ctx->state[j] = si;+		/* Xor the key stream value into the input */+		*output++ = *input++ ^ (ctx->state[(si + sj) & 0xff]);+	}++	/* Output new S-box indices */+	ctx->i = i;+	ctx->j = j;+}
+ cbits/crypton_rc4.h view
@@ -0,0 +1,14 @@+#ifndef CRYPTON_RC4_H+# define CRYPTON_RC4_H++struct rc4_ctx+{+	uint8_t state[256];+	uint32_t i;+	uint32_t j;+};++void crypton_rc4_init(uint8_t * key, uint32_t keylen, struct rc4_ctx *ctx);+void crypton_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output);++#endif
+ cbits/crypton_rdrand.c view
@@ -0,0 +1,126 @@+/*+ * Copyright (C) Thomas DuBuisson+ * Copyright (C) 2013 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <stdlib.h>+#include <stdio.h>+#include <string.h>++int crypton_cpu_has_rdrand()+{+	uint32_t ax,bx,cx,dx,func=1;+#if defined(__PIC__) && defined(__i386__)+	__asm__ volatile ("mov %%ebx, %%edi;" "cpuid;" "xchgl %%ebx, %%edi;"+		: "=a" (ax), "=D" (bx), "=c" (cx), "=d" (dx) : "a" (func));+#else+	__asm__ volatile ("cpuid": "=a" (ax), "=b" (bx), "=c" (cx), "=d" (dx) : "a" (func));+#endif+	return (cx & 0x40000000);+}++/* inline encoding of 'rdrand %rax' to cover old binutils+ * - no inputs+ * - 'cc' to the clobber list as we modify condition code.+ * - output of rdrand in rax and have a 8 bit error condition+ */+#define inline_rdrand_rax(val, err) \+	asm(".byte 0x48,0x0f,0xc7,0xf0; setc %1" \+	   : "=a" (val), "=q" (err) \+	   : \+	   : "cc")++/* inline encoding of 'rdrand %eax' to cover old binutils+ * - no inputs+ * - 'cc' to the clobber list as we modify condition code.+ * - output of rdrand in eax and have a 8 bit error condition+ */+#define inline_rdrand_eax(val, err) \+	asm(".byte 0x0f,0xc7,0xf0; setc %1" \+	   : "=a" (val), "=q" (err) \+	   : \+	   : "cc")++#ifdef __x86_64__+# define RDRAND_SZ 8+# define RDRAND_T  uint64_t+#define inline_rdrand(val, err) err = crypton_rdrand_step(&val)+#else+# define RDRAND_SZ 4+# define RDRAND_T  uint32_t+#define inline_rdrand(val, err) err = crypton_rdrand_step(&val)+#endif++/* sadly many people are still using an old binutils,+ * leading to report that instruction is not recognized.+ */+#if 1+/* Returns 1 on success */+static inline int crypton_rdrand_step(RDRAND_T *buffer)+{+	unsigned char err;+	asm volatile ("rdrand %0; setc %1" : "=r" (*buffer), "=qm" (err));+	return (int) err;+}+#endif++/* Returns the number of bytes successfully generated */+int crypton_get_rand_bytes(uint8_t *buffer, size_t len)+{+	RDRAND_T tmp;+	int aligned = (intptr_t) buffer % RDRAND_SZ;+	int orig_len = len;+	int to_alignment = RDRAND_SZ - aligned;+	uint8_t ok;++	if (aligned != 0) {+		inline_rdrand(tmp, ok);+		if (!ok)+			return 0;+		memcpy(buffer, (uint8_t *) &tmp, to_alignment);+		buffer += to_alignment;+		len -= to_alignment;+	}++	for (; len >= RDRAND_SZ; buffer += RDRAND_SZ, len -= RDRAND_SZ) {+		inline_rdrand(tmp, ok);+		if (!ok)+			return (orig_len - len);+		*((RDRAND_T *) buffer) = tmp;+	}++	if (len > 0) {+		inline_rdrand(tmp, ok);+		if (!ok)+			return (orig_len - len);+		memcpy(buffer, (uint8_t *) &tmp, len);+	}+	return orig_len;+}
+ cbits/crypton_ripemd.c view
@@ -0,0 +1,310 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include "crypton_ripemd.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include <string.h>++void crypton_ripemd160_init(struct ripemd160_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+	ctx->h[4] = 0xc3d2e1f0;+}++#define K1  0x00000000+#define K2  0x5a827999+#define K3  0x6ed9eba1+#define K4  0x8f1bbcdc+#define K5  0xa953fd4e+#define K6  0x50a28be6+#define K7  0x5c4dd124+#define K8  0x6d703ef3+#define K9  0x7a6d76e9++#define f1(x, y, z) (x ^ y ^ z)+#define f2(x, y, z) (z ^ (x & (y ^ z)))+#define f3(x, y, z) ((x | ~y) ^ z)+#define f4(x, y, z) (y ^ (z & (x ^ y)))+#define f5(x, y, z) (x ^ (y | ~z))++#define R(a, b, c, d, e, f, k, i, s)	\+	a += f(b, c, d) + w[i] + k; a = rol32(a, s) + e; c = rol32(c, 10)++static void ripemd160_do_chunk(struct ripemd160_ctx *ctx, uint32_t *buf)+{+	uint32_t a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, buf, 16);+#else+	uint32_t *w = buf;+#endif++	a1 = ctx->h[0]; b1 = ctx->h[1]; c1 = ctx->h[2]; d1 = ctx->h[3]; e1 = ctx->h[4];+	a2 = ctx->h[0]; b2 = ctx->h[1]; c2 = ctx->h[2]; d2 = ctx->h[3]; e2 = ctx->h[4];++	/* 5 passes on first state copy */+	R(a1, b1, c1, d1, e1, f1, K1, 0, 11);+	R(e1, a1, b1, c1, d1, f1, K1, 1, 14);+	R(d1, e1, a1, b1, c1, f1, K1, 2, 15);+	R(c1, d1, e1, a1, b1, f1, K1, 3, 12);+	R(b1, c1, d1, e1, a1, f1, K1, 4, 5);+	R(a1, b1, c1, d1, e1, f1, K1, 5, 8);+	R(e1, a1, b1, c1, d1, f1, K1, 6, 7);+	R(d1, e1, a1, b1, c1, f1, K1, 7, 9);+	R(c1, d1, e1, a1, b1, f1, K1, 8, 11);+	R(b1, c1, d1, e1, a1, f1, K1, 9, 13);+	R(a1, b1, c1, d1, e1, f1, K1, 10, 14);+	R(e1, a1, b1, c1, d1, f1, K1, 11, 15);+	R(d1, e1, a1, b1, c1, f1, K1, 12, 6);+	R(c1, d1, e1, a1, b1, f1, K1, 13, 7);+	R(b1, c1, d1, e1, a1, f1, K1, 14, 9);+	R(a1, b1, c1, d1, e1, f1, K1, 15, 8);+	+	R(e1, a1, b1, c1, d1, f2, K2, 7, 7);+	R(d1, e1, a1, b1, c1, f2, K2, 4, 6);+	R(c1, d1, e1, a1, b1, f2, K2, 13, 8);+	R(b1, c1, d1, e1, a1, f2, K2, 1, 13);+	R(a1, b1, c1, d1, e1, f2, K2, 10, 11);+	R(e1, a1, b1, c1, d1, f2, K2, 6, 9);+	R(d1, e1, a1, b1, c1, f2, K2, 15, 7);+	R(c1, d1, e1, a1, b1, f2, K2, 3, 15);+	R(b1, c1, d1, e1, a1, f2, K2, 12, 7);+	R(a1, b1, c1, d1, e1, f2, K2, 0, 12);+	R(e1, a1, b1, c1, d1, f2, K2, 9, 15);+	R(d1, e1, a1, b1, c1, f2, K2, 5, 9);+	R(c1, d1, e1, a1, b1, f2, K2, 2, 11);+	R(b1, c1, d1, e1, a1, f2, K2, 14, 7);+	R(a1, b1, c1, d1, e1, f2, K2, 11, 13);+	R(e1, a1, b1, c1, d1, f2, K2, 8, 12);++	R(d1, e1, a1, b1, c1, f3, K3, 3, 11);+	R(c1, d1, e1, a1, b1, f3, K3, 10, 13);+	R(b1, c1, d1, e1, a1, f3, K3, 14, 6);+	R(a1, b1, c1, d1, e1, f3, K3, 4, 7);+	R(e1, a1, b1, c1, d1, f3, K3, 9, 14);+	R(d1, e1, a1, b1, c1, f3, K3, 15, 9);+	R(c1, d1, e1, a1, b1, f3, K3, 8, 13);+	R(b1, c1, d1, e1, a1, f3, K3, 1, 15);+	R(a1, b1, c1, d1, e1, f3, K3, 2, 14);+	R(e1, a1, b1, c1, d1, f3, K3, 7, 8);+	R(d1, e1, a1, b1, c1, f3, K3, 0, 13);+	R(c1, d1, e1, a1, b1, f3, K3, 6, 6);+	R(b1, c1, d1, e1, a1, f3, K3, 13, 5);+	R(a1, b1, c1, d1, e1, f3, K3, 11, 12);+	R(e1, a1, b1, c1, d1, f3, K3, 5, 7);+	R(d1, e1, a1, b1, c1, f3, K3, 12, 5);++	R(c1, d1, e1, a1, b1, f4, K4, 1, 11);+	R(b1, c1, d1, e1, a1, f4, K4, 9, 12);+	R(a1, b1, c1, d1, e1, f4, K4, 11, 14);+	R(e1, a1, b1, c1, d1, f4, K4, 10, 15);+	R(d1, e1, a1, b1, c1, f4, K4, 0, 14);+	R(c1, d1, e1, a1, b1, f4, K4, 8, 15);+	R(b1, c1, d1, e1, a1, f4, K4, 12, 9);+	R(a1, b1, c1, d1, e1, f4, K4, 4, 8);+	R(e1, a1, b1, c1, d1, f4, K4, 13, 9);+	R(d1, e1, a1, b1, c1, f4, K4, 3, 14);+	R(c1, d1, e1, a1, b1, f4, K4, 7, 5);+	R(b1, c1, d1, e1, a1, f4, K4, 15, 6);+	R(a1, b1, c1, d1, e1, f4, K4, 14, 8);+	R(e1, a1, b1, c1, d1, f4, K4, 5, 6);+	R(d1, e1, a1, b1, c1, f4, K4, 6, 5);+	R(c1, d1, e1, a1, b1, f4, K4, 2, 12);++	R(b1, c1, d1, e1, a1, f5, K5, 4, 9);+	R(a1, b1, c1, d1, e1, f5, K5, 0, 15);+	R(e1, a1, b1, c1, d1, f5, K5, 5, 5);+	R(d1, e1, a1, b1, c1, f5, K5, 9, 11);+	R(c1, d1, e1, a1, b1, f5, K5, 7, 6);+	R(b1, c1, d1, e1, a1, f5, K5, 12, 8);+	R(a1, b1, c1, d1, e1, f5, K5, 2, 13);+	R(e1, a1, b1, c1, d1, f5, K5, 10, 12);+	R(d1, e1, a1, b1, c1, f5, K5, 14, 5);+	R(c1, d1, e1, a1, b1, f5, K5, 1, 12);+	R(b1, c1, d1, e1, a1, f5, K5, 3, 13);+	R(a1, b1, c1, d1, e1, f5, K5, 8, 14);+	R(e1, a1, b1, c1, d1, f5, K5, 11, 11);+	R(d1, e1, a1, b1, c1, f5, K5, 6, 8);+	R(c1, d1, e1, a1, b1, f5, K5, 15, 5);+	R(b1, c1, d1, e1, a1, f5, K5, 13, 6);++	/* 5 passes on second state copy */+	R(a2, b2, c2, d2, e2, f5, K6, 5, 8);+	R(e2, a2, b2, c2, d2, f5, K6, 14, 9);+	R(d2, e2, a2, b2, c2, f5, K6, 7, 9);+	R(c2, d2, e2, a2, b2, f5, K6, 0, 11);+	R(b2, c2, d2, e2, a2, f5, K6, 9, 13);+	R(a2, b2, c2, d2, e2, f5, K6, 2, 15);+	R(e2, a2, b2, c2, d2, f5, K6, 11, 15);+	R(d2, e2, a2, b2, c2, f5, K6, 4, 5);+	R(c2, d2, e2, a2, b2, f5, K6, 13, 7);+	R(b2, c2, d2, e2, a2, f5, K6, 6, 7);+	R(a2, b2, c2, d2, e2, f5, K6, 15, 8);+	R(e2, a2, b2, c2, d2, f5, K6, 8, 11);+	R(d2, e2, a2, b2, c2, f5, K6, 1, 14);+	R(c2, d2, e2, a2, b2, f5, K6, 10, 14);+	R(b2, c2, d2, e2, a2, f5, K6, 3, 12);+	R(a2, b2, c2, d2, e2, f5, K6, 12, 6);++	R(e2, a2, b2, c2, d2, f4, K7, 6, 9);+	R(d2, e2, a2, b2, c2, f4, K7, 11, 13);+	R(c2, d2, e2, a2, b2, f4, K7, 3, 15);+	R(b2, c2, d2, e2, a2, f4, K7, 7, 7);+	R(a2, b2, c2, d2, e2, f4, K7, 0, 12);+	R(e2, a2, b2, c2, d2, f4, K7, 13, 8);+	R(d2, e2, a2, b2, c2, f4, K7, 5, 9);+	R(c2, d2, e2, a2, b2, f4, K7, 10, 11);+	R(b2, c2, d2, e2, a2, f4, K7, 14, 7);+	R(a2, b2, c2, d2, e2, f4, K7, 15, 7);+	R(e2, a2, b2, c2, d2, f4, K7, 8, 12);+	R(d2, e2, a2, b2, c2, f4, K7, 12, 7);+	R(c2, d2, e2, a2, b2, f4, K7, 4, 6);+	R(b2, c2, d2, e2, a2, f4, K7, 9, 15);+	R(a2, b2, c2, d2, e2, f4, K7, 1, 13);+	R(e2, a2, b2, c2, d2, f4, K7, 2, 11);++	R(d2, e2, a2, b2, c2, f3, K8, 15, 9);+	R(c2, d2, e2, a2, b2, f3, K8, 5, 7);+	R(b2, c2, d2, e2, a2, f3, K8, 1, 15);+	R(a2, b2, c2, d2, e2, f3, K8, 3, 11);+	R(e2, a2, b2, c2, d2, f3, K8, 7, 8);+	R(d2, e2, a2, b2, c2, f3, K8, 14, 6);+	R(c2, d2, e2, a2, b2, f3, K8, 6, 6);+	R(b2, c2, d2, e2, a2, f3, K8, 9, 14);+	R(a2, b2, c2, d2, e2, f3, K8, 11, 12);+	R(e2, a2, b2, c2, d2, f3, K8, 8, 13);+	R(d2, e2, a2, b2, c2, f3, K8, 12, 5);+	R(c2, d2, e2, a2, b2, f3, K8, 2, 14);+	R(b2, c2, d2, e2, a2, f3, K8, 10, 13);+	R(a2, b2, c2, d2, e2, f3, K8, 0, 13);+	R(e2, a2, b2, c2, d2, f3, K8, 4, 7);+	R(d2, e2, a2, b2, c2, f3, K8, 13, 5);++	R(c2, d2, e2, a2, b2, f2, K9, 8, 15);+	R(b2, c2, d2, e2, a2, f2, K9, 6, 5);+	R(a2, b2, c2, d2, e2, f2, K9, 4, 8);+	R(e2, a2, b2, c2, d2, f2, K9, 1, 11);+	R(d2, e2, a2, b2, c2, f2, K9, 3, 14);+	R(c2, d2, e2, a2, b2, f2, K9, 11, 14);+	R(b2, c2, d2, e2, a2, f2, K9, 15, 6);+	R(a2, b2, c2, d2, e2, f2, K9, 0, 14);+	R(e2, a2, b2, c2, d2, f2, K9, 5, 6);+	R(d2, e2, a2, b2, c2, f2, K9, 12, 9);+	R(c2, d2, e2, a2, b2, f2, K9, 2, 12);+	R(b2, c2, d2, e2, a2, f2, K9, 13, 9);+	R(a2, b2, c2, d2, e2, f2, K9, 9, 12);+	R(e2, a2, b2, c2, d2, f2, K9, 7, 5);+	R(d2, e2, a2, b2, c2, f2, K9, 10, 15);+	R(c2, d2, e2, a2, b2, f2, K9, 14, 8);++	R(b2, c2, d2, e2, a2, f1, K1, 12, 8);+	R(a2, b2, c2, d2, e2, f1, K1, 15, 5);+	R(e2, a2, b2, c2, d2, f1, K1, 10, 12);+	R(d2, e2, a2, b2, c2, f1, K1, 4, 9);+	R(c2, d2, e2, a2, b2, f1, K1, 1, 12);+	R(b2, c2, d2, e2, a2, f1, K1, 5, 5);+	R(a2, b2, c2, d2, e2, f1, K1, 8, 14);+	R(e2, a2, b2, c2, d2, f1, K1, 7, 6);+	R(d2, e2, a2, b2, c2, f1, K1, 6, 8);+	R(c2, d2, e2, a2, b2, f1, K1, 2, 13);+	R(b2, c2, d2, e2, a2, f1, K1, 13, 6);+	R(a2, b2, c2, d2, e2, f1, K1, 14, 5);+	R(e2, a2, b2, c2, d2, f1, K1, 0, 15);+	R(d2, e2, a2, b2, c2, f1, K1, 3, 13);+	R(c2, d2, e2, a2, b2, f1, K1, 9, 11);+	R(b2, c2, d2, e2, a2, f1, K1, 11, 11);++	d2 += c1 + ctx->h[1];+	ctx->h[1] = ctx->h[2] + d1 + e2;+	ctx->h[2] = ctx->h[3] + e1 + a2;+	ctx->h[3] = ctx->h[4] + a1 + b2;+	ctx->h[4] = ctx->h[0] + b1 + c2;+	ctx->h[0] = d2;+}++void crypton_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		ripemd160_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 4)) {+		uint32_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 4);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			ripemd160_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			ripemd160_do_chunk(ctx, (uint32_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_ripemd160_update(ctx, padding, padlen);++	/* append length */+	crypton_ripemd160_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output digest */+	store_le32(out   , ctx->h[0]);+	store_le32(out+ 4, ctx->h[1]);+	store_le32(out+ 8, ctx->h[2]);+	store_le32(out+12, ctx->h[3]);+	store_le32(out+16, ctx->h[4]);+}
+ cbits/crypton_ripemd.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_RIPEMD_H+#define CRYPTOHASH_RIPEMD_H++#include <stdint.h>++struct ripemd160_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[5];+};++#define RIPEMD160_DIGEST_SIZE	20+#define RIPEMD160_CTX_SIZE	sizeof(struct ripemd160_ctx)++void crypton_ripemd160_init(struct ripemd160_ctx *ctx);+void crypton_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out);++#endif
+ cbits/crypton_salsa.c view
@@ -0,0 +1,292 @@+/*+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include <stdio.h>+#include "crypton_salsa.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++static const uint8_t sigma[16] = "expand 32-byte k";+static const uint8_t tau[16] = "expand 16-byte k";++#define QR(a,b,c,d) \+	b ^= rol32(a+d, 7); \+	c ^= rol32(b+a, 9); \+	d ^= rol32(c+b, 13); \+	a ^= rol32(d+c, 18);++#define ALIGNED64(PTR) \+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)++#define SALSA_CORE_LOOP \+	for (i = rounds; i > 0; i -= 2) { \+		QR (x0,x4,x8,x12); \+		QR (x5,x9,x13,x1); \+		QR (x10,x14,x2,x6); \+		QR (x15,x3,x7,x11); \+		QR (x0,x1,x2,x3); \+		QR (x5,x6,x7,x4); \+		QR (x10,x11,x8,x9); \+		QR (x15,x12,x13,x14); \+	}++static void salsa_core(int rounds, block *out, const crypton_salsa_state *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];++	SALSA_CORE_LOOP;++	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];++	out->d[0] = cpu_to_le32(x0);+	out->d[1] = cpu_to_le32(x1);+	out->d[2] = cpu_to_le32(x2);+	out->d[3] = cpu_to_le32(x3);+	out->d[4] = cpu_to_le32(x4);+	out->d[5] = cpu_to_le32(x5);+	out->d[6] = cpu_to_le32(x6);+	out->d[7] = cpu_to_le32(x7);+	out->d[8] = cpu_to_le32(x8);+	out->d[9] = cpu_to_le32(x9);+	out->d[10] = cpu_to_le32(x10);+	out->d[11] = cpu_to_le32(x11);+	out->d[12] = cpu_to_le32(x12);+	out->d[13] = cpu_to_le32(x13);+	out->d[14] = cpu_to_le32(x14);+	out->d[15] = cpu_to_le32(x15);+}++void crypton_salsa_core_xor(int rounds, block *out, block *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++#define LOAD(i) (out->d[i] ^= in->d[i])+	x0 = LOAD(0); x1 = LOAD(1); x2 = LOAD(2); x3 = LOAD(3);+	x4 = LOAD(4); x5 = LOAD(5); x6 = LOAD(6); x7 = LOAD(7);+	x8 = LOAD(8); x9 = LOAD(9); x10 = LOAD(10); x11 = LOAD(11);+	x12 = LOAD(12); x13 = LOAD(13); x14 = LOAD(14); x15 = LOAD(15);+#undef LOAD++	SALSA_CORE_LOOP;++	out->d[0] += x0; out->d[1] += x1; out->d[2] += x2; out->d[3] += x3;+	out->d[4] += x4; out->d[5] += x5; out->d[6] += x6; out->d[7] += x7;+	out->d[8] += x8; out->d[9] += x9; out->d[10] += x10; out->d[11] += x11;+	out->d[12] += x12; out->d[13] += x13; out->d[14] += x14; out->d[15] += x15;+}++/* only 2 valid values for keylen are 256 (32) and 128 (16) */+void crypton_salsa_init_core(crypton_salsa_state *st,+                                uint32_t keylen, const uint8_t *key,+                                uint32_t ivlen, const uint8_t *iv)+{+	const uint8_t *constants = (keylen == 32) ? sigma : tau;++	st->d[0] = load_le32_aligned(constants + 0);+	st->d[5] = load_le32_aligned(constants + 4);+	st->d[10] = load_le32_aligned(constants + 8);+	st->d[15] = load_le32_aligned(constants + 12);++	st->d[1] = load_le32(key + 0);+	st->d[2] = load_le32(key + 4);+	st->d[3] = load_le32(key + 8);+	st->d[4] = load_le32(key + 12);+	/* we repeat the key on 128 bits */+	if (keylen == 32)+		key += 16;+	st->d[11] = load_le32(key + 0);+	st->d[12] = load_le32(key + 4);+	st->d[13] = load_le32(key + 8);+	st->d[14] = load_le32(key + 12);++	st->d[9] = 0;+	switch (ivlen) {+	case 8:+		st->d[6] = load_le32(iv + 0);+		st->d[7] = load_le32(iv + 4);+		st->d[8] = 0;+		break;+	case 12:+		st->d[6] = load_le32(iv + 0);+		st->d[7] = load_le32(iv + 4);+		st->d[8] = load_le32(iv + 8);+	default:+		return;+	}+}++void crypton_salsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds,+                           uint32_t keylen, const uint8_t *key,+                           uint32_t ivlen, const uint8_t *iv)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->nb_rounds = nb_rounds;+	crypton_salsa_init_core(&ctx->st, keylen, key, ivlen, iv);+}++void crypton_salsa_combine(uint8_t *dst, crypton_salsa_context *ctx, const uint8_t *src, uint32_t bytes)+{+	block out;+	crypton_salsa_state *st;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		src += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	/* xor new 64-bytes chunks and store the left over if any */+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		for (i = 0; i < 64; ++i)+			dst[i] = src[i] ^ out.b[i];+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = src[i] ^ out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++) {+			ctx->prev[i] = out.b[i];+		}+	}+}++void crypton_salsa_generate(uint8_t *dst, crypton_salsa_context *ctx, uint32_t bytes)+{+	crypton_salsa_state *st;+	block out;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	if (ALIGNED64(dst)) {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			salsa_core(ctx->nb_rounds, (block *) dst, st);+			st->d[8] += 1;+			if (st->d[8] == 0)+				st->d[9] += 1;+		}+	} else {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			salsa_core(ctx->nb_rounds, &out, st);+			st->d[8] += 1;+			if (st->d[8] == 0)+				st->d[9] += 1;++			for (i = 0; i < 64; ++i)+				dst[i] = out.b[i];+		}+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++)+			ctx->prev[i] = out.b[i];+	}+}+
+ cbits/crypton_salsa.h view
@@ -0,0 +1,57 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTON_SALSA+#define CRYPTON_SALSA++typedef union {+	uint64_t q[8];+	uint32_t d[16];+	uint8_t  b[64];+} block;++typedef block crypton_salsa_state;++typedef struct {+	crypton_salsa_state st;+	uint8_t prev[64];+	uint8_t prev_ofs;+	uint8_t prev_len;+	uint8_t nb_rounds;+} crypton_salsa_context;++/* for scrypt */+void crypton_salsa_core_xor(int rounds, block *out, block *in);++void crypton_salsa_init_core(crypton_salsa_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void crypton_salsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void crypton_salsa_combine(uint8_t *dst, crypton_salsa_context *st, const uint8_t *src, uint32_t bytes);+void crypton_salsa_generate(uint8_t *dst, crypton_salsa_context *st, uint32_t bytes);++#endif
+ cbits/crypton_scrypt.c view
@@ -0,0 +1,81 @@+/*+ * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ *+ * Based on scrypt from Colin Percival's paper+ */++#include <stdint.h>+#include <string.h>+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_salsa.h"++static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)+{+	int i;++	array_copy32(X, &in[(2 * r - 1) * 16], 16);++	for (i = 0; i < 2 * r; i += 2) {+		crypton_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);+		array_copy32(&out[i * 8], X, 16);++		crypton_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);+		array_copy32(&out[i * 8 + r * 16], X, 16);+	}+}++static inline uint64_t integerify(uint32_t *B, const uint32_t r)+{+	return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32;+}++void crypton_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)+{+	uint32_t *X = XY;+	uint32_t *Y = &XY[32 * r];+	uint32_t *Z = &XY[64 * r];+	uint64_t i, j;+	int k;+	const int r32 = 32*r;++	for (k = 0; k < r32; k++)+		X[k] = load_le32_aligned(&B[4 * k]);+	for (i = 0; i < N; i += 2) {+		array_copy32(&V[i * r32], X, r32);+		blockmix_salsa8(X, Y, Z, r);+		array_copy32(&V[(i + 1) * r32], Y, r32);+		blockmix_salsa8(Y, X, Z, r);+	}+	for (i = 0; i < N; i += 2) {+		j = integerify(X, r) & (N - 1);+		array_xor32(X, &V[j * r32], r32);+		blockmix_salsa8(X, Y, Z, r);++		j = integerify(Y, r) & (N - 1);+		array_xor32(Y, &V[j * r32], r32);+		blockmix_salsa8(Y, X, Z, r);+	}+	for (k = 0; k < r32; k++)+		store_le32_aligned(&B[4*k], X[k]);+}
+ cbits/crypton_sha1.c view
@@ -0,0 +1,246 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_sha1.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++void crypton_sha1_init(struct sha1_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+	ctx->h[4] = 0xc3d2e1f0;+}++#define f1(x, y, z)   (z ^ (x & (y ^ z)))+#define f2(x, y, z)   (x ^ y ^ z)+#define f3(x, y, z)   ((x & y) + (z & (x ^ y)))+#define f4(x, y, z)   f2(x, y, z)++#define K1  0x5a827999+#define K2  0x6ed9eba1+#define K3  0x8f1bbcdc+#define K4  0xca62c1d6++#define R(a, b, c, d, e, f, k, w)  \+	e += rol32(a, 5) + f(b, c, d) + k + w; b = rol32(b, 30)++#define M(i)  (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \+              ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1))++static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d, e;+	uint32_t w[16];+#define CPY(i)	w[i] = be32_to_cpu(buf[i])+	CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7);+	CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15);+#undef CPY++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; e = ctx->h[4];++	R(a, b, c, d, e, f1, K1, w[0]);+	R(e, a, b, c, d, f1, K1, w[1]);+	R(d, e, a, b, c, f1, K1, w[2]);+	R(c, d, e, a, b, f1, K1, w[3]);+	R(b, c, d, e, a, f1, K1, w[4]);+	R(a, b, c, d, e, f1, K1, w[5]);+	R(e, a, b, c, d, f1, K1, w[6]);+	R(d, e, a, b, c, f1, K1, w[7]);+	R(c, d, e, a, b, f1, K1, w[8]);+	R(b, c, d, e, a, f1, K1, w[9]);+	R(a, b, c, d, e, f1, K1, w[10]);+	R(e, a, b, c, d, f1, K1, w[11]);+	R(d, e, a, b, c, f1, K1, w[12]);+	R(c, d, e, a, b, f1, K1, w[13]);+	R(b, c, d, e, a, f1, K1, w[14]);+	R(a, b, c, d, e, f1, K1, w[15]);+	R(e, a, b, c, d, f1, K1, M(16));+	R(d, e, a, b, c, f1, K1, M(17));+	R(c, d, e, a, b, f1, K1, M(18));+	R(b, c, d, e, a, f1, K1, M(19));++	R(a, b, c, d, e, f2, K2, M(20));+	R(e, a, b, c, d, f2, K2, M(21));+	R(d, e, a, b, c, f2, K2, M(22));+	R(c, d, e, a, b, f2, K2, M(23));+	R(b, c, d, e, a, f2, K2, M(24));+	R(a, b, c, d, e, f2, K2, M(25));+	R(e, a, b, c, d, f2, K2, M(26));+	R(d, e, a, b, c, f2, K2, M(27));+	R(c, d, e, a, b, f2, K2, M(28));+	R(b, c, d, e, a, f2, K2, M(29));+	R(a, b, c, d, e, f2, K2, M(30));+	R(e, a, b, c, d, f2, K2, M(31));+	R(d, e, a, b, c, f2, K2, M(32));+	R(c, d, e, a, b, f2, K2, M(33));+	R(b, c, d, e, a, f2, K2, M(34));+	R(a, b, c, d, e, f2, K2, M(35));+	R(e, a, b, c, d, f2, K2, M(36));+	R(d, e, a, b, c, f2, K2, M(37));+	R(c, d, e, a, b, f2, K2, M(38));+	R(b, c, d, e, a, f2, K2, M(39));++	R(a, b, c, d, e, f3, K3, M(40));+	R(e, a, b, c, d, f3, K3, M(41));+	R(d, e, a, b, c, f3, K3, M(42));+	R(c, d, e, a, b, f3, K3, M(43));+	R(b, c, d, e, a, f3, K3, M(44));+	R(a, b, c, d, e, f3, K3, M(45));+	R(e, a, b, c, d, f3, K3, M(46));+	R(d, e, a, b, c, f3, K3, M(47));+	R(c, d, e, a, b, f3, K3, M(48));+	R(b, c, d, e, a, f3, K3, M(49));+	R(a, b, c, d, e, f3, K3, M(50));+	R(e, a, b, c, d, f3, K3, M(51));+	R(d, e, a, b, c, f3, K3, M(52));+	R(c, d, e, a, b, f3, K3, M(53));+	R(b, c, d, e, a, f3, K3, M(54));+	R(a, b, c, d, e, f3, K3, M(55));+	R(e, a, b, c, d, f3, K3, M(56));+	R(d, e, a, b, c, f3, K3, M(57));+	R(c, d, e, a, b, f3, K3, M(58));+	R(b, c, d, e, a, f3, K3, M(59));++	R(a, b, c, d, e, f4, K4, M(60));+	R(e, a, b, c, d, f4, K4, M(61));+	R(d, e, a, b, c, f4, K4, M(62));+	R(c, d, e, a, b, f4, K4, M(63));+	R(b, c, d, e, a, f4, K4, M(64));+	R(a, b, c, d, e, f4, K4, M(65));+	R(e, a, b, c, d, f4, K4, M(66));+	R(d, e, a, b, c, f4, K4, M(67));+	R(c, d, e, a, b, f4, K4, M(68));+	R(b, c, d, e, a, f4, K4, M(69));+	R(a, b, c, d, e, f4, K4, M(70));+	R(e, a, b, c, d, f4, K4, M(71));+	R(d, e, a, b, c, f4, K4, M(72));+	R(c, d, e, a, b, f4, K4, M(73));+	R(b, c, d, e, a, f4, K4, M(74));+	R(a, b, c, d, e, f4, K4, M(75));+	R(e, a, b, c, d, f4, K4, M(76));+	R(d, e, a, b, c, f4, K4, M(77));+	R(c, d, e, a, b, f4, K4, M(78));+	R(b, c, d, e, a, f4, K4, M(79));++	ctx->h[0] += a;+	ctx->h[1] += b;+	ctx->h[2] += c;+	ctx->h[3] += d;+	ctx->h[4] += e;+}++void crypton_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha1_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 4)) {+		uint32_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 4);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			sha1_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			sha1_do_chunk(ctx, (uint32_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_be64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_sha1_update(ctx, padding, padlen);++	/* append length */+	crypton_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	store_be32(out   , ctx->h[0]);+	store_be32(out+ 4, ctx->h[1]);+	store_be32(out+ 8, ctx->h[2]);+	store_be32(out+12, ctx->h[3]);+	store_be32(out+16, ctx->h[4]);+}++#define HASHED(m) SHA1_##m+#define HASHED_LOWER(m) sha1_##m+#define CRYPTON_HASHED(m) crypton_sha1_##m+#define SHA1_BLOCK_SIZE 64+#define SHA1_BITS_ELEMS 1++static inline uint32_t crypton_sha1_get_index(const struct sha1_ctx *ctx)+{+	return (uint32_t) (ctx->sz & 0x3f);+}++static inline void crypton_sha1_incr_sz(struct sha1_ctx *ctx, uint64_t *bits, uint32_t n)+{+	ctx->sz += n;+	*bits = cpu_to_be64(ctx->sz << 3);+}++static inline void crypton_sha1_select_digest(const struct sha1_ctx *ctx, uint8_t *out, uint32_t out_mask)+{+	xor_be32(out   , ctx->h[0] & out_mask);+	xor_be32(out+ 4, ctx->h[1] & out_mask);+	xor_be32(out+ 8, ctx->h[2] & out_mask);+	xor_be32(out+12, ctx->h[3] & out_mask);+	xor_be32(out+16, ctx->h[4] & out_mask);+}++#include <crypton_hash_prefix.c>
+ cbits/crypton_sha1.h view
@@ -0,0 +1,46 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA1_H+#define CRYPTOHASH_SHA1_H++#include <stdint.h>++# define SHA1_BLOCK_SIZE 64++struct sha1_ctx+{+	uint64_t sz;+	uint8_t  buf[SHA1_BLOCK_SIZE];+	uint32_t h[5];+};++#define SHA1_DIGEST_SIZE	20+#define SHA1_CTX_SIZE 		(sizeof(struct sha1_ctx))++void crypton_sha1_init(struct sha1_ctx *ctx);+void crypton_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out);+void crypton_sha1_finalize_prefix(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++#endif
+ cbits/crypton_sha256.c view
@@ -0,0 +1,218 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_sha256.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++void crypton_sha224_init(struct sha224_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0xc1059ed8;+	ctx->h[1] = 0x367cd507;+	ctx->h[2] = 0x3070dd17;+	ctx->h[3] = 0xf70e5939;+	ctx->h[4] = 0xffc00b31;+	ctx->h[5] = 0x68581511;+	ctx->h[6] = 0x64f98fa7;+	ctx->h[7] = 0xbefa4fa4;+}++void crypton_sha256_init(struct sha256_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x6a09e667;+	ctx->h[1] = 0xbb67ae85;+	ctx->h[2] = 0x3c6ef372;+	ctx->h[3] = 0xa54ff53a;+	ctx->h[4] = 0x510e527f;+	ctx->h[5] = 0x9b05688c;+	ctx->h[6] = 0x1f83d9ab;+	ctx->h[7] = 0x5be0cd19;+}++/* 232 times the cube root of the first 64 primes 2..311 */+static const uint32_t k[] = {+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,+	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,+	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,+	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,+	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,+	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,+	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,+	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,+	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2+};++#define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))+#define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))+#define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))+#define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))++static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[])+{+	uint32_t a, b, c, d, e, f, g, h, t1, t2;+	int i;+	uint32_t w[64];++	cpu_to_be32_array(w, buf, 16);+	for (i = 16; i < 64; i++)+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];++#define R(a, b, c, d, e, f, g, h, k, w)			\+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w; 	\+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\+	d += t1;					\+	h = t1 + t2;++	for (i = 0; i < 64; i += 8) {+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);+	}++#undef R++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;+}++void crypton_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return crypton_sha256_update(ctx, data, len);+}++void crypton_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	/* check for partial buffer */+	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha256_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 4)) {+		uint32_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 4);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			sha256_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			sha256_do_chunk(ctx, (uint32_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out)+{+	uint8_t intermediate[SHA256_DIGEST_SIZE];++	crypton_sha256_finalize(ctx, intermediate);+	memcpy(out, intermediate, SHA224_DIGEST_SIZE);+}++void crypton_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)+{+	uint8_t intermediate[SHA256_DIGEST_SIZE];++	crypton_sha256_finalize_prefix(ctx, data, len, n, intermediate);+	memcpy(out, intermediate, SHA224_DIGEST_SIZE);+}++void crypton_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t i, index, padlen;++	/* cpu -> big endian */+	bits = cpu_to_be64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_sha256_update(ctx, padding, padlen);++	/* append length */+	crypton_sha256_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* store to digest */+	for (i = 0; i < 8; i++)+		store_be32(out+4*i, ctx->h[i]);+}++#define HASHED(m) SHA256_##m+#define HASHED_LOWER(m) sha256_##m+#define CRYPTON_HASHED(m) crypton_sha256_##m+#define SHA256_BLOCK_SIZE 64+#define SHA256_BITS_ELEMS 1++static inline uint32_t crypton_sha256_get_index(const struct sha256_ctx *ctx)+{+	return (uint32_t) (ctx->sz & 0x3f);+}++static inline void crypton_sha256_incr_sz(struct sha256_ctx *ctx, uint64_t *bits, uint32_t n)+{+	ctx->sz += n;+	*bits = cpu_to_be64(ctx->sz << 3);+}++static inline void crypton_sha256_select_digest(const struct sha256_ctx *ctx, uint8_t *out, uint32_t out_mask)+{+	uint32_t i;+	for (i = 0; i < 8; i++)+		xor_be32(out+4*i, ctx->h[i] & out_mask);+}++#include <crypton_hash_prefix.c>
+ cbits/crypton_sha256.h view
@@ -0,0 +1,57 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef CRYPTOHASH_SHA256_H+#define CRYPTOHASH_SHA256_H++#include <stdint.h>++#define SHA256_BLOCK_SIZE 64++struct sha256_ctx+{+	uint64_t sz;+	uint8_t  buf[128];+	uint32_t h[8];+};++#define sha224_ctx 		sha256_ctx++#define SHA224_DIGEST_SIZE	28+#define SHA224_CTX_SIZE		sizeof(struct sha224_ctx)++#define SHA256_DIGEST_SIZE	32+#define SHA256_CTX_SIZE		sizeof(struct sha256_ctx)++void crypton_sha224_init(struct sha224_ctx *ctx);+void crypton_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out);+void crypton_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++void crypton_sha256_init(struct sha256_ctx *ctx);+void crypton_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out);+void crypton_sha256_finalize_prefix(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++#endif
+ cbits/crypton_sha3.c view
@@ -0,0 +1,252 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_sha3.h"++#define KECCAK_NB_ROUNDS 24++/* rounds constants */+static const uint64_t keccak_rndc[24] =+{+	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,+	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,+	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,+	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,+	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,+	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,+	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,+	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,+};++/* triangular numbers constants */+static const int keccak_rotc[24] =+	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };++static const int keccak_piln[24] =+	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };++static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)+{+	int i, j, r;+	uint64_t tmp, bc[5];++	/* merge buf with state */+	for (i = 0; i < bufsz; i++)+		state[i] ^= le64_to_cpu(buf[i]);++	/* run keccak rounds */+	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {+		/* compute the parity of each columns */+		for (i = 0; i < 5; i++)+			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];++		for (i = 0; i < 5; i++) {+			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);+			for (j = 0; j < 25; j += 5)+				state[j + i] ^= tmp;+		}++		/* rho pi */+		tmp = state[1];+		for (i = 0; i < 24; i++) {+			j = keccak_piln[i];+			bc[0] = state[j];+			state[j] = rol64(tmp, keccak_rotc[i]);+			tmp = bc[0];+		}++		/* bitwise combine along rows using a = a xor (not b and c) */+		for (j = 0; j < 25; j += 5) {+			for (i = 0; i < 5; i++)+				bc[i] = state[j + i];+			#define andn(b,c) (~(b) & (c))+			state[j + 0] ^= andn(bc[1], bc[2]);+			state[j + 1] ^= andn(bc[2], bc[3]);+			state[j + 2] ^= andn(bc[3], bc[4]);+			state[j + 3] ^= andn(bc[4], bc[0]);+			state[j + 4] ^= andn(bc[0], bc[1]);+			#undef andn+		}++		/* xor the round constant */+		state[0] ^= keccak_rndc[r];+	}+}++/*+ * Initialize a SHA-3 / SHAKE / cSHAKE context: hashlen is the security level+ * (and half the capacity) in bits.+ *+ * In case of cSHAKE, the message prefix with encoded N and S must be added with+ * crypton_sha3_update.+ */+void crypton_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen)+{+	/* assert(hashlen >= SHA3_BITSIZE_MIN && hashlen <= SHA3_BITSIZE_MAX) */+	int bufsz = SHA3_BUF_SIZE(hashlen);+	memset(ctx, 0, sizeof(*ctx) + bufsz);+	ctx->bufsz = bufsz;+}++/* Update a SHA-3 / SHAKE / cSHAKE context */+void crypton_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	to_fill = ctx->bufsz - ctx->bufindex;++	if (ctx->bufindex == ctx->bufsz) {+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block */+	if (ctx->bufindex && len >= to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	if (need_alignment(data, 8)) {+		uint64_t tramp[SHA3_BUF_SIZE_MAX/8];+		ASSERT_ALIGNMENT(tramp, 8);+		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz) {+			memcpy(tramp, data, ctx->bufsz);+			sha3_do_chunk(ctx->state, tramp, ctx->bufsz / 8);+		}+	} else {+		/* process as much ctx->bufsz-block */+		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)+			sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);+	}+++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void crypton_sha3_finalize_with_pad_byte(struct sha3_ctx *ctx, uint8_t pad_byte)+{+	/* process full buffer if needed */+	if (ctx->bufindex == ctx->bufsz) {+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* add the 10*1 padding */+	ctx->buf[ctx->bufindex++] = pad_byte;+	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);+	ctx->buf[ctx->bufsz - 1] |= 0x80;++	/* process */+	sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+	ctx->bufindex = 0;+}++/*+ * Extract some bytes from a finalized SHA-3 / SHAKE / cSHAKE context.+ * May be called multiple times.+ */+void crypton_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len)+{+	uint64_t w[25];+	uint8_t *wptr = (uint8_t *) w;+	uint32_t still_avail;++	still_avail = ctx->bufsz - ctx->bufindex;++	if (ctx->bufindex == ctx->bufsz) {+		/* squeeze the sponge again, without any input */+		sha3_do_chunk(ctx->state, NULL, 0);+		ctx->bufindex = 0;+	}++	/* use bytes already available if this block is fully consumed */+	if (ctx->bufindex && len >= still_avail) {+		cpu_to_le64_array(w, ctx->state, 25);+		memcpy(out, wptr + ctx->bufindex, still_avail);+		sha3_do_chunk(ctx->state, NULL, 0);+		len -= still_avail;+		out += still_avail;+		ctx->bufindex = 0;+	}++	/* output as much ctx->bufsz-block */+	for (; len > ctx->bufsz; len -= ctx->bufsz, out += ctx->bufsz) {+		cpu_to_le64_array(w, ctx->state, 25);+		memcpy(out, w, ctx->bufsz);+		sha3_do_chunk(ctx->state, NULL, 0);+	}++	/* output from partial buffer */+	if (len) {+		cpu_to_le64_array(w, ctx->state, 25);+		memcpy(out, wptr + ctx->bufindex, len);+		ctx->bufindex += len;+	}+}++/* Finalize a SHA-3 context and return the digest value */+void crypton_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	crypton_sha3_finalize_with_pad_byte(ctx, 0x06);+	crypton_sha3_output(ctx, out, hashlen / 8);+}++/* Finalize a SHAKE context. Output is read using crypton_sha3_output. */+void crypton_sha3_finalize_shake(struct sha3_ctx *ctx)+{+	crypton_sha3_finalize_with_pad_byte(ctx, 0x1F);+}++/* Finalize a cSHAKE context. Output is read using crypton_sha3_output. */+void crypton_sha3_finalize_cshake(struct sha3_ctx *ctx)+{+	crypton_sha3_finalize_with_pad_byte(ctx, 0x04);+}++void crypton_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen)+{+	crypton_sha3_init(ctx, hashlen);+}++void crypton_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len)+{+	crypton_sha3_update(ctx, data, len);+}++void crypton_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	crypton_sha3_finalize_with_pad_byte(ctx, 1);+	crypton_sha3_output(ctx, out, hashlen / 8);+}
+ cbits/crypton_sha3.h view
@@ -0,0 +1,67 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA3_H+#define CRYPTOHASH_SHA3_H++#include <stdint.h>++struct sha3_ctx+{+	uint32_t bufindex;+	uint32_t bufsz;+	uint64_t state[25];+	uint8_t  buf[0]; /* maximum SHAKE128 is 168 bytes, otherwise buffer can be decreased */+};++#define SHA3_CTX_SIZE		sizeof(struct sha3_ctx)+#define SHA3_CTX_BUF_MAX_SIZE   (SHA3_CTX_SIZE + SHA3_BUF_SIZE_MAX)+#define SHA3_BITSIZE_MIN   	128+#define SHA3_BITSIZE_MAX    	512++#define SHA3_BUF_SIZE(bitsize)  (200 - 2 * ((bitsize) / 8))++#define SHA3_BUF_SIZE_MIN       SHA3_BUF_SIZE(SHA3_BITSIZE_MAX)+#define SHA3_BUF_SIZE_MAX       SHA3_BUF_SIZE(SHA3_BITSIZE_MIN)++/*+ * buffer size:+ *+ * 128 bits (shake 128 bits) => 200 - 2 * (128 / 8) = 200 - 2*16 = 200 - 32  = 168 bytes+ * 224 bits (SHA3 224 bits)  => 200 - 2 * (224 / 8) = 200 - 2*28 = 200 - 56  = 144 bytes+ * 512 bits (SHA3 512 bits)  => 200 - 2 * (512 / 8) = 200 - 2*64 = 200 - 128 = 72 bytes+ */++void crypton_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen);+void crypton_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);++void crypton_sha3_finalize_shake(struct sha3_ctx *ctx);+void crypton_sha3_finalize_cshake(struct sha3_ctx *ctx);+void crypton_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len);++void crypton_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen);+void crypton_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len);+void crypton_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_sha512.c view
@@ -0,0 +1,307 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_bitfn.h"+#include "crypton_align.h"+#include "crypton_sha512.h"++void crypton_sha384_init(struct sha512_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0xcbbb9d5dc1059ed8ULL;+	ctx->h[1] = 0x629a292a367cd507ULL;+	ctx->h[2] = 0x9159015a3070dd17ULL;+	ctx->h[3] = 0x152fecd8f70e5939ULL;+	ctx->h[4] = 0x67332667ffc00b31ULL;+	ctx->h[5] = 0x8eb44a8768581511ULL;+	ctx->h[6] = 0xdb0c2e0d64f98fa7ULL;+	ctx->h[7] = 0x47b5481dbefa4fa4ULL;+}++void crypton_sha512_init(struct sha512_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x6a09e667f3bcc908ULL;+	ctx->h[1] = 0xbb67ae8584caa73bULL;+	ctx->h[2] = 0x3c6ef372fe94f82bULL;+	ctx->h[3] = 0xa54ff53a5f1d36f1ULL;+	ctx->h[4] = 0x510e527fade682d1ULL;+	ctx->h[5] = 0x9b05688c2b3e6c1fULL;+	ctx->h[6] = 0x1f83d9abfb41bd6bULL;+	ctx->h[7] = 0x5be0cd19137e2179ULL;+}++/* 232 times the cube root of the first 64 primes 2..311 */+static const uint64_t k[] = {+	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,+	0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,+	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,+	0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,+	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,+	0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,+	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,+	0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,+	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,+	0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,+	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,+	0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,+	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,+	0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,+	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,+	0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,+	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,+	0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,+	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,+	0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,+	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,+	0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,+	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,+	0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,+	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,+	0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,+	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,+};++#define e0(x)       (ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39))+#define e1(x)       (ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41))+#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))+#define s1(x)       (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6))++static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf)+{+	uint64_t a, b, c, d, e, f, g, h, t1, t2;+	int i;+	uint64_t w[80];++	cpu_to_be64_array(w, buf, 16);++	for (i = 16; i < 80; i++)+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];++#define R(a, b, c, d, e, f, g, h, k, w)			\+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w;	\+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\+	d += t1;					\+	h = t1 + t2++	for (i = 0; i < 80; i += 8) {+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);+	}++#undef R++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;+}++void crypton_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return crypton_sha512_update(ctx, data, len);+}++void crypton_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)+{+	unsigned int index, to_fill;++	/* check for partial buffer */+	index = (unsigned int) (ctx->sz[0] & 0x7f);+	to_fill = 128 - index;++	ctx->sz[0] += len;+	if (ctx->sz[0] < len)+		ctx->sz[1]++;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha512_do_chunk(ctx, (uint64_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 8)) {+		uint64_t tramp[16];+		ASSERT_ALIGNMENT(tramp, 8);+		for (; len >= 128; len -= 128, data += 128) {+			memcpy(tramp, data, 128);+			sha512_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 128-block as possible */+		for (; len >= 128; len -= 128, data += 128)+			sha512_do_chunk(ctx, (uint64_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out)+{+	uint8_t intermediate[SHA512_DIGEST_SIZE];++	crypton_sha512_finalize(ctx, intermediate);+	memcpy(out, intermediate, SHA384_DIGEST_SIZE);+}++void crypton_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)+{+	uint8_t intermediate[SHA512_DIGEST_SIZE];++	crypton_sha512_finalize_prefix(ctx, data, len, n, intermediate);+	memcpy(out, intermediate, SHA384_DIGEST_SIZE);+}++void crypton_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[128] = { 0x80, };+	uint32_t i, index, padlen;+	uint64_t bits[2];++	/* cpu -> big endian */+	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));+	bits[1] = cpu_to_be64((ctx->sz[0] << 3));++	/* pad out to 56 */+	index = (unsigned int) (ctx->sz[0] & 0x7f);+	padlen = (index < 112) ? (112 - index) : ((128 + 112) - index);+	crypton_sha512_update(ctx, padding, padlen);++	/* append length */+	crypton_sha512_update(ctx, (uint8_t *) bits, sizeof(bits));++	/* store to digest */+	for (i = 0; i < 8; i++)+		store_be64(out+8*i, ctx->h[i]);+}++#define HASHED(m) SHA512_##m+#define HASHED_LOWER(m) sha512_##m+#define CRYPTON_HASHED(m) crypton_sha512_##m+#define SHA512_BLOCK_SIZE 128+#define SHA512_BITS_ELEMS 2++#include <crypton_hash_prefix.h>++static inline uint32_t crypton_sha512_get_index(const struct sha512_ctx *ctx)+{+	return (uint32_t) (ctx->sz[0] & 0x7f);+}++static inline void crypton_sha512_incr_sz(struct sha512_ctx *ctx, uint64_t *bits, uint32_t n)+{+	ctx->sz[0] += n;+	ctx->sz[1] += 1 & constant_time_lt_64(ctx->sz[0], n);+	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));+	bits[1] = cpu_to_be64((ctx->sz[0] << 3));+}++static inline void crypton_sha512_select_digest(const struct sha512_ctx *ctx, uint8_t *out, uint32_t out_mask)+{+	uint32_t i;+	uint64_t out_mask_64 = out_mask;+	out_mask_64 |= out_mask_64 << 32;+	for (i = 0; i < 8; i++)+		xor_be64(out+8*i, ctx->h[i] & out_mask_64);+}++#include <crypton_hash_prefix.c>++#include <stdio.h>++void crypton_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen)+{+	memset(ctx, 0, sizeof(*ctx));+	if (hashlen >= 512)+		return;+	switch (hashlen) {+	case 224:+		ctx->h[0] = 0x8c3d37c819544da2ULL;+		ctx->h[1] = 0x73e1996689dcd4d6ULL;+		ctx->h[2] = 0x1dfab7ae32ff9c82ULL;+		ctx->h[3] = 0x679dd514582f9fcfULL;+		ctx->h[4] = 0x0f6d2b697bd44da8ULL;+		ctx->h[5] = 0x77e36f7304c48942ULL;+		ctx->h[6] = 0x3f9d85a86a1d36c8ULL;+		ctx->h[7] = 0x1112e6ad91d692a1ULL;+		break;+	case 256:+		ctx->h[0] = 0x22312194fc2bf72cULL;+		ctx->h[1] = 0x9f555fa3c84c64c2ULL;+		ctx->h[2] = 0x2393b86b6f53b151ULL;+		ctx->h[3] = 0x963877195940eabdULL;+		ctx->h[4] = 0x96283ee2a88effe3ULL;+		ctx->h[5] = 0xbe5e1e2553863992ULL;+		ctx->h[6] = 0x2b0199fc2c85b8aaULL;+		ctx->h[7] = 0x0eb72ddc81c52ca2ULL;+		break;+	default: {+		char buf[8+4];+		uint8_t out[64];+		int i;++		crypton_sha512_init(ctx);+		for (i = 0; i < 8; i++)+			ctx->h[i] ^= 0xa5a5a5a5a5a5a5a5ULL;++		i = sprintf(buf, "SHA-512/%d", hashlen);+		crypton_sha512_update(ctx, (uint8_t *) buf, i);+		crypton_sha512_finalize(ctx, out);++		/* re-init the context, otherwise len is changed */+		memset(ctx, 0, sizeof(*ctx));+		for (i = 0; i < 8; i++)+			ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]);+		}+	}+}++void crypton_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return crypton_sha512_update(ctx, data, len);+}++void crypton_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	uint8_t intermediate[SHA512_DIGEST_SIZE];++	crypton_sha512_finalize(ctx, intermediate);+	memcpy(out, intermediate, hashlen / 8);+}+
+ cbits/crypton_sha512.h view
@@ -0,0 +1,61 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA512_H+#define CRYPTOHASH_SHA512_H++#include <stdint.h>++# define SHA512_BLOCK_SIZE 128++struct sha512_ctx+{+	uint64_t sz[2];+	uint8_t  buf[SHA512_BLOCK_SIZE];+	uint64_t h[8];+};++#define sha384_ctx sha512_ctx++#define SHA384_DIGEST_SIZE	48+#define SHA384_CTX_SIZE		sizeof(struct sha384_ctx)++#define SHA512_DIGEST_SIZE	64+#define SHA512_CTX_SIZE		sizeof(struct sha512_ctx)++void crypton_sha384_init(struct sha384_ctx *ctx);+void crypton_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out);+void crypton_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++void crypton_sha512_init(struct sha512_ctx *ctx);+void crypton_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out);+void crypton_sha512_finalize_prefix(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);++/* only multiples of 8 are supported as valid t values */+void crypton_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen);+void crypton_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_skein.h view
@@ -0,0 +1,46 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN_H+#define CRYPTOHASH_SKEIN_H++#define SKEIN_VERSION 1ULL+#define SKEIN_IDSTRING 0x33414853ULL++/*+t0 0-63 || t1 64-127+0-95      96-111      112-118    119     120-125  126    127+Position  reserved    TreeLevel  BitPad  Type     First  Final+*/+#define FLAG_FIRST   (1ULL << 62)+#define FLAG_FINAL   (1ULL << 63)+#define FLAG_TYPE(x) (((uint64_t) ((x) & 0x3f)) << 56)++#define TYPE_KEY     0x00+#define TYPE_CFG     0x04+#define TYPE_MSG     0x30+#define TYPE_OUT     0x3f++#define SET_TYPE(ctx, ty) ctx->t0 = 0; ctx->t1 = (ty)++#endif
+ cbits/crypton_skein256.c view
@@ -0,0 +1,204 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_skein.h"+#include "crypton_skein256.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++static const uint8_t K256_0[2] = { 14, 16, };+static const uint8_t K256_1[2] = { 52, 57, };+static const uint8_t K256_2[2] = { 23, 40, };+static const uint8_t K256_3[2] = {  5, 37, };+static const uint8_t K256_4[2] = { 25, 33, };+static const uint8_t K256_5[2] = { 46, 12, };+static const uint8_t K256_6[2] = { 58, 22, };+static const uint8_t K256_7[2] = { 32, 32, };++static inline void skein256_do_chunk(struct skein256_ctx *ctx, uint64_t *buf, uint32_t len)+{+	uint64_t x[4];+	uint64_t ts[3];+	uint64_t ks[4+1];++	ks[4] = 0x1bd11bdaa9fc1a22ULL;+	ks[0] = ctx->h[0]; ks[4] ^= ctx->h[0];+	ks[1] = ctx->h[1]; ks[4] ^= ctx->h[1];+	ks[2] = ctx->h[2]; ks[4] ^= ctx->h[2];+	ks[3] = ctx->h[3]; ks[4] ^= ctx->h[3];++	ts[0] = ctx->t0;+	ts[1] = ctx->t1;++	ts[0] += len;++	ts[2] = ts[0] ^ ts[1];++#define INJECTKEY(r) \+	x[0] += ks[((r)+0) % (4+1)];                   \+	x[1] += ks[((r)+1) % (4+1)] + ts[((r)+0) % 3]; \+	x[2] += ks[((r)+2) % (4+1)] + ts[((r)+1) % 3]; \+	x[3] += ks[((r)+3) % (4+1)] + (r)++#define ROUND(a,b,c,d,k) \+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c];++#define PASS(i) \+	ROUND(0,1,2,3,K256_0); \+	ROUND(0,3,2,1,K256_1); \+	ROUND(0,1,2,3,K256_2); \+	ROUND(0,3,2,1,K256_3); \+	INJECTKEY((i*2) + 1);          \+	ROUND(0,1,2,3,K256_4); \+	ROUND(0,3,2,1,K256_5); \+	ROUND(0,1,2,3,K256_6); \+	ROUND(0,3,2,1,K256_7); \+	INJECTKEY((i*2) + 2)++	x[0] = le64_to_cpu(buf[0]) + ks[0];+	x[1] = le64_to_cpu(buf[1]) + ks[1] + ts[0];+	x[2] = le64_to_cpu(buf[2]) + ks[2] + ts[1];+	x[3] = le64_to_cpu(buf[3]) + ks[3];++	/* 9 pass of 8 rounds = 72 rounds */+	PASS(0);+	PASS(1);+	PASS(2);+	PASS(3);+	PASS(4);+	PASS(5);+	PASS(6);+	PASS(7);+	PASS(8);++	ts[1] &= ~FLAG_FIRST;+	ctx->t0 = ts[0];+	ctx->t1 = ts[1];++	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);+}++void crypton_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen)+{+	uint64_t buf[4];+	memset(ctx, 0, sizeof(*ctx));++	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));+	+	memset(buf, '\0', sizeof(buf));+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);+	buf[1] = cpu_to_le64(hashlen);+	buf[2] = 0; /* tree info, not implemented */+	skein256_do_chunk(ctx, buf, 4*8);++	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));+}++void crypton_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	if (!len)+		return;++	to_fill = 32 - ctx->bufindex;++	if (ctx->bufindex == 32) {+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block+	 * and there's without doubt further blocks */+	if (ctx->bufindex && len > to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	if (need_alignment(data, 8)) {+		uint64_t tramp[4];+		ASSERT_ALIGNMENT(tramp, 8);+		for (; len > 32; len -= 32, data += 32) {+			memcpy(tramp, data, 32);+			skein256_do_chunk(ctx, tramp, 32);+		}+	} else {+		/* process as much 32-block as possible except the last one in case we finalize */+		for (; len > 32; len -= 32, data += 32)+			skein256_do_chunk(ctx, (uint64_t *) data, 32);+	}++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void crypton_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	uint32_t outsize;+	uint64_t x[4];+	int i, j, n;++	ctx->t1 |= FLAG_FINAL;+	/* if buf is not complete pad with 0 bytes */+	if (ctx->bufindex < 32)+		memset(ctx->buf + ctx->bufindex, '\0', 32 - ctx->bufindex);+	skein256_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);++	memset(ctx->buf, '\0', 32);++	/* make sure we have a 8 bit up rounded value */+	outsize = (hashlen + 7) >> 3;++	/* backup h[0--4] */+	for (j = 0; j < 4; j++)+		x[j] = ctx->h[j];+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */+	for (i = 0; i*32 < outsize; i++) {+		uint64_t w[4];+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));++		n = outsize - i * 32;+		if (n >= 32) n = 32;++		cpu_to_le64_array(w, ctx->h, 4);+		memcpy(out + i*32, w, n);++		/* restore h[0--4] */+		for (j = 0; j < 4; j++)+			ctx->h[j] = x[j];+	}+}
+ cbits/crypton_skein256.h view
@@ -0,0 +1,44 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN256_H+#define CRYPTOHASH_SKEIN256_H++#include <stdint.h>++struct skein256_ctx+{+	uint8_t  buf[32];+	uint64_t h[4];+	uint64_t t0;+	uint64_t t1;+	uint32_t bufindex;+};++#define SKEIN256_CTX_SIZE		sizeof(struct skein256_ctx)++void cryponite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen);+void cryponite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len);+void cryponite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_skein512.c view
@@ -0,0 +1,222 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_skein.h"+#include "crypton_skein512.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++static const uint8_t K512_0[4] = { 46, 36, 19, 37, };+static const uint8_t K512_1[4] = { 33, 27, 14, 42, };+static const uint8_t K512_2[4] = { 17, 49, 36, 39, };+static const uint8_t K512_3[4] = { 44,  9, 54, 56, };+static const uint8_t K512_4[4] = { 39, 30, 34, 24, };+static const uint8_t K512_5[4] = { 13, 50, 10, 17, };+static const uint8_t K512_6[4] = { 25, 29, 39, 43, };+static const uint8_t K512_7[4] = {  8, 35, 56, 22, };++static inline void skein512_do_chunk(struct skein512_ctx *ctx, uint64_t *buf, uint32_t len)+{+	uint64_t x[8];+	uint64_t ts[3];+	uint64_t ks[8+1];++	ks[8] = 0x1bd11bdaa9fc1a22ULL;+	ks[0] = ctx->h[0]; ks[8] ^= ctx->h[0];+	ks[1] = ctx->h[1]; ks[8] ^= ctx->h[1];+	ks[2] = ctx->h[2]; ks[8] ^= ctx->h[2];+	ks[3] = ctx->h[3]; ks[8] ^= ctx->h[3];+	ks[4] = ctx->h[4]; ks[8] ^= ctx->h[4];+	ks[5] = ctx->h[5]; ks[8] ^= ctx->h[5];+	ks[6] = ctx->h[6]; ks[8] ^= ctx->h[6];+	ks[7] = ctx->h[7]; ks[8] ^= ctx->h[7];++	ts[0] = ctx->t0;+	ts[1] = ctx->t1;++	ts[0] += len;++	ts[2] = ts[0] ^ ts[1];++#define INJECTKEY(r) \+	x[0] += ks[((r)+0) % (8+1)];                   \+	x[1] += ks[((r)+1) % (8+1)];                   \+	x[2] += ks[((r)+2) % (8+1)];                   \+	x[3] += ks[((r)+3) % (8+1)];                   \+	x[4] += ks[((r)+4) % (8+1)];                   \+	x[5] += ks[((r)+5) % (8+1)] + ts[((r)+0) % 3]; \+	x[6] += ks[((r)+6) % (8+1)] + ts[((r)+1) % 3]; \+	x[7] += ks[((r)+7) % (8+1)] + (r)++#define ROUND(a,b,c,d,e,f,g,h,k) \+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c]; \+	x[e] += x[f]; x[f] = rol64(x[f],k[2]); x[f] ^= x[e]; \+	x[g] += x[h]; x[h] = rol64(x[h],k[3]); x[h] ^= x[g];++#define PASS(i) \+	ROUND(0,1,2,3,4,5,6,7,K512_0); \+	ROUND(2,1,4,7,6,5,0,3,K512_1); \+	ROUND(4,1,6,3,0,5,2,7,K512_2); \+	ROUND(6,1,0,7,2,5,4,3,K512_3); \+	INJECTKEY((i*2) + 1);          \+	ROUND(0,1,2,3,4,5,6,7,K512_4); \+	ROUND(2,1,4,7,6,5,0,3,K512_5); \+	ROUND(4,1,6,3,0,5,2,7,K512_6); \+	ROUND(6,1,0,7,2,5,4,3,K512_7); \+	INJECTKEY((i*2) + 2)++	x[0] = le64_to_cpu(buf[0]) + ks[0];+	x[1] = le64_to_cpu(buf[1]) + ks[1];+	x[2] = le64_to_cpu(buf[2]) + ks[2];+	x[3] = le64_to_cpu(buf[3]) + ks[3];+	x[4] = le64_to_cpu(buf[4]) + ks[4];+	x[5] = le64_to_cpu(buf[5]) + ks[5] + ts[0];+	x[6] = le64_to_cpu(buf[6]) + ks[6] + ts[1];+	x[7] = le64_to_cpu(buf[7]) + ks[7];++	/* 9 pass of 8 rounds = 72 rounds */+	PASS(0);+	PASS(1);+	PASS(2);+	PASS(3);+	PASS(4);+	PASS(5);+	PASS(6);+	PASS(7);+	PASS(8);++	ts[1] &= ~FLAG_FIRST;+	ctx->t0 = ts[0];+	ctx->t1 = ts[1];++	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);+        ctx->h[4] = x[4] ^ cpu_to_le64(buf[4]);+        ctx->h[5] = x[5] ^ cpu_to_le64(buf[5]);+        ctx->h[6] = x[6] ^ cpu_to_le64(buf[6]);+        ctx->h[7] = x[7] ^ cpu_to_le64(buf[7]);+}++void crypton_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen)+{+	uint64_t buf[8];+	memset(ctx, 0, sizeof(*ctx));++	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));+	+	memset(buf, '\0', sizeof(buf));+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);+	buf[1] = cpu_to_le64(hashlen);+	buf[2] = 0; /* tree info, not implemented */+	skein512_do_chunk(ctx, buf, 4*8);++	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));+}++void crypton_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	if (!len)+		return;++	to_fill = 64 - ctx->bufindex;++	if (ctx->bufindex == 64) {+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block+	 * and there's without doubt further blocks */+	if (ctx->bufindex && len > to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	if (need_alignment(data, 8)) {+		uint64_t tramp[8];+		ASSERT_ALIGNMENT(tramp, 8);+		for (; len > 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			skein512_do_chunk(ctx, tramp, 64);+		}+	} else {+		/* process as much 64-block as possible except the last one in case we finalize */+		for (; len > 64; len -= 64, data += 64)+			skein512_do_chunk(ctx, (uint64_t *) data, 64);+	}++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void crypton_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out)+{+	uint32_t outsize;+	uint64_t x[8];+	int i, j, n;++	ctx->t1 |= FLAG_FINAL;+	/* if buf is not complete pad with 0 bytes */+	if (ctx->bufindex < 64)+		memset(ctx->buf + ctx->bufindex, '\0', 64 - ctx->bufindex);+	skein512_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);++	memset(ctx->buf, '\0', 64);++	/* make sure we have a 8 bit rounded value */+	outsize = (hashlen + 7) >> 3;++	/* backup h[0--7] */+	for (j = 0; j < 8; j++)+		x[j] = ctx->h[j];+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */+	for (i = 0; i*64 < outsize; i++) {+		uint64_t w[8];+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));++		n = outsize - i * 64;+		if (n >= 64) n = 64;++		cpu_to_le64_array(w, ctx->h, 8);+		memcpy(out + i*64, w, n);++		/* restore h[0--7] */+		for (j = 0; j < 8; j++)+			ctx->h[j] = x[j];+	}+}
+ cbits/crypton_skein512.h view
@@ -0,0 +1,44 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN512_H+#define CRYPTOHASH_SKEIN512_H++#include <stdint.h>++struct skein512_ctx+{+	uint8_t  buf[64];+	uint64_t h[8];+	uint64_t t0;+	uint64_t t1;+	uint32_t bufindex;+};++#define SKEIN512_CTX_SIZE		sizeof(struct skein512_ctx)++void cryponite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen);+void cryponite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len);+void cryponite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out);++#endif
+ cbits/crypton_tiger.c view
@@ -0,0 +1,424 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "crypton_tiger.h"+#include "crypton_bitfn.h"+#include "crypton_align.h"++static const uint64_t t1[256] = {+	0x02aab17cf7e90c5eULL,0xac424b03e243a8ecULL,0x72cd5be30dd5fcd3ULL,0x6d019b93f6f97f3aULL,+	0xcd9978ffd21f9193ULL,0x7573a1c9708029e2ULL,0xb164326b922a83c3ULL,0x46883eee04915870ULL,+	0xeaace3057103ece6ULL,0xc54169b808a3535cULL,0x4ce754918ddec47cULL,0x0aa2f4dfdc0df40cULL,+	0x10b76f18a74dbefaULL,0xc6ccb6235ad1ab6aULL,0x13726121572fe2ffULL,0x1a488c6f199d921eULL,+	0x4bc9f9f4da0007caULL,0x26f5e6f6e85241c7ULL,0x859079dbea5947b6ULL,0x4f1885c5c99e8c92ULL,+	0xd78e761ea96f864bULL,0x8e36428c52b5c17dULL,0x69cf6827373063c1ULL,0xb607c93d9bb4c56eULL,+	0x7d820e760e76b5eaULL,0x645c9cc6f07fdc42ULL,0xbf38a078243342e0ULL,0x5f6b343c9d2e7d04ULL,+	0xf2c28aeb600b0ec6ULL,0x6c0ed85f7254bcacULL,0x71592281a4db4fe5ULL,0x1967fa69ce0fed9fULL,+	0xfd5293f8b96545dbULL,0xc879e9d7f2a7600bULL,0x860248920193194eULL,0xa4f9533b2d9cc0b3ULL,+	0x9053836c15957613ULL,0xdb6dcf8afc357bf1ULL,0x18beea7a7a370f57ULL,0x037117ca50b99066ULL,+	0x6ab30a9774424a35ULL,0xf4e92f02e325249bULL,0x7739db07061ccae1ULL,0xd8f3b49ceca42a05ULL,+	0xbd56be3f51382f73ULL,0x45faed5843b0bb28ULL,0x1c813d5c11bf1f83ULL,0x8af0e4b6d75fa169ULL,+	0x33ee18a487ad9999ULL,0x3c26e8eab1c94410ULL,0xb510102bc0a822f9ULL,0x141eef310ce6123bULL,+	0xfc65b90059ddb154ULL,0xe0158640c5e0e607ULL,0x884e079826c3a3cfULL,0x930d0d9523c535fdULL,+	0x35638d754e9a2b00ULL,0x4085fccf40469dd5ULL,0xc4b17ad28be23a4cULL,0xcab2f0fc6a3e6a2eULL,+	0x2860971a6b943fcdULL,0x3dde6ee212e30446ULL,0x6222f32ae01765aeULL,0x5d550bb5478308feULL,+	0xa9efa98da0eda22aULL,0xc351a71686c40da7ULL,0x1105586d9c867c84ULL,0xdcffee85fda22853ULL,+	0xccfbd0262c5eef76ULL,0xbaf294cb8990d201ULL,0xe69464f52afad975ULL,0x94b013afdf133e14ULL,+	0x06a7d1a32823c958ULL,0x6f95fe5130f61119ULL,0xd92ab34e462c06c0ULL,0xed7bde33887c71d2ULL,+	0x79746d6e6518393eULL,0x5ba419385d713329ULL,0x7c1ba6b948a97564ULL,0x31987c197bfdac67ULL,+	0xde6c23c44b053d02ULL,0x581c49fed002d64dULL,0xdd474d6338261571ULL,0xaa4546c3e473d062ULL,+	0x928fce349455f860ULL,0x48161bbacaab94d9ULL,0x63912430770e6f68ULL,0x6ec8a5e602c6641cULL,+	0x87282515337ddd2bULL,0x2cda6b42034b701bULL,0xb03d37c181cb096dULL,0xe108438266c71c6fULL,+	0x2b3180c7eb51b255ULL,0xdf92b82f96c08bbcULL,0x5c68c8c0a632f3baULL,0x5504cc861c3d0556ULL,+	0xabbfa4e55fb26b8fULL,0x41848b0ab3baceb4ULL,0xb334a273aa445d32ULL,0xbca696f0a85ad881ULL,+	0x24f6ec65b528d56cULL,0x0ce1512e90f4524aULL,0x4e9dd79d5506d35aULL,0x258905fac6ce9779ULL,+	0x2019295b3e109b33ULL,0xf8a9478b73a054ccULL,0x2924f2f934417eb0ULL,0x3993357d536d1bc4ULL,+	0x38a81ac21db6ff8bULL,0x47c4fbf17d6016bfULL,0x1e0faadd7667e3f5ULL,0x7abcff62938beb96ULL,+	0xa78dad948fc179c9ULL,0x8f1f98b72911e50dULL,0x61e48eae27121a91ULL,0x4d62f7ad31859808ULL,+	0xeceba345ef5ceaebULL,0xf5ceb25ebc9684ceULL,0xf633e20cb7f76221ULL,0xa32cdf06ab8293e4ULL,+	0x985a202ca5ee2ca4ULL,0xcf0b8447cc8a8fb1ULL,0x9f765244979859a3ULL,0xa8d516b1a1240017ULL,+	0x0bd7ba3ebb5dc726ULL,0xe54bca55b86adb39ULL,0x1d7a3afd6c478063ULL,0x519ec608e7669eddULL,+	0x0e5715a2d149aa23ULL,0x177d4571848ff194ULL,0xeeb55f3241014c22ULL,0x0f5e5ca13a6e2ec2ULL,+	0x8029927b75f5c361ULL,0xad139fabc3d6e436ULL,0x0d5df1a94ccf402fULL,0x3e8bd948bea5dfc8ULL,+	0xa5a0d357bd3ff77eULL,0xa2d12e251f74f645ULL,0x66fd9e525e81a082ULL,0x2e0c90ce7f687a49ULL,+	0xc2e8bcbeba973bc5ULL,0x000001bce509745fULL,0x423777bbe6dab3d6ULL,0xd1661c7eaef06eb5ULL,+	0xa1781f354daacfd8ULL,0x2d11284a2b16affcULL,0xf1fc4f67fa891d1fULL,0x73ecc25dcb920adaULL,+	0xae610c22c2a12651ULL,0x96e0a810d356b78aULL,0x5a9a381f2fe7870fULL,0xd5ad62ede94e5530ULL,+	0xd225e5e8368d1427ULL,0x65977b70c7af4631ULL,0x99f889b2de39d74fULL,0x233f30bf54e1d143ULL,+	0x9a9675d3d9a63c97ULL,0x5470554ff334f9a8ULL,0x166acb744a4f5688ULL,0x70c74caab2e4aeadULL,+	0xf0d091646f294d12ULL,0x57b82a89684031d1ULL,0xefd95a5a61be0b6bULL,0x2fbd12e969f2f29aULL,+	0x9bd37013feff9fe8ULL,0x3f9b0404d6085a06ULL,0x4940c1f3166cfe15ULL,0x09542c4dcdf3defbULL,+	0xb4c5218385cd5ce3ULL,0xc935b7dc4462a641ULL,0x3417f8a68ed3b63fULL,0xb80959295b215b40ULL,+	0xf99cdaef3b8c8572ULL,0x018c0614f8fcb95dULL,0x1b14accd1a3acdf3ULL,0x84d471f200bb732dULL,+	0xc1a3110e95e8da16ULL,0x430a7220bf1a82b8ULL,0xb77e090d39df210eULL,0x5ef4bd9f3cd05e9dULL,+	0x9d4ff6da7e57a444ULL,0xda1d60e183d4a5f8ULL,0xb287c38417998e47ULL,0xfe3edc121bb31886ULL,+	0xc7fe3ccc980ccbefULL,0xe46fb590189bfd03ULL,0x3732fd469a4c57dcULL,0x7ef700a07cf1ad65ULL,+	0x59c64468a31d8859ULL,0x762fb0b4d45b61f6ULL,0x155baed099047718ULL,0x68755e4c3d50baa6ULL,+	0xe9214e7f22d8b4dfULL,0x2addbf532eac95f4ULL,0x32ae3909b4bd0109ULL,0x834df537b08e3450ULL,+	0xfa209da84220728dULL,0x9e691d9b9efe23f7ULL,0x0446d288c4ae8d7fULL,0x7b4cc524e169785bULL,+	0x21d87f0135ca1385ULL,0xcebb400f137b8aa5ULL,0x272e2b66580796beULL,0x3612264125c2b0deULL,+	0x057702bdad1efbb2ULL,0xd4babb8eacf84be9ULL,0x91583139641bc67bULL,0x8bdc2de08036e024ULL,+	0x603c8156f49f68edULL,0xf7d236f7dbef5111ULL,0x9727c4598ad21e80ULL,0xa08a0896670a5fd7ULL,+	0xcb4a8f4309eba9cbULL,0x81af564b0f7036a1ULL,0xc0b99aa778199abdULL,0x959f1ec83fc8e952ULL,+	0x8c505077794a81b9ULL,0x3acaaf8f056338f0ULL,0x07b43f50627a6778ULL,0x4a44ab49f5eccc77ULL,+	0x3bc3d6e4b679ee98ULL,0x9cc0d4d1cf14108cULL,0x4406c00b206bc8a0ULL,0x82a18854c8d72d89ULL,+	0x67e366b35c3c432cULL,0xb923dd61102b37f2ULL,0x56ab2779d884271dULL,0xbe83e1b0ff1525afULL,+	0xfb7c65d4217e49a9ULL,0x6bdbe0e76d48e7d4ULL,0x08df828745d9179eULL,0x22ea6a9add53bd34ULL,+	0xe36e141c5622200aULL,0x7f805d1b8cb750eeULL,0xafe5c7a59f58e837ULL,0xe27f996a4fb1c23cULL,+	0xd3867dfb0775f0d0ULL,0xd0e673de6e88891aULL,0x123aeb9eafb86c25ULL,0x30f1d5d5c145b895ULL,+	0xbb434a2dee7269e7ULL,0x78cb67ecf931fa38ULL,0xf33b0372323bbf9cULL,0x52d66336fb279c74ULL,+	0x505f33ac0afb4eaaULL,0xe8a5cd99a2cce187ULL,0x534974801e2d30bbULL,0x8d2d5711d5876d90ULL,+	0x1f1a412891bc038eULL,0xd6e2e71d82e56648ULL,0x74036c3a497732b7ULL,0x89b67ed96361f5abULL,+	0xffed95d8f1ea02a2ULL,0xe72b3bd61464d43dULL,0xa6300f170bdc4820ULL,0xebc18760ed78a77aULL,+};++static const uint64_t t2[256] =+{+	0xe6a6be5a05a12138ULL,0xb5a122a5b4f87c98ULL,0x563c6089140b6990ULL,0x4c46cb2e391f5dd5ULL,+	0xd932addbc9b79434ULL,0x08ea70e42015aff5ULL,0xd765a6673e478cf1ULL,0xc4fb757eab278d99ULL,+	0xdf11c6862d6e0692ULL,0xddeb84f10d7f3b16ULL,0x6f2ef604a665ea04ULL,0x4a8e0f0ff0e0dfb3ULL,+	0xa5edeef83dbcba51ULL,0xfc4f0a2a0ea4371eULL,0xe83e1da85cb38429ULL,0xdc8ff882ba1b1ce2ULL,+	0xcd45505e8353e80dULL,0x18d19a00d4db0717ULL,0x34a0cfeda5f38101ULL,0x0be77e518887caf2ULL,+	0x1e341438b3c45136ULL,0xe05797f49089ccf9ULL,0xffd23f9df2591d14ULL,0x543dda228595c5cdULL,+	0x661f81fd99052a33ULL,0x8736e641db0f7b76ULL,0x15227725418e5307ULL,0xe25f7f46162eb2faULL,+	0x48a8b2126c13d9feULL,0xafdc541792e76eeaULL,0x03d912bfc6d1898fULL,0x31b1aafa1b83f51bULL,+	0xf1ac2796e42ab7d9ULL,0x40a3a7d7fcd2ebacULL,0x1056136d0afbbcc5ULL,0x7889e1dd9a6d0c85ULL,+	0xd33525782a7974aaULL,0xa7e25d09078ac09bULL,0xbd4138b3eac6edd0ULL,0x920abfbe71eb9e70ULL,+	0xa2a5d0f54fc2625cULL,0xc054e36b0b1290a3ULL,0xf6dd59ff62fe932bULL,0x3537354511a8ac7dULL,+	0xca845e9172fadcd4ULL,0x84f82b60329d20dcULL,0x79c62ce1cd672f18ULL,0x8b09a2add124642cULL,+	0xd0c1e96a19d9e726ULL,0x5a786a9b4ba9500cULL,0x0e020336634c43f3ULL,0xc17b474aeb66d822ULL,+	0x6a731ae3ec9baac2ULL,0x8226667ae0840258ULL,0x67d4567691caeca5ULL,0x1d94155c4875adb5ULL,+	0x6d00fd985b813fdfULL,0x51286efcb774cd06ULL,0x5e8834471fa744afULL,0xf72ca0aee761ae2eULL,+	0xbe40e4cdaee8e09aULL,0xe9970bbb5118f665ULL,0x726e4beb33df1964ULL,0x703b000729199762ULL,+	0x4631d816f5ef30a7ULL,0xb880b5b51504a6beULL,0x641793c37ed84b6cULL,0x7b21ed77f6e97d96ULL,+	0x776306312ef96b73ULL,0xae528948e86ff3f4ULL,0x53dbd7f286a3f8f8ULL,0x16cadce74cfc1063ULL,+	0x005c19bdfa52c6ddULL,0x68868f5d64d46ad3ULL,0x3a9d512ccf1e186aULL,0x367e62c2385660aeULL,+	0xe359e7ea77dcb1d7ULL,0x526c0773749abe6eULL,0x735ae5f9d09f734bULL,0x493fc7cc8a558ba8ULL,+	0xb0b9c1533041ab45ULL,0x321958ba470a59bdULL,0x852db00b5f46c393ULL,0x91209b2bd336b0e5ULL,+	0x6e604f7d659ef19fULL,0xb99a8ae2782ccb24ULL,0xccf52ab6c814c4c7ULL,0x4727d9afbe11727bULL,+	0x7e950d0c0121b34dULL,0x756f435670ad471fULL,0xf5add442615a6849ULL,0x4e87e09980b9957aULL,+	0x2acfa1df50aee355ULL,0xd898263afd2fd556ULL,0xc8f4924dd80c8fd6ULL,0xcf99ca3d754a173aULL,+	0xfe477bacaf91bf3cULL,0xed5371f6d690c12dULL,0x831a5c285e687094ULL,0xc5d3c90a3708a0a4ULL,+	0x0f7f903717d06580ULL,0x19f9bb13b8fdf27fULL,0xb1bd6f1b4d502843ULL,0x1c761ba38fff4012ULL,+	0x0d1530c4e2e21f3bULL,0x8943ce69a7372c8aULL,0xe5184e11feb5ce66ULL,0x618bdb80bd736621ULL,+	0x7d29bad68b574d0bULL,0x81bb613e25e6fe5bULL,0x071c9c10bc07913fULL,0xc7beeb7909ac2d97ULL,+	0xc3e58d353bc5d757ULL,0xeb017892f38f61e8ULL,0xd4effb9c9b1cc21aULL,0x99727d26f494f7abULL,+	0xa3e063a2956b3e03ULL,0x9d4a8b9a4aa09c30ULL,0x3f6ab7d500090fb4ULL,0x9cc0f2a057268ac0ULL,+	0x3dee9d2dedbf42d1ULL,0x330f49c87960a972ULL,0xc6b2720287421b41ULL,0x0ac59ec07c00369cULL,+	0xef4eac49cb353425ULL,0xf450244eef0129d8ULL,0x8acc46e5caf4deb6ULL,0x2ffeab63989263f7ULL,+	0x8f7cb9fe5d7a4578ULL,0x5bd8f7644e634635ULL,0x427a7315bf2dc900ULL,0x17d0c4aa2125261cULL,+	0x3992486c93518e50ULL,0xb4cbfee0a2d7d4c3ULL,0x7c75d6202c5ddd8dULL,0xdbc295d8e35b6c61ULL,+	0x60b369d302032b19ULL,0xce42685fdce44132ULL,0x06f3ddb9ddf65610ULL,0x8ea4d21db5e148f0ULL,+	0x20b0fce62fcd496fULL,0x2c1b912358b0ee31ULL,0xb28317b818f5a308ULL,0xa89c1e189ca6d2cfULL,+	0x0c6b18576aaadbc8ULL,0xb65deaa91299fae3ULL,0xfb2b794b7f1027e7ULL,0x04e4317f443b5bebULL,+	0x4b852d325939d0a6ULL,0xd5ae6beefb207ffcULL,0x309682b281c7d374ULL,0xbae309a194c3b475ULL,+	0x8cc3f97b13b49f05ULL,0x98a9422ff8293967ULL,0x244b16b01076ff7cULL,0xf8bf571c663d67eeULL,+	0x1f0d6758eee30da1ULL,0xc9b611d97adeb9b7ULL,0xb7afd5887b6c57a2ULL,0x6290ae846b984fe1ULL,+	0x94df4cdeacc1a5fdULL,0x058a5bd1c5483affULL,0x63166cc142ba3c37ULL,0x8db8526eb2f76f40ULL,+	0xe10880036f0d6d4eULL,0x9e0523c9971d311dULL,0x45ec2824cc7cd691ULL,0x575b8359e62382c9ULL,+	0xfa9e400dc4889995ULL,0xd1823ecb45721568ULL,0xdafd983b8206082fULL,0xaa7d29082386a8cbULL,+	0x269fcd4403b87588ULL,0x1b91f5f728bdd1e0ULL,0xe4669f39040201f6ULL,0x7a1d7c218cf04adeULL,+	0x65623c29d79ce5ceULL,0x2368449096c00bb1ULL,0xab9bf1879da503baULL,0xbc23ecb1a458058eULL,+	0x9a58df01bb401eccULL,0xa070e868a85f143dULL,0x4ff188307df2239eULL,0x14d565b41a641183ULL,+	0xee13337452701602ULL,0x950e3dcf3f285e09ULL,0x59930254b9c80953ULL,0x3bf299408930da6dULL,+	0xa955943f53691387ULL,0xa15edecaa9cb8784ULL,0x29142127352be9a0ULL,0x76f0371fff4e7afbULL,+	0x0239f450274f2228ULL,0xbb073af01d5e868bULL,0xbfc80571c10e96c1ULL,0xd267088568222e23ULL,+	0x9671a3d48e80b5b0ULL,0x55b5d38ae193bb81ULL,0x693ae2d0a18b04b8ULL,0x5c48b4ecadd5335fULL,+	0xfd743b194916a1caULL,0x2577018134be98c4ULL,0xe77987e83c54a4adULL,0x28e11014da33e1b9ULL,+	0x270cc59e226aa213ULL,0x71495f756d1a5f60ULL,0x9be853fb60afef77ULL,0xadc786a7f7443dbfULL,+	0x0904456173b29a82ULL,0x58bc7a66c232bd5eULL,0xf306558c673ac8b2ULL,0x41f639c6b6c9772aULL,+	0x216defe99fda35daULL,0x11640cc71c7be615ULL,0x93c43694565c5527ULL,0xea038e6246777839ULL,+	0xf9abf3ce5a3e2469ULL,0x741e768d0fd312d2ULL,0x0144b883ced652c6ULL,0xc20b5a5ba33f8552ULL,+	0x1ae69633c3435a9dULL,0x97a28ca4088cfdecULL,0x8824a43c1e96f420ULL,0x37612fa66eeea746ULL,+	0x6b4cb165f9cf0e5aULL,0x43aa1c06a0abfb4aULL,0x7f4dc26ff162796bULL,0x6cbacc8e54ed9b0fULL,+	0xa6b7ffefd2bb253eULL,0x2e25bc95b0a29d4fULL,0x86d6a58bdef1388cULL,0xded74ac576b6f054ULL,+	0x8030bdbc2b45805dULL,0x3c81af70e94d9289ULL,0x3eff6dda9e3100dbULL,0xb38dc39fdfcc8847ULL,+	0x123885528d17b87eULL,0xf2da0ed240b1b642ULL,0x44cefadcd54bf9a9ULL,0x1312200e433c7ee6ULL,+	0x9ffcc84f3a78c748ULL,0xf0cd1f72248576bbULL,0xec6974053638cfe4ULL,0x2ba7b67c0cec4e4cULL,+	0xac2f4df3e5ce32edULL,0xcb33d14326ea4c11ULL,0xa4e9044cc77e58bcULL,0x5f513293d934fcefULL,+	0x5dc9645506e55444ULL,0x50de418f317de40aULL,0x388cb31a69dde259ULL,0x2db4a83455820a86ULL,+	0x9010a91e84711ae9ULL,0x4df7f0b7b1498371ULL,0xd62a2eabc0977179ULL,0x22fac097aa8d5c0eULL,+}; ++static const uint64_t t3[256]= {+	0xf49fcc2ff1daf39bULL,0x487fd5c66ff29281ULL,0xe8a30667fcdca83fULL,0x2c9b4be3d2fcce63ULL,+	0xda3ff74b93fbbbc2ULL,0x2fa165d2fe70ba66ULL,0xa103e279970e93d4ULL,0xbecdec77b0e45e71ULL,+	0xcfb41e723985e497ULL,0xb70aaa025ef75017ULL,0xd42309f03840b8e0ULL,0x8efc1ad035898579ULL,+	0x96c6920be2b2abc5ULL,0x66af4163375a9172ULL,0x2174abdcca7127fbULL,0xb33ccea64a72ff41ULL,+	0xf04a4933083066a5ULL,0x8d970acdd7289af5ULL,0x8f96e8e031c8c25eULL,0xf3fec02276875d47ULL,+	0xec7bf310056190ddULL,0xf5adb0aebb0f1491ULL,0x9b50f8850fd58892ULL,0x4975488358b74de8ULL,+	0xa3354ff691531c61ULL,0x0702bbe481d2c6eeULL,0x89fb24057deded98ULL,0xac3075138596e902ULL,+	0x1d2d3580172772edULL,0xeb738fc28e6bc30dULL,0x5854ef8f63044326ULL,0x9e5c52325add3bbeULL,+	0x90aa53cf325c4623ULL,0xc1d24d51349dd067ULL,0x2051cfeea69ea624ULL,0x13220f0a862e7e4fULL,+	0xce39399404e04864ULL,0xd9c42ca47086fcb7ULL,0x685ad2238a03e7ccULL,0x066484b2ab2ff1dbULL,+	0xfe9d5d70efbf79ecULL,0x5b13b9dd9c481854ULL,0x15f0d475ed1509adULL,0x0bebcd060ec79851ULL,+	0xd58c6791183ab7f8ULL,0xd1187c5052f3eee4ULL,0xc95d1192e54e82ffULL,0x86eea14cb9ac6ca2ULL,+	0x3485beb153677d5dULL,0xdd191d781f8c492aULL,0xf60866baa784ebf9ULL,0x518f643ba2d08c74ULL,+	0x8852e956e1087c22ULL,0xa768cb8dc410ae8dULL,0x38047726bfec8e1aULL,0xa67738b4cd3b45aaULL,+	0xad16691cec0dde19ULL,0xc6d4319380462e07ULL,0xc5a5876d0ba61938ULL,0x16b9fa1fa58fd840ULL,+	0x188ab1173ca74f18ULL,0xabda2f98c99c021fULL,0x3e0580ab134ae816ULL,0x5f3b05b773645abbULL,+	0x2501a2be5575f2f6ULL,0x1b2f74004e7e8ba9ULL,0x1cd7580371e8d953ULL,0x7f6ed89562764e30ULL,+	0xb15926ff596f003dULL,0x9f65293da8c5d6b9ULL,0x6ecef04dd690f84cULL,0x4782275fff33af88ULL,+	0xe41433083f820801ULL,0xfd0dfe409a1af9b5ULL,0x4325a3342cdb396bULL,0x8ae77e62b301b252ULL,+	0xc36f9e9f6655615aULL,0x85455a2d92d32c09ULL,0xf2c7dea949477485ULL,0x63cfb4c133a39ebaULL,+	0x83b040cc6ebc5462ULL,0x3b9454c8fdb326b0ULL,0x56f56a9e87ffd78cULL,0x2dc2940d99f42bc6ULL,+	0x98f7df096b096e2dULL,0x19a6e01e3ad852bfULL,0x42a99ccbdbd4b40bULL,0xa59998af45e9c559ULL,+	0x366295e807d93186ULL,0x6b48181bfaa1f773ULL,0x1fec57e2157a0a1dULL,0x4667446af6201ad5ULL,+	0xe615ebcacfb0f075ULL,0xb8f31f4f68290778ULL,0x22713ed6ce22d11eULL,0x3057c1a72ec3c93bULL,+	0xcb46acc37c3f1f2fULL,0xdbb893fd02aaf50eULL,0x331fd92e600b9fcfULL,0xa498f96148ea3ad6ULL,+	0xa8d8426e8b6a83eaULL,0xa089b274b7735cdcULL,0x87f6b3731e524a11ULL,0x118808e5cbc96749ULL,+	0x9906e4c7b19bd394ULL,0xafed7f7e9b24a20cULL,0x6509eadeeb3644a7ULL,0x6c1ef1d3e8ef0edeULL,+	0xb9c97d43e9798fb4ULL,0xa2f2d784740c28a3ULL,0x7b8496476197566fULL,0x7a5be3e6b65f069dULL,+	0xf96330ed78be6f10ULL,0xeee60de77a076a15ULL,0x2b4bee4aa08b9bd0ULL,0x6a56a63ec7b8894eULL,+	0x02121359ba34fef4ULL,0x4cbf99f8283703fcULL,0x398071350caf30c8ULL,0xd0a77a89f017687aULL,+	0xf1c1a9eb9e423569ULL,0x8c7976282dee8199ULL,0x5d1737a5dd1f7abdULL,0x4f53433c09a9fa80ULL,+	0xfa8b0c53df7ca1d9ULL,0x3fd9dcbc886ccb77ULL,0xc040917ca91b4720ULL,0x7dd00142f9d1dcdfULL,+	0x8476fc1d4f387b58ULL,0x23f8e7c5f3316503ULL,0x032a2244e7e37339ULL,0x5c87a5d750f5a74bULL,+	0x082b4cc43698992eULL,0xdf917becb858f63cULL,0x3270b8fc5bf86ddaULL,0x10ae72bb29b5dd76ULL,+	0x576ac94e7700362bULL,0x1ad112dac61efb8fULL,0x691bc30ec5faa427ULL,0xff246311cc327143ULL,+	0x3142368e30e53206ULL,0x71380e31e02ca396ULL,0x958d5c960aad76f1ULL,0xf8d6f430c16da536ULL,+	0xc8ffd13f1be7e1d2ULL,0x7578ae66004ddbe1ULL,0x05833f01067be646ULL,0xbb34b5ad3bfe586dULL,+	0x095f34c9a12b97f0ULL,0x247ab64525d60ca8ULL,0xdcdbc6f3017477d1ULL,0x4a2e14d4decad24dULL,+	0xbdb5e6d9be0a1eebULL,0x2a7e70f7794301abULL,0xdef42d8a270540fdULL,0x01078ec0a34c22c1ULL,+	0xe5de511af4c16387ULL,0x7ebb3a52bd9a330aULL,0x77697857aa7d6435ULL,0x004e831603ae4c32ULL,+	0xe7a21020ad78e312ULL,0x9d41a70c6ab420f2ULL,0x28e06c18ea1141e6ULL,0xd2b28cbd984f6b28ULL,+	0x26b75f6c446e9d83ULL,0xba47568c4d418d7fULL,0xd80badbfe6183d8eULL,0x0e206d7f5f166044ULL,+	0xe258a43911cbca3eULL,0x723a1746b21dc0bcULL,0xc7caa854f5d7cdd3ULL,0x7cac32883d261d9cULL,+	0x7690c26423ba942cULL,0x17e55524478042b8ULL,0xe0be477656a2389fULL,0x4d289b5e67ab2da0ULL,+	0x44862b9c8fbbfd31ULL,0xb47cc8049d141365ULL,0x822c1b362b91c793ULL,0x4eb14655fb13dfd8ULL,+	0x1ecbba0714e2a97bULL,0x6143459d5cde5f14ULL,0x53a8fbf1d5f0ac89ULL,0x97ea04d81c5e5b00ULL,+	0x622181a8d4fdb3f3ULL,0xe9bcd341572a1208ULL,0x1411258643cce58aULL,0x9144c5fea4c6e0a4ULL,+	0x0d33d06565cf620fULL,0x54a48d489f219ca1ULL,0xc43e5eac6d63c821ULL,0xa9728b3a72770dafULL,+	0xd7934e7b20df87efULL,0xe35503b61a3e86e5ULL,0xcae321fbc819d504ULL,0x129a50b3ac60bfa6ULL,+	0xcd5e68ea7e9fb6c3ULL,0xb01c90199483b1c7ULL,0x3de93cd5c295376cULL,0xaed52edf2ab9ad13ULL,+	0x2e60f512c0a07884ULL,0xbc3d86a3e36210c9ULL,0x35269d9b163951ceULL,0x0c7d6e2ad0cdb5faULL,+	0x59e86297d87f5733ULL,0x298ef221898db0e7ULL,0x55000029d1a5aa7eULL,0x8bc08ae1b5061b45ULL,+	0xc2c31c2b6c92703aULL,0x94cc596baf25ef42ULL,0x0a1d73db22540456ULL,0x04b6a0f9d9c4179aULL,+	0xeffdafa2ae3d3c60ULL,0xf7c8075bb49496c4ULL,0x9cc5c7141d1cd4e3ULL,0x78bd1638218e5534ULL,+	0xb2f11568f850246aULL,0xedfabcfa9502bc29ULL,0x796ce5f2da23051bULL,0xaae128b0dc93537cULL,+	0x3a493da0ee4b29aeULL,0xb5df6b2c416895d7ULL,0xfcabbd25122d7f37ULL,0x70810b58105dc4b1ULL,+	0xe10fdd37f7882a90ULL,0x524dcab5518a3f5cULL,0x3c9e85878451255bULL,0x4029828119bd34e2ULL,+	0x74a05b6f5d3ceccbULL,0xb610021542e13ecaULL,0x0ff979d12f59e2acULL,0x6037da27e4f9cc50ULL,+	0x5e92975a0df1847dULL,0xd66de190d3e623feULL,0x5032d6b87b568048ULL,0x9a36b7ce8235216eULL,+	0x80272a7a24f64b4aULL,0x93efed8b8c6916f7ULL,0x37ddbff44cce1555ULL,0x4b95db5d4b99bd25ULL,+	0x92d3fda169812fc0ULL,0xfb1a4a9a90660bb6ULL,0x730c196946a4b9b2ULL,0x81e289aa7f49da68ULL,+	0x64669a0f83b1a05fULL,0x27b3ff7d9644f48bULL,0xcc6b615c8db675b3ULL,0x674f20b9bcebbe95ULL,+	0x6f31238275655982ULL,0x5ae488713e45cf05ULL,0xbf619f9954c21157ULL,0xeabac46040a8eae9ULL,+	0x454c6fe9f2c0c1cdULL,0x419cf6496412691cULL,0xd3dc3bef265b0f70ULL,0x6d0e60f5c3578a9eULL,+};++static const uint64_t t4[256]=+{+	0x5b0e608526323c55ULL,0x1a46c1a9fa1b59f5ULL, 0xa9e245a17c4c8ffaULL,0x65ca5159db2955d7ULL,+	0x05db0a76ce35afc2ULL,0x81eac77ea9113d45ULL, 0x528ef88ab6ac0a0dULL,0xa09ea253597be3ffULL,+	0x430ddfb3ac48cd56ULL,0xc4b3a67af45ce46fULL, 0x4ececfd8fbe2d05eULL,0x3ef56f10b39935f0ULL,+	0x0b22d6829cd619c6ULL,0x17fd460a74df2069ULL, 0x6cf8cc8e8510ed40ULL,0xd6c824bf3a6ecaa7ULL,+	0x61243d581a817049ULL,0x048bacb6bbc163a2ULL, 0xd9a38ac27d44cc32ULL,0x7fddff5baaf410abULL,+	0xad6d495aa804824bULL,0xe1a6a74f2d8c9f94ULL, 0xd4f7851235dee8e3ULL,0xfd4b7f886540d893ULL,+	0x247c20042aa4bfdaULL,0x096ea1c517d1327cULL, 0xd56966b4361a6685ULL,0x277da5c31221057dULL,+	0x94d59893a43acff7ULL,0x64f0c51ccdc02281ULL, 0x3d33bcc4ff6189dbULL,0xe005cb184ce66af1ULL,+	0xff5ccd1d1db99beaULL,0xb0b854a7fe42980fULL, 0x7bd46a6a718d4b9fULL,0xd10fa8cc22a5fd8cULL,+	0xd31484952be4bd31ULL,0xc7fa975fcb243847ULL, 0x4886ed1e5846c407ULL,0x28cddb791eb70b04ULL,+	0xc2b00be2f573417fULL,0x5c9590452180f877ULL, 0x7a6bddfff370eb00ULL,0xce509e38d6d9d6a4ULL,+	0xebeb0f00647fa702ULL,0x1dcc06cf76606f06ULL, 0xe4d9f28ba286ff0aULL,0xd85a305dc918c262ULL,+	0x475b1d8732225f54ULL,0x2d4fb51668ccb5feULL, 0xa679b9d9d72bba20ULL,0x53841c0d912d43a5ULL,+	0x3b7eaa48bf12a4e8ULL,0x781e0e47f22f1ddfULL, 0xeff20ce60ab50973ULL,0x20d261d19dffb742ULL,+	0x16a12b03062a2e39ULL,0x1960eb2239650495ULL, 0x251c16fed50eb8b8ULL,0x9ac0c330f826016eULL,+	0xed152665953e7671ULL,0x02d63194a6369570ULL, 0x5074f08394b1c987ULL,0x70ba598c90b25ce1ULL,+	0x794a15810b9742f6ULL,0x0d5925e9fcaf8c6cULL, 0x3067716cd868744eULL,0x910ab077e8d7731bULL,+	0x6a61bbdb5ac42f61ULL,0x93513efbf0851567ULL, 0xf494724b9e83e9d5ULL,0xe887e1985c09648dULL,+	0x34b1d3c675370cfdULL,0xdc35e433bc0d255dULL, 0xd0aab84234131be0ULL,0x08042a50b48b7eafULL,+	0x9997c4ee44a3ab35ULL,0x829a7b49201799d0ULL, 0x263b8307b7c54441ULL,0x752f95f4fd6a6ca6ULL,+	0x927217402c08c6e5ULL,0x2a8ab754a795d9eeULL, 0xa442f7552f72943dULL,0x2c31334e19781208ULL,+	0x4fa98d7ceaee6291ULL,0x55c3862f665db309ULL, 0xbd0610175d53b1f3ULL,0x46fe6cb840413f27ULL,+	0x3fe03792df0cfa59ULL,0xcfe700372eb85e8fULL, 0xa7be29e7adbce118ULL,0xe544ee5cde8431ddULL,+	0x8a781b1b41f1873eULL,0xa5c94c78a0d2f0e7ULL, 0x39412e2877b60728ULL,0xa1265ef3afc9a62cULL,+	0xbcc2770c6a2506c5ULL,0x3ab66dd5dce1ce12ULL, 0xe65499d04a675b37ULL,0x7d8f523481bfd216ULL,+	0x0f6f64fcec15f389ULL,0x74efbe618b5b13c8ULL, 0xacdc82b714273e1dULL,0xdd40bfe003199d17ULL,+	0x37e99257e7e061f8ULL,0xfa52626904775aaaULL, 0x8bbbf63a463d56f9ULL,0xf0013f1543a26e64ULL,+	0xa8307e9f879ec898ULL,0xcc4c27a4150177ccULL, 0x1b432f2cca1d3348ULL,0xde1d1f8f9f6fa013ULL,+	0x606602a047a7ddd6ULL,0xd237ab64cc1cb2c7ULL, 0x9b938e7225fcd1d3ULL,0xec4e03708e0ff476ULL,+	0xfeb2fbda3d03c12dULL,0xae0bced2ee43889aULL, 0x22cb8923ebfb4f43ULL,0x69360d013cf7396dULL,+	0x855e3602d2d4e022ULL,0x073805bad01f784cULL, 0x33e17a133852f546ULL,0xdf4874058ac7b638ULL,+	0xba92b29c678aa14aULL,0x0ce89fc76cfaadcdULL, 0x5f9d4e0908339e34ULL,0xf1afe9291f5923b9ULL,+	0x6e3480f60f4a265fULL,0xeebf3a2ab29b841cULL, 0xe21938a88f91b4adULL,0x57dfeff845c6d3c3ULL,+	0x2f006b0bf62caaf2ULL,0x62f479ef6f75ee78ULL, 0x11a55ad41c8916a9ULL,0xf229d29084fed453ULL,+	0x42f1c27b16b000e6ULL,0x2b1f76749823c074ULL, 0x4b76eca3c2745360ULL,0x8c98f463b91691bdULL,+	0x14bcc93cf1ade66aULL,0x8885213e6d458397ULL, 0x8e177df0274d4711ULL,0xb49b73b5503f2951ULL,+	0x10168168c3f96b6bULL,0x0e3d963b63cab0aeULL, 0x8dfc4b5655a1db14ULL,0xf789f1356e14de5cULL,+	0x683e68af4e51dac1ULL,0xc9a84f9d8d4b0fd9ULL, 0x3691e03f52a0f9d1ULL,0x5ed86e46e1878e80ULL,+	0x3c711a0e99d07150ULL,0x5a0865b20c4e9310ULL, 0x56fbfc1fe4f0682eULL,0xea8d5de3105edf9bULL,+	0x71abfdb12379187aULL,0x2eb99de1bee77b9cULL, 0x21ecc0ea33cf4523ULL,0x59a4d7521805c7a1ULL,+	0x3896f5eb56ae7c72ULL,0xaa638f3db18f75dcULL, 0x9f39358dabe9808eULL,0xb7defa91c00b72acULL,+	0x6b5541fd62492d92ULL,0x6dc6dee8f92e4d5bULL, 0x353f57abc4beea7eULL,0x735769d6da5690ceULL,+	0x0a234aa642391484ULL,0xf6f9508028f80d9dULL, 0xb8e319a27ab3f215ULL,0x31ad9c1151341a4dULL,+	0x773c22a57bef5805ULL,0x45c7561a07968633ULL, 0xf913da9e249dbe36ULL,0xda652d9b78a64c68ULL,+	0x4c27a97f3bc334efULL,0x76621220e66b17f4ULL, 0x967743899acd7d0bULL,0xf3ee5bcae0ed6782ULL,+	0x409f753600c879fcULL,0x06d09a39b5926db6ULL, 0x6f83aeb0317ac588ULL,0x01e6ca4a86381f21ULL,+	0x66ff3462d19f3025ULL,0x72207c24ddfd3bfbULL, 0x4af6b6d3e2ece2ebULL,0x9c994dbec7ea08deULL,+	0x49ace597b09a8bc4ULL,0xb38c4766cf0797baULL, 0x131b9373c57c2a75ULL,0xb1822cce61931e58ULL,+	0x9d7555b909ba1c0cULL,0x127fafdd937d11d2ULL, 0x29da3badc66d92e4ULL,0xa2c1d57154c2ecbcULL,+	0x58c5134d82f6fe24ULL,0x1c3ae3515b62274fULL, 0xe907c82e01cb8126ULL,0xf8ed091913e37fcbULL,+	0x3249d8f9c80046c9ULL,0x80cf9bede388fb63ULL, 0x1881539a116cf19eULL,0x5103f3f76bd52457ULL,+	0x15b7e6f5ae47f7a8ULL,0xdbd7c6ded47e9ccfULL, 0x44e55c410228bb1aULL,0xb647d4255edb4e99ULL,+	0x5d11882bb8aafc30ULL,0xf5098bbb29d3212aULL, 0x8fb5ea14e90296b3ULL,0x677b942157dd025aULL,+	0xfb58e7c0a390acb5ULL,0x89d3674c83bd4a01ULL, 0x9e2da4df4bf3b93bULL,0xfcc41e328cab4829ULL,+	0x03f38c96ba582c52ULL,0xcad1bdbd7fd85db2ULL, 0xbbb442c16082ae83ULL,0xb95fe86ba5da9ab0ULL,+	0xb22e04673771a93fULL,0x845358c9493152d8ULL, 0xbe2a488697b4541eULL,0x95a2dc2dd38e6966ULL,+	0xc02c11ac923c852bULL,0x2388b1990df2a87bULL, 0x7c8008fa1b4f37beULL,0x1f70d0c84d54e503ULL,+	0x5490adec7ece57d4ULL,0x002b3c27d9063a3aULL, 0x7eaea3848030a2bfULL,0xc602326ded2003c0ULL,+	0x83a7287d69a94086ULL,0xc57a5fcb30f57a8aULL, 0xb56844e479ebe779ULL,0xa373b40f05dcbce9ULL,+	0xd71a786e88570ee2ULL,0x879cbacdbde8f6a0ULL, 0x976ad1bcc164a32fULL,0xab21e25e9666d78bULL,+	0x901063aae5e5c33cULL,0x9818b34448698d90ULL, 0xe36487ae3e1e8abbULL,0xafbdf931893bdcb4ULL,+	0x6345a0dc5fbbd519ULL,0x8628fe269b9465caULL, 0x1e5d01603f9c51ecULL,0x4de44006a15049b7ULL,+	0xbf6c70e5f776cbb1ULL,0x411218f2ef552bedULL, 0xcb0c0708705a36a3ULL,0xe74d14754f986044ULL,+	0xcd56d9430ea8280eULL,0xc12591d7535f5065ULL, 0xc83223f1720aef96ULL,0xc3a0396f7363a51fULL,+}; ++void crypton_tiger_init(struct tiger_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x0123456789abcdefULL;+	ctx->h[1] = 0xfedcba9876543210ULL;+	ctx->h[2] = 0xf096a5b4c3b2e187ULL;+}++static inline void tiger_do_chunk(struct tiger_ctx *ctx, uint64_t *buf)+{+	uint64_t x0, x1, x2, x3, x4, x5, x6, x7;+	uint64_t a,b,c;+	a = ctx->h[0];+	b = ctx->h[1];+	c = ctx->h[2];++	x0 = cpu_to_le64(buf[0]); x1 = cpu_to_le64(buf[1]); x2 = cpu_to_le64(buf[2]); x3 = cpu_to_le64(buf[3]);+	x4 = cpu_to_le64(buf[4]); x5 = cpu_to_le64(buf[5]); x6 = cpu_to_le64(buf[6]); x7 = cpu_to_le64(buf[7]);++#define BYTEOF(c, n) ((uint8_t) (c >> ((n * 8))))++#define ROUND(a,b,c,x,mul)                                                          \+	c ^= x;                                                                     \+	a -= t1[BYTEOF(c,0)] ^ t2[BYTEOF(c,2)] ^ t3[BYTEOF(c,4)] ^ t4[BYTEOF(c,6)]; \+	b += t4[BYTEOF(c,1)] ^ t3[BYTEOF(c,3)] ^ t2[BYTEOF(c,5)] ^ t1[BYTEOF(c,7)]; \+	b *= mul;++#define PASS(a,b,c,mul)	     \+	ROUND(a,b,c,x0,mul); \+	ROUND(b,c,a,x1,mul); \+	ROUND(c,a,b,x2,mul); \+	ROUND(a,b,c,x3,mul); \+	ROUND(b,c,a,x4,mul); \+	ROUND(c,a,b,x5,mul); \+	ROUND(a,b,c,x6,mul); \+	ROUND(b,c,a,x7,mul)++#define SCHEDULE()                        \+	x0 -= x7 ^ 0xa5a5a5a5a5a5a5a5ULL; \+	x1 ^= x0;                         \+	x2 += x1;                         \+	x3 -= x2 ^ ((~x1)<<19);           \+	x4 ^= x3;                         \+	x5 += x4;                         \+	x6 -= x5 ^ ((~x4)>>23);           \+	x7 ^= x6;                         \+	x0 += x7;                         \+	x1 -= x0 ^ ((~x7)<<19);           \+	x2 ^= x1;                         \+	x3 += x2;                         \+	x4 -= x3 ^ ((~x2)>>23);           \+	x5 ^= x4;                         \+	x6 += x5;                         \+	x7 -= x6 ^ 0x0123456789abcdefULL++	PASS(a,b,c,5);+	SCHEDULE();+	PASS(c,a,b,7);+	SCHEDULE();+	PASS(b,c,a,9);++	ctx->h[0] ^= a;+	ctx->h[1] = b - ctx->h[1];+	ctx->h[2] += c;+}++void crypton_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		tiger_do_chunk(ctx, (uint64_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	if (need_alignment(data, 8)) {+		uint64_t tramp[8];+		ASSERT_ALIGNMENT(tramp, 8);+		for (; len >= 64; len -= 64, data += 64) {+			memcpy(tramp, data, 64);+			tiger_do_chunk(ctx, tramp);+		}+	} else {+		/* process as much 64-block as possible */+		for (; len >= 64; len -= 64, data += 64)+			tiger_do_chunk(ctx, (uint64_t *) data);+	}++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void crypton_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x01, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	crypton_tiger_update(ctx, padding, padlen);++	/* append length */+	crypton_tiger_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	store_le64(out   , ctx->h[0]);+	store_le64(out+ 8, ctx->h[1]);+	store_le64(out+16, ctx->h[2]);+}
+ cbits/crypton_tiger.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_TIGER_H+#define CRYPTOHASH_TIGER_H++#include <stdint.h>++struct tiger_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint64_t h[3];+};++#define TIGER_DIGEST_SIZE	24+#define TIGER_CTX_SIZE 		(sizeof(struct tiger_ctx))++void crypton_tiger_init(struct tiger_ctx *ctx);+void crypton_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len);+void crypton_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out);++#endif
+ cbits/crypton_whirlpool.c view
@@ -0,0 +1,1026 @@+/**+ * The Whirlpool hashing function.+ *+ * <P>+ * <b>References</b>+ *+ * <P>+ * The Whirlpool algorithm was developed by+ * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and+ * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.+ *+ * See+ *      P.S.L.M. Barreto, V. Rijmen,+ *      ``The Whirlpool hashing function,''+ *      NESSIE submission, 2000 (tweaked version, 2001),+ *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>+ * + * @author  Paulo S.L.M. Barreto+ * @author  Vincent Rijmen.+ *+ * @version 3.0 (2003.03.12)+ *+ * =============================================================================+ *+ * Differences from version 2.1:+ *+ * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).+ *+ * =============================================================================+ *+ * Differences from version 2.0:+ *+ * - Generation of ISO/IEC 10118-3 test vectors.+ * - Bug fix: nonzero carry was ignored when tallying the data length+ *      (this bug apparently only manifested itself when feeding data+ *      in pieces rather than in a single chunk at once).+ * - Support for MS Visual C++ 64-bit integer arithmetic.+ *+ * Differences from version 1.0:+ *+ * - Original S-box replaced by the tweaked, hardware-efficient version.+ *+ * =============================================================================+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ *+ */+/* Modified by Stijn van Drongelen for use in the cryptohash library.+*/++#include <stdlib.h>+#include <string.h>++#include "crypton_bitfn.h"+#include "crypton_whirlpool.h"++/* #define TRACE_INTERMEDIATE_VALUES */++/*+ * The number of rounds of the internal dedicated block cipher.+ */+#define R 10++/*+ * Though Whirlpool is endianness-neutral, the encryption tables are listed+ * in BIG-ENDIAN format, which is adopted throughout this implementation+ * (but little-endian notation would be equally suitable if consistently+ * employed).+ */++static const uint64_t C0[256] = {+	0x18186018c07830d8ULL, 0x23238c2305af4626ULL, 0xc6c63fc67ef991b8ULL, 0xe8e887e8136fcdfbULL,+	0x878726874ca113cbULL, 0xb8b8dab8a9626d11ULL, 0x0101040108050209ULL, 0x4f4f214f426e9e0dULL,+	0x3636d836adee6c9bULL, 0xa6a6a2a6590451ffULL, 0xd2d26fd2debdb90cULL, 0xf5f5f3f5fb06f70eULL,+	0x7979f979ef80f296ULL, 0x6f6fa16f5fcede30ULL, 0x91917e91fcef3f6dULL, 0x52525552aa07a4f8ULL,+	0x60609d6027fdc047ULL, 0xbcbccabc89766535ULL, 0x9b9b569baccd2b37ULL, 0x8e8e028e048c018aULL,+	0xa3a3b6a371155bd2ULL, 0x0c0c300c603c186cULL, 0x7b7bf17bff8af684ULL, 0x3535d435b5e16a80ULL,+	0x1d1d741de8693af5ULL, 0xe0e0a7e05347ddb3ULL, 0xd7d77bd7f6acb321ULL, 0xc2c22fc25eed999cULL,+	0x2e2eb82e6d965c43ULL, 0x4b4b314b627a9629ULL, 0xfefedffea321e15dULL, 0x575741578216aed5ULL,+	0x15155415a8412abdULL, 0x7777c1779fb6eee8ULL, 0x3737dc37a5eb6e92ULL, 0xe5e5b3e57b56d79eULL,+	0x9f9f469f8cd92313ULL, 0xf0f0e7f0d317fd23ULL, 0x4a4a354a6a7f9420ULL, 0xdada4fda9e95a944ULL,+	0x58587d58fa25b0a2ULL, 0xc9c903c906ca8fcfULL, 0x2929a429558d527cULL, 0x0a0a280a5022145aULL,+	0xb1b1feb1e14f7f50ULL, 0xa0a0baa0691a5dc9ULL, 0x6b6bb16b7fdad614ULL, 0x85852e855cab17d9ULL,+	0xbdbdcebd8173673cULL, 0x5d5d695dd234ba8fULL, 0x1010401080502090ULL, 0xf4f4f7f4f303f507ULL,+	0xcbcb0bcb16c08bddULL, 0x3e3ef83eedc67cd3ULL, 0x0505140528110a2dULL, 0x676781671fe6ce78ULL,+	0xe4e4b7e47353d597ULL, 0x27279c2725bb4e02ULL, 0x4141194132588273ULL, 0x8b8b168b2c9d0ba7ULL,+	0xa7a7a6a7510153f6ULL, 0x7d7de97dcf94fab2ULL, 0x95956e95dcfb3749ULL, 0xd8d847d88e9fad56ULL,+	0xfbfbcbfb8b30eb70ULL, 0xeeee9fee2371c1cdULL, 0x7c7ced7cc791f8bbULL, 0x6666856617e3cc71ULL,+	0xdddd53dda68ea77bULL, 0x17175c17b84b2eafULL, 0x4747014702468e45ULL, 0x9e9e429e84dc211aULL,+	0xcaca0fca1ec589d4ULL, 0x2d2db42d75995a58ULL, 0xbfbfc6bf9179632eULL, 0x07071c07381b0e3fULL,+	0xadad8ead012347acULL, 0x5a5a755aea2fb4b0ULL, 0x838336836cb51befULL, 0x3333cc3385ff66b6ULL,+	0x636391633ff2c65cULL, 0x02020802100a0412ULL, 0xaaaa92aa39384993ULL, 0x7171d971afa8e2deULL,+	0xc8c807c80ecf8dc6ULL, 0x19196419c87d32d1ULL, 0x494939497270923bULL, 0xd9d943d9869aaf5fULL,+	0xf2f2eff2c31df931ULL, 0xe3e3abe34b48dba8ULL, 0x5b5b715be22ab6b9ULL, 0x88881a8834920dbcULL,+	0x9a9a529aa4c8293eULL, 0x262698262dbe4c0bULL, 0x3232c8328dfa64bfULL, 0xb0b0fab0e94a7d59ULL,+	0xe9e983e91b6acff2ULL, 0x0f0f3c0f78331e77ULL, 0xd5d573d5e6a6b733ULL, 0x80803a8074ba1df4ULL,+	0xbebec2be997c6127ULL, 0xcdcd13cd26de87ebULL, 0x3434d034bde46889ULL, 0x48483d487a759032ULL,+	0xffffdbffab24e354ULL, 0x7a7af57af78ff48dULL, 0x90907a90f4ea3d64ULL, 0x5f5f615fc23ebe9dULL,+	0x202080201da0403dULL, 0x6868bd6867d5d00fULL, 0x1a1a681ad07234caULL, 0xaeae82ae192c41b7ULL,+	0xb4b4eab4c95e757dULL, 0x54544d549a19a8ceULL, 0x93937693ece53b7fULL, 0x222288220daa442fULL,+	0x64648d6407e9c863ULL, 0xf1f1e3f1db12ff2aULL, 0x7373d173bfa2e6ccULL, 0x12124812905a2482ULL,+	0x40401d403a5d807aULL, 0x0808200840281048ULL, 0xc3c32bc356e89b95ULL, 0xecec97ec337bc5dfULL,+	0xdbdb4bdb9690ab4dULL, 0xa1a1bea1611f5fc0ULL, 0x8d8d0e8d1c830791ULL, 0x3d3df43df5c97ac8ULL,+	0x97976697ccf1335bULL, 0x0000000000000000ULL, 0xcfcf1bcf36d483f9ULL, 0x2b2bac2b4587566eULL,+	0x7676c57697b3ece1ULL, 0x8282328264b019e6ULL, 0xd6d67fd6fea9b128ULL, 0x1b1b6c1bd87736c3ULL,+	0xb5b5eeb5c15b7774ULL, 0xafaf86af112943beULL, 0x6a6ab56a77dfd41dULL, 0x50505d50ba0da0eaULL,+	0x45450945124c8a57ULL, 0xf3f3ebf3cb18fb38ULL, 0x3030c0309df060adULL, 0xefef9bef2b74c3c4ULL,+	0x3f3ffc3fe5c37edaULL, 0x55554955921caac7ULL, 0xa2a2b2a2791059dbULL, 0xeaea8fea0365c9e9ULL,+	0x656589650fecca6aULL, 0xbabad2bab9686903ULL, 0x2f2fbc2f65935e4aULL, 0xc0c027c04ee79d8eULL,+	0xdede5fdebe81a160ULL, 0x1c1c701ce06c38fcULL, 0xfdfdd3fdbb2ee746ULL, 0x4d4d294d52649a1fULL,+	0x92927292e4e03976ULL, 0x7575c9758fbceafaULL, 0x06061806301e0c36ULL, 0x8a8a128a249809aeULL,+	0xb2b2f2b2f940794bULL, 0xe6e6bfe66359d185ULL, 0x0e0e380e70361c7eULL, 0x1f1f7c1ff8633ee7ULL,+	0x6262956237f7c455ULL, 0xd4d477d4eea3b53aULL, 0xa8a89aa829324d81ULL, 0x96966296c4f43152ULL,+	0xf9f9c3f99b3aef62ULL, 0xc5c533c566f697a3ULL, 0x2525942535b14a10ULL, 0x59597959f220b2abULL,+	0x84842a8454ae15d0ULL, 0x7272d572b7a7e4c5ULL, 0x3939e439d5dd72ecULL, 0x4c4c2d4c5a619816ULL,+	0x5e5e655eca3bbc94ULL, 0x7878fd78e785f09fULL, 0x3838e038ddd870e5ULL, 0x8c8c0a8c14860598ULL,+	0xd1d163d1c6b2bf17ULL, 0xa5a5aea5410b57e4ULL, 0xe2e2afe2434dd9a1ULL, 0x616199612ff8c24eULL,+	0xb3b3f6b3f1457b42ULL, 0x2121842115a54234ULL, 0x9c9c4a9c94d62508ULL, 0x1e1e781ef0663ceeULL,+	0x4343114322528661ULL, 0xc7c73bc776fc93b1ULL, 0xfcfcd7fcb32be54fULL, 0x0404100420140824ULL,+	0x51515951b208a2e3ULL, 0x99995e99bcc72f25ULL, 0x6d6da96d4fc4da22ULL, 0x0d0d340d68391a65ULL,+	0xfafacffa8335e979ULL, 0xdfdf5bdfb684a369ULL, 0x7e7ee57ed79bfca9ULL, 0x242490243db44819ULL,+	0x3b3bec3bc5d776feULL, 0xabab96ab313d4b9aULL, 0xcece1fce3ed181f0ULL, 0x1111441188552299ULL,+	0x8f8f068f0c890383ULL, 0x4e4e254e4a6b9c04ULL, 0xb7b7e6b7d1517366ULL, 0xebeb8beb0b60cbe0ULL,+	0x3c3cf03cfdcc78c1ULL, 0x81813e817cbf1ffdULL, 0x94946a94d4fe3540ULL, 0xf7f7fbf7eb0cf31cULL,+	0xb9b9deb9a1676f18ULL, 0x13134c13985f268bULL, 0x2c2cb02c7d9c5851ULL, 0xd3d36bd3d6b8bb05ULL,+	0xe7e7bbe76b5cd38cULL, 0x6e6ea56e57cbdc39ULL, 0xc4c437c46ef395aaULL, 0x03030c03180f061bULL,+	0x565645568a13acdcULL, 0x44440d441a49885eULL, 0x7f7fe17fdf9efea0ULL, 0xa9a99ea921374f88ULL,+	0x2a2aa82a4d825467ULL, 0xbbbbd6bbb16d6b0aULL, 0xc1c123c146e29f87ULL, 0x53535153a202a6f1ULL,+	0xdcdc57dcae8ba572ULL, 0x0b0b2c0b58271653ULL, 0x9d9d4e9d9cd32701ULL, 0x6c6cad6c47c1d82bULL,+	0x3131c43195f562a4ULL, 0x7474cd7487b9e8f3ULL, 0xf6f6fff6e309f115ULL, 0x464605460a438c4cULL,+	0xacac8aac092645a5ULL, 0x89891e893c970fb5ULL, 0x14145014a04428b4ULL, 0xe1e1a3e15b42dfbaULL,+	0x16165816b04e2ca6ULL, 0x3a3ae83acdd274f7ULL, 0x6969b9696fd0d206ULL, 0x09092409482d1241ULL,+	0x7070dd70a7ade0d7ULL, 0xb6b6e2b6d954716fULL, 0xd0d067d0ceb7bd1eULL, 0xeded93ed3b7ec7d6ULL,+	0xcccc17cc2edb85e2ULL, 0x424215422a578468ULL, 0x98985a98b4c22d2cULL, 0xa4a4aaa4490e55edULL,+	0x2828a0285d885075ULL, 0x5c5c6d5cda31b886ULL, 0xf8f8c7f8933fed6bULL, 0x8686228644a411c2ULL,+};++static const uint64_t C1[256] = {+	0xd818186018c07830ULL, 0x2623238c2305af46ULL, 0xb8c6c63fc67ef991ULL, 0xfbe8e887e8136fcdULL,+	0xcb878726874ca113ULL, 0x11b8b8dab8a9626dULL, 0x0901010401080502ULL, 0x0d4f4f214f426e9eULL,+	0x9b3636d836adee6cULL, 0xffa6a6a2a6590451ULL, 0x0cd2d26fd2debdb9ULL, 0x0ef5f5f3f5fb06f7ULL,+	0x967979f979ef80f2ULL, 0x306f6fa16f5fcedeULL, 0x6d91917e91fcef3fULL, 0xf852525552aa07a4ULL,+	0x4760609d6027fdc0ULL, 0x35bcbccabc897665ULL, 0x379b9b569baccd2bULL, 0x8a8e8e028e048c01ULL,+	0xd2a3a3b6a371155bULL, 0x6c0c0c300c603c18ULL, 0x847b7bf17bff8af6ULL, 0x803535d435b5e16aULL,+	0xf51d1d741de8693aULL, 0xb3e0e0a7e05347ddULL, 0x21d7d77bd7f6acb3ULL, 0x9cc2c22fc25eed99ULL,+	0x432e2eb82e6d965cULL, 0x294b4b314b627a96ULL, 0x5dfefedffea321e1ULL, 0xd5575741578216aeULL,+	0xbd15155415a8412aULL, 0xe87777c1779fb6eeULL, 0x923737dc37a5eb6eULL, 0x9ee5e5b3e57b56d7ULL,+	0x139f9f469f8cd923ULL, 0x23f0f0e7f0d317fdULL, 0x204a4a354a6a7f94ULL, 0x44dada4fda9e95a9ULL,+	0xa258587d58fa25b0ULL, 0xcfc9c903c906ca8fULL, 0x7c2929a429558d52ULL, 0x5a0a0a280a502214ULL,+	0x50b1b1feb1e14f7fULL, 0xc9a0a0baa0691a5dULL, 0x146b6bb16b7fdad6ULL, 0xd985852e855cab17ULL,+	0x3cbdbdcebd817367ULL, 0x8f5d5d695dd234baULL, 0x9010104010805020ULL, 0x07f4f4f7f4f303f5ULL,+	0xddcbcb0bcb16c08bULL, 0xd33e3ef83eedc67cULL, 0x2d0505140528110aULL, 0x78676781671fe6ceULL,+	0x97e4e4b7e47353d5ULL, 0x0227279c2725bb4eULL, 0x7341411941325882ULL, 0xa78b8b168b2c9d0bULL,+	0xf6a7a7a6a7510153ULL, 0xb27d7de97dcf94faULL, 0x4995956e95dcfb37ULL, 0x56d8d847d88e9fadULL,+	0x70fbfbcbfb8b30ebULL, 0xcdeeee9fee2371c1ULL, 0xbb7c7ced7cc791f8ULL, 0x716666856617e3ccULL,+	0x7bdddd53dda68ea7ULL, 0xaf17175c17b84b2eULL, 0x454747014702468eULL, 0x1a9e9e429e84dc21ULL,+	0xd4caca0fca1ec589ULL, 0x582d2db42d75995aULL, 0x2ebfbfc6bf917963ULL, 0x3f07071c07381b0eULL,+	0xacadad8ead012347ULL, 0xb05a5a755aea2fb4ULL, 0xef838336836cb51bULL, 0xb63333cc3385ff66ULL,+	0x5c636391633ff2c6ULL, 0x1202020802100a04ULL, 0x93aaaa92aa393849ULL, 0xde7171d971afa8e2ULL,+	0xc6c8c807c80ecf8dULL, 0xd119196419c87d32ULL, 0x3b49493949727092ULL, 0x5fd9d943d9869aafULL,+	0x31f2f2eff2c31df9ULL, 0xa8e3e3abe34b48dbULL, 0xb95b5b715be22ab6ULL, 0xbc88881a8834920dULL,+	0x3e9a9a529aa4c829ULL, 0x0b262698262dbe4cULL, 0xbf3232c8328dfa64ULL, 0x59b0b0fab0e94a7dULL,+	0xf2e9e983e91b6acfULL, 0x770f0f3c0f78331eULL, 0x33d5d573d5e6a6b7ULL, 0xf480803a8074ba1dULL,+	0x27bebec2be997c61ULL, 0xebcdcd13cd26de87ULL, 0x893434d034bde468ULL, 0x3248483d487a7590ULL,+	0x54ffffdbffab24e3ULL, 0x8d7a7af57af78ff4ULL, 0x6490907a90f4ea3dULL, 0x9d5f5f615fc23ebeULL,+	0x3d202080201da040ULL, 0x0f6868bd6867d5d0ULL, 0xca1a1a681ad07234ULL, 0xb7aeae82ae192c41ULL,+	0x7db4b4eab4c95e75ULL, 0xce54544d549a19a8ULL, 0x7f93937693ece53bULL, 0x2f222288220daa44ULL,+	0x6364648d6407e9c8ULL, 0x2af1f1e3f1db12ffULL, 0xcc7373d173bfa2e6ULL, 0x8212124812905a24ULL,+	0x7a40401d403a5d80ULL, 0x4808082008402810ULL, 0x95c3c32bc356e89bULL, 0xdfecec97ec337bc5ULL,+	0x4ddbdb4bdb9690abULL, 0xc0a1a1bea1611f5fULL, 0x918d8d0e8d1c8307ULL, 0xc83d3df43df5c97aULL,+	0x5b97976697ccf133ULL, 0x0000000000000000ULL, 0xf9cfcf1bcf36d483ULL, 0x6e2b2bac2b458756ULL,+	0xe17676c57697b3ecULL, 0xe68282328264b019ULL, 0x28d6d67fd6fea9b1ULL, 0xc31b1b6c1bd87736ULL,+	0x74b5b5eeb5c15b77ULL, 0xbeafaf86af112943ULL, 0x1d6a6ab56a77dfd4ULL, 0xea50505d50ba0da0ULL,+	0x5745450945124c8aULL, 0x38f3f3ebf3cb18fbULL, 0xad3030c0309df060ULL, 0xc4efef9bef2b74c3ULL,+	0xda3f3ffc3fe5c37eULL, 0xc755554955921caaULL, 0xdba2a2b2a2791059ULL, 0xe9eaea8fea0365c9ULL,+	0x6a656589650feccaULL, 0x03babad2bab96869ULL, 0x4a2f2fbc2f65935eULL, 0x8ec0c027c04ee79dULL,+	0x60dede5fdebe81a1ULL, 0xfc1c1c701ce06c38ULL, 0x46fdfdd3fdbb2ee7ULL, 0x1f4d4d294d52649aULL,+	0x7692927292e4e039ULL, 0xfa7575c9758fbceaULL, 0x3606061806301e0cULL, 0xae8a8a128a249809ULL,+	0x4bb2b2f2b2f94079ULL, 0x85e6e6bfe66359d1ULL, 0x7e0e0e380e70361cULL, 0xe71f1f7c1ff8633eULL,+	0x556262956237f7c4ULL, 0x3ad4d477d4eea3b5ULL, 0x81a8a89aa829324dULL, 0x5296966296c4f431ULL,+	0x62f9f9c3f99b3aefULL, 0xa3c5c533c566f697ULL, 0x102525942535b14aULL, 0xab59597959f220b2ULL,+	0xd084842a8454ae15ULL, 0xc57272d572b7a7e4ULL, 0xec3939e439d5dd72ULL, 0x164c4c2d4c5a6198ULL,+	0x945e5e655eca3bbcULL, 0x9f7878fd78e785f0ULL, 0xe53838e038ddd870ULL, 0x988c8c0a8c148605ULL,+	0x17d1d163d1c6b2bfULL, 0xe4a5a5aea5410b57ULL, 0xa1e2e2afe2434dd9ULL, 0x4e616199612ff8c2ULL,+	0x42b3b3f6b3f1457bULL, 0x342121842115a542ULL, 0x089c9c4a9c94d625ULL, 0xee1e1e781ef0663cULL,+	0x6143431143225286ULL, 0xb1c7c73bc776fc93ULL, 0x4ffcfcd7fcb32be5ULL, 0x2404041004201408ULL,+	0xe351515951b208a2ULL, 0x2599995e99bcc72fULL, 0x226d6da96d4fc4daULL, 0x650d0d340d68391aULL,+	0x79fafacffa8335e9ULL, 0x69dfdf5bdfb684a3ULL, 0xa97e7ee57ed79bfcULL, 0x19242490243db448ULL,+	0xfe3b3bec3bc5d776ULL, 0x9aabab96ab313d4bULL, 0xf0cece1fce3ed181ULL, 0x9911114411885522ULL,+	0x838f8f068f0c8903ULL, 0x044e4e254e4a6b9cULL, 0x66b7b7e6b7d15173ULL, 0xe0ebeb8beb0b60cbULL,+	0xc13c3cf03cfdcc78ULL, 0xfd81813e817cbf1fULL, 0x4094946a94d4fe35ULL, 0x1cf7f7fbf7eb0cf3ULL,+	0x18b9b9deb9a1676fULL, 0x8b13134c13985f26ULL, 0x512c2cb02c7d9c58ULL, 0x05d3d36bd3d6b8bbULL,+	0x8ce7e7bbe76b5cd3ULL, 0x396e6ea56e57cbdcULL, 0xaac4c437c46ef395ULL, 0x1b03030c03180f06ULL,+	0xdc565645568a13acULL, 0x5e44440d441a4988ULL, 0xa07f7fe17fdf9efeULL, 0x88a9a99ea921374fULL,+	0x672a2aa82a4d8254ULL, 0x0abbbbd6bbb16d6bULL, 0x87c1c123c146e29fULL, 0xf153535153a202a6ULL,+	0x72dcdc57dcae8ba5ULL, 0x530b0b2c0b582716ULL, 0x019d9d4e9d9cd327ULL, 0x2b6c6cad6c47c1d8ULL,+	0xa43131c43195f562ULL, 0xf37474cd7487b9e8ULL, 0x15f6f6fff6e309f1ULL, 0x4c464605460a438cULL,+	0xa5acac8aac092645ULL, 0xb589891e893c970fULL, 0xb414145014a04428ULL, 0xbae1e1a3e15b42dfULL,+	0xa616165816b04e2cULL, 0xf73a3ae83acdd274ULL, 0x066969b9696fd0d2ULL, 0x4109092409482d12ULL,+	0xd77070dd70a7ade0ULL, 0x6fb6b6e2b6d95471ULL, 0x1ed0d067d0ceb7bdULL, 0xd6eded93ed3b7ec7ULL,+	0xe2cccc17cc2edb85ULL, 0x68424215422a5784ULL, 0x2c98985a98b4c22dULL, 0xeda4a4aaa4490e55ULL,+	0x752828a0285d8850ULL, 0x865c5c6d5cda31b8ULL, 0x6bf8f8c7f8933fedULL, 0xc28686228644a411ULL,+};++static const uint64_t C2[256] = {+	0x30d818186018c078ULL, 0x462623238c2305afULL, 0x91b8c6c63fc67ef9ULL, 0xcdfbe8e887e8136fULL,+	0x13cb878726874ca1ULL, 0x6d11b8b8dab8a962ULL, 0x0209010104010805ULL, 0x9e0d4f4f214f426eULL,+	0x6c9b3636d836adeeULL, 0x51ffa6a6a2a65904ULL, 0xb90cd2d26fd2debdULL, 0xf70ef5f5f3f5fb06ULL,+	0xf2967979f979ef80ULL, 0xde306f6fa16f5fceULL, 0x3f6d91917e91fcefULL, 0xa4f852525552aa07ULL,+	0xc04760609d6027fdULL, 0x6535bcbccabc8976ULL, 0x2b379b9b569baccdULL, 0x018a8e8e028e048cULL,+	0x5bd2a3a3b6a37115ULL, 0x186c0c0c300c603cULL, 0xf6847b7bf17bff8aULL, 0x6a803535d435b5e1ULL,+	0x3af51d1d741de869ULL, 0xddb3e0e0a7e05347ULL, 0xb321d7d77bd7f6acULL, 0x999cc2c22fc25eedULL,+	0x5c432e2eb82e6d96ULL, 0x96294b4b314b627aULL, 0xe15dfefedffea321ULL, 0xaed5575741578216ULL,+	0x2abd15155415a841ULL, 0xeee87777c1779fb6ULL, 0x6e923737dc37a5ebULL, 0xd79ee5e5b3e57b56ULL,+	0x23139f9f469f8cd9ULL, 0xfd23f0f0e7f0d317ULL, 0x94204a4a354a6a7fULL, 0xa944dada4fda9e95ULL,+	0xb0a258587d58fa25ULL, 0x8fcfc9c903c906caULL, 0x527c2929a429558dULL, 0x145a0a0a280a5022ULL,+	0x7f50b1b1feb1e14fULL, 0x5dc9a0a0baa0691aULL, 0xd6146b6bb16b7fdaULL, 0x17d985852e855cabULL,+	0x673cbdbdcebd8173ULL, 0xba8f5d5d695dd234ULL, 0x2090101040108050ULL, 0xf507f4f4f7f4f303ULL,+	0x8bddcbcb0bcb16c0ULL, 0x7cd33e3ef83eedc6ULL, 0x0a2d050514052811ULL, 0xce78676781671fe6ULL,+	0xd597e4e4b7e47353ULL, 0x4e0227279c2725bbULL, 0x8273414119413258ULL, 0x0ba78b8b168b2c9dULL,+	0x53f6a7a7a6a75101ULL, 0xfab27d7de97dcf94ULL, 0x374995956e95dcfbULL, 0xad56d8d847d88e9fULL,+	0xeb70fbfbcbfb8b30ULL, 0xc1cdeeee9fee2371ULL, 0xf8bb7c7ced7cc791ULL, 0xcc716666856617e3ULL,+	0xa77bdddd53dda68eULL, 0x2eaf17175c17b84bULL, 0x8e45474701470246ULL, 0x211a9e9e429e84dcULL,+	0x89d4caca0fca1ec5ULL, 0x5a582d2db42d7599ULL, 0x632ebfbfc6bf9179ULL, 0x0e3f07071c07381bULL,+	0x47acadad8ead0123ULL, 0xb4b05a5a755aea2fULL, 0x1bef838336836cb5ULL, 0x66b63333cc3385ffULL,+	0xc65c636391633ff2ULL, 0x041202020802100aULL, 0x4993aaaa92aa3938ULL, 0xe2de7171d971afa8ULL,+	0x8dc6c8c807c80ecfULL, 0x32d119196419c87dULL, 0x923b494939497270ULL, 0xaf5fd9d943d9869aULL,+	0xf931f2f2eff2c31dULL, 0xdba8e3e3abe34b48ULL, 0xb6b95b5b715be22aULL, 0x0dbc88881a883492ULL,+	0x293e9a9a529aa4c8ULL, 0x4c0b262698262dbeULL, 0x64bf3232c8328dfaULL, 0x7d59b0b0fab0e94aULL,+	0xcff2e9e983e91b6aULL, 0x1e770f0f3c0f7833ULL, 0xb733d5d573d5e6a6ULL, 0x1df480803a8074baULL,+	0x6127bebec2be997cULL, 0x87ebcdcd13cd26deULL, 0x68893434d034bde4ULL, 0x903248483d487a75ULL,+	0xe354ffffdbffab24ULL, 0xf48d7a7af57af78fULL, 0x3d6490907a90f4eaULL, 0xbe9d5f5f615fc23eULL,+	0x403d202080201da0ULL, 0xd00f6868bd6867d5ULL, 0x34ca1a1a681ad072ULL, 0x41b7aeae82ae192cULL,+	0x757db4b4eab4c95eULL, 0xa8ce54544d549a19ULL, 0x3b7f93937693ece5ULL, 0x442f222288220daaULL,+	0xc86364648d6407e9ULL, 0xff2af1f1e3f1db12ULL, 0xe6cc7373d173bfa2ULL, 0x248212124812905aULL,+	0x807a40401d403a5dULL, 0x1048080820084028ULL, 0x9b95c3c32bc356e8ULL, 0xc5dfecec97ec337bULL,+	0xab4ddbdb4bdb9690ULL, 0x5fc0a1a1bea1611fULL, 0x07918d8d0e8d1c83ULL, 0x7ac83d3df43df5c9ULL,+	0x335b97976697ccf1ULL, 0x0000000000000000ULL, 0x83f9cfcf1bcf36d4ULL, 0x566e2b2bac2b4587ULL,+	0xece17676c57697b3ULL, 0x19e68282328264b0ULL, 0xb128d6d67fd6fea9ULL, 0x36c31b1b6c1bd877ULL,+	0x7774b5b5eeb5c15bULL, 0x43beafaf86af1129ULL, 0xd41d6a6ab56a77dfULL, 0xa0ea50505d50ba0dULL,+	0x8a5745450945124cULL, 0xfb38f3f3ebf3cb18ULL, 0x60ad3030c0309df0ULL, 0xc3c4efef9bef2b74ULL,+	0x7eda3f3ffc3fe5c3ULL, 0xaac755554955921cULL, 0x59dba2a2b2a27910ULL, 0xc9e9eaea8fea0365ULL,+	0xca6a656589650fecULL, 0x6903babad2bab968ULL, 0x5e4a2f2fbc2f6593ULL, 0x9d8ec0c027c04ee7ULL,+	0xa160dede5fdebe81ULL, 0x38fc1c1c701ce06cULL, 0xe746fdfdd3fdbb2eULL, 0x9a1f4d4d294d5264ULL,+	0x397692927292e4e0ULL, 0xeafa7575c9758fbcULL, 0x0c3606061806301eULL, 0x09ae8a8a128a2498ULL,+	0x794bb2b2f2b2f940ULL, 0xd185e6e6bfe66359ULL, 0x1c7e0e0e380e7036ULL, 0x3ee71f1f7c1ff863ULL,+	0xc4556262956237f7ULL, 0xb53ad4d477d4eea3ULL, 0x4d81a8a89aa82932ULL, 0x315296966296c4f4ULL,+	0xef62f9f9c3f99b3aULL, 0x97a3c5c533c566f6ULL, 0x4a102525942535b1ULL, 0xb2ab59597959f220ULL,+	0x15d084842a8454aeULL, 0xe4c57272d572b7a7ULL, 0x72ec3939e439d5ddULL, 0x98164c4c2d4c5a61ULL,+	0xbc945e5e655eca3bULL, 0xf09f7878fd78e785ULL, 0x70e53838e038ddd8ULL, 0x05988c8c0a8c1486ULL,+	0xbf17d1d163d1c6b2ULL, 0x57e4a5a5aea5410bULL, 0xd9a1e2e2afe2434dULL, 0xc24e616199612ff8ULL,+	0x7b42b3b3f6b3f145ULL, 0x42342121842115a5ULL, 0x25089c9c4a9c94d6ULL, 0x3cee1e1e781ef066ULL,+	0x8661434311432252ULL, 0x93b1c7c73bc776fcULL, 0xe54ffcfcd7fcb32bULL, 0x0824040410042014ULL,+	0xa2e351515951b208ULL, 0x2f2599995e99bcc7ULL, 0xda226d6da96d4fc4ULL, 0x1a650d0d340d6839ULL,+	0xe979fafacffa8335ULL, 0xa369dfdf5bdfb684ULL, 0xfca97e7ee57ed79bULL, 0x4819242490243db4ULL,+	0x76fe3b3bec3bc5d7ULL, 0x4b9aabab96ab313dULL, 0x81f0cece1fce3ed1ULL, 0x2299111144118855ULL,+	0x03838f8f068f0c89ULL, 0x9c044e4e254e4a6bULL, 0x7366b7b7e6b7d151ULL, 0xcbe0ebeb8beb0b60ULL,+	0x78c13c3cf03cfdccULL, 0x1ffd81813e817cbfULL, 0x354094946a94d4feULL, 0xf31cf7f7fbf7eb0cULL,+	0x6f18b9b9deb9a167ULL, 0x268b13134c13985fULL, 0x58512c2cb02c7d9cULL, 0xbb05d3d36bd3d6b8ULL,+	0xd38ce7e7bbe76b5cULL, 0xdc396e6ea56e57cbULL, 0x95aac4c437c46ef3ULL, 0x061b03030c03180fULL,+	0xacdc565645568a13ULL, 0x885e44440d441a49ULL, 0xfea07f7fe17fdf9eULL, 0x4f88a9a99ea92137ULL,+	0x54672a2aa82a4d82ULL, 0x6b0abbbbd6bbb16dULL, 0x9f87c1c123c146e2ULL, 0xa6f153535153a202ULL,+	0xa572dcdc57dcae8bULL, 0x16530b0b2c0b5827ULL, 0x27019d9d4e9d9cd3ULL, 0xd82b6c6cad6c47c1ULL,+	0x62a43131c43195f5ULL, 0xe8f37474cd7487b9ULL, 0xf115f6f6fff6e309ULL, 0x8c4c464605460a43ULL,+	0x45a5acac8aac0926ULL, 0x0fb589891e893c97ULL, 0x28b414145014a044ULL, 0xdfbae1e1a3e15b42ULL,+	0x2ca616165816b04eULL, 0x74f73a3ae83acdd2ULL, 0xd2066969b9696fd0ULL, 0x124109092409482dULL,+	0xe0d77070dd70a7adULL, 0x716fb6b6e2b6d954ULL, 0xbd1ed0d067d0ceb7ULL, 0xc7d6eded93ed3b7eULL,+	0x85e2cccc17cc2edbULL, 0x8468424215422a57ULL, 0x2d2c98985a98b4c2ULL, 0x55eda4a4aaa4490eULL,+	0x50752828a0285d88ULL, 0xb8865c5c6d5cda31ULL, 0xed6bf8f8c7f8933fULL, 0x11c28686228644a4ULL,+};++static const uint64_t C3[256] = {+	0x7830d818186018c0ULL, 0xaf462623238c2305ULL, 0xf991b8c6c63fc67eULL, 0x6fcdfbe8e887e813ULL,+	0xa113cb878726874cULL, 0x626d11b8b8dab8a9ULL, 0x0502090101040108ULL, 0x6e9e0d4f4f214f42ULL,+	0xee6c9b3636d836adULL, 0x0451ffa6a6a2a659ULL, 0xbdb90cd2d26fd2deULL, 0x06f70ef5f5f3f5fbULL,+	0x80f2967979f979efULL, 0xcede306f6fa16f5fULL, 0xef3f6d91917e91fcULL, 0x07a4f852525552aaULL,+	0xfdc04760609d6027ULL, 0x766535bcbccabc89ULL, 0xcd2b379b9b569bacULL, 0x8c018a8e8e028e04ULL,+	0x155bd2a3a3b6a371ULL, 0x3c186c0c0c300c60ULL, 0x8af6847b7bf17bffULL, 0xe16a803535d435b5ULL,+	0x693af51d1d741de8ULL, 0x47ddb3e0e0a7e053ULL, 0xacb321d7d77bd7f6ULL, 0xed999cc2c22fc25eULL,+	0x965c432e2eb82e6dULL, 0x7a96294b4b314b62ULL, 0x21e15dfefedffea3ULL, 0x16aed55757415782ULL,+	0x412abd15155415a8ULL, 0xb6eee87777c1779fULL, 0xeb6e923737dc37a5ULL, 0x56d79ee5e5b3e57bULL,+	0xd923139f9f469f8cULL, 0x17fd23f0f0e7f0d3ULL, 0x7f94204a4a354a6aULL, 0x95a944dada4fda9eULL,+	0x25b0a258587d58faULL, 0xca8fcfc9c903c906ULL, 0x8d527c2929a42955ULL, 0x22145a0a0a280a50ULL,+	0x4f7f50b1b1feb1e1ULL, 0x1a5dc9a0a0baa069ULL, 0xdad6146b6bb16b7fULL, 0xab17d985852e855cULL,+	0x73673cbdbdcebd81ULL, 0x34ba8f5d5d695dd2ULL, 0x5020901010401080ULL, 0x03f507f4f4f7f4f3ULL,+	0xc08bddcbcb0bcb16ULL, 0xc67cd33e3ef83eedULL, 0x110a2d0505140528ULL, 0xe6ce78676781671fULL,+	0x53d597e4e4b7e473ULL, 0xbb4e0227279c2725ULL, 0x5882734141194132ULL, 0x9d0ba78b8b168b2cULL,+	0x0153f6a7a7a6a751ULL, 0x94fab27d7de97dcfULL, 0xfb374995956e95dcULL, 0x9fad56d8d847d88eULL,+	0x30eb70fbfbcbfb8bULL, 0x71c1cdeeee9fee23ULL, 0x91f8bb7c7ced7cc7ULL, 0xe3cc716666856617ULL,+	0x8ea77bdddd53dda6ULL, 0x4b2eaf17175c17b8ULL, 0x468e454747014702ULL, 0xdc211a9e9e429e84ULL,+	0xc589d4caca0fca1eULL, 0x995a582d2db42d75ULL, 0x79632ebfbfc6bf91ULL, 0x1b0e3f07071c0738ULL,+	0x2347acadad8ead01ULL, 0x2fb4b05a5a755aeaULL, 0xb51bef838336836cULL, 0xff66b63333cc3385ULL,+	0xf2c65c636391633fULL, 0x0a04120202080210ULL, 0x384993aaaa92aa39ULL, 0xa8e2de7171d971afULL,+	0xcf8dc6c8c807c80eULL, 0x7d32d119196419c8ULL, 0x70923b4949394972ULL, 0x9aaf5fd9d943d986ULL,+	0x1df931f2f2eff2c3ULL, 0x48dba8e3e3abe34bULL, 0x2ab6b95b5b715be2ULL, 0x920dbc88881a8834ULL,+	0xc8293e9a9a529aa4ULL, 0xbe4c0b262698262dULL, 0xfa64bf3232c8328dULL, 0x4a7d59b0b0fab0e9ULL,+	0x6acff2e9e983e91bULL, 0x331e770f0f3c0f78ULL, 0xa6b733d5d573d5e6ULL, 0xba1df480803a8074ULL,+	0x7c6127bebec2be99ULL, 0xde87ebcdcd13cd26ULL, 0xe468893434d034bdULL, 0x75903248483d487aULL,+	0x24e354ffffdbffabULL, 0x8ff48d7a7af57af7ULL, 0xea3d6490907a90f4ULL, 0x3ebe9d5f5f615fc2ULL,+	0xa0403d202080201dULL, 0xd5d00f6868bd6867ULL, 0x7234ca1a1a681ad0ULL, 0x2c41b7aeae82ae19ULL,+	0x5e757db4b4eab4c9ULL, 0x19a8ce54544d549aULL, 0xe53b7f93937693ecULL, 0xaa442f222288220dULL,+	0xe9c86364648d6407ULL, 0x12ff2af1f1e3f1dbULL, 0xa2e6cc7373d173bfULL, 0x5a24821212481290ULL,+	0x5d807a40401d403aULL, 0x2810480808200840ULL, 0xe89b95c3c32bc356ULL, 0x7bc5dfecec97ec33ULL,+	0x90ab4ddbdb4bdb96ULL, 0x1f5fc0a1a1bea161ULL, 0x8307918d8d0e8d1cULL, 0xc97ac83d3df43df5ULL,+	0xf1335b97976697ccULL, 0x0000000000000000ULL, 0xd483f9cfcf1bcf36ULL, 0x87566e2b2bac2b45ULL,+	0xb3ece17676c57697ULL, 0xb019e68282328264ULL, 0xa9b128d6d67fd6feULL, 0x7736c31b1b6c1bd8ULL,+	0x5b7774b5b5eeb5c1ULL, 0x2943beafaf86af11ULL, 0xdfd41d6a6ab56a77ULL, 0x0da0ea50505d50baULL,+	0x4c8a574545094512ULL, 0x18fb38f3f3ebf3cbULL, 0xf060ad3030c0309dULL, 0x74c3c4efef9bef2bULL,+	0xc37eda3f3ffc3fe5ULL, 0x1caac75555495592ULL, 0x1059dba2a2b2a279ULL, 0x65c9e9eaea8fea03ULL,+	0xecca6a656589650fULL, 0x686903babad2bab9ULL, 0x935e4a2f2fbc2f65ULL, 0xe79d8ec0c027c04eULL,+	0x81a160dede5fdebeULL, 0x6c38fc1c1c701ce0ULL, 0x2ee746fdfdd3fdbbULL, 0x649a1f4d4d294d52ULL,+	0xe0397692927292e4ULL, 0xbceafa7575c9758fULL, 0x1e0c360606180630ULL, 0x9809ae8a8a128a24ULL,+	0x40794bb2b2f2b2f9ULL, 0x59d185e6e6bfe663ULL, 0x361c7e0e0e380e70ULL, 0x633ee71f1f7c1ff8ULL,+	0xf7c4556262956237ULL, 0xa3b53ad4d477d4eeULL, 0x324d81a8a89aa829ULL, 0xf4315296966296c4ULL,+	0x3aef62f9f9c3f99bULL, 0xf697a3c5c533c566ULL, 0xb14a102525942535ULL, 0x20b2ab59597959f2ULL,+	0xae15d084842a8454ULL, 0xa7e4c57272d572b7ULL, 0xdd72ec3939e439d5ULL, 0x6198164c4c2d4c5aULL,+	0x3bbc945e5e655ecaULL, 0x85f09f7878fd78e7ULL, 0xd870e53838e038ddULL, 0x8605988c8c0a8c14ULL,+	0xb2bf17d1d163d1c6ULL, 0x0b57e4a5a5aea541ULL, 0x4dd9a1e2e2afe243ULL, 0xf8c24e616199612fULL,+	0x457b42b3b3f6b3f1ULL, 0xa542342121842115ULL, 0xd625089c9c4a9c94ULL, 0x663cee1e1e781ef0ULL,+	0x5286614343114322ULL, 0xfc93b1c7c73bc776ULL, 0x2be54ffcfcd7fcb3ULL, 0x1408240404100420ULL,+	0x08a2e351515951b2ULL, 0xc72f2599995e99bcULL, 0xc4da226d6da96d4fULL, 0x391a650d0d340d68ULL,+	0x35e979fafacffa83ULL, 0x84a369dfdf5bdfb6ULL, 0x9bfca97e7ee57ed7ULL, 0xb44819242490243dULL,+	0xd776fe3b3bec3bc5ULL, 0x3d4b9aabab96ab31ULL, 0xd181f0cece1fce3eULL, 0x5522991111441188ULL,+	0x8903838f8f068f0cULL, 0x6b9c044e4e254e4aULL, 0x517366b7b7e6b7d1ULL, 0x60cbe0ebeb8beb0bULL,+	0xcc78c13c3cf03cfdULL, 0xbf1ffd81813e817cULL, 0xfe354094946a94d4ULL, 0x0cf31cf7f7fbf7ebULL,+	0x676f18b9b9deb9a1ULL, 0x5f268b13134c1398ULL, 0x9c58512c2cb02c7dULL, 0xb8bb05d3d36bd3d6ULL,+	0x5cd38ce7e7bbe76bULL, 0xcbdc396e6ea56e57ULL, 0xf395aac4c437c46eULL, 0x0f061b03030c0318ULL,+	0x13acdc565645568aULL, 0x49885e44440d441aULL, 0x9efea07f7fe17fdfULL, 0x374f88a9a99ea921ULL,+	0x8254672a2aa82a4dULL, 0x6d6b0abbbbd6bbb1ULL, 0xe29f87c1c123c146ULL, 0x02a6f153535153a2ULL,+	0x8ba572dcdc57dcaeULL, 0x2716530b0b2c0b58ULL, 0xd327019d9d4e9d9cULL, 0xc1d82b6c6cad6c47ULL,+	0xf562a43131c43195ULL, 0xb9e8f37474cd7487ULL, 0x09f115f6f6fff6e3ULL, 0x438c4c464605460aULL,+	0x2645a5acac8aac09ULL, 0x970fb589891e893cULL, 0x4428b414145014a0ULL, 0x42dfbae1e1a3e15bULL,+	0x4e2ca616165816b0ULL, 0xd274f73a3ae83acdULL, 0xd0d2066969b9696fULL, 0x2d12410909240948ULL,+	0xade0d77070dd70a7ULL, 0x54716fb6b6e2b6d9ULL, 0xb7bd1ed0d067d0ceULL, 0x7ec7d6eded93ed3bULL,+	0xdb85e2cccc17cc2eULL, 0x578468424215422aULL, 0xc22d2c98985a98b4ULL, 0x0e55eda4a4aaa449ULL,+	0x8850752828a0285dULL, 0x31b8865c5c6d5cdaULL, 0x3fed6bf8f8c7f893ULL, 0xa411c28686228644ULL,+};++static const uint64_t C4[256] = {+	0xc07830d818186018ULL, 0x05af462623238c23ULL, 0x7ef991b8c6c63fc6ULL, 0x136fcdfbe8e887e8ULL,+	0x4ca113cb87872687ULL, 0xa9626d11b8b8dab8ULL, 0x0805020901010401ULL, 0x426e9e0d4f4f214fULL,+	0xadee6c9b3636d836ULL, 0x590451ffa6a6a2a6ULL, 0xdebdb90cd2d26fd2ULL, 0xfb06f70ef5f5f3f5ULL,+	0xef80f2967979f979ULL, 0x5fcede306f6fa16fULL, 0xfcef3f6d91917e91ULL, 0xaa07a4f852525552ULL,+	0x27fdc04760609d60ULL, 0x89766535bcbccabcULL, 0xaccd2b379b9b569bULL, 0x048c018a8e8e028eULL,+	0x71155bd2a3a3b6a3ULL, 0x603c186c0c0c300cULL, 0xff8af6847b7bf17bULL, 0xb5e16a803535d435ULL,+	0xe8693af51d1d741dULL, 0x5347ddb3e0e0a7e0ULL, 0xf6acb321d7d77bd7ULL, 0x5eed999cc2c22fc2ULL,+	0x6d965c432e2eb82eULL, 0x627a96294b4b314bULL, 0xa321e15dfefedffeULL, 0x8216aed557574157ULL,+	0xa8412abd15155415ULL, 0x9fb6eee87777c177ULL, 0xa5eb6e923737dc37ULL, 0x7b56d79ee5e5b3e5ULL,+	0x8cd923139f9f469fULL, 0xd317fd23f0f0e7f0ULL, 0x6a7f94204a4a354aULL, 0x9e95a944dada4fdaULL,+	0xfa25b0a258587d58ULL, 0x06ca8fcfc9c903c9ULL, 0x558d527c2929a429ULL, 0x5022145a0a0a280aULL,+	0xe14f7f50b1b1feb1ULL, 0x691a5dc9a0a0baa0ULL, 0x7fdad6146b6bb16bULL, 0x5cab17d985852e85ULL,+	0x8173673cbdbdcebdULL, 0xd234ba8f5d5d695dULL, 0x8050209010104010ULL, 0xf303f507f4f4f7f4ULL,+	0x16c08bddcbcb0bcbULL, 0xedc67cd33e3ef83eULL, 0x28110a2d05051405ULL, 0x1fe6ce7867678167ULL,+	0x7353d597e4e4b7e4ULL, 0x25bb4e0227279c27ULL, 0x3258827341411941ULL, 0x2c9d0ba78b8b168bULL,+	0x510153f6a7a7a6a7ULL, 0xcf94fab27d7de97dULL, 0xdcfb374995956e95ULL, 0x8e9fad56d8d847d8ULL,+	0x8b30eb70fbfbcbfbULL, 0x2371c1cdeeee9feeULL, 0xc791f8bb7c7ced7cULL, 0x17e3cc7166668566ULL,+	0xa68ea77bdddd53ddULL, 0xb84b2eaf17175c17ULL, 0x02468e4547470147ULL, 0x84dc211a9e9e429eULL,+	0x1ec589d4caca0fcaULL, 0x75995a582d2db42dULL, 0x9179632ebfbfc6bfULL, 0x381b0e3f07071c07ULL,+	0x012347acadad8eadULL, 0xea2fb4b05a5a755aULL, 0x6cb51bef83833683ULL, 0x85ff66b63333cc33ULL,+	0x3ff2c65c63639163ULL, 0x100a041202020802ULL, 0x39384993aaaa92aaULL, 0xafa8e2de7171d971ULL,+	0x0ecf8dc6c8c807c8ULL, 0xc87d32d119196419ULL, 0x7270923b49493949ULL, 0x869aaf5fd9d943d9ULL,+	0xc31df931f2f2eff2ULL, 0x4b48dba8e3e3abe3ULL, 0xe22ab6b95b5b715bULL, 0x34920dbc88881a88ULL,+	0xa4c8293e9a9a529aULL, 0x2dbe4c0b26269826ULL, 0x8dfa64bf3232c832ULL, 0xe94a7d59b0b0fab0ULL,+	0x1b6acff2e9e983e9ULL, 0x78331e770f0f3c0fULL, 0xe6a6b733d5d573d5ULL, 0x74ba1df480803a80ULL,+	0x997c6127bebec2beULL, 0x26de87ebcdcd13cdULL, 0xbde468893434d034ULL, 0x7a75903248483d48ULL,+	0xab24e354ffffdbffULL, 0xf78ff48d7a7af57aULL, 0xf4ea3d6490907a90ULL, 0xc23ebe9d5f5f615fULL,+	0x1da0403d20208020ULL, 0x67d5d00f6868bd68ULL, 0xd07234ca1a1a681aULL, 0x192c41b7aeae82aeULL,+	0xc95e757db4b4eab4ULL, 0x9a19a8ce54544d54ULL, 0xece53b7f93937693ULL, 0x0daa442f22228822ULL,+	0x07e9c86364648d64ULL, 0xdb12ff2af1f1e3f1ULL, 0xbfa2e6cc7373d173ULL, 0x905a248212124812ULL,+	0x3a5d807a40401d40ULL, 0x4028104808082008ULL, 0x56e89b95c3c32bc3ULL, 0x337bc5dfecec97ecULL,+	0x9690ab4ddbdb4bdbULL, 0x611f5fc0a1a1bea1ULL, 0x1c8307918d8d0e8dULL, 0xf5c97ac83d3df43dULL,+	0xccf1335b97976697ULL, 0x0000000000000000ULL, 0x36d483f9cfcf1bcfULL, 0x4587566e2b2bac2bULL,+	0x97b3ece17676c576ULL, 0x64b019e682823282ULL, 0xfea9b128d6d67fd6ULL, 0xd87736c31b1b6c1bULL,+	0xc15b7774b5b5eeb5ULL, 0x112943beafaf86afULL, 0x77dfd41d6a6ab56aULL, 0xba0da0ea50505d50ULL,+	0x124c8a5745450945ULL, 0xcb18fb38f3f3ebf3ULL, 0x9df060ad3030c030ULL, 0x2b74c3c4efef9befULL,+	0xe5c37eda3f3ffc3fULL, 0x921caac755554955ULL, 0x791059dba2a2b2a2ULL, 0x0365c9e9eaea8feaULL,+	0x0fecca6a65658965ULL, 0xb9686903babad2baULL, 0x65935e4a2f2fbc2fULL, 0x4ee79d8ec0c027c0ULL,+	0xbe81a160dede5fdeULL, 0xe06c38fc1c1c701cULL, 0xbb2ee746fdfdd3fdULL, 0x52649a1f4d4d294dULL,+	0xe4e0397692927292ULL, 0x8fbceafa7575c975ULL, 0x301e0c3606061806ULL, 0x249809ae8a8a128aULL,+	0xf940794bb2b2f2b2ULL, 0x6359d185e6e6bfe6ULL, 0x70361c7e0e0e380eULL, 0xf8633ee71f1f7c1fULL,+	0x37f7c45562629562ULL, 0xeea3b53ad4d477d4ULL, 0x29324d81a8a89aa8ULL, 0xc4f4315296966296ULL,+	0x9b3aef62f9f9c3f9ULL, 0x66f697a3c5c533c5ULL, 0x35b14a1025259425ULL, 0xf220b2ab59597959ULL,+	0x54ae15d084842a84ULL, 0xb7a7e4c57272d572ULL, 0xd5dd72ec3939e439ULL, 0x5a6198164c4c2d4cULL,+	0xca3bbc945e5e655eULL, 0xe785f09f7878fd78ULL, 0xddd870e53838e038ULL, 0x148605988c8c0a8cULL,+	0xc6b2bf17d1d163d1ULL, 0x410b57e4a5a5aea5ULL, 0x434dd9a1e2e2afe2ULL, 0x2ff8c24e61619961ULL,+	0xf1457b42b3b3f6b3ULL, 0x15a5423421218421ULL, 0x94d625089c9c4a9cULL, 0xf0663cee1e1e781eULL,+	0x2252866143431143ULL, 0x76fc93b1c7c73bc7ULL, 0xb32be54ffcfcd7fcULL, 0x2014082404041004ULL,+	0xb208a2e351515951ULL, 0xbcc72f2599995e99ULL, 0x4fc4da226d6da96dULL, 0x68391a650d0d340dULL,+	0x8335e979fafacffaULL, 0xb684a369dfdf5bdfULL, 0xd79bfca97e7ee57eULL, 0x3db4481924249024ULL,+	0xc5d776fe3b3bec3bULL, 0x313d4b9aabab96abULL, 0x3ed181f0cece1fceULL, 0x8855229911114411ULL,+	0x0c8903838f8f068fULL, 0x4a6b9c044e4e254eULL, 0xd1517366b7b7e6b7ULL, 0x0b60cbe0ebeb8bebULL,+	0xfdcc78c13c3cf03cULL, 0x7cbf1ffd81813e81ULL, 0xd4fe354094946a94ULL, 0xeb0cf31cf7f7fbf7ULL,+	0xa1676f18b9b9deb9ULL, 0x985f268b13134c13ULL, 0x7d9c58512c2cb02cULL, 0xd6b8bb05d3d36bd3ULL,+	0x6b5cd38ce7e7bbe7ULL, 0x57cbdc396e6ea56eULL, 0x6ef395aac4c437c4ULL, 0x180f061b03030c03ULL,+	0x8a13acdc56564556ULL, 0x1a49885e44440d44ULL, 0xdf9efea07f7fe17fULL, 0x21374f88a9a99ea9ULL,+	0x4d8254672a2aa82aULL, 0xb16d6b0abbbbd6bbULL, 0x46e29f87c1c123c1ULL, 0xa202a6f153535153ULL,+	0xae8ba572dcdc57dcULL, 0x582716530b0b2c0bULL, 0x9cd327019d9d4e9dULL, 0x47c1d82b6c6cad6cULL,+	0x95f562a43131c431ULL, 0x87b9e8f37474cd74ULL, 0xe309f115f6f6fff6ULL, 0x0a438c4c46460546ULL,+	0x092645a5acac8aacULL, 0x3c970fb589891e89ULL, 0xa04428b414145014ULL, 0x5b42dfbae1e1a3e1ULL,+	0xb04e2ca616165816ULL, 0xcdd274f73a3ae83aULL, 0x6fd0d2066969b969ULL, 0x482d124109092409ULL,+	0xa7ade0d77070dd70ULL, 0xd954716fb6b6e2b6ULL, 0xceb7bd1ed0d067d0ULL, 0x3b7ec7d6eded93edULL,+	0x2edb85e2cccc17ccULL, 0x2a57846842421542ULL, 0xb4c22d2c98985a98ULL, 0x490e55eda4a4aaa4ULL,+	0x5d8850752828a028ULL, 0xda31b8865c5c6d5cULL, 0x933fed6bf8f8c7f8ULL, 0x44a411c286862286ULL,+};++static const uint64_t C5[256] = {+	0x18c07830d8181860ULL, 0x2305af462623238cULL, 0xc67ef991b8c6c63fULL, 0xe8136fcdfbe8e887ULL,+	0x874ca113cb878726ULL, 0xb8a9626d11b8b8daULL, 0x0108050209010104ULL, 0x4f426e9e0d4f4f21ULL,+	0x36adee6c9b3636d8ULL, 0xa6590451ffa6a6a2ULL, 0xd2debdb90cd2d26fULL, 0xf5fb06f70ef5f5f3ULL,+	0x79ef80f2967979f9ULL, 0x6f5fcede306f6fa1ULL, 0x91fcef3f6d91917eULL, 0x52aa07a4f8525255ULL,+	0x6027fdc04760609dULL, 0xbc89766535bcbccaULL, 0x9baccd2b379b9b56ULL, 0x8e048c018a8e8e02ULL,+	0xa371155bd2a3a3b6ULL, 0x0c603c186c0c0c30ULL, 0x7bff8af6847b7bf1ULL, 0x35b5e16a803535d4ULL,+	0x1de8693af51d1d74ULL, 0xe05347ddb3e0e0a7ULL, 0xd7f6acb321d7d77bULL, 0xc25eed999cc2c22fULL,+	0x2e6d965c432e2eb8ULL, 0x4b627a96294b4b31ULL, 0xfea321e15dfefedfULL, 0x578216aed5575741ULL,+	0x15a8412abd151554ULL, 0x779fb6eee87777c1ULL, 0x37a5eb6e923737dcULL, 0xe57b56d79ee5e5b3ULL,+	0x9f8cd923139f9f46ULL, 0xf0d317fd23f0f0e7ULL, 0x4a6a7f94204a4a35ULL, 0xda9e95a944dada4fULL,+	0x58fa25b0a258587dULL, 0xc906ca8fcfc9c903ULL, 0x29558d527c2929a4ULL, 0x0a5022145a0a0a28ULL,+	0xb1e14f7f50b1b1feULL, 0xa0691a5dc9a0a0baULL, 0x6b7fdad6146b6bb1ULL, 0x855cab17d985852eULL,+	0xbd8173673cbdbdceULL, 0x5dd234ba8f5d5d69ULL, 0x1080502090101040ULL, 0xf4f303f507f4f4f7ULL,+	0xcb16c08bddcbcb0bULL, 0x3eedc67cd33e3ef8ULL, 0x0528110a2d050514ULL, 0x671fe6ce78676781ULL,+	0xe47353d597e4e4b7ULL, 0x2725bb4e0227279cULL, 0x4132588273414119ULL, 0x8b2c9d0ba78b8b16ULL,+	0xa7510153f6a7a7a6ULL, 0x7dcf94fab27d7de9ULL, 0x95dcfb374995956eULL, 0xd88e9fad56d8d847ULL,+	0xfb8b30eb70fbfbcbULL, 0xee2371c1cdeeee9fULL, 0x7cc791f8bb7c7cedULL, 0x6617e3cc71666685ULL,+	0xdda68ea77bdddd53ULL, 0x17b84b2eaf17175cULL, 0x4702468e45474701ULL, 0x9e84dc211a9e9e42ULL,+	0xca1ec589d4caca0fULL, 0x2d75995a582d2db4ULL, 0xbf9179632ebfbfc6ULL, 0x07381b0e3f07071cULL,+	0xad012347acadad8eULL, 0x5aea2fb4b05a5a75ULL, 0x836cb51bef838336ULL, 0x3385ff66b63333ccULL,+	0x633ff2c65c636391ULL, 0x02100a0412020208ULL, 0xaa39384993aaaa92ULL, 0x71afa8e2de7171d9ULL,+	0xc80ecf8dc6c8c807ULL, 0x19c87d32d1191964ULL, 0x497270923b494939ULL, 0xd9869aaf5fd9d943ULL,+	0xf2c31df931f2f2efULL, 0xe34b48dba8e3e3abULL, 0x5be22ab6b95b5b71ULL, 0x8834920dbc88881aULL,+	0x9aa4c8293e9a9a52ULL, 0x262dbe4c0b262698ULL, 0x328dfa64bf3232c8ULL, 0xb0e94a7d59b0b0faULL,+	0xe91b6acff2e9e983ULL, 0x0f78331e770f0f3cULL, 0xd5e6a6b733d5d573ULL, 0x8074ba1df480803aULL,+	0xbe997c6127bebec2ULL, 0xcd26de87ebcdcd13ULL, 0x34bde468893434d0ULL, 0x487a75903248483dULL,+	0xffab24e354ffffdbULL, 0x7af78ff48d7a7af5ULL, 0x90f4ea3d6490907aULL, 0x5fc23ebe9d5f5f61ULL,+	0x201da0403d202080ULL, 0x6867d5d00f6868bdULL, 0x1ad07234ca1a1a68ULL, 0xae192c41b7aeae82ULL,+	0xb4c95e757db4b4eaULL, 0x549a19a8ce54544dULL, 0x93ece53b7f939376ULL, 0x220daa442f222288ULL,+	0x6407e9c86364648dULL, 0xf1db12ff2af1f1e3ULL, 0x73bfa2e6cc7373d1ULL, 0x12905a2482121248ULL,+	0x403a5d807a40401dULL, 0x0840281048080820ULL, 0xc356e89b95c3c32bULL, 0xec337bc5dfecec97ULL,+	0xdb9690ab4ddbdb4bULL, 0xa1611f5fc0a1a1beULL, 0x8d1c8307918d8d0eULL, 0x3df5c97ac83d3df4ULL,+	0x97ccf1335b979766ULL, 0x0000000000000000ULL, 0xcf36d483f9cfcf1bULL, 0x2b4587566e2b2bacULL,+	0x7697b3ece17676c5ULL, 0x8264b019e6828232ULL, 0xd6fea9b128d6d67fULL, 0x1bd87736c31b1b6cULL,+	0xb5c15b7774b5b5eeULL, 0xaf112943beafaf86ULL, 0x6a77dfd41d6a6ab5ULL, 0x50ba0da0ea50505dULL,+	0x45124c8a57454509ULL, 0xf3cb18fb38f3f3ebULL, 0x309df060ad3030c0ULL, 0xef2b74c3c4efef9bULL,+	0x3fe5c37eda3f3ffcULL, 0x55921caac7555549ULL, 0xa2791059dba2a2b2ULL, 0xea0365c9e9eaea8fULL,+	0x650fecca6a656589ULL, 0xbab9686903babad2ULL, 0x2f65935e4a2f2fbcULL, 0xc04ee79d8ec0c027ULL,+	0xdebe81a160dede5fULL, 0x1ce06c38fc1c1c70ULL, 0xfdbb2ee746fdfdd3ULL, 0x4d52649a1f4d4d29ULL,+	0x92e4e03976929272ULL, 0x758fbceafa7575c9ULL, 0x06301e0c36060618ULL, 0x8a249809ae8a8a12ULL,+	0xb2f940794bb2b2f2ULL, 0xe66359d185e6e6bfULL, 0x0e70361c7e0e0e38ULL, 0x1ff8633ee71f1f7cULL,+	0x6237f7c455626295ULL, 0xd4eea3b53ad4d477ULL, 0xa829324d81a8a89aULL, 0x96c4f43152969662ULL,+	0xf99b3aef62f9f9c3ULL, 0xc566f697a3c5c533ULL, 0x2535b14a10252594ULL, 0x59f220b2ab595979ULL,+	0x8454ae15d084842aULL, 0x72b7a7e4c57272d5ULL, 0x39d5dd72ec3939e4ULL, 0x4c5a6198164c4c2dULL,+	0x5eca3bbc945e5e65ULL, 0x78e785f09f7878fdULL, 0x38ddd870e53838e0ULL, 0x8c148605988c8c0aULL,+	0xd1c6b2bf17d1d163ULL, 0xa5410b57e4a5a5aeULL, 0xe2434dd9a1e2e2afULL, 0x612ff8c24e616199ULL,+	0xb3f1457b42b3b3f6ULL, 0x2115a54234212184ULL, 0x9c94d625089c9c4aULL, 0x1ef0663cee1e1e78ULL,+	0x4322528661434311ULL, 0xc776fc93b1c7c73bULL, 0xfcb32be54ffcfcd7ULL, 0x0420140824040410ULL,+	0x51b208a2e3515159ULL, 0x99bcc72f2599995eULL, 0x6d4fc4da226d6da9ULL, 0x0d68391a650d0d34ULL,+	0xfa8335e979fafacfULL, 0xdfb684a369dfdf5bULL, 0x7ed79bfca97e7ee5ULL, 0x243db44819242490ULL,+	0x3bc5d776fe3b3becULL, 0xab313d4b9aabab96ULL, 0xce3ed181f0cece1fULL, 0x1188552299111144ULL,+	0x8f0c8903838f8f06ULL, 0x4e4a6b9c044e4e25ULL, 0xb7d1517366b7b7e6ULL, 0xeb0b60cbe0ebeb8bULL,+	0x3cfdcc78c13c3cf0ULL, 0x817cbf1ffd81813eULL, 0x94d4fe354094946aULL, 0xf7eb0cf31cf7f7fbULL,+	0xb9a1676f18b9b9deULL, 0x13985f268b13134cULL, 0x2c7d9c58512c2cb0ULL, 0xd3d6b8bb05d3d36bULL,+	0xe76b5cd38ce7e7bbULL, 0x6e57cbdc396e6ea5ULL, 0xc46ef395aac4c437ULL, 0x03180f061b03030cULL,+	0x568a13acdc565645ULL, 0x441a49885e44440dULL, 0x7fdf9efea07f7fe1ULL, 0xa921374f88a9a99eULL,+	0x2a4d8254672a2aa8ULL, 0xbbb16d6b0abbbbd6ULL, 0xc146e29f87c1c123ULL, 0x53a202a6f1535351ULL,+	0xdcae8ba572dcdc57ULL, 0x0b582716530b0b2cULL, 0x9d9cd327019d9d4eULL, 0x6c47c1d82b6c6cadULL,+	0x3195f562a43131c4ULL, 0x7487b9e8f37474cdULL, 0xf6e309f115f6f6ffULL, 0x460a438c4c464605ULL,+	0xac092645a5acac8aULL, 0x893c970fb589891eULL, 0x14a04428b4141450ULL, 0xe15b42dfbae1e1a3ULL,+	0x16b04e2ca6161658ULL, 0x3acdd274f73a3ae8ULL, 0x696fd0d2066969b9ULL, 0x09482d1241090924ULL,+	0x70a7ade0d77070ddULL, 0xb6d954716fb6b6e2ULL, 0xd0ceb7bd1ed0d067ULL, 0xed3b7ec7d6eded93ULL,+	0xcc2edb85e2cccc17ULL, 0x422a578468424215ULL, 0x98b4c22d2c98985aULL, 0xa4490e55eda4a4aaULL,+	0x285d8850752828a0ULL, 0x5cda31b8865c5c6dULL, 0xf8933fed6bf8f8c7ULL, 0x8644a411c2868622ULL,+};++static const uint64_t C6[256] = {+	0x6018c07830d81818ULL, 0x8c2305af46262323ULL, 0x3fc67ef991b8c6c6ULL, 0x87e8136fcdfbe8e8ULL,+	0x26874ca113cb8787ULL, 0xdab8a9626d11b8b8ULL, 0x0401080502090101ULL, 0x214f426e9e0d4f4fULL,+	0xd836adee6c9b3636ULL, 0xa2a6590451ffa6a6ULL, 0x6fd2debdb90cd2d2ULL, 0xf3f5fb06f70ef5f5ULL,+	0xf979ef80f2967979ULL, 0xa16f5fcede306f6fULL, 0x7e91fcef3f6d9191ULL, 0x5552aa07a4f85252ULL,+	0x9d6027fdc0476060ULL, 0xcabc89766535bcbcULL, 0x569baccd2b379b9bULL, 0x028e048c018a8e8eULL,+	0xb6a371155bd2a3a3ULL, 0x300c603c186c0c0cULL, 0xf17bff8af6847b7bULL, 0xd435b5e16a803535ULL,+	0x741de8693af51d1dULL, 0xa7e05347ddb3e0e0ULL, 0x7bd7f6acb321d7d7ULL, 0x2fc25eed999cc2c2ULL,+	0xb82e6d965c432e2eULL, 0x314b627a96294b4bULL, 0xdffea321e15dfefeULL, 0x41578216aed55757ULL,+	0x5415a8412abd1515ULL, 0xc1779fb6eee87777ULL, 0xdc37a5eb6e923737ULL, 0xb3e57b56d79ee5e5ULL,+	0x469f8cd923139f9fULL, 0xe7f0d317fd23f0f0ULL, 0x354a6a7f94204a4aULL, 0x4fda9e95a944dadaULL,+	0x7d58fa25b0a25858ULL, 0x03c906ca8fcfc9c9ULL, 0xa429558d527c2929ULL, 0x280a5022145a0a0aULL,+	0xfeb1e14f7f50b1b1ULL, 0xbaa0691a5dc9a0a0ULL, 0xb16b7fdad6146b6bULL, 0x2e855cab17d98585ULL,+	0xcebd8173673cbdbdULL, 0x695dd234ba8f5d5dULL, 0x4010805020901010ULL, 0xf7f4f303f507f4f4ULL,+	0x0bcb16c08bddcbcbULL, 0xf83eedc67cd33e3eULL, 0x140528110a2d0505ULL, 0x81671fe6ce786767ULL,+	0xb7e47353d597e4e4ULL, 0x9c2725bb4e022727ULL, 0x1941325882734141ULL, 0x168b2c9d0ba78b8bULL,+	0xa6a7510153f6a7a7ULL, 0xe97dcf94fab27d7dULL, 0x6e95dcfb37499595ULL, 0x47d88e9fad56d8d8ULL,+	0xcbfb8b30eb70fbfbULL, 0x9fee2371c1cdeeeeULL, 0xed7cc791f8bb7c7cULL, 0x856617e3cc716666ULL,+	0x53dda68ea77bddddULL, 0x5c17b84b2eaf1717ULL, 0x014702468e454747ULL, 0x429e84dc211a9e9eULL,+	0x0fca1ec589d4cacaULL, 0xb42d75995a582d2dULL, 0xc6bf9179632ebfbfULL, 0x1c07381b0e3f0707ULL,+	0x8ead012347acadadULL, 0x755aea2fb4b05a5aULL, 0x36836cb51bef8383ULL, 0xcc3385ff66b63333ULL,+	0x91633ff2c65c6363ULL, 0x0802100a04120202ULL, 0x92aa39384993aaaaULL, 0xd971afa8e2de7171ULL,+	0x07c80ecf8dc6c8c8ULL, 0x6419c87d32d11919ULL, 0x39497270923b4949ULL, 0x43d9869aaf5fd9d9ULL,+	0xeff2c31df931f2f2ULL, 0xabe34b48dba8e3e3ULL, 0x715be22ab6b95b5bULL, 0x1a8834920dbc8888ULL,+	0x529aa4c8293e9a9aULL, 0x98262dbe4c0b2626ULL, 0xc8328dfa64bf3232ULL, 0xfab0e94a7d59b0b0ULL,+	0x83e91b6acff2e9e9ULL, 0x3c0f78331e770f0fULL, 0x73d5e6a6b733d5d5ULL, 0x3a8074ba1df48080ULL,+	0xc2be997c6127bebeULL, 0x13cd26de87ebcdcdULL, 0xd034bde468893434ULL, 0x3d487a7590324848ULL,+	0xdbffab24e354ffffULL, 0xf57af78ff48d7a7aULL, 0x7a90f4ea3d649090ULL, 0x615fc23ebe9d5f5fULL,+	0x80201da0403d2020ULL, 0xbd6867d5d00f6868ULL, 0x681ad07234ca1a1aULL, 0x82ae192c41b7aeaeULL,+	0xeab4c95e757db4b4ULL, 0x4d549a19a8ce5454ULL, 0x7693ece53b7f9393ULL, 0x88220daa442f2222ULL,+	0x8d6407e9c8636464ULL, 0xe3f1db12ff2af1f1ULL, 0xd173bfa2e6cc7373ULL, 0x4812905a24821212ULL,+	0x1d403a5d807a4040ULL, 0x2008402810480808ULL, 0x2bc356e89b95c3c3ULL, 0x97ec337bc5dfececULL,+	0x4bdb9690ab4ddbdbULL, 0xbea1611f5fc0a1a1ULL, 0x0e8d1c8307918d8dULL, 0xf43df5c97ac83d3dULL,+	0x6697ccf1335b9797ULL, 0x0000000000000000ULL, 0x1bcf36d483f9cfcfULL, 0xac2b4587566e2b2bULL,+	0xc57697b3ece17676ULL, 0x328264b019e68282ULL, 0x7fd6fea9b128d6d6ULL, 0x6c1bd87736c31b1bULL,+	0xeeb5c15b7774b5b5ULL, 0x86af112943beafafULL, 0xb56a77dfd41d6a6aULL, 0x5d50ba0da0ea5050ULL,+	0x0945124c8a574545ULL, 0xebf3cb18fb38f3f3ULL, 0xc0309df060ad3030ULL, 0x9bef2b74c3c4efefULL,+	0xfc3fe5c37eda3f3fULL, 0x4955921caac75555ULL, 0xb2a2791059dba2a2ULL, 0x8fea0365c9e9eaeaULL,+	0x89650fecca6a6565ULL, 0xd2bab9686903babaULL, 0xbc2f65935e4a2f2fULL, 0x27c04ee79d8ec0c0ULL,+	0x5fdebe81a160dedeULL, 0x701ce06c38fc1c1cULL, 0xd3fdbb2ee746fdfdULL, 0x294d52649a1f4d4dULL,+	0x7292e4e039769292ULL, 0xc9758fbceafa7575ULL, 0x1806301e0c360606ULL, 0x128a249809ae8a8aULL,+	0xf2b2f940794bb2b2ULL, 0xbfe66359d185e6e6ULL, 0x380e70361c7e0e0eULL, 0x7c1ff8633ee71f1fULL,+	0x956237f7c4556262ULL, 0x77d4eea3b53ad4d4ULL, 0x9aa829324d81a8a8ULL, 0x6296c4f431529696ULL,+	0xc3f99b3aef62f9f9ULL, 0x33c566f697a3c5c5ULL, 0x942535b14a102525ULL, 0x7959f220b2ab5959ULL,+	0x2a8454ae15d08484ULL, 0xd572b7a7e4c57272ULL, 0xe439d5dd72ec3939ULL, 0x2d4c5a6198164c4cULL,+	0x655eca3bbc945e5eULL, 0xfd78e785f09f7878ULL, 0xe038ddd870e53838ULL, 0x0a8c148605988c8cULL,+	0x63d1c6b2bf17d1d1ULL, 0xaea5410b57e4a5a5ULL, 0xafe2434dd9a1e2e2ULL, 0x99612ff8c24e6161ULL,+	0xf6b3f1457b42b3b3ULL, 0x842115a542342121ULL, 0x4a9c94d625089c9cULL, 0x781ef0663cee1e1eULL,+	0x1143225286614343ULL, 0x3bc776fc93b1c7c7ULL, 0xd7fcb32be54ffcfcULL, 0x1004201408240404ULL,+	0x5951b208a2e35151ULL, 0x5e99bcc72f259999ULL, 0xa96d4fc4da226d6dULL, 0x340d68391a650d0dULL,+	0xcffa8335e979fafaULL, 0x5bdfb684a369dfdfULL, 0xe57ed79bfca97e7eULL, 0x90243db448192424ULL,+	0xec3bc5d776fe3b3bULL, 0x96ab313d4b9aababULL, 0x1fce3ed181f0ceceULL, 0x4411885522991111ULL,+	0x068f0c8903838f8fULL, 0x254e4a6b9c044e4eULL, 0xe6b7d1517366b7b7ULL, 0x8beb0b60cbe0ebebULL,+	0xf03cfdcc78c13c3cULL, 0x3e817cbf1ffd8181ULL, 0x6a94d4fe35409494ULL, 0xfbf7eb0cf31cf7f7ULL,+	0xdeb9a1676f18b9b9ULL, 0x4c13985f268b1313ULL, 0xb02c7d9c58512c2cULL, 0x6bd3d6b8bb05d3d3ULL,+	0xbbe76b5cd38ce7e7ULL, 0xa56e57cbdc396e6eULL, 0x37c46ef395aac4c4ULL, 0x0c03180f061b0303ULL,+	0x45568a13acdc5656ULL, 0x0d441a49885e4444ULL, 0xe17fdf9efea07f7fULL, 0x9ea921374f88a9a9ULL,+	0xa82a4d8254672a2aULL, 0xd6bbb16d6b0abbbbULL, 0x23c146e29f87c1c1ULL, 0x5153a202a6f15353ULL,+	0x57dcae8ba572dcdcULL, 0x2c0b582716530b0bULL, 0x4e9d9cd327019d9dULL, 0xad6c47c1d82b6c6cULL,+	0xc43195f562a43131ULL, 0xcd7487b9e8f37474ULL, 0xfff6e309f115f6f6ULL, 0x05460a438c4c4646ULL,+	0x8aac092645a5acacULL, 0x1e893c970fb58989ULL, 0x5014a04428b41414ULL, 0xa3e15b42dfbae1e1ULL,+	0x5816b04e2ca61616ULL, 0xe83acdd274f73a3aULL, 0xb9696fd0d2066969ULL, 0x2409482d12410909ULL,+	0xdd70a7ade0d77070ULL, 0xe2b6d954716fb6b6ULL, 0x67d0ceb7bd1ed0d0ULL, 0x93ed3b7ec7d6ededULL,+	0x17cc2edb85e2ccccULL, 0x15422a5784684242ULL, 0x5a98b4c22d2c9898ULL, 0xaaa4490e55eda4a4ULL,+	0xa0285d8850752828ULL, 0x6d5cda31b8865c5cULL, 0xc7f8933fed6bf8f8ULL, 0x228644a411c28686ULL,+};++static const uint64_t C7[256] = {+	0x186018c07830d818ULL, 0x238c2305af462623ULL, 0xc63fc67ef991b8c6ULL, 0xe887e8136fcdfbe8ULL,+	0x8726874ca113cb87ULL, 0xb8dab8a9626d11b8ULL, 0x0104010805020901ULL, 0x4f214f426e9e0d4fULL,+	0x36d836adee6c9b36ULL, 0xa6a2a6590451ffa6ULL, 0xd26fd2debdb90cd2ULL, 0xf5f3f5fb06f70ef5ULL,+	0x79f979ef80f29679ULL, 0x6fa16f5fcede306fULL, 0x917e91fcef3f6d91ULL, 0x525552aa07a4f852ULL,+	0x609d6027fdc04760ULL, 0xbccabc89766535bcULL, 0x9b569baccd2b379bULL, 0x8e028e048c018a8eULL,+	0xa3b6a371155bd2a3ULL, 0x0c300c603c186c0cULL, 0x7bf17bff8af6847bULL, 0x35d435b5e16a8035ULL,+	0x1d741de8693af51dULL, 0xe0a7e05347ddb3e0ULL, 0xd77bd7f6acb321d7ULL, 0xc22fc25eed999cc2ULL,+	0x2eb82e6d965c432eULL, 0x4b314b627a96294bULL, 0xfedffea321e15dfeULL, 0x5741578216aed557ULL,+	0x155415a8412abd15ULL, 0x77c1779fb6eee877ULL, 0x37dc37a5eb6e9237ULL, 0xe5b3e57b56d79ee5ULL,+	0x9f469f8cd923139fULL, 0xf0e7f0d317fd23f0ULL, 0x4a354a6a7f94204aULL, 0xda4fda9e95a944daULL,+	0x587d58fa25b0a258ULL, 0xc903c906ca8fcfc9ULL, 0x29a429558d527c29ULL, 0x0a280a5022145a0aULL,+	0xb1feb1e14f7f50b1ULL, 0xa0baa0691a5dc9a0ULL, 0x6bb16b7fdad6146bULL, 0x852e855cab17d985ULL,+	0xbdcebd8173673cbdULL, 0x5d695dd234ba8f5dULL, 0x1040108050209010ULL, 0xf4f7f4f303f507f4ULL,+	0xcb0bcb16c08bddcbULL, 0x3ef83eedc67cd33eULL, 0x05140528110a2d05ULL, 0x6781671fe6ce7867ULL,+	0xe4b7e47353d597e4ULL, 0x279c2725bb4e0227ULL, 0x4119413258827341ULL, 0x8b168b2c9d0ba78bULL,+	0xa7a6a7510153f6a7ULL, 0x7de97dcf94fab27dULL, 0x956e95dcfb374995ULL, 0xd847d88e9fad56d8ULL,+	0xfbcbfb8b30eb70fbULL, 0xee9fee2371c1cdeeULL, 0x7ced7cc791f8bb7cULL, 0x66856617e3cc7166ULL,+	0xdd53dda68ea77bddULL, 0x175c17b84b2eaf17ULL, 0x47014702468e4547ULL, 0x9e429e84dc211a9eULL,+	0xca0fca1ec589d4caULL, 0x2db42d75995a582dULL, 0xbfc6bf9179632ebfULL, 0x071c07381b0e3f07ULL,+	0xad8ead012347acadULL, 0x5a755aea2fb4b05aULL, 0x8336836cb51bef83ULL, 0x33cc3385ff66b633ULL,+	0x6391633ff2c65c63ULL, 0x020802100a041202ULL, 0xaa92aa39384993aaULL, 0x71d971afa8e2de71ULL,+	0xc807c80ecf8dc6c8ULL, 0x196419c87d32d119ULL, 0x4939497270923b49ULL, 0xd943d9869aaf5fd9ULL,+	0xf2eff2c31df931f2ULL, 0xe3abe34b48dba8e3ULL, 0x5b715be22ab6b95bULL, 0x881a8834920dbc88ULL,+	0x9a529aa4c8293e9aULL, 0x2698262dbe4c0b26ULL, 0x32c8328dfa64bf32ULL, 0xb0fab0e94a7d59b0ULL,+	0xe983e91b6acff2e9ULL, 0x0f3c0f78331e770fULL, 0xd573d5e6a6b733d5ULL, 0x803a8074ba1df480ULL,+	0xbec2be997c6127beULL, 0xcd13cd26de87ebcdULL, 0x34d034bde4688934ULL, 0x483d487a75903248ULL,+	0xffdbffab24e354ffULL, 0x7af57af78ff48d7aULL, 0x907a90f4ea3d6490ULL, 0x5f615fc23ebe9d5fULL,+	0x2080201da0403d20ULL, 0x68bd6867d5d00f68ULL, 0x1a681ad07234ca1aULL, 0xae82ae192c41b7aeULL,+	0xb4eab4c95e757db4ULL, 0x544d549a19a8ce54ULL, 0x937693ece53b7f93ULL, 0x2288220daa442f22ULL,+	0x648d6407e9c86364ULL, 0xf1e3f1db12ff2af1ULL, 0x73d173bfa2e6cc73ULL, 0x124812905a248212ULL,+	0x401d403a5d807a40ULL, 0x0820084028104808ULL, 0xc32bc356e89b95c3ULL, 0xec97ec337bc5dfecULL,+	0xdb4bdb9690ab4ddbULL, 0xa1bea1611f5fc0a1ULL, 0x8d0e8d1c8307918dULL, 0x3df43df5c97ac83dULL,+	0x976697ccf1335b97ULL, 0x0000000000000000ULL, 0xcf1bcf36d483f9cfULL, 0x2bac2b4587566e2bULL,+	0x76c57697b3ece176ULL, 0x82328264b019e682ULL, 0xd67fd6fea9b128d6ULL, 0x1b6c1bd87736c31bULL,+	0xb5eeb5c15b7774b5ULL, 0xaf86af112943beafULL, 0x6ab56a77dfd41d6aULL, 0x505d50ba0da0ea50ULL,+	0x450945124c8a5745ULL, 0xf3ebf3cb18fb38f3ULL, 0x30c0309df060ad30ULL, 0xef9bef2b74c3c4efULL,+	0x3ffc3fe5c37eda3fULL, 0x554955921caac755ULL, 0xa2b2a2791059dba2ULL, 0xea8fea0365c9e9eaULL,+	0x6589650fecca6a65ULL, 0xbad2bab9686903baULL, 0x2fbc2f65935e4a2fULL, 0xc027c04ee79d8ec0ULL,+	0xde5fdebe81a160deULL, 0x1c701ce06c38fc1cULL, 0xfdd3fdbb2ee746fdULL, 0x4d294d52649a1f4dULL,+	0x927292e4e0397692ULL, 0x75c9758fbceafa75ULL, 0x061806301e0c3606ULL, 0x8a128a249809ae8aULL,+	0xb2f2b2f940794bb2ULL, 0xe6bfe66359d185e6ULL, 0x0e380e70361c7e0eULL, 0x1f7c1ff8633ee71fULL,+	0x62956237f7c45562ULL, 0xd477d4eea3b53ad4ULL, 0xa89aa829324d81a8ULL, 0x966296c4f4315296ULL,+	0xf9c3f99b3aef62f9ULL, 0xc533c566f697a3c5ULL, 0x25942535b14a1025ULL, 0x597959f220b2ab59ULL,+	0x842a8454ae15d084ULL, 0x72d572b7a7e4c572ULL, 0x39e439d5dd72ec39ULL, 0x4c2d4c5a6198164cULL,+	0x5e655eca3bbc945eULL, 0x78fd78e785f09f78ULL, 0x38e038ddd870e538ULL, 0x8c0a8c148605988cULL,+	0xd163d1c6b2bf17d1ULL, 0xa5aea5410b57e4a5ULL, 0xe2afe2434dd9a1e2ULL, 0x6199612ff8c24e61ULL,+	0xb3f6b3f1457b42b3ULL, 0x21842115a5423421ULL, 0x9c4a9c94d625089cULL, 0x1e781ef0663cee1eULL,+	0x4311432252866143ULL, 0xc73bc776fc93b1c7ULL, 0xfcd7fcb32be54ffcULL, 0x0410042014082404ULL,+	0x515951b208a2e351ULL, 0x995e99bcc72f2599ULL, 0x6da96d4fc4da226dULL, 0x0d340d68391a650dULL,+	0xfacffa8335e979faULL, 0xdf5bdfb684a369dfULL, 0x7ee57ed79bfca97eULL, 0x2490243db4481924ULL,+	0x3bec3bc5d776fe3bULL, 0xab96ab313d4b9aabULL, 0xce1fce3ed181f0ceULL, 0x1144118855229911ULL,+	0x8f068f0c8903838fULL, 0x4e254e4a6b9c044eULL, 0xb7e6b7d1517366b7ULL, 0xeb8beb0b60cbe0ebULL,+	0x3cf03cfdcc78c13cULL, 0x813e817cbf1ffd81ULL, 0x946a94d4fe354094ULL, 0xf7fbf7eb0cf31cf7ULL,+	0xb9deb9a1676f18b9ULL, 0x134c13985f268b13ULL, 0x2cb02c7d9c58512cULL, 0xd36bd3d6b8bb05d3ULL,+	0xe7bbe76b5cd38ce7ULL, 0x6ea56e57cbdc396eULL, 0xc437c46ef395aac4ULL, 0x030c03180f061b03ULL,+	0x5645568a13acdc56ULL, 0x440d441a49885e44ULL, 0x7fe17fdf9efea07fULL, 0xa99ea921374f88a9ULL,+	0x2aa82a4d8254672aULL, 0xbbd6bbb16d6b0abbULL, 0xc123c146e29f87c1ULL, 0x535153a202a6f153ULL,+	0xdc57dcae8ba572dcULL, 0x0b2c0b582716530bULL, 0x9d4e9d9cd327019dULL, 0x6cad6c47c1d82b6cULL,+	0x31c43195f562a431ULL, 0x74cd7487b9e8f374ULL, 0xf6fff6e309f115f6ULL, 0x4605460a438c4c46ULL,+	0xac8aac092645a5acULL, 0x891e893c970fb589ULL, 0x145014a04428b414ULL, 0xe1a3e15b42dfbae1ULL,+	0x165816b04e2ca616ULL, 0x3ae83acdd274f73aULL, 0x69b9696fd0d20669ULL, 0x092409482d124109ULL,+	0x70dd70a7ade0d770ULL, 0xb6e2b6d954716fb6ULL, 0xd067d0ceb7bd1ed0ULL, 0xed93ed3b7ec7d6edULL,+	0xcc17cc2edb85e2ccULL, 0x4215422a57846842ULL, 0x985a98b4c22d2c98ULL, 0xa4aaa4490e55eda4ULL,+	0x28a0285d88507528ULL, 0x5c6d5cda31b8865cULL, 0xf8c7f8933fed6bf8ULL, 0x86228644a411c286ULL,+};++static const uint64_t rc[R + 1] = {+	0x0000000000000000ULL,+	0x1823c6e887b8014fULL,+	0x36a6d2f5796f9152ULL,+	0x60bc9b8ea30c7b35ULL,+	0x1de0d7c22e4bfe57ULL,+	0x157737e59ff04adaULL,+	0x58c9290ab1a06b85ULL,+	0xbd5d10f4cb3e0567ULL,+	0xe427418ba77d95d8ULL,+	0xfbee7c66dd17479eULL,+	0xca2dbf07ad5a8333ULL,+};++/* This might not be true for all platforms and compilers. */+#define SANE_ARRAY_PACKING 1++#if defined(SANE_ARRAY_PACKING) && (defined(ARCH_IS_LITTLE_ENDIAN) || defined(ARCH_IS_BIG_ENDIAN))++#if defined(ARCH_IS_LITTLE_ENDIAN)+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 7]] \+	^ C1[mu[((n+7)%8) * 8 + 6]] \+	^ C2[mu[((n+6)%8) * 8 + 5]] \+	^ C3[mu[((n+5)%8) * 8 + 4]] \+	^ C4[mu[((n+4)%8) * 8 + 3]] \+	^ C5[mu[((n+3)%8) * 8 + 2]] \+	^ C6[mu[((n+2)%8) * 8 + 1]] \+	^ C7[mu[((n+1)%8) * 8 + 0]] \+	; } while (0)+#else+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 0]] \+	^ C1[mu[((n+7)%8) * 8 + 1]] \+	^ C2[mu[((n+6)%8) * 8 + 2]] \+	^ C3[mu[((n+5)%8) * 8 + 3]] \+	^ C4[mu[((n+4)%8) * 8 + 4]] \+	^ C5[mu[((n+3)%8) * 8 + 5]] \+	^ C6[mu[((n+2)%8) * 8 + 6]] \+	^ C7[mu[((n+1)%8) * 8 + 7]] \+	; } while (0)+#endif++static void transformMatrix(uint64_t m[8])+{+	uint64_t L[8];+	uint8_t *mu = (uint8_t*)m;++	LB(0);+	LB(1);+	LB(2);+	LB(3);+	LB(4);+	LB(5);+	LB(6);+	LB(7);++	array_copy64(m, L, 8);+}++#else++static void transformMatrix(uint64_t m[8])+{+	uint64_t L[8];++	L[0] =+		C0[(int)(m[0] >> 56)       ] ^+		C1[(int)(m[7] >> 48) & 0xff] ^+		C2[(int)(m[6] >> 40) & 0xff] ^+		C3[(int)(m[5] >> 32) & 0xff] ^+		C4[(int)(m[4] >> 24) & 0xff] ^+		C5[(int)(m[3] >> 16) & 0xff] ^+		C6[(int)(m[2] >>  8) & 0xff] ^+		C7[(int)(m[1]      ) & 0xff];+	L[1] =+		C0[(int)(m[1] >> 56)       ] ^+		C1[(int)(m[0] >> 48) & 0xff] ^+		C2[(int)(m[7] >> 40) & 0xff] ^+		C3[(int)(m[6] >> 32) & 0xff] ^+		C4[(int)(m[5] >> 24) & 0xff] ^+		C5[(int)(m[4] >> 16) & 0xff] ^+		C6[(int)(m[3] >>  8) & 0xff] ^+		C7[(int)(m[2]      ) & 0xff];+	L[2] =+		C0[(int)(m[2] >> 56)       ] ^+		C1[(int)(m[1] >> 48) & 0xff] ^+		C2[(int)(m[0] >> 40) & 0xff] ^+		C3[(int)(m[7] >> 32) & 0xff] ^+		C4[(int)(m[6] >> 24) & 0xff] ^+		C5[(int)(m[5] >> 16) & 0xff] ^+		C6[(int)(m[4] >>  8) & 0xff] ^+		C7[(int)(m[3]      ) & 0xff];+	L[3] =+		C0[(int)(m[3] >> 56)       ] ^+		C1[(int)(m[2] >> 48) & 0xff] ^+		C2[(int)(m[1] >> 40) & 0xff] ^+		C3[(int)(m[0] >> 32) & 0xff] ^+		C4[(int)(m[7] >> 24) & 0xff] ^+		C5[(int)(m[6] >> 16) & 0xff] ^+		C6[(int)(m[5] >>  8) & 0xff] ^+		C7[(int)(m[4]      ) & 0xff];+	L[4] =+		C0[(int)(m[4] >> 56)       ] ^+		C1[(int)(m[3] >> 48) & 0xff] ^+		C2[(int)(m[2] >> 40) & 0xff] ^+		C3[(int)(m[1] >> 32) & 0xff] ^+		C4[(int)(m[0] >> 24) & 0xff] ^+		C5[(int)(m[7] >> 16) & 0xff] ^+		C6[(int)(m[6] >>  8) & 0xff] ^+		C7[(int)(m[5]      ) & 0xff];+	L[5] =+		C0[(int)(m[5] >> 56)       ] ^+		C1[(int)(m[4] >> 48) & 0xff] ^+		C2[(int)(m[3] >> 40) & 0xff] ^+		C3[(int)(m[2] >> 32) & 0xff] ^+		C4[(int)(m[1] >> 24) & 0xff] ^+		C5[(int)(m[0] >> 16) & 0xff] ^+		C6[(int)(m[7] >>  8) & 0xff] ^+		C7[(int)(m[6]      ) & 0xff];+	L[6] =+		C0[(int)(m[6] >> 56)       ] ^+		C1[(int)(m[5] >> 48) & 0xff] ^+		C2[(int)(m[4] >> 40) & 0xff] ^+		C3[(int)(m[3] >> 32) & 0xff] ^+		C4[(int)(m[2] >> 24) & 0xff] ^+		C5[(int)(m[1] >> 16) & 0xff] ^+		C6[(int)(m[0] >>  8) & 0xff] ^+		C7[(int)(m[7]      ) & 0xff];+	L[7] =+		C0[(int)(m[7] >> 56)       ] ^+		C1[(int)(m[6] >> 48) & 0xff] ^+		C2[(int)(m[5] >> 40) & 0xff] ^+		C3[(int)(m[4] >> 32) & 0xff] ^+		C4[(int)(m[3] >> 24) & 0xff] ^+		C5[(int)(m[2] >> 16) & 0xff] ^+		C6[(int)(m[1] >>  8) & 0xff] ^+		C7[(int)(m[0]      ) & 0xff];++	array_copy64(m, L, 8);+}++#endif++static void inplaceXor(uint64_t dst[8], uint64_t src[8])+{+	dst[0] ^= src[0];+	dst[1] ^= src[1];+	dst[2] ^= src[2];+	dst[3] ^= src[3];+	dst[4] ^= src[4];+	dst[5] ^= src[5];+	dst[6] ^= src[6];+	dst[7] ^= src[7];+}++/**+ * The core Whirlpool transform.+ */+static void processBuffer(whirlpool_ctx * const ctx)+{+	int i, r;+	uint64_t K[8];        /* the round key */+	uint64_t block[8];    /* mu(buffer) */+	uint64_t state[8];    /* the cipher state */+	uint8_t *buffer = ctx->buffer;++	/*+	 * map the buffer to a block:+	 */+	for (i = 0; i < 8; i++, buffer += 8) {+		block[i] =+			(((uint64_t)buffer[0]        ) << 56) ^+			(((uint64_t)buffer[1] & 0xffL) << 48) ^+			(((uint64_t)buffer[2] & 0xffL) << 40) ^+			(((uint64_t)buffer[3] & 0xffL) << 32) ^+			(((uint64_t)buffer[4] & 0xffL) << 24) ^+			(((uint64_t)buffer[5] & 0xffL) << 16) ^+			(((uint64_t)buffer[6] & 0xffL) <<  8) ^+			(((uint64_t)buffer[7] & 0xffL)      );+	}++	/*+	 * compute and apply K^0 to the cipher state:+	 */+	array_copy64(K, ctx->hash, 8);+	array_copy64(state, block, 8);+	inplaceXor(state, K);++	/*+	 * iterate over all rounds:+	 */+	for (r = 1; r <= R; r++) {+		/*+		 * compute K^r from K^{r-1}:+		 */+		transformMatrix(K);+		K[0] ^= rc[r];++		/*+		 * apply the r-th round transformation:+		 */+		transformMatrix(state);+		inplaceXor(state, K);+	}+	/*+	 * apply the Miyaguchi-Preneel compression function:+	 */+	inplaceXor(ctx->hash, state);+	inplaceXor(ctx->hash, block);+}++/**+ * Initialize the hashing state.+ */+void crypton_whirlpool_init(struct whirlpool_ctx * const ctx)+{+	int i;++	memset(ctx->bitLength, 0, 32);+	ctx->bufferBits = ctx->bufferPos = 0;+	ctx->buffer[0] = 0; /* it's only necessary to cleanup buffer[bufferPos] */+	for (i = 0; i < 8; i++) {+		ctx->hash[i] = 0L; /* initial value */+	}+}++/**+ * Delivers input data to the hashing algorithm.+ *+ * @param    source        plaintext data to hash.+ * @param    sourceBits    how many bits of plaintext to process.+ *+ * This method maintains the invariant: bufferBits < DIGESTBITS+ */+void crypton_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t sourceBytes)+{+	/*+	   sourcePos+	   |+	   +-------+-------+-------+	   ||||||||||||||||||||| source+	   +-------+-------+-------+	   +-------+-------+-------+-------+-------+-------+	   ||||||||||||||||||||||                           buffer+	   +-------+-------+-------+-------+-------+-------+	   |+	   bufferPos+	   */+	int sourceBits   = sourceBytes * 8;+	int sourcePos    = 0; /* index of leftmost source uint8_t containing data (1 to 8 bits). */+	int sourceGap    = (8 - ((int)sourceBits & 7)) & 7; /* space on source[sourcePos]. */+	int bufferRem    = ctx->bufferBits & 7; /* occupied bits on buffer[bufferPos]. */+	int i;+	uint32_t b, carry;+	uint8_t *buffer       = ctx->buffer;+	uint8_t *bitLength    = ctx->bitLength;+	int bufferBits   = ctx->bufferBits;+	int bufferPos    = ctx->bufferPos;++	/*+	 * tally the length of the added data:+	 */+	uint64_t value = sourceBits;+	for (i = 31, carry = 0; i >= 0 && (carry != 0 || value != 0ULL); i--) {+		carry += bitLength[i] + ((uint32_t)value & 0xff);+		bitLength[i] = (uint8_t)carry;+		carry >>= 8;+		value >>= 8;+	}+	/*+	 * process data in chunks of 8 bits (a more efficient approach would be to take whole-word chunks):+	 */+	while (sourceBits > 8) {+		/* N.B. at least source[sourcePos] and source[sourcePos+1] contain data. */+		/*+		 * take a byte from the source:+		 */+		b = ((source[sourcePos] << sourceGap) & 0xff) |+			((source[sourcePos + 1] & 0xff) >> (8 - sourceGap));+		/*+		 * process this byte:+		 */+		buffer[bufferPos++] |= (uint8_t)(b >> bufferRem);+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */+		if (bufferBits == DIGESTBITS) {+			/*+			 * process data block:+			 */+			processBuffer(ctx);+			/*+			 * reset buffer:+			 */+			bufferBits = bufferPos = 0;+		}+		buffer[bufferPos] = b << (8 - bufferRem);+		bufferBits += bufferRem;+		/*+		 * proceed to remaining data:+		 */+		sourceBits -= 8;+		sourcePos++;+	}+	/* now 0 <= sourceBits <= 8;+	 * furthermore, all data (if any is left) is in source[sourcePos].+	 */+	if (sourceBits > 0) {+		b = (source[sourcePos] << sourceGap) & 0xff; /* bits are left-justified on b. */+		/*+		 * process the remaining bits:+		 */+		buffer[bufferPos] |= b >> bufferRem;+	} else {+		b = 0;+	}+	if (bufferRem + sourceBits < 8) {+		/*+		 * all remaining data fits on buffer[bufferPos],+		 * and there still remains some space.+		 */+		bufferBits += sourceBits;+	} else {+		/*+		 * buffer[bufferPos] is full:+		 */+		bufferPos++;+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */+		sourceBits -= 8 - bufferRem;+		/* now 0 <= sourceBits < 8;+		 * furthermore, all data (if any is left) is in source[sourcePos].+		 */+		if (bufferBits == DIGESTBITS) {+			/*+			 * process data block:+			 */+			processBuffer(ctx);+			/*+			 * reset buffer:+			 */+			bufferBits = bufferPos = 0;+		}+		buffer[bufferPos] = b << (8 - bufferRem);+		bufferBits += (int)sourceBits;+	}+	ctx->bufferBits   = bufferBits;+	ctx->bufferPos    = bufferPos;+}++/**+ * Get the hash value from the hashing state.+ * + * This method uses the invariant: bufferBits < DIGESTBITS+ */+void crypton_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result)+{+	int i;+	uint8_t *buffer    = ctx->buffer;+	uint8_t *bitLength = ctx->bitLength;+	int bufferBits     = ctx->bufferBits;+	int bufferPos      = ctx->bufferPos;+	uint8_t *digest    = result;++	/*+	 * append a '1'-bit:+	 */+	buffer[bufferPos] |= 0x80U >> (bufferBits & 7);+	bufferPos++; /* all remaining bits on the current uint8_t are set to zero. */+	/*+	 * pad with zero bits to complete (N*WBLOCKBITS - LENGTHBITS) bits:+	 */+	if (bufferPos > WBLOCKBYTES - LENGTHBYTES) {+		if (bufferPos < WBLOCKBYTES) {+			memset(&buffer[bufferPos], 0, WBLOCKBYTES - bufferPos);+		}+		/*+		 * process data block:+		 */+		processBuffer(ctx);+		/*+		 * reset buffer:+		 */+		bufferPos = 0;+	}+	if (bufferPos < WBLOCKBYTES - LENGTHBYTES) {+		memset(&buffer[bufferPos], 0, (WBLOCKBYTES - LENGTHBYTES) - bufferPos);+	}+	bufferPos = WBLOCKBYTES - LENGTHBYTES;+	/*+	 * append bit length of hashed data:+	 */+	memcpy(&buffer[WBLOCKBYTES - LENGTHBYTES], bitLength, LENGTHBYTES);+	/*+	 * process data block:+	 */+	processBuffer(ctx);+	/*+	 * return the completed message digest:+	 */+	for (i = 0; i < DIGESTBYTES/8; i++) {+		digest[0] = (uint8_t)(ctx->hash[i] >> 56);+		digest[1] = (uint8_t)(ctx->hash[i] >> 48);+		digest[2] = (uint8_t)(ctx->hash[i] >> 40);+		digest[3] = (uint8_t)(ctx->hash[i] >> 32);+		digest[4] = (uint8_t)(ctx->hash[i] >> 24);+		digest[5] = (uint8_t)(ctx->hash[i] >> 16);+		digest[6] = (uint8_t)(ctx->hash[i] >>  8);+		digest[7] = (uint8_t)(ctx->hash[i]      );+		digest += 8;+	}+	ctx->bufferBits   = bufferBits;+	ctx->bufferPos    = bufferPos;+}
+ cbits/crypton_whirlpool.h view
@@ -0,0 +1,31 @@+#ifndef CRYPTOHASH_WHIRLPOOL_H
+#define CRYPTOHASH_WHIRLPOOL_H
+
+#include <stdint.h>
+
+/*
+ * Whirlpool-specific definitions.
+ */
+
+#define DIGESTBYTES 64
+#define DIGESTBITS  (8*DIGESTBYTES) /* 512 */
+
+#define WBLOCKBYTES 64
+#define WBLOCKBITS  (8*WBLOCKBYTES) /* 512 */
+
+#define LENGTHBYTES 32
+#define LENGTHBITS  (8*LENGTHBYTES) /* 256 */
+
+typedef struct whirlpool_ctx {
+	uint8_t  bitLength[LENGTHBYTES]; /* global number of hashed bits (256-bit counter) */
+	uint8_t  buffer[WBLOCKBYTES];    /* buffer of data to hash */
+	uint32_t bufferBits;             /* current number of bits on the buffer */
+	uint32_t bufferPos;              /* current (possibly incomplete) byte slot on the buffer */
+	uint64_t hash[DIGESTBYTES/8];    /* the hashing state */
+} whirlpool_ctx;
+
+void crypton_whirlpool_init(struct whirlpool_ctx * const ctx);
+void crypton_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t len);
+void crypton_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result);
+
+#endif
+ cbits/crypton_xsalsa.c view
@@ -0,0 +1,90 @@+/*+ * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>+ * + * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#include <stdint.h>+#include <string.h>+#include "crypton_xsalsa.h"+#include "crypton_align.h"+#include "crypton_bitfn.h"++/* XSalsa20 algorithm as described in https://cr.yp.to/snuffle/xsalsa-20081128.pdf */+void crypton_xsalsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds,+                            uint32_t keylen, const uint8_t *key,+                            uint32_t ivlen, const uint8_t *iv)+{+  memset(ctx, 0, sizeof(*ctx));+  ctx->nb_rounds = nb_rounds;++  /* Create initial 512-bit input block:+       (x0, x5, x10, x15) is the Salsa20 constant+       (x1, x2, x3, x4, x11, x12, x13, x14) is a 256-bit key+       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce+  */+  crypton_salsa_init_core(&ctx->st, keylen, key, 8, iv);++  /* Continue initialization in a separate function that may also+     be called independently */+  crypton_xsalsa_derive(ctx, ivlen - 8, iv + 8);+}++void crypton_xsalsa_derive(crypton_salsa_context *ctx,+                              uint32_t ivlen, const uint8_t *iv)+{+  /* Finish creating initial 512-bit input block:+       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce++     Except iv has been shifted by 64 bits so there are now only 128 bits ahead.+  */+  ctx->st.d[ 8] += load_le32(iv + 0);+  ctx->st.d[ 9] += load_le32(iv + 4);++  /* Compute (z0, z1, . . . , z15) = doubleround ^(r/2) (x0, x1, . . . , x15) */+  block hSalsa;+  memset(&hSalsa, 0, sizeof(block));+  crypton_salsa_core_xor(ctx->nb_rounds, &hSalsa, &ctx->st);+ +  /* Build a new 512-bit input block (x′0, x′1, . . . , x′15):+       (x′0, x′5, x′10, x′15) is the Salsa20 constant+       (x′1,x′2,x′3,x′4,x′11,x′12,x′13,x′14) = (z0,z5,z10,z15,z6,z7,z8,z9)+       (x′6,x′7) is the last 64 bits of the 192-bit nonce+       (x′8, x′9) is a 64-bit block counter.+  */+  ctx->st.d[ 1] = hSalsa.d[ 0] - ctx->st.d[ 0];+  ctx->st.d[ 2] = hSalsa.d[ 5] - ctx->st.d[ 5];+  ctx->st.d[ 3] = hSalsa.d[10] - ctx->st.d[10];+  ctx->st.d[ 4] = hSalsa.d[15] - ctx->st.d[15];+  ctx->st.d[11] = hSalsa.d[ 6] - ctx->st.d[ 6];+  ctx->st.d[12] = hSalsa.d[ 7] - ctx->st.d[ 7];+  ctx->st.d[13] = hSalsa.d[ 8] - ctx->st.d[ 8];+  ctx->st.d[14] = hSalsa.d[ 9] - ctx->st.d[ 9];+  ctx->st.d[ 6] = load_le32(iv + 8);+  ctx->st.d[ 7] = load_le32(iv + 12);+  ctx->st.d[ 8] = 0;+  ctx->st.d[ 9] = 0;+}
+ cbits/crypton_xsalsa.h view
@@ -0,0 +1,38 @@+/*+ * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTON_XSALSA+#define CRYPTON_XSALSA++#include "crypton_salsa.h"++void crypton_xsalsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void crypton_xsalsa_derive(crypton_salsa_context *ctx, uint32_t ivlen, const uint8_t *iv);++#endif
− cbits/cryptonite_aes.c 
@@ -1,1109 +0,0 @@-/*- * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */--#include <string.h>-#include <stdio.h>--#include <cryptonite_cpu.h>-#include <cryptonite_aes.h>-#include <cryptonite_bitfn.h>--#include <aes/generic.h>-#include <aes/gf.h>-#include <aes/x86ni.h>--void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);--enum {-	/* init */-	INIT_128, INIT_192, INIT_256,-	/* single block */-	ENCRYPT_BLOCK_128, ENCRYPT_BLOCK_192, ENCRYPT_BLOCK_256,-	DECRYPT_BLOCK_128, DECRYPT_BLOCK_192, DECRYPT_BLOCK_256,-	/* ecb */-	ENCRYPT_ECB_128, ENCRYPT_ECB_192, ENCRYPT_ECB_256,-	DECRYPT_ECB_128, DECRYPT_ECB_192, DECRYPT_ECB_256,-	/* cbc */-	ENCRYPT_CBC_128, ENCRYPT_CBC_192, ENCRYPT_CBC_256,-	DECRYPT_CBC_128, DECRYPT_CBC_192, DECRYPT_CBC_256,-	/* ctr */-	ENCRYPT_CTR_128, ENCRYPT_CTR_192, ENCRYPT_CTR_256,-	/* ctr with 32-bit wrapping */-	ENCRYPT_C32_128, ENCRYPT_C32_192, ENCRYPT_C32_256,-	/* xts */-	ENCRYPT_XTS_128, ENCRYPT_XTS_192, ENCRYPT_XTS_256,-	DECRYPT_XTS_128, DECRYPT_XTS_192, DECRYPT_XTS_256,-	/* gcm */-	ENCRYPT_GCM_128, ENCRYPT_GCM_192, ENCRYPT_GCM_256,-	DECRYPT_GCM_128, DECRYPT_GCM_192, DECRYPT_GCM_256,-	/* ocb */-	ENCRYPT_OCB_128, ENCRYPT_OCB_192, ENCRYPT_OCB_256,-	DECRYPT_OCB_128, DECRYPT_OCB_192, DECRYPT_OCB_256,-	/* ccm */-	ENCRYPT_CCM_128, ENCRYPT_CCM_192, ENCRYPT_CCM_256,-	DECRYPT_CCM_128, DECRYPT_CCM_192, DECRYPT_CCM_256,-	/* ghash */-	GHASH_HINIT, GHASH_GF_MUL,-};--void *cryptonite_aes_branch_table[] = {-	/* INIT */-	[INIT_128]          = cryptonite_aes_generic_init,-	[INIT_192]          = cryptonite_aes_generic_init,-	[INIT_256]          = cryptonite_aes_generic_init,-	/* BLOCK */-	[ENCRYPT_BLOCK_128] = cryptonite_aes_generic_encrypt_block,-	[ENCRYPT_BLOCK_192] = cryptonite_aes_generic_encrypt_block,-	[ENCRYPT_BLOCK_256] = cryptonite_aes_generic_encrypt_block,-	[DECRYPT_BLOCK_128] = cryptonite_aes_generic_decrypt_block,-	[DECRYPT_BLOCK_192] = cryptonite_aes_generic_decrypt_block,-	[DECRYPT_BLOCK_256] = cryptonite_aes_generic_decrypt_block,-	/* ECB */-	[ENCRYPT_ECB_128]   = cryptonite_aes_generic_encrypt_ecb,-	[ENCRYPT_ECB_192]   = cryptonite_aes_generic_encrypt_ecb,-	[ENCRYPT_ECB_256]   = cryptonite_aes_generic_encrypt_ecb,-	[DECRYPT_ECB_128]   = cryptonite_aes_generic_decrypt_ecb,-	[DECRYPT_ECB_192]   = cryptonite_aes_generic_decrypt_ecb,-	[DECRYPT_ECB_256]   = cryptonite_aes_generic_decrypt_ecb,-	/* CBC */-	[ENCRYPT_CBC_128]   = cryptonite_aes_generic_encrypt_cbc,-	[ENCRYPT_CBC_192]   = cryptonite_aes_generic_encrypt_cbc,-	[ENCRYPT_CBC_256]   = cryptonite_aes_generic_encrypt_cbc,-	[DECRYPT_CBC_128]   = cryptonite_aes_generic_decrypt_cbc,-	[DECRYPT_CBC_192]   = cryptonite_aes_generic_decrypt_cbc,-	[DECRYPT_CBC_256]   = cryptonite_aes_generic_decrypt_cbc,-	/* CTR */-	[ENCRYPT_CTR_128]   = cryptonite_aes_generic_encrypt_ctr,-	[ENCRYPT_CTR_192]   = cryptonite_aes_generic_encrypt_ctr,-	[ENCRYPT_CTR_256]   = cryptonite_aes_generic_encrypt_ctr,-	/* CTR with 32-bit wrapping */-	[ENCRYPT_C32_128]   = cryptonite_aes_generic_encrypt_c32,-	[ENCRYPT_C32_192]   = cryptonite_aes_generic_encrypt_c32,-	[ENCRYPT_C32_256]   = cryptonite_aes_generic_encrypt_c32,-	/* XTS */-	[ENCRYPT_XTS_128]   = cryptonite_aes_generic_encrypt_xts,-	[ENCRYPT_XTS_192]   = cryptonite_aes_generic_encrypt_xts,-	[ENCRYPT_XTS_256]   = cryptonite_aes_generic_encrypt_xts,-	[DECRYPT_XTS_128]   = cryptonite_aes_generic_decrypt_xts,-	[DECRYPT_XTS_192]   = cryptonite_aes_generic_decrypt_xts,-	[DECRYPT_XTS_256]   = cryptonite_aes_generic_decrypt_xts,-	/* GCM */-	[ENCRYPT_GCM_128]   = cryptonite_aes_generic_gcm_encrypt,-	[ENCRYPT_GCM_192]   = cryptonite_aes_generic_gcm_encrypt,-	[ENCRYPT_GCM_256]   = cryptonite_aes_generic_gcm_encrypt,-	[DECRYPT_GCM_128]   = cryptonite_aes_generic_gcm_decrypt,-	[DECRYPT_GCM_192]   = cryptonite_aes_generic_gcm_decrypt,-	[DECRYPT_GCM_256]   = cryptonite_aes_generic_gcm_decrypt,-	/* OCB */-	[ENCRYPT_OCB_128]   = cryptonite_aes_generic_ocb_encrypt,-	[ENCRYPT_OCB_192]   = cryptonite_aes_generic_ocb_encrypt,-	[ENCRYPT_OCB_256]   = cryptonite_aes_generic_ocb_encrypt,-	[DECRYPT_OCB_128]   = cryptonite_aes_generic_ocb_decrypt,-	[DECRYPT_OCB_192]   = cryptonite_aes_generic_ocb_decrypt,-	[DECRYPT_OCB_256]   = cryptonite_aes_generic_ocb_decrypt,-	/* CCM */-	[ENCRYPT_CCM_128]   = cryptonite_aes_generic_ccm_encrypt,-	[ENCRYPT_CCM_192]   = cryptonite_aes_generic_ccm_encrypt,-	[ENCRYPT_CCM_256]   = cryptonite_aes_generic_ccm_encrypt,-	[DECRYPT_CCM_128]   = cryptonite_aes_generic_ccm_decrypt,-	[DECRYPT_CCM_192]   = cryptonite_aes_generic_ccm_decrypt,-	[DECRYPT_CCM_256]   = cryptonite_aes_generic_ccm_decrypt,-	/* GHASH */-	[GHASH_HINIT]       = cryptonite_aes_generic_hinit,-	[GHASH_GF_MUL]      = cryptonite_aes_generic_gf_mul,-};--typedef void (*init_f)(aes_key *, uint8_t *, uint8_t);-typedef void (*ecb_f)(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);-typedef void (*cbc_f)(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);-typedef void (*ctr_f)(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);-typedef void (*xts_f)(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit, uint32_t spoint, aes_block *input, uint32_t nb_blocks);-typedef void (*gcm_crypt_f)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);-typedef void (*ocb_crypt_f)(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-typedef void (*ccm_crypt_f)(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);-typedef void (*block_f)(aes_block *output, aes_key *key, aes_block *input);-typedef void (*hinit_f)(table_4bit htable, const block128 *h);-typedef void (*gf_mul_f)(block128 *a, const table_4bit htable);--#ifdef WITH_AESNI-#define GET_INIT(strength) \-	((init_f) (cryptonite_aes_branch_table[INIT_128 + strength]))-#define GET_ECB_ENCRYPT(strength) \-	((ecb_f) (cryptonite_aes_branch_table[ENCRYPT_ECB_128 + strength]))-#define GET_ECB_DECRYPT(strength) \-	((ecb_f) (cryptonite_aes_branch_table[DECRYPT_ECB_128 + strength]))-#define GET_CBC_ENCRYPT(strength) \-	((cbc_f) (cryptonite_aes_branch_table[ENCRYPT_CBC_128 + strength]))-#define GET_CBC_DECRYPT(strength) \-	((cbc_f) (cryptonite_aes_branch_table[DECRYPT_CBC_128 + strength]))-#define GET_CTR_ENCRYPT(strength) \-	((ctr_f) (cryptonite_aes_branch_table[ENCRYPT_CTR_128 + strength]))-#define GET_C32_ENCRYPT(strength) \-	((ctr_f) (cryptonite_aes_branch_table[ENCRYPT_C32_128 + strength]))-#define GET_XTS_ENCRYPT(strength) \-	((xts_f) (cryptonite_aes_branch_table[ENCRYPT_XTS_128 + strength]))-#define GET_XTS_DECRYPT(strength) \-	((xts_f) (cryptonite_aes_branch_table[DECRYPT_XTS_128 + strength]))-#define GET_GCM_ENCRYPT(strength) \-	((gcm_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_GCM_128 + strength]))-#define GET_GCM_DECRYPT(strength) \-	((gcm_crypt_f) (cryptonite_aes_branch_table[DECRYPT_GCM_128 + strength]))-#define GET_OCB_ENCRYPT(strength) \-	((ocb_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_OCB_128 + strength]))-#define GET_OCB_DECRYPT(strength) \-	((ocb_crypt_f) (cryptonite_aes_branch_table[DECRYPT_OCB_128 + strength]))-#define GET_CCM_ENCRYPT(strength) \-	((ccm_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_CCM_128 + strength]))-#define GET_CCM_DECRYPT(strength) \-	((ccm_crypt_f) (cryptonite_aes_branch_table[DECRYPT_CCM_128 + strength]))-#define cryptonite_aes_encrypt_block(o,k,i) \-	(((block_f) (cryptonite_aes_branch_table[ENCRYPT_BLOCK_128 + k->strength]))(o,k,i))-#define cryptonite_aes_decrypt_block(o,k,i) \-	(((block_f) (cryptonite_aes_branch_table[DECRYPT_BLOCK_128 + k->strength]))(o,k,i))-#define cryptonite_hinit(t,h) \-	(((hinit_f) (cryptonite_aes_branch_table[GHASH_HINIT]))(t,h))-#define cryptonite_gf_mul(a,t) \-	(((gf_mul_f) (cryptonite_aes_branch_table[GHASH_GF_MUL]))(a,t))-#else-#define GET_INIT(strenght) cryptonite_aes_generic_init-#define GET_ECB_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ecb-#define GET_ECB_DECRYPT(strength) cryptonite_aes_generic_decrypt_ecb-#define GET_CBC_ENCRYPT(strength) cryptonite_aes_generic_encrypt_cbc-#define GET_CBC_DECRYPT(strength) cryptonite_aes_generic_decrypt_cbc-#define GET_CTR_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ctr-#define GET_C32_ENCRYPT(strength) cryptonite_aes_generic_encrypt_c32-#define GET_XTS_ENCRYPT(strength) cryptonite_aes_generic_encrypt_xts-#define GET_XTS_DECRYPT(strength) cryptonite_aes_generic_decrypt_xts-#define GET_GCM_ENCRYPT(strength) cryptonite_aes_generic_gcm_encrypt-#define GET_GCM_DECRYPT(strength) cryptonite_aes_generic_gcm_decrypt-#define GET_OCB_ENCRYPT(strength) cryptonite_aes_generic_ocb_encrypt-#define GET_OCB_DECRYPT(strength) cryptonite_aes_generic_ocb_decrypt-#define GET_CCM_ENCRYPT(strength) cryptonite_aes_generic_ccm_encrypt-#define GET_CCM_DECRYPT(strength) cryptonite_aes_generic_ccm_decrypt-#define cryptonite_aes_encrypt_block(o,k,i) cryptonite_aes_generic_encrypt_block(o,k,i)-#define cryptonite_aes_decrypt_block(o,k,i) cryptonite_aes_generic_decrypt_block(o,k,i)-#define cryptonite_hinit(t,h) cryptonite_aes_generic_hinit(t,h)-#define cryptonite_gf_mul(a,t) cryptonite_aes_generic_gf_mul(a,t)-#endif--#define CPU_AESNI        0-#define CPU_PCLMUL       1-#define CPU_OPTION_COUNT 2--static uint8_t cryptonite_aes_cpu_options[CPU_OPTION_COUNT] = {};--#if defined(ARCH_X86) && defined(WITH_AESNI)-static void initialize_table_ni(int aesni, int pclmul)-{-	if (!aesni)-		return;-	cryptonite_aes_cpu_options[CPU_AESNI] = 1;--	cryptonite_aes_branch_table[INIT_128] = cryptonite_aesni_init;-	cryptonite_aes_branch_table[INIT_256] = cryptonite_aesni_init;--	cryptonite_aes_branch_table[ENCRYPT_BLOCK_128] = cryptonite_aesni_encrypt_block128;-	cryptonite_aes_branch_table[DECRYPT_BLOCK_128] = cryptonite_aesni_decrypt_block128;-	cryptonite_aes_branch_table[ENCRYPT_BLOCK_256] = cryptonite_aesni_encrypt_block256;-	cryptonite_aes_branch_table[DECRYPT_BLOCK_256] = cryptonite_aesni_decrypt_block256;-	/* ECB */-	cryptonite_aes_branch_table[ENCRYPT_ECB_128] = cryptonite_aesni_encrypt_ecb128;-	cryptonite_aes_branch_table[DECRYPT_ECB_128] = cryptonite_aesni_decrypt_ecb128;-	cryptonite_aes_branch_table[ENCRYPT_ECB_256] = cryptonite_aesni_encrypt_ecb256;-	cryptonite_aes_branch_table[DECRYPT_ECB_256] = cryptonite_aesni_decrypt_ecb256;-	/* CBC */-	cryptonite_aes_branch_table[ENCRYPT_CBC_128] = cryptonite_aesni_encrypt_cbc128;-	cryptonite_aes_branch_table[DECRYPT_CBC_128] = cryptonite_aesni_decrypt_cbc128;-	cryptonite_aes_branch_table[ENCRYPT_CBC_256] = cryptonite_aesni_encrypt_cbc256;-	cryptonite_aes_branch_table[DECRYPT_CBC_256] = cryptonite_aesni_decrypt_cbc256;-	/* CTR */-	cryptonite_aes_branch_table[ENCRYPT_CTR_128] = cryptonite_aesni_encrypt_ctr128;-	cryptonite_aes_branch_table[ENCRYPT_CTR_256] = cryptonite_aesni_encrypt_ctr256;-	/* CTR with 32-bit wrapping */-	cryptonite_aes_branch_table[ENCRYPT_C32_128] = cryptonite_aesni_encrypt_c32_128;-	cryptonite_aes_branch_table[ENCRYPT_C32_256] = cryptonite_aesni_encrypt_c32_256;-	/* XTS */-	cryptonite_aes_branch_table[ENCRYPT_XTS_128] = cryptonite_aesni_encrypt_xts128;-	cryptonite_aes_branch_table[ENCRYPT_XTS_256] = cryptonite_aesni_encrypt_xts256;-	/* GCM */-	cryptonite_aes_branch_table[ENCRYPT_GCM_128] = cryptonite_aesni_gcm_encrypt128;-	cryptonite_aes_branch_table[ENCRYPT_GCM_256] = cryptonite_aesni_gcm_encrypt256;-	/* OCB */-	/*-	cryptonite_aes_branch_table[ENCRYPT_OCB_128] = cryptonite_aesni_ocb_encrypt128;-	cryptonite_aes_branch_table[ENCRYPT_OCB_256] = cryptonite_aesni_ocb_encrypt256;-	*/-#ifdef WITH_PCLMUL-	if (!pclmul)-		return;-	cryptonite_aes_cpu_options[CPU_PCLMUL] = 1;--	/* GHASH */-	cryptonite_aes_branch_table[GHASH_HINIT]     = cryptonite_aesni_hinit_pclmul,-	cryptonite_aes_branch_table[GHASH_GF_MUL]    = cryptonite_aesni_gf_mul_pclmul,-	cryptonite_aesni_init_pclmul();-#endif-}-#endif--uint8_t *cryptonite_aes_cpu_init(void)-{-#if defined(ARCH_X86) && defined(WITH_AESNI)-	cryptonite_aesni_initialize_hw(initialize_table_ni);-#endif-	return cryptonite_aes_cpu_options;-}--void cryptonite_aes_initkey(aes_key *key, uint8_t *origkey, uint8_t size)-{-	switch (size) {-	case 16: key->nbr = 10; key->strength = 0; break;-	case 24: key->nbr = 12; key->strength = 1; break;-	case 32: key->nbr = 14; key->strength = 2; break;-	}-	cryptonite_aes_cpu_init();-	init_f _init = GET_INIT(key->strength);-	_init(key, origkey, size);-}--void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)-{-	ecb_f e = GET_ECB_ENCRYPT(key->strength);-	e(output, key, input, nb_blocks);-}--void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)-{-	ecb_f d = GET_ECB_DECRYPT(key->strength);-	d(output, key, input, nb_blocks);-}--void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)-{-	cbc_f e = GET_CBC_ENCRYPT(key->strength);-	e(output, key, iv, input, nb_blocks);-}--void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)-{-	cbc_f d = GET_CBC_DECRYPT(key->strength);-	d(output, key, iv, input, nb_blocks);-}--void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks)-{-	aes_block block;--	/* preload IV in block */-	block128_copy(&block, iv);--	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {-		cryptonite_aes_encrypt_block(output, key, &block);-	}-}--void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks)-{-	aes_block block;--	/* preload IV in block */-	block128_copy(&block, iv);--	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {-		cryptonite_aes_encrypt_block(output, key, &block);-	}--	/* copy back the IV */-	block128_copy(iv, &block);-}--void cryptonite_aes_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)-{-	ctr_f e = GET_CTR_ENCRYPT(key->strength);-	e(output, key, iv, input, len);-}--void cryptonite_aes_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)-{-	ctr_f e = GET_C32_ENCRYPT(key->strength);-	e(output, key, iv, input, len);-}--void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)-{-	xts_f e = GET_XTS_ENCRYPT(k1->strength);-	e(output, k1, k2, dataunit, spoint, input, nb_blocks);-}--void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)-{-	cryptonite_aes_generic_decrypt_xts(output, k1, k2, dataunit, spoint, input, nb_blocks);-}--void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)-{-	gcm_crypt_f e = GET_GCM_ENCRYPT(key->strength);-	e(output, gcm, key, input, length);-}--void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)-{-	gcm_crypt_f d = GET_GCM_DECRYPT(key->strength);-	d(output, gcm, key, input, length);-}--void cryptonite_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)-{-	ccm_crypt_f e = GET_CCM_ENCRYPT(key->strength);-	e(output, ccm, key, input, length);-}--void cryptonite_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)-{-	ccm_crypt_f d = GET_CCM_DECRYPT(key->strength);-	d(output, ccm, key, input, length);-}--void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)-{-	ocb_crypt_f e = GET_OCB_ENCRYPT(key->strength);-	e(output, ocb, key, input, length);-}--void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)-{-	ocb_crypt_f d = GET_OCB_DECRYPT(key->strength);-	d(output, ocb, key, input, length);-}--static void gcm_ghash_add(aes_gcm *gcm, block128 *b)-{-	block128_xor(&gcm->tag, b);-	cryptonite_gf_mul(&gcm->tag, gcm->htable);-}--void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len)-{-	block128 h;-	gcm->length_aad = 0;-	gcm->length_input = 0;--	block128_zero(&h);-	block128_zero(&gcm->tag);-	block128_zero(&gcm->iv);--	/* prepare H : encrypt_K(0^128) */-	cryptonite_aes_encrypt_block(&h, key, &h);-	cryptonite_hinit(gcm->htable, &h);--	if (len == 12) {-		block128_copy_bytes(&gcm->iv, iv, 12);-		gcm->iv.b[15] = 0x01;-	} else {-		uint32_t origlen = len << 3;-		int i;-		for (; len >= 16; len -= 16, iv += 16) {-			block128_xor(&gcm->iv, (block128 *) iv);-			cryptonite_gf_mul(&gcm->iv, gcm->htable);-		}-		if (len > 0) {-			block128_xor_bytes(&gcm->iv, iv, len);-			cryptonite_gf_mul(&gcm->iv, gcm->htable);-		}-		for (i = 15; origlen; --i, origlen >>= 8)-			gcm->iv.b[i] ^= (uint8_t) origlen;-		cryptonite_gf_mul(&gcm->iv, gcm->htable);-	}--	block128_copy_aligned(&gcm->civ, &gcm->iv);-}--void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length)-{-	gcm->length_aad += length;-	for (; length >= 16; input += 16, length -= 16) {-		gcm_ghash_add(gcm, (block128 *) input);-	}-	if (length > 0) {-		aes_block tmp;-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		gcm_ghash_add(gcm, &tmp);-	}--}--void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key)-{-	aes_block lblock;-	int i;--	/* tag = (tag-1 xor (lenbits(a) | lenbits(c)) ) . H */-	lblock.q[0] = cpu_to_be64(gcm->length_aad << 3);-	lblock.q[1] = cpu_to_be64(gcm->length_input << 3);-	gcm_ghash_add(gcm, &lblock);--	cryptonite_aes_encrypt_block(&lblock, key, &gcm->iv);-	block128_xor_aligned(&gcm->tag, &lblock);--	for (i = 0; i < 16; i++) {-		tag[i] = gcm->tag.b[i];-	}-}--static inline uint8_t ccm_b0_flags(uint32_t has_adata, uint32_t m, uint32_t l)-{-	return 8*m + l + (has_adata? 64: 0);-}--/* depends on input size */-static void ccm_encode_b0(block128* output, aes_ccm* ccm, uint32_t has_adata)-{-	int last = 15;-	uint32_t m = ccm->length_M;-	uint32_t l = ccm->length_L;-	uint32_t msg_len = ccm->length_input;--	block128_zero(output);-	block128_copy_aligned(output, &ccm->nonce);-	output->b[0] = ccm_b0_flags(has_adata, (m-2)/2, l-1);-	while (msg_len > 0) {-		output->b[last--] = msg_len & 0xff;-		msg_len >>= 8;-	}-}--/* encode adata length */-static int ccm_encode_la(block128* output, uint32_t la)-{-	if (la < ( (1 << 16) - (1 << 8)) ) {-		output->b[0] = (la >> 8) & 0xff;-		output->b[1] = la        & 0xff;-		return 2;-	} else {-		output->b[0] = 0xff;-		output->b[1] = 0xfe;-		output->b[2] = (la >> 24) & 0xff;-		output->b[3] = (la >> 16) & 0xff;-		output->b[4] = (la >>  8) & 0xff;-		output->b[5] = la         & 0xff;-		return 6;-	}-}--static void ccm_encode_ctr(block128* out, aes_ccm* ccm, unsigned int cnt)-{-	int last = 15;-	block128_copy_aligned(out, &ccm->nonce);-	out->b[0] = ccm->length_L - 1;--	while (cnt > 0) {-		out->b[last--] = cnt & 0xff;-		cnt >>= 8;-	}-}--static void ccm_cbcmac_add(aes_ccm* ccm, aes_key* key, block128* bi)-{-	block128_xor_aligned(&ccm->xi, bi);-	cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->xi);-}--/* even though it is possible to support message size as large as 2^64, we support up to 2^32 only */-void cryptonite_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t nonce_len, uint32_t input_size, int m, int l)-{-	memset(ccm, 0, sizeof(aes_ccm));--	if (l < 2 || l > 4) return;-	if (m != 4 && m != 6 && m != 8 && m != 10-		   && m != 12 && m != 14 && m != 16) return;--	if (nonce_len > 15 - l) {-		nonce_len = 15 - l;-	}--	if (l <= 4) {-		if (input_size >= (1ull << (8*l))) return;-	}--	ccm->length_L = l;-	ccm->length_M = m;-	ccm->length_input = input_size;--	memcpy(&ccm->nonce.b[1], nonce, nonce_len);--	ccm_encode_b0(&ccm->b0, ccm, 1); /* assume aad is present */-	cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);-}--/* even though l(a) can be as large as 2^64, we only handle aad up to 2 ^ 32 for practical reasons.-  Also we don't support incremental aad add, because the 1st encoded adata has length information- */-void cryptonite_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)-{-	block128 tmp;--	if (ccm->length_aad != 0) return;--	ccm->length_aad = length;-	int len_len;--	block128_zero(&tmp);-	len_len = ccm_encode_la(&tmp, length);--	if (length < 16 - len_len) {-		memcpy(&tmp.b[len_len], input, length);-		length = 0;-	} else {-		memcpy(&tmp.b[len_len], input, 16 - len_len);-		input += 16 - len_len;-		length -= 16 - len_len;-	}--	ccm_cbcmac_add(ccm, key, &tmp);--	for (; length >= 16; input += 16, length -= 16) {-		block128_copy(&tmp, (block128*)input);-		ccm_cbcmac_add(ccm, key, &tmp);--	}-	if (length > 0) {-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		ccm_cbcmac_add(ccm, key, &tmp);-	}-	block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);-}--void cryptonite_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key)-{-	block128 iv, s0;--	block128_zero(&iv);-	ccm_encode_ctr(&iv, ccm, 0);-	cryptonite_aes_encrypt_block(&s0, key, &iv);-	block128_vxor((block128*)tag, &ccm->xi, &s0);-}--static inline void ocb_block_double(block128 *d, block128 *s)-{-	unsigned int i;-	uint8_t tmp = s->b[0];--	for (i=0; i<15; i++)-		d->b[i] = (s->b[i] << 1) | (s->b[i+1] >> 7);-	d->b[15] = (s->b[15] << 1) ^ ((tmp >> 7) * 0x87);-}--static void ocb_get_L_i(block128 *l, block128 *lis, unsigned int i)-{-#define L_CACHED 4-	i = bitfn_ntz(i);-	if (i < L_CACHED) {-		block128_copy(l, &lis[i]);-	} else {-		i -= (L_CACHED - 1);-		block128_copy(l, &lis[L_CACHED - 1]);-		while (i--) {-			ocb_block_double(l, l);-		}-	}-#undef L_CACHED-}--void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)-{-	block128 tmp, nonce, ktop;-	unsigned char stretch[24];-	unsigned bottom, byteshift, bitshift, i;--	/* we don't accept more than 15 bytes, any bytes higher will be ignored. */-	if (len > 15) {-		len = 15;-	}--	/* create L*, and L$,L0,L1,L2,L3 */-	block128_zero(&tmp);-	cryptonite_aes_encrypt_block(&ocb->lstar, key, &tmp);--	ocb_block_double(&ocb->ldollar, &ocb->lstar);-	ocb_block_double(&ocb->li[0], &ocb->ldollar);-	ocb_block_double(&ocb->li[1], &ocb->li[0]);-	ocb_block_double(&ocb->li[2], &ocb->li[1]);-	ocb_block_double(&ocb->li[3], &ocb->li[2]);--	/* create strech from the nonce */-	block128_zero(&nonce);-	memcpy(nonce.b + 4, iv, 12);-	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);-	nonce.b[16-12-1] |= 0x01;-	bottom = nonce.b[15] & 0x3F;-	nonce.b[15] &= 0xC0;-	cryptonite_aes_encrypt_block(&ktop, key, &nonce);-	memcpy(stretch, ktop.b, 16);--	memcpy(tmp.b, ktop.b + 1, 8);-	block128_xor_aligned(&tmp, &ktop);-	memcpy(stretch + 16, tmp.b, 8);--	/* initialize the encryption offset from stretch */-	byteshift = bottom / 8;-	bitshift = bottom % 8;-	if (bitshift != 0)-		for (i = 0; i < 16; i++)-			ocb->offset_enc.b[i] = (stretch[i+byteshift] << bitshift)-			                     | (stretch[i+byteshift+1] >> (8-bitshift));-	else-		for (i = 0; i < 16; i++)-			ocb->offset_enc.b[i] = stretch[i+byteshift];-	/* initialize checksum for aad and encryption, and the aad offset */-	block128_zero(&ocb->sum_aad);-	block128_zero(&ocb->sum_enc);-	block128_zero(&ocb->offset_aad);-}--void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)-{-	block128 tmp;-	unsigned int i;--	for (i=1; i<= length/16; i++, input=input+16) {-		ocb_get_L_i(&tmp, ocb->li, i);-		block128_xor_aligned(&ocb->offset_aad, &tmp);--		block128_vxor(&tmp, &ocb->offset_aad, (block128 *) input);-		cryptonite_aes_encrypt_block(&tmp, key, &tmp);-		block128_xor_aligned(&ocb->sum_aad, &tmp);-	}--	length = length % 16; /* Bytes in final block */-	if (length > 0) {-		block128_xor_aligned(&ocb->offset_aad, &ocb->lstar);-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		tmp.b[length] = 0x80;-		block128_xor_aligned(&tmp, &ocb->offset_aad);-		cryptonite_aes_encrypt_block(&tmp, key, &tmp);-		block128_xor_aligned(&ocb->sum_aad, &tmp);-	}-}--void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key)-{-	block128 tmp;--	block128_vxor_aligned(&tmp, &ocb->sum_enc, &ocb->offset_enc);-	block128_xor_aligned(&tmp, &ocb->ldollar);-	cryptonite_aes_encrypt_block((block128 *) tag, key, &tmp);-	block128_xor((block128 *) tag, &ocb->sum_aad);-}--void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)-{-	for ( ; nb_blocks-- > 0; input++, output++) {-		cryptonite_aes_generic_encrypt_block(output, key, input);-	}-}--void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)-{-	for ( ; nb_blocks-- > 0; input++, output++) {-		cryptonite_aes_generic_decrypt_block(output, key, input);-	}-}--void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)-{-	aes_block block;--	/* preload IV in block */-	block128_copy(&block, iv);-	for ( ; nb_blocks-- > 0; input++, output++) {-		block128_xor(&block, (block128 *) input);-		cryptonite_aes_generic_encrypt_block(&block, key, &block);-		block128_copy((block128 *) output, &block);-	}-}--void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *ivini, aes_block *input, uint32_t nb_blocks)-{-	aes_block block, blocko;-	aes_block iv;--	/* preload IV in block */-	block128_copy(&iv, ivini);-	for ( ; nb_blocks-- > 0; input++, output++) {-		block128_copy(&block, (block128 *) input);-		cryptonite_aes_generic_decrypt_block(&blocko, key, &block);-		block128_vxor((block128 *) output, &blocko, &iv);-		block128_copy(&iv, &block);-	}-}--void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)-{-	aes_block block, o;-	uint32_t nb_blocks = len / 16;-	int i;--	/* preload IV in block */-	block128_copy(&block, iv);--	for ( ; nb_blocks-- > 0; block128_inc_be(&block), output += 16, input += 16) {-		cryptonite_aes_encrypt_block(&o, key, &block);-		block128_vxor((block128 *) output, &o, (block128 *) input);-	}--	if ((len % 16) != 0) {-		cryptonite_aes_encrypt_block(&o, key, &block);-		for (i = 0; i < (len % 16); i++) {-			*output = ((uint8_t *) &o)[i] ^ *input;-			output++;-			input++;-		}-	}-}--void cryptonite_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)-{-	aes_block block, o;-	uint32_t nb_blocks = len / 16;-	int i;--	/* preload IV in block */-	block128_copy(&block, iv);--	for ( ; nb_blocks-- > 0; block128_inc32_le(&block), output += 16, input += 16) {-		cryptonite_aes_encrypt_block(&o, key, &block);-		block128_vxor((block128 *) output, &o, (block128 *) input);-	}--	if ((len % 16) != 0) {-		cryptonite_aes_encrypt_block(&o, key, &block);-		for (i = 0; i < (len % 16); i++) {-			*output = ((uint8_t *) &o)[i] ^ *input;-			output++;-			input++;-		}-	}-}--void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)-{-	aes_block block, tweak;--	/* load IV and encrypt it using k2 as the tweak */-	block128_copy(&tweak, dataunit);-	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);--	/* TO OPTIMISE: this is really inefficient way to do that */-	while (spoint-- > 0)-		cryptonite_aes_generic_gf_mulx(&tweak);--	for ( ; nb_blocks-- > 0; input++, output++, cryptonite_aes_generic_gf_mulx(&tweak)) {-		block128_vxor(&block, input, &tweak);-		cryptonite_aes_encrypt_block(&block, k1, &block);-		block128_vxor(output, &block, &tweak);-	}-}--void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)-{-	aes_block block, tweak;--	/* load IV and encrypt it using k2 as the tweak */-	block128_copy(&tweak, dataunit);-	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);--	/* TO OPTIMISE: this is really inefficient way to do that */-	while (spoint-- > 0)-		cryptonite_aes_generic_gf_mulx(&tweak);--	for ( ; nb_blocks-- > 0; input++, output++, cryptonite_aes_generic_gf_mulx(&tweak)) {-		block128_vxor(&block, input, &tweak);-		cryptonite_aes_decrypt_block(&block, k1, &block);-		block128_vxor(output, &block, &tweak);-	}-}--void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)-{-	aes_block out;--	gcm->length_input += length;-	for (; length >= 16; input += 16, output += 16, length -= 16) {-		block128_inc32_be(&gcm->civ);--		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);-		block128_xor(&out, (block128 *) input);-		gcm_ghash_add(gcm, &out);-		block128_copy((block128 *) output, &out);-	}-	if (length > 0) {-		aes_block tmp;-		int i;--		block128_inc32_be(&gcm->civ);-		/* create e(civ) in out */-		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);-		/* initialize a tmp as input and xor it to e(civ) */-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		block128_xor_bytes(&tmp, out.b, length);--		gcm_ghash_add(gcm, &tmp);--		for (i = 0; i < length; i++) {-			output[i] = tmp.b[i];-		}-	}-}--void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)-{-	aes_block out;--	gcm->length_input += length;-	for (; length >= 16; input += 16, output += 16, length -= 16) {-		block128_inc32_be(&gcm->civ);--		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);-		gcm_ghash_add(gcm, (block128 *) input);-		block128_xor(&out, (block128 *) input);-		block128_copy((block128 *) output, &out);-	}-	if (length > 0) {-		aes_block tmp;-		int i;--		block128_inc32_be(&gcm->civ);--		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		gcm_ghash_add(gcm, &tmp);--		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);-		block128_xor_bytes(&tmp, out.b, length);--		for (i = 0; i < length; i++) {-			output[i] = tmp.b[i];-		}-	}-}--static void ocb_generic_crypt(uint8_t *output, aes_ocb *ocb, aes_key *key,-                              uint8_t *input, uint32_t length, int encrypt)-{-	block128 tmp, pad;-	unsigned int i;--	for (i = 1; i <= length/16; i++, input += 16, output += 16) {-		/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */-		ocb_get_L_i(&tmp, ocb->li, i);-		block128_xor_aligned(&ocb->offset_enc, &tmp);--		block128_vxor(&tmp, &ocb->offset_enc, (block128 *) input);-		if (encrypt) {-			cryptonite_aes_encrypt_block(&tmp, key, &tmp);-			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);-			block128_xor(&ocb->sum_enc, (block128 *) input);-		} else {-			cryptonite_aes_decrypt_block(&tmp, key, &tmp);-			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);-			block128_xor(&ocb->sum_enc, (block128 *) output);-		}-	}--	/* process the last partial block if any */-	length = length % 16;-	if (length > 0) {-		block128_xor_aligned(&ocb->offset_enc, &ocb->lstar);-		cryptonite_aes_encrypt_block(&pad, key, &ocb->offset_enc);--		if (encrypt) {-			block128_zero(&tmp);-			block128_copy_bytes(&tmp, input, length);-			tmp.b[length] = 0x80;-			block128_xor_aligned(&ocb->sum_enc, &tmp);-			block128_xor_aligned(&pad, &tmp);-			memcpy(output, pad.b, length);-			output += length;-		} else {-			block128_copy_aligned(&tmp, &pad);-			block128_copy_bytes(&tmp, input, length);-			block128_xor_aligned(&tmp, &pad);-			tmp.b[length] = 0x80;-			memcpy(output, tmp.b, length);-			block128_xor_aligned(&ocb->sum_enc, &tmp);-			input += length;-		}-	}-}--void cryptonite_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)-{-	block128 tmp, ctr;--	/* when aad is absent, reset b0 block */-	if (ccm->length_aad == 0) {-		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */-		cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);-		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);-	}--	if (length != ccm->length_input) {-		return;-	}--	ccm_encode_ctr(&ctr, ccm, 1);-	cryptonite_aes_encrypt_ctr(output, key, &ctr, input, length);--	for (;length >= 16; input += 16, length -= 16) {-		block128_copy(&tmp, (block128*)input);-		ccm_cbcmac_add(ccm, key, &tmp);-	}-	if (length > 0) {-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		ccm_cbcmac_add(ccm, key, &tmp);-	}-}--void cryptonite_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)-{-	block128 tmp, ctr;--	if (length != ccm->length_input) {-		return;-	}--	/* when aad is absent, reset b0 block */-	if (ccm->length_aad == 0) {-		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */-		cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);-		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);-	}--	ccm_encode_ctr(&ctr, ccm, 1);-	cryptonite_aes_encrypt_ctr(output, key, &ctr, input, length);-	block128_copy_aligned(&ccm->xi, &ccm->header_cbcmac);-	input = output;--	for (;length >= 16; input += 16, length -= 16) {-		block128_copy(&tmp, (block128*)input);-		ccm_cbcmac_add(ccm, key, &tmp);-	}-	if (length > 0) {-		block128_zero(&tmp);-		block128_copy_bytes(&tmp, input, length);-		ccm_cbcmac_add(ccm, key, &tmp);-	}-}--void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)-{-	ocb_generic_crypt(output, ocb, key, input, length, 1);-}--void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)-{-	ocb_generic_crypt(output, ocb, key, input, length, 0);-}--static inline void gf_mulx_rev(block128 *a, const block128 *h)-{-	uint64_t v1 = cpu_to_le64(h->q[0]);-	uint64_t v0 = cpu_to_le64(h->q[1]);-	a->q[1] = cpu_to_be64(v1 >> 1 | v0 << 63);-	a->q[0] = cpu_to_be64(v0 >> 1 ^ ((0-(v1 & 1)) & 0xe100000000000000ULL));-}--void cryptonite_aes_polyval_init(aes_polyval *ctx, const aes_block *h)-{-	aes_block r;--	/* ByteReverse(S_0) = 0 */-	block128_zero(&ctx->s);--	/* ByteReverse(H) * x */-	gf_mulx_rev(&r, h);-	cryptonite_hinit(ctx->htable, &r);-}--void cryptonite_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length)-{-	aes_block r;-	const uint8_t *p;-	uint32_t sz;--	/* This automatically pads with zeros if input is not a multiple of the-	   block size. */-	for (p = input; length > 0; p += 16, length -= sz)-	{-		sz = length < 16 ? length : 16;--		/* ByteReverse(X_j) */-		block128_zero(&r);-		memcpy(&r, p, sz);-		block128_byte_reverse(&r);--		/* ByteReverse(S_{j-1}) + ByteReverse(X_j) */-		block128_xor_aligned(&ctx->s, &r);--		/* ByteReverse(S_j) */-		cryptonite_gf_mul(&ctx->s, ctx->htable);-	}-}--void cryptonite_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst)-{-	/* S_s */-	block128_copy_aligned(dst, &ctx->s);-	block128_byte_reverse(dst);-}
− cbits/cryptonite_aes.h 
@@ -1,130 +0,0 @@-/*- *	Copyright (C) 2008 Vincent Hanquez <tab@snarc.org>- *- * All rights reserved.- * - * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- *- * AES implementation- */-#ifndef CRYPTONITE_AES_H-#define CRYPTONITE_AES_H--#include <stdint.h>-#include "aes/block128.h"--typedef block128 aes_block;--/* size = 456 */-typedef struct {-	uint8_t nbr; /* number of rounds: 10 (128), 12 (192), 14 (256) */-	uint8_t strength; /* 128 = 0, 192 = 1, 256 = 2 */-	uint8_t _padding[6];-	uint8_t data[16*14*2];-} aes_key;--/* size = 19*16+2*8= 320 */-typedef struct {-	aes_block tag;-	aes_block htable[16];-	aes_block iv;-	aes_block civ;-	uint64_t length_aad;-	uint64_t length_input;-} aes_gcm;--/* size = 4*16+4*4= 80 */-typedef struct {-	aes_block xi;-	aes_block header_cbcmac;-	aes_block b0;-	aes_block nonce;-	uint32_t length_aad;-	uint32_t length_input;-	uint32_t length_M;-	uint32_t length_L;-} aes_ccm;--typedef struct {-	block128 offset_aad;-	block128 offset_enc;-	block128 sum_aad;-	block128 sum_enc;-	block128 lstar;-	block128 ldollar;-	block128 li[4];-} aes_ocb;--/* size = 17*16= 272 */-typedef struct {-	aes_block htable[16];-	aes_block s;-} aes_polyval;--/* in bytes: either 16,24,32 */-void cryptonite_aes_initkey(aes_key *ctx, uint8_t *key, uint8_t size);--void cryptonite_aes_encrypt(aes_block *output, aes_key *key, aes_block *input);-void cryptonite_aes_decrypt(aes_block *output, aes_key *key, aes_block *input);--void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);--void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);--void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks);-void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks);--void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);-void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);--void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len);-void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length);-void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key);--void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);-void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key);--void cryptonite_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t len, uint32_t msg_size, int m, int l);-void cryptonite_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);-void cryptonite_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key);--uint8_t *cryptonite_aes_cpu_init(void);--void cryptonite_aes_polyval_init(aes_polyval *ctx, const aes_block *h);-void cryptonite_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length);-void cryptonite_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst);--#endif
− cbits/cryptonite_align.h 
@@ -1,140 +0,0 @@-#ifndef CRYPTONITE_ALIGN_H-#define CRYPTONITE_ALIGN_H--#include "cryptonite_bitfn.h"--#if (defined(__i386__))-# define UNALIGNED_ACCESS_OK-#elif defined(__x86_64__)-# define UNALIGNED_ACCESS_OK-#else-# define UNALIGNED_ACCESS_FAULT-#endif--/* n need to be power of 2.- * IS_ALIGNED(p,8) */-#define IS_ALIGNED(p,alignment) (((uintptr_t) (p)) & ((alignment)-1))--#ifdef WITH_ASSERT_ALIGNMENT-#include <stdio.h>-#include <stdlib.h>-#include <inttypes.h>-# define ASSERT_ALIGNMENT(up, alignment) \-	do { if (IS_ALIGNED(up, alignment)) \-	{ printf("ALIGNMENT-ASSERT-FAILURE: %s:%d: ptr=%p alignment=%d\n", __FILE__, __LINE__, (void *) up, (alignment)); \-	  exit(99); \-	}; } while (0)-#else-# define ASSERT_ALIGNMENT(p, n) do {} while (0)-#endif--#ifdef UNALIGNED_ACCESS_OK-#define need_alignment(p,n) (0)-#else-#define need_alignment(p,n) IS_ALIGNED(p,n)-#endif--static inline uint32_t load_le32_aligned(const uint8_t *p)-{-	return le32_to_cpu(*((uint32_t *) p));		-}--static inline void store_le32_aligned(uint8_t *dst, const uint32_t v)-{-	*((uint32_t *) dst) = cpu_to_le32(v);-}--static inline void xor_le32_aligned(uint8_t *dst, const uint32_t v)-{-	*((uint32_t *) dst) ^= cpu_to_le32(v);-}--static inline void store_be32_aligned(uint8_t *dst, const uint32_t v)-{-	*((uint32_t *) dst) = cpu_to_be32(v);-}--static inline void xor_be32_aligned(uint8_t *dst, const uint32_t v)-{-	*((uint32_t *) dst) ^= cpu_to_be32(v);-}--static inline void store_le64_aligned(uint8_t *dst, const uint64_t v)-{-	*((uint64_t *) dst) = cpu_to_le64(v);-}--static inline void store_be64_aligned(uint8_t *dst, const uint64_t v)-{-	*((uint64_t *) dst) = cpu_to_be64(v);-}--static inline void xor_be64_aligned(uint8_t *dst, const uint64_t v)-{-	*((uint64_t *) dst) ^= cpu_to_be64(v);-}--#ifdef UNALIGNED_ACCESS_OK-#define load_le32(a) load_le32_aligned(a)-#else-static inline uint32_t load_le32(const uint8_t *p)-{-	return ((uint32_t)p[0]) | ((uint32_t)p[1] <<  8) | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);-}-#endif--#ifdef UNALIGNED_ACCESS_OK-#define store_le32(a, b) store_le32_aligned(a, b)-#define xor_le32(a, b) xor_le32_aligned(a, b)-#else-static inline void store_le32(uint8_t *dst, const uint32_t v)-{-	dst[0] = v; dst[1] = v >> 8; dst[2] = v >> 16; dst[3] = v >> 24;-}-static inline void xor_le32(uint8_t *dst, const uint32_t v)-{-	dst[0] ^= v; dst[1] ^= v >> 8; dst[2] ^= v >> 16; dst[3] ^= v >> 24;-}-#endif--#ifdef UNALIGNED_ACCESS_OK-#define store_be32(a, b) store_be32_aligned(a, b)-#define xor_be32(a, b) xor_be32_aligned(a, b)-#else-static inline void store_be32(uint8_t *dst, const uint32_t v)-{-	dst[3] = v; dst[2] = v >> 8; dst[1] = v >> 16; dst[0] = v >> 24;-}-static inline void xor_be32(uint8_t *dst, const uint32_t v)-{-	dst[3] ^= v; dst[2] ^= v >> 8; dst[1] ^= v >> 16; dst[0] ^= v >> 24;-}-#endif--#ifdef UNALIGNED_ACCESS_OK-#define store_le64(a, b) store_le64_aligned(a, b)-#else-static inline void store_le64(uint8_t *dst, const uint64_t v)-{-	dst[0] = v      ; dst[1] = v >> 8 ; dst[2] = v >> 16; dst[3] = v >> 24;-	dst[4] = v >> 32; dst[5] = v >> 40; dst[6] = v >> 48; dst[7] = v >> 56;-}-#endif--#ifdef UNALIGNED_ACCESS_OK-#define store_be64(a, b) store_be64_aligned(a, b)-#define xor_be64(a, b) xor_be64_aligned(a, b)-#else-static inline void store_be64(uint8_t *dst, const uint64_t v)-{-	dst[7] = v      ; dst[6] = v >> 8 ; dst[5] = v >> 16; dst[4] = v >> 24;-	dst[3] = v >> 32; dst[2] = v >> 40; dst[1] = v >> 48; dst[0] = v >> 56;-}-static inline void xor_be64(uint8_t *dst, const uint64_t v)-{-	dst[7] ^= v      ; dst[6] ^= v >> 8 ; dst[5] ^= v >> 16; dst[4] ^= v >> 24;-	dst[3] ^= v >> 32; dst[2] ^= v >> 40; dst[1] ^= v >> 48; dst[0] ^= v >> 56;-}-#endif--#endif
− cbits/cryptonite_bitfn.h 
@@ -1,253 +0,0 @@-/*- * Copyright (C) 2006-2014 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#ifndef BITFN_H-#define BITFN_H-#include <stdint.h>--#ifndef NO_INLINE_ASM-/**********************************************************/-# if (defined(__i386__))-#  define ARCH_HAS_SWAP32-static inline uint32_t bitfn_swap32(uint32_t a)-{-	asm ("bswap %0" : "=r" (a) : "0" (a));-	return a;-}-/**********************************************************/-# elif (defined(__arm__))-#  define ARCH_HAS_SWAP32-static inline uint32_t bitfn_swap32(uint32_t a)-{-	uint32_t tmp = a;-	asm volatile ("eor %1, %0, %0, ror #16\n"-	              "bic %1, %1, #0xff0000\n"-	              "mov %0, %0, ror #8\n"-	              "eor %0, %0, %1, lsr #8\n"-	             : "=r" (a), "=r" (tmp) : "0" (a), "1" (tmp));-	return a;-}-/**********************************************************/-# elif defined(__x86_64__)-#  define ARCH_HAS_SWAP32-#  define ARCH_HAS_SWAP64-static inline uint32_t bitfn_swap32(uint32_t a)-{-	asm ("bswap %0" : "=r" (a) : "0" (a));-	return a;-}--static inline uint64_t bitfn_swap64(uint64_t a)-{-	asm ("bswap %0" : "=r" (a) : "0" (a));-	return a;-}--# endif-#endif /* NO_INLINE_ASM */-/**********************************************************/--#ifndef ARCH_HAS_ROL32-static inline uint32_t rol32(uint32_t word, uint32_t shift)-{-	return (word << shift) | (word >> (32 - shift));-}-#endif--#ifndef ARCH_HAS_ROR32-static inline uint32_t ror32(uint32_t word, uint32_t shift)-{-	return (word >> shift) | (word << (32 - shift));-}-#endif--#ifndef ARCH_HAS_ROL64-static inline uint64_t rol64(uint64_t word, uint32_t shift)-{-	return (word << shift) | (word >> (64 - shift));-}-#endif--#ifndef ARCH_HAS_ROR64-static inline uint64_t ror64(uint64_t word, uint32_t shift)-{-	return (word >> shift) | (word << (64 - shift));-}-#endif--#ifndef ARCH_HAS_SWAP32-static inline uint32_t bitfn_swap32(uint32_t a)-{-	return (a << 24) | ((a & 0xff00) << 8) | ((a >> 8) & 0xff00) | (a >> 24);-}-#endif--#ifndef ARCH_HAS_ARRAY_SWAP32-static inline void array_swap32(uint32_t *d, uint32_t *s, uint32_t nb)-{-	while (nb--)-		*d++ = bitfn_swap32(*s++);-}-#endif--#ifndef ARCH_HAS_SWAP64-static inline uint64_t bitfn_swap64(uint64_t a)-{-	return ((uint64_t) bitfn_swap32((uint32_t) (a >> 32))) |-	       (((uint64_t) bitfn_swap32((uint32_t) a)) << 32);-}-#endif--#ifndef ARCH_HAS_ARRAY_SWAP64-static inline void array_swap64(uint64_t *d, uint64_t *s, uint32_t nb)-{-	while (nb--)-		*d++ = bitfn_swap64(*s++);-}-#endif--#ifndef ARCH_HAS_MEMORY_ZERO-static inline void memory_zero(void *ptr, uint32_t len)-{-	uint32_t *ptr32 = ptr;-	uint8_t *ptr8;-	int i;--	for (i = 0; i < len / 4; i++)-		*ptr32++ = 0;-	if (len % 4) {-		ptr8 = (uint8_t *) ptr32;-		for (i = len % 4; i >= 0; i--)-			ptr8[i] = 0;-	}-}-#endif--#ifndef ARCH_HAS_ARRAY_COPY32-static inline void array_copy32(uint32_t *d, uint32_t *s, uint32_t nb)-{-	while (nb--) *d++ = *s++;-}-#endif--#ifndef ARCH_HAS_ARRAY_XOR32-static inline void array_xor32(uint32_t *d, uint32_t *s, uint32_t nb)-{-	while (nb--) *d++ ^= *s++;-}-#endif--#ifndef ARCH_HAS_ARRAY_COPY64-static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb)-{-	while (nb--) *d++ = *s++;-}-#endif--#ifdef __GNUC__-#define bitfn_ntz(n) __builtin_ctz(n)-#else-#error "define ntz for your platform"-#endif--#ifdef __MINGW32__-  # define LITTLE_ENDIAN 1234-  # define BYTE_ORDER    LITTLE_ENDIAN-#elif defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)-  # include <sys/endian.h>-#elif defined(__OpenBSD__) || defined(__SVR4)-  # include <sys/types.h>-#elif defined(__APPLE__)-  # include <machine/endian.h>-#elif defined( BSD ) && ( BSD >= 199103 )-  # include <machine/endian.h>-#elif defined( __QNXNTO__ ) && defined( __LITTLEENDIAN__ )-  # define LITTLE_ENDIAN 1234-  # define BYTE_ORDER    LITTLE_ENDIAN-#elif defined( __QNXNTO__ ) && defined( __BIGENDIAN__ )-  # define BIG_ENDIAN 1234-  # define BYTE_ORDER    BIG_ENDIAN-#elif defined( _AIX )-  # include <sys/machine.h>-#else-  # include <endian.h>-#endif-/* big endian to cpu */-#if LITTLE_ENDIAN == BYTE_ORDER--# define be32_to_cpu(a) bitfn_swap32(a)-# define cpu_to_be32(a) bitfn_swap32(a)-# define le32_to_cpu(a) (a)-# define cpu_to_le32(a) (a)-# define be64_to_cpu(a) bitfn_swap64(a)-# define cpu_to_be64(a) bitfn_swap64(a)-# define le64_to_cpu(a) (a)-# define cpu_to_le64(a) (a)--# define cpu_to_le32_array(d, s, l) array_copy32(d, s, l)-# define le32_to_cpu_array(d, s, l) array_copy32(d, s, l)-# define cpu_to_be32_array(d, s, l) array_swap32(d, s, l)-# define be32_to_cpu_array(d, s, l) array_swap32(d, s, l)--# define cpu_to_le64_array(d, s, l) array_copy64(d, s, l)-# define le64_to_cpu_array(d, s, l) array_copy64(d, s, l)-# define cpu_to_be64_array(d, s, l) array_swap64(d, s, l)-# define be64_to_cpu_array(d, s, l) array_swap64(d, s, l)--# define ror32_be(a, s) rol32(a, s)-# define rol32_be(a, s) ror32(a, s)--# define ARCH_IS_LITTLE_ENDIAN--#elif BIG_ENDIAN == BYTE_ORDER--# define be32_to_cpu(a) (a)-# define cpu_to_be32(a) (a)-# define be64_to_cpu(a) (a)-# define cpu_to_be64(a) (a)-# define le64_to_cpu(a) bitfn_swap64(a)-# define cpu_to_le64(a) bitfn_swap64(a)-# define le32_to_cpu(a) bitfn_swap32(a)-# define cpu_to_le32(a) bitfn_swap32(a)--# define cpu_to_le32_array(d, s, l) array_swap32(d, s, l)-# define le32_to_cpu_array(d, s, l) array_swap32(d, s, l)-# define cpu_to_be32_array(d, s, l) array_copy32(d, s, l)-# define be32_to_cpu_array(d, s, l) array_copy32(d, s, l)--# define cpu_to_le64_array(d, s, l) array_swap64(d, s, l)-# define le64_to_cpu_array(d, s, l) array_swap64(d, s, l)-# define cpu_to_be64_array(d, s, l) array_copy64(d, s, l)-# define be64_to_cpu_array(d, s, l) array_copy64(d, s, l)--# define ror32_be(a, s) ror32(a, s)-# define rol32_be(a, s) rol32(a, s)--# define ARCH_IS_BIG_ENDIAN--#else-# error "endian not supported"-#endif--#endif /* !BITFN_H */
− cbits/cryptonite_blake2b.c 
@@ -1,16 +0,0 @@-#include "cryptonite_blake2b.h"--void cryptonite_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen)-{-	_cryptonite_blake2b_init(ctx, hashlen / 8);-}--void cryptonite_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len)-{-	_cryptonite_blake2b_update(ctx, data, len);-}--void cryptonite_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	_cryptonite_blake2b_final(ctx, out, hashlen / 8);-}
− cbits/cryptonite_blake2b.h 
@@ -1,12 +0,0 @@-#ifndef CRYPTOHASH_BLAKE2B_H-#define CRYPTOHASH_BLAKE2B_H--#include "blake2.h"--typedef blake2b_state blake2b_ctx;--void cryptonite_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen);-void cryptonite_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_blake2bp.c 
@@ -1,16 +0,0 @@-#include "cryptonite_blake2bp.h"--void cryptonite_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen)-{-	_cryptonite_blake2bp_init(ctx, hashlen / 8);-}--void cryptonite_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len)-{-	_cryptonite_blake2bp_update(ctx, data, len);-}--void cryptonite_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	_cryptonite_blake2bp_final(ctx, out, hashlen / 8);-}
− cbits/cryptonite_blake2bp.h 
@@ -1,12 +0,0 @@-#ifndef CRYPTOHASH_BLAKE2BP_H-#define CRYPTOHASH_BLAKE2BP_H--#include "blake2.h"--typedef blake2bp_state blake2bp_ctx;--void cryptonite_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen);-void cryptonite_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_blake2s.c 
@@ -1,16 +0,0 @@-#include "cryptonite_blake2s.h"--void cryptonite_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen)-{-	_cryptonite_blake2s_init(ctx, hashlen / 8);-}--void cryptonite_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len)-{-	_cryptonite_blake2s_update(ctx, data, len);-}--void cryptonite_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	_cryptonite_blake2s_final(ctx, out, hashlen / 8);-}
− cbits/cryptonite_blake2s.h 
@@ -1,12 +0,0 @@-#ifndef CRYPTOHASH_BLAKE2S_H-#define CRYPTOHASH_BLAKE2S_H--#include "blake2.h"--typedef blake2s_state blake2s_ctx;--void cryptonite_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen);-void cryptonite_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_blake2sp.c 
@@ -1,16 +0,0 @@-#include "cryptonite_blake2sp.h"--void cryptonite_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen)-{-	_cryptonite_blake2sp_init(ctx, hashlen / 8);-}--void cryptonite_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len)-{-	_cryptonite_blake2sp_update(ctx, data, len);-}--void cryptonite_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	_cryptonite_blake2sp_final(ctx, out, hashlen / 8);-}
− cbits/cryptonite_blake2sp.h 
@@ -1,12 +0,0 @@-#ifndef CRYPTOHASH_BLAKE2SP_H-#define CRYPTOHASH_BLAKE2SP_H--#include "blake2.h"--typedef blake2sp_state blake2sp_ctx;--void cryptonite_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen);-void cryptonite_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_chacha.c 
@@ -1,288 +0,0 @@-/*- * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */--#include <stdint.h>-#include <string.h>-#include "cryptonite_chacha.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include <stdio.h>--#define QR(a,b,c,d) \-	a += b; d = rol32(d ^ a,16); \-	c += d; b = rol32(b ^ c,12); \-	a += b; d = rol32(d ^ a, 8); \-	c += d; b = rol32(b ^ c, 7);--#define ALIGNED64(PTR) \-	(((uintptr_t)(const void *)(PTR)) % 8 == 0)--static const uint8_t sigma[16] = "expand 32-byte k";-static const uint8_t tau[16] = "expand 16-byte k";--static void chacha_core(int rounds, block *out, const cryptonite_chacha_state *in)-{-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;-	int i;--	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];-	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];-	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];-	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];--	for (i = rounds; i > 0; i -= 2) {-		QR(x0, x4, x8, x12);-		QR(x1, x5, x9, x13);-		QR(x2, x6, x10, x14);-		QR(x3, x7, x11, x15);--		QR(x0, x5, x10, x15);-		QR(x1, x6, x11, x12);-		QR(x2, x7, x8, x13);-		QR(x3, x4, x9, x14);-	}--	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];-	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];-	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];-	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];--	out->d[0] = cpu_to_le32(x0);-	out->d[1] = cpu_to_le32(x1);-	out->d[2] = cpu_to_le32(x2);-	out->d[3] = cpu_to_le32(x3);-	out->d[4] = cpu_to_le32(x4);-	out->d[5] = cpu_to_le32(x5);-	out->d[6] = cpu_to_le32(x6);-	out->d[7] = cpu_to_le32(x7);-	out->d[8] = cpu_to_le32(x8);-	out->d[9] = cpu_to_le32(x9);-	out->d[10] = cpu_to_le32(x10);-	out->d[11] = cpu_to_le32(x11);-	out->d[12] = cpu_to_le32(x12);-	out->d[13] = cpu_to_le32(x13);-	out->d[14] = cpu_to_le32(x14);-	out->d[15] = cpu_to_le32(x15);-}--/* only 2 valids values are 256 (32) and 128 (16) */-void cryptonite_chacha_init_core(cryptonite_chacha_state *st,-                                 uint32_t keylen, const uint8_t *key,-                                 uint32_t ivlen, const uint8_t *iv)-{-	const uint8_t *constants = (keylen == 32) ? sigma : tau;--	ASSERT_ALIGNMENT(constants, 4);--	st->d[0] = load_le32_aligned(constants + 0);-	st->d[1] = load_le32_aligned(constants + 4);-	st->d[2] = load_le32_aligned(constants + 8);-	st->d[3] = load_le32_aligned(constants + 12);--	st->d[4] = load_le32(key + 0);-	st->d[5] = load_le32(key + 4);-	st->d[6] = load_le32(key + 8);-	st->d[7] = load_le32(key + 12);-	/* we repeat the key on 128 bits */-	if (keylen == 32)-		key += 16;-	st->d[8] = load_le32(key + 0);-	st->d[9] = load_le32(key + 4);-	st->d[10] = load_le32(key + 8);-	st->d[11] = load_le32(key + 12);-	st->d[12] = 0;-	switch (ivlen) {-	case 8:-		st->d[13] = 0;-		st->d[14] = load_le32(iv + 0);-		st->d[15] = load_le32(iv + 4);-		break;-	case 12:-		st->d[13] = load_le32(iv + 0);-		st->d[14] = load_le32(iv + 4);-		st->d[15] = load_le32(iv + 8);-	default:-		return;-	}-}--void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds,-                            uint32_t keylen, const uint8_t *key,-                            uint32_t ivlen, const uint8_t *iv)-{-	memset(ctx, 0, sizeof(*ctx));-	ctx->nb_rounds = nb_rounds;-	cryptonite_chacha_init_core(&ctx->st, keylen, key, ivlen, iv);-}--void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *ctx, const uint8_t *src, uint32_t bytes)-{-	block out;-	cryptonite_chacha_state *st;-	int i;--	if (!bytes)-		return;--	/* xor the previous buffer first (if any) */-	if (ctx->prev_len > 0) {-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;-		for (i = 0; i < to_copy; i++)-			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);-		ctx->prev_len -= to_copy;-		ctx->prev_ofs += to_copy;-		src += to_copy;-		dst += to_copy;-		bytes -= to_copy;-	}--	if (bytes == 0)-		return;--	st = &ctx->st;--	/* xor new 64-bytes chunks and store the left over if any */-	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {-		/* generate new chunk and update state */-		chacha_core(ctx->nb_rounds, &out, st);-		st->d[12] += 1;-		if (st->d[12] == 0)-			st->d[13] += 1;--		for (i = 0; i < 64; ++i)-			dst[i] = src[i] ^ out.b[i];-	}--	if (bytes > 0) {-		/* generate new chunk and update state */-		chacha_core(ctx->nb_rounds, &out, st);-		st->d[12] += 1;-		if (st->d[12] == 0)-			st->d[13] += 1;--		/* xor as much as needed */-		for (i = 0; i < bytes; i++)-			dst[i] = src[i] ^ out.b[i];-		-		/* copy the left over in the buffer */-		ctx->prev_len = 64 - bytes;-		ctx->prev_ofs = i;-		for (; i < 64; i++) {-			ctx->prev[i] = out.b[i];-		}-	}-}--void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *ctx, uint32_t bytes)-{-	cryptonite_chacha_state *st;-	block out;-	int i;--	if (!bytes)-		return;--	/* xor the previous buffer first (if any) */-	if (ctx->prev_len > 0) {-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;-		for (i = 0; i < to_copy; i++)-			dst[i] = ctx->prev[ctx->prev_ofs+i];-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);-		ctx->prev_len -= to_copy;-		ctx->prev_ofs += to_copy;-		dst += to_copy;-		bytes -= to_copy;-	}--	if (bytes == 0)-		return;--	st = &ctx->st;--	if (ALIGNED64(dst)) {-		/* xor new 64-bytes chunks and store the left over if any */-		for (; bytes >= 64; bytes -= 64, dst += 64) {-			/* generate new chunk and update state */-			chacha_core(ctx->nb_rounds, (block *) dst, st);-			st->d[12] += 1;-			if (st->d[12] == 0)-				st->d[13] += 1;-		}-	} else {-		/* xor new 64-bytes chunks and store the left over if any */-		for (; bytes >= 64; bytes -= 64, dst += 64) {-			/* generate new chunk and update state */-			chacha_core(ctx->nb_rounds, &out, st);-			st->d[12] += 1;-			if (st->d[12] == 0)-				st->d[13] += 1;--			for (i = 0; i < 64; ++i)-				dst[i] = out.b[i];-		}-	}--	if (bytes > 0) {-		/* generate new chunk and update state */-		chacha_core(ctx->nb_rounds, &out, st);-		st->d[12] += 1;-		if (st->d[12] == 0)-			st->d[13] += 1;--		/* xor as much as needed */-		for (i = 0; i < bytes; i++)-			dst[i] = out.b[i];-		-		/* copy the left over in the buffer */-		ctx->prev_len = 64 - bytes;-		ctx->prev_ofs = i;-		for (; i < 64; i++)-			ctx->prev[i] = out.b[i];-	}-}--void cryptonite_chacha_random(uint32_t rounds, uint8_t *dst, cryptonite_chacha_state *st, uint32_t bytes)-{-	block out;--	if (!bytes)-		return;-	for (; bytes >= 16; bytes -= 16, dst += 16) {-		chacha_core(rounds, &out, st);-		memcpy(dst, out.b + 40, 16);-		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);-	}-	if (bytes) {-		chacha_core(rounds, &out, st);-		memcpy(dst, out.b + 40, bytes);-		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);-	}-}
− cbits/cryptonite_chacha.h 
@@ -1,54 +0,0 @@-/*- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */-#ifndef CRYPTONITE_CHACHA-#define CRYPTONITE_CHACHA--typedef union {-	uint64_t q[8];-	uint32_t d[16];-	uint8_t  b[64];-} block;--typedef block cryptonite_chacha_state;--typedef struct {-	cryptonite_chacha_state st;-	uint8_t prev[64];-	uint8_t prev_ofs;-	uint8_t prev_len;-	uint8_t nb_rounds;-} cryptonite_chacha_context;--void cryptonite_chacha_init_core(cryptonite_chacha_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);-void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);-void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *st, const uint8_t *src, uint32_t bytes);-void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *st, uint32_t bytes);--#endif
− cbits/cryptonite_cpu.c 
@@ -1,75 +0,0 @@-/*- *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>- *- * All rights reserved.- * - * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- *- */-#include "cryptonite_cpu.h"-#include <stdint.h>--#ifdef ARCH_X86-static void cpuid(uint32_t info, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)-{-	*eax = info;-	asm volatile-		(-#ifdef __x86_64__-		 "mov %%rbx, %%rdi;"-#else-		 "mov %%ebx, %%edi;"-#endif-		 "cpuid;"-		 "mov %%ebx, %%esi;"-#ifdef __x86_64__-		 "mov %%rdi, %%rbx;"-#else-		 "mov %%edi, %%ebx;"-#endif-		 :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)-		 : :"edi");-}--#ifdef USE_AESNI-void cryptonite_aesni_initialize_hw(void (*init_table)(int, int))-{-	static int inited = 0;-	if (inited == 0) {-		uint32_t eax, ebx, ecx, edx;-		int aesni, pclmul;--		inited = 1;-		cpuid(1, &eax, &ebx, &ecx, &edx);-		aesni = (ecx & 0x02000000);-		pclmul = (ecx & 0x00000001);-		init_table(aesni, pclmul);-	}-}-#else-#define cryptonite_aesni_initialize_hw(init_table) 	(0)-#endif--#endif
− cbits/cryptonite_cpu.h 
@@ -1,45 +0,0 @@-/*- *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>- *- * All rights reserved.- * - * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- *- */-#ifndef CPU_H-#define CPU_H--#if defined(__i386__) || defined(__x86_64__)-#define ARCH_X86-#define USE_AESNI-#endif--#ifdef USE_AESNI-void cryptonite_aesni_initialize_hw(void (*init_table)(int, int));-#else-#define cryptonite_aesni_initialize_hw(init_table) 	(0)-#endif--#endif
− cbits/cryptonite_curve25519.h 
@@ -1,6 +0,0 @@-#ifndef CRYPTONITE_CURVE25519_H-#define CRYPTONITE_CURVE25519_H--int cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint);--#endif
− cbits/cryptonite_hash_prefix.c 
@@ -1,90 +0,0 @@-/*- * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <cryptonite_hash_prefix.h>--void CRYPTONITE_HASHED(finalize_prefix)(struct HASHED_LOWER(ctx) *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)-{-	uint64_t bits[HASHED(BITS_ELEMS)];-	uint8_t *p = (uint8_t *) &bits;-	uint32_t index, padidx, padlen, pos, out_mask;-	static const uint32_t cut_off = HASHED(BLOCK_SIZE) - sizeof(bits);--	/* Make sure n <= len */-	n += (len - n) & constant_time_lt(len, n);--	/* Initial index, based on current context state */-	index = CRYPTONITE_HASHED(get_index)(ctx);--	/* Final size after n bytes */-	CRYPTONITE_HASHED(incr_sz)(ctx, bits, n);--	/* Padding index and length */-	padidx = CRYPTONITE_HASHED(get_index)(ctx);-	padlen = HASHED(BLOCK_SIZE) + cut_off - padidx;-	padlen -= HASHED(BLOCK_SIZE) & constant_time_lt(padidx, cut_off);--	/* Initialize buffers because we will XOR into them */-	memset(ctx->buf + index, 0, HASHED(BLOCK_SIZE) - index);-	memset(out, 0, HASHED(DIGEST_SIZE));-	pos = 0;--	/* Iterate based on the full buffer length, regardless of n, and include-	 * the maximum overhead with padding and size bytes-	 */-	while (pos < len + HASHED(BLOCK_SIZE) + sizeof(bits)) {-		uint8_t b;--		/* Take as many bytes from the input buffer as possible */-		if (pos < len)-			b = *(data++) & (uint8_t) constant_time_lt(pos, n);-		else-			b = 0;--		/* First padding byte */-		b |= 0x80 & (uint8_t) constant_time_eq(pos, n);--		/* Size bytes are always at the end of a block */-		if (index >= cut_off)-			b |= p[index - cut_off] & (uint8_t) constant_time_ge(pos, n + padlen);--		/* Store this byte into the buffer */-		ctx->buf[index++] ^= b;-		pos++;--		/* Process a full block, at a boundary which is independent from n */-		if (index >= HASHED(BLOCK_SIZE)) {-			index = 0;-			HASHED_LOWER(do_chunk)(ctx, (void *) ctx->buf);-			memset(ctx->buf, 0, HASHED(BLOCK_SIZE));--			/* Try to store the result: this is a no-op except when we reach the-			 * actual size based on n, more iterations may continue after that-			 * when len is really larger-			 */-			out_mask = constant_time_eq(pos, n + padlen + sizeof(bits));-			CRYPTONITE_HASHED(select_digest)(ctx, out, out_mask);-		}-	}-}
− cbits/cryptonite_hash_prefix.h 
@@ -1,65 +0,0 @@-/*- * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *	notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *	notice, this list of conditions and the following disclaimer in the- *	documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#ifndef CRYPTONITE_HASH_PREFIX_H-#define CRYPTONITE_HASH_PREFIX_H--#include <stdint.h>--static inline uint32_t constant_time_msb(uint32_t a)-{-	return 0 - (a >> 31);-}--static inline uint32_t constant_time_lt(uint32_t a, uint32_t b)-{-	return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));-}--static inline uint32_t constant_time_ge(uint32_t a, uint32_t b)-{-	return ~constant_time_lt(a, b);-}--static inline uint32_t constant_time_is_zero(uint32_t a)-{-	return constant_time_msb(~a & (a - 1));-}--static inline uint32_t constant_time_eq(uint32_t a, uint32_t b)-{-	return constant_time_is_zero(a ^ b);-}--static inline uint64_t constant_time_msb_64(uint64_t a)-{-	return 0 - (a >> 63);-}--static inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b)-{-	return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b)));-}--#endif
− cbits/cryptonite_md2.c 
@@ -1,136 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include <stdio.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_md2.h"--void cryptonite_md2_init(struct md2_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));-	ctx->sz = 0ULL;-}--static uint8_t S_table[]  = {-	0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, -	0x62, 0xA7, 0x05, 0xF3, 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, 0x82, 0xCA, -	0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, -	0xBE, 0x4E, 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, 0xBB, 0x2F, 0xEE, 0x7A, -	0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21,-	0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, -	0xFF, 0x19, 0x30, 0xB3, 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, 0xAA, 0xC6, -	0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, -	0x45, 0x9D, 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, 0xE6, 0x2D, 0xA8, 0x02, -	0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, -	0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, -	0x2C, 0x53, 0x0D, 0x6E, 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, 0x4D, 0x52, -	0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, -	0x78, 0x88, 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, 0x3B, 0x00, 0x1D, 0x39, -	0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, -	0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14-};--#define UBYTES(s) ((uint8_t *) s)-static uint8_t *padding_table[] = {-	UBYTES(""),-	UBYTES("\x1"),-	UBYTES("\x2\x2"),-	UBYTES("\x3\x3\x3"),-	UBYTES("\x4\x4\x4\x4"),-	UBYTES("\x5\x5\x5\x5\x5"),-	UBYTES("\x6\x6\x6\x6\x6\x6"),-	UBYTES("\x7\x7\x7\x7\x7\x7\x7"),-	UBYTES("\x8\x8\x8\x8\x8\x8\x8\x8"),-	UBYTES("\x9\x9\x9\x9\x9\x9\x9\x9\x9"),-	UBYTES("\xa\xa\xa\xa\xa\xa\xa\xa\xa\xa"),-	UBYTES("\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb"),-	UBYTES("\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc"),-	UBYTES("\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd"),-	UBYTES("\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe"),-	UBYTES("\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf"),-	UBYTES("\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10")-};--static void md2_do_chunk(struct md2_ctx *ctx, const uint8_t *buf)-{-	uint8_t i, j, t;-	uint8_t x[48];--	memcpy(x, ctx->h, 16);-	memcpy(x+16, buf, 16);--	for (i = 0; i < 16; i++)-		x[i+32] = ctx->h[i] ^ buf[i];--	for (t = i = 0; i < 18; i++) {-		for (j = 0; j < 48; j++)-			t = x[j] ^= S_table[t];-		t = (t + i) & 0xff;-	}--	memcpy(ctx->h, x, 16);--	t = ctx->cksum[15];-	for (i = 0; i < 16; i++)-		t = ctx->cksum[i] ^= S_table[buf[i] ^ t];-}--void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0xf);-	to_fill = 16 - index;--	ctx->sz += len;--	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		md2_do_chunk(ctx, ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	/* process as much 16-block as possible */-	for (; len >= 16; len -= 16, data += 16)-		md2_do_chunk(ctx, data);--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out)-{-	uint32_t index, padlen;--	index = ctx->sz & 0xf;-	padlen = 16 - index;--	cryptonite_md2_update(ctx, padding_table[padlen], padlen);-	cryptonite_md2_update(ctx, ctx->cksum, 16);-	memcpy(out, ctx->h, 16);-}
− cbits/cryptonite_md2.h 
@@ -1,44 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_MD2_H-#define CRYPTOHASH_MD2_H--#include <stdint.h>--struct md2_ctx-{-	uint64_t sz;-	uint8_t  buf[16];-	uint8_t  h[16];-	uint8_t  cksum[16];-};--#define MD2_DIGEST_SIZE		16-#define MD2_CTX_SIZE		sizeof(struct md2_ctx)--void cryptonite_md2_init(struct md2_ctx *ctx);-void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out);--#endif
− cbits/cryptonite_md4.c 
@@ -1,174 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include <stdio.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_md4.h"--void cryptonite_md4_init(struct md4_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->sz = 0ULL;-	ctx->h[0] = 0x67452301;-	ctx->h[1] = 0xefcdab89;-	ctx->h[2] = 0x98badcfe;-	ctx->h[3] = 0x10325476;-}--#define f1(x, y, z)	((x & y) | ((~x) & z))-#define f2(x, y, z)	((x & y) | (x & z) | (y & z))-#define f3(x, y, z)	(x ^ y ^ z)--#define K1 	0x00000000-#define K2 	0x5A827999-#define K3 	0x6ED9EBA1-#define R(a,b,c,d,f,k,s,i) (a = rol32(a + f(b,c,d) + w[i] + k, s))--static void md4_do_chunk(struct md4_ctx *ctx, uint32_t *buf)-{-	uint32_t a, b, c, d;-#ifdef ARCH_IS_BIG_ENDIAN-	uint32_t w[16];-	cpu_to_le32_array(w, (uint32_t *) buf, 16);-#else-	uint32_t *w = buf;-#endif--	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];--	R(a, b, c, d, f1, K1, 3, 0);-	R(d, a, b, c, f1, K1, 7, 1);-	R(c, d, a, b, f1, K1, 11, 2);-	R(b, c, d, a, f1, K1, 19, 3);-	R(a, b, c, d, f1, K1, 3, 4);-	R(d, a, b, c, f1, K1, 7, 5);-	R(c, d, a, b, f1, K1, 11, 6);-	R(b, c, d, a, f1, K1, 19, 7);-	R(a, b, c, d, f1, K1, 3, 8);-	R(d, a, b, c, f1, K1, 7, 9);-	R(c, d, a, b, f1, K1, 11, 10);-	R(b, c, d, a, f1, K1, 19, 11);-	R(a, b, c, d, f1, K1, 3, 12);-	R(d, a, b, c, f1, K1, 7, 13);-	R(c, d, a, b, f1, K1, 11, 14);-	R(b, c, d, a, f1, K1, 19, 15);--	R(a, b, c, d, f2, K2, 3, 0);-	R(d, a, b, c, f2, K2, 5, 4);-	R(c, d, a, b, f2, K2, 9, 8);-	R(b, c, d, a, f2, K2, 13, 12);-	R(a, b, c, d, f2, K2, 3, 1);-	R(d, a, b, c, f2, K2, 5, 5);-	R(c, d, a, b, f2, K2, 9, 9);-	R(b, c, d, a, f2, K2, 13, 13);-	R(a, b, c, d, f2, K2, 3, 2);-	R(d, a, b, c, f2, K2, 5, 6);-	R(c, d, a, b, f2, K2, 9, 10);-	R(b, c, d, a, f2, K2, 13, 14);-	R(a, b, c, d, f2, K2, 3, 3);-	R(d, a, b, c, f2, K2, 5, 7);-	R(c, d, a, b, f2, K2, 9, 11);-	R(b, c, d, a, f2, K2, 13, 15);--	R(a, b, c, d, f3, K3, 3, 0);-	R(d, a, b, c, f3, K3, 9, 8);-	R(c, d, a, b, f3, K3, 11, 4);-	R(b, c, d, a, f3, K3, 15, 12);-	R(a, b, c, d, f3, K3, 3, 2);-	R(d, a, b, c, f3, K3, 9, 10);-	R(c, d, a, b, f3, K3, 11, 6);-	R(b, c, d, a, f3, K3, 15, 14);-	R(a, b, c, d, f3, K3, 3, 1);-	R(d, a, b, c, f3, K3, 9, 9);-	R(c, d, a, b, f3, K3, 11, 5);-	R(b, c, d, a, f3, K3, 15, 13);-	R(a, b, c, d, f3, K3, 3, 3);-	R(d, a, b, c, f3, K3, 9, 11);-	R(c, d, a, b, f3, K3, 11, 7);-	R(b, c, d, a, f3, K3, 15, 15);--	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;-}--void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;--	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		md4_do_chunk(ctx, (uint32_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 4)) {-		uint32_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 4);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			md4_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			md4_do_chunk(ctx, (uint32_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x80, };-	uint64_t bits;-	uint32_t index, padlen;--	/* add padding and update data with it */-	bits = cpu_to_le64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_md4_update(ctx, padding, padlen);--	/* append length */-	cryptonite_md4_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* output hash */-	store_le32(out   , ctx->h[0]);-	store_le32(out+ 4, ctx->h[1]);-	store_le32(out+ 8, ctx->h[2]);-	store_le32(out+12, ctx->h[3]);-}
− cbits/cryptonite_md4.h 
@@ -1,43 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_MD4_H-#define CRYPTOHASH_MD4_H--#include <stdint.h>--struct md4_ctx-{-	uint64_t sz;-	uint8_t  buf[64];-	uint32_t h[4];-};--#define MD4_DIGEST_SIZE		16-#define MD4_CTX_SIZE		sizeof(struct md4_ctx)--void cryptonite_md4_init(struct md4_ctx *ctx);-void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out);--#endif
− cbits/cryptonite_md5.c 
@@ -1,214 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include <stdio.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_md5.h"--void cryptonite_md5_init(struct md5_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->sz = 0ULL;-	ctx->h[0] = 0x67452301;-	ctx->h[1] = 0xefcdab89;-	ctx->h[2] = 0x98badcfe;-	ctx->h[3] = 0x10325476;-}--#define f1(x, y, z)	(z ^ (x & (y ^ z)))-#define f2(x, y, z)	f1(z, x, y)-#define f3(x, y, z)	(x ^ y ^ z)-#define f4(x, y, z)	(y ^ (x | ~z))-#define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b--static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf)-{-	uint32_t a, b, c, d;-#ifdef ARCH_IS_BIG_ENDIAN-	uint32_t w[16];-	cpu_to_le32_array(w, buf, 16);-#else-	uint32_t *w = buf;-#endif-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];--	R(f1, a, b, c, d, 0, 0xd76aa478, 7);-	R(f1, d, a, b, c, 1, 0xe8c7b756, 12);-	R(f1, c, d, a, b, 2, 0x242070db, 17);-	R(f1, b, c, d, a, 3, 0xc1bdceee, 22);-	R(f1, a, b, c, d, 4, 0xf57c0faf, 7);-	R(f1, d, a, b, c, 5, 0x4787c62a, 12);-	R(f1, c, d, a, b, 6, 0xa8304613, 17);-	R(f1, b, c, d, a, 7, 0xfd469501, 22);-	R(f1, a, b, c, d, 8, 0x698098d8, 7);-	R(f1, d, a, b, c, 9, 0x8b44f7af, 12);-	R(f1, c, d, a, b, 10, 0xffff5bb1, 17);-	R(f1, b, c, d, a, 11, 0x895cd7be, 22);-	R(f1, a, b, c, d, 12, 0x6b901122, 7);-	R(f1, d, a, b, c, 13, 0xfd987193, 12);-	R(f1, c, d, a, b, 14, 0xa679438e, 17);-	R(f1, b, c, d, a, 15, 0x49b40821, 22);--	R(f2, a, b, c, d, 1, 0xf61e2562, 5);-	R(f2, d, a, b, c, 6, 0xc040b340, 9);-	R(f2, c, d, a, b, 11, 0x265e5a51, 14);-	R(f2, b, c, d, a, 0, 0xe9b6c7aa, 20);-	R(f2, a, b, c, d, 5, 0xd62f105d, 5);-	R(f2, d, a, b, c, 10, 0x02441453, 9);-	R(f2, c, d, a, b, 15, 0xd8a1e681, 14);-	R(f2, b, c, d, a, 4, 0xe7d3fbc8, 20);-	R(f2, a, b, c, d, 9, 0x21e1cde6, 5);-	R(f2, d, a, b, c, 14, 0xc33707d6, 9);-	R(f2, c, d, a, b, 3, 0xf4d50d87, 14);-	R(f2, b, c, d, a, 8, 0x455a14ed, 20);-	R(f2, a, b, c, d, 13, 0xa9e3e905, 5);-	R(f2, d, a, b, c, 2, 0xfcefa3f8, 9);-	R(f2, c, d, a, b, 7, 0x676f02d9, 14);-	R(f2, b, c, d, a, 12, 0x8d2a4c8a, 20);--	R(f3, a, b, c, d, 5, 0xfffa3942, 4);-	R(f3, d, a, b, c, 8, 0x8771f681, 11);-	R(f3, c, d, a, b, 11, 0x6d9d6122, 16);-	R(f3, b, c, d, a, 14, 0xfde5380c, 23);-	R(f3, a, b, c, d, 1, 0xa4beea44, 4);-	R(f3, d, a, b, c, 4, 0x4bdecfa9, 11);-	R(f3, c, d, a, b, 7, 0xf6bb4b60, 16);-	R(f3, b, c, d, a, 10, 0xbebfbc70, 23);-	R(f3, a, b, c, d, 13, 0x289b7ec6, 4);-	R(f3, d, a, b, c, 0, 0xeaa127fa, 11);-	R(f3, c, d, a, b, 3, 0xd4ef3085, 16);-	R(f3, b, c, d, a, 6, 0x04881d05, 23);-	R(f3, a, b, c, d, 9, 0xd9d4d039, 4);-	R(f3, d, a, b, c, 12, 0xe6db99e5, 11);-	R(f3, c, d, a, b, 15, 0x1fa27cf8, 16);-	R(f3, b, c, d, a, 2, 0xc4ac5665, 23);--	R(f4, a, b, c, d, 0, 0xf4292244, 6);-	R(f4, d, a, b, c, 7, 0x432aff97, 10);-	R(f4, c, d, a, b, 14, 0xab9423a7, 15);-	R(f4, b, c, d, a, 5, 0xfc93a039, 21);-	R(f4, a, b, c, d, 12, 0x655b59c3, 6);-	R(f4, d, a, b, c, 3, 0x8f0ccc92, 10);-	R(f4, c, d, a, b, 10, 0xffeff47d, 15);-	R(f4, b, c, d, a, 1, 0x85845dd1, 21);-	R(f4, a, b, c, d, 8, 0x6fa87e4f, 6);-	R(f4, d, a, b, c, 15, 0xfe2ce6e0, 10);-	R(f4, c, d, a, b, 6, 0xa3014314, 15);-	R(f4, b, c, d, a, 13, 0x4e0811a1, 21);-	R(f4, a, b, c, d, 4, 0xf7537e82, 6);-	R(f4, d, a, b, c, 11, 0xbd3af235, 10);-	R(f4, c, d, a, b, 2, 0x2ad7d2bb, 15);-	R(f4, b, c, d, a, 9, 0xeb86d391, 21);--	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;-}--void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;--	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		md5_do_chunk(ctx, (uint32_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 4)) {-		uint32_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 4);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			md5_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			md5_do_chunk(ctx, (uint32_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x80, };-	uint64_t bits;-	uint32_t index, padlen;--	/* add padding and update data with it */-	bits = cpu_to_le64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_md5_update(ctx, padding, padlen);--	/* append length */-	cryptonite_md5_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* output hash */-	store_le32(out   , ctx->h[0]);-	store_le32(out+ 4, ctx->h[1]);-	store_le32(out+ 8, ctx->h[2]);-	store_le32(out+12, ctx->h[3]);-}--#define HASHED(m) MD5_##m-#define HASHED_LOWER(m) md5_##m-#define CRYPTONITE_HASHED(m) cryptonite_md5_##m-#define MD5_BLOCK_SIZE 64-#define MD5_BITS_ELEMS 1--static inline uint32_t cryptonite_md5_get_index(const struct md5_ctx *ctx)-{-	return (uint32_t) (ctx->sz & 0x3f);-}--static inline void cryptonite_md5_incr_sz(struct md5_ctx *ctx, uint64_t *bits, uint32_t n)-{-	ctx->sz += n;-	*bits = cpu_to_le64(ctx->sz << 3);-}--static inline void cryptonite_md5_select_digest(const struct md5_ctx *ctx, uint8_t *out, uint32_t out_mask)-{-	xor_le32(out   , ctx->h[0] & out_mask);-	xor_le32(out+ 4, ctx->h[1] & out_mask);-	xor_le32(out+ 8, ctx->h[2] & out_mask);-	xor_le32(out+12, ctx->h[3] & out_mask);-}--#include <cryptonite_hash_prefix.c>
− cbits/cryptonite_md5.h 
@@ -1,44 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_MD5_H-#define CRYPTOHASH_MD5_H--#include <stdint.h>--struct md5_ctx-{-	uint64_t sz;-	uint8_t  buf[64];-	uint32_t h[4];-};--#define MD5_DIGEST_SIZE		16-#define MD5_CTX_SIZE		sizeof(struct md5_ctx)--void cryptonite_md5_init(struct md5_ctx *ctx);-void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out);-void cryptonite_md5_finalize_prefix(struct md5_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--#endif
− cbits/cryptonite_pbkdf2.c 
@@ -1,390 +0,0 @@-/*- * fast-pbkdf2 - Optimal PBKDF2-HMAC calculation- * Written in 2015 by Joseph Birr-Pixton <jpixton@gmail.com>- * Ported to cryptonite in 2017 by Nicolas Di Prima <nicolas@primetype.co.uk>- *- * To the extent possible under law, the author(s) have dedicated all- * copyright and related and neighboring rights to this software to the- * public domain worldwide. This software is distributed without any- * warranty.- *- * You should have received a copy of the CC0 Public Domain Dedication- * along with this software. If not, see- * <http://creativecommons.org/publicdomain/zero/1.0/>.- */--#include <assert.h>-#include <string.h>--#include "cryptonite_pbkdf2.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_sha1.h"-#include "cryptonite_sha256.h"-#include "cryptonite_sha512.h"--/* --- MSVC doesn't support C99 --- */-#ifdef _MSC_VER-#define restrict-#define _Pragma __pragma-#endif--/* --- Common useful things --- */-#define MIN(a, b) ((a) > (b)) ? (b) : (a)--/* Prepare block (of blocksz bytes) to contain md padding denoting a msg-size- * message (in bytes).  block has a prefix of used bytes.- *- * Message length is expressed in 32 bits (so suitable for sha1, sha256, sha512). */-static inline void md_pad(uint8_t *block, size_t blocksz, size_t used, size_t msg)-{-  memset(block + used, 0, blocksz - used - 4);-  block[used] = 0x80;-  block += blocksz - 4;-  store_be32(block, (uint32_t) (msg * 8));-}--/* Internal function/type names for hash-specific things. */-#define HMAC_CTX(_name) HMAC_ ## _name ## _ctx-#define HMAC_INIT(_name) HMAC_ ## _name ## _init-#define HMAC_UPDATE(_name) HMAC_ ## _name ## _update-#define HMAC_FINAL(_name) HMAC_ ## _name ## _final--#define PBKDF2_F(_name) pbkdf2_f_ ## _name-#define PBKDF2(_name) pbkdf2_ ## _name--/* This macro expands to decls for the whole implementation for a given- * hash function.  Arguments are:- *- * _name like 'sha1', added to symbol names- * _blocksz block size, in bytes- * _hashsz digest output, in bytes- * _ctx hash context type- * _init hash context initialisation function- *    args: (_ctx *c)- * _update hash context update function- *    args: (_ctx *c, const void *data, size_t ndata)- * _final hash context finish function- *    args: (void *out, _ctx *c)- * _xform hash context raw block update function- *    args: (_ctx *c, const void *data)- * _xcpy hash context raw copy function (only need copy hash state)- *    args: (_ctx * restrict out, const _ctx *restrict in)- * _xtract hash context state extraction- *    args: args (_ctx *restrict c, uint8_t *restrict out)- * _xxor hash context xor function (only need xor hash state)- *    args: (_ctx *restrict out, const _ctx *restrict in)- *- * The resulting function is named PBKDF2(_name).- */-#define DECL_PBKDF2(_name, _blocksz, _hashsz, _ctx,                           \-                    _init, _update, _xform, _final, _xcpy, _xtract, _xxor)    \-  typedef struct {                                                            \-    _ctx inner;                                                               \-    _ctx outer;                                                               \-  } HMAC_CTX(_name);                                                          \-                                                                              \-  static inline void HMAC_INIT(_name)(HMAC_CTX(_name) *ctx,                   \-                                      const uint8_t *key, size_t nkey)        \-  {                                                                           \-    /* Prepare key: */                                                        \-    uint8_t k[_blocksz];                                                      \-                                                                              \-    /* Shorten long keys. */                                                  \-    if (nkey > _blocksz)                                                      \-    {                                                                         \-      _init(&ctx->inner);                                                     \-      _update(&ctx->inner, key, nkey);                                        \-      _final(&ctx->inner, k);                                                 \-                                                                              \-      key = k;                                                                \-      nkey = _hashsz;                                                         \-    }                                                                         \-                                                                              \-    /* Standard doesn't cover case where blocksz < hashsz. */                 \-    assert(nkey <= _blocksz);                                                 \-                                                                              \-    /* Right zero-pad short keys. */                                          \-    if (k != key)                                                             \-      memcpy(k, key, nkey);                                                   \-    if (_blocksz > nkey)                                                      \-      memset(k + nkey, 0, _blocksz - nkey);                                   \-                                                                              \-    /* Start inner hash computation */                                        \-    uint8_t blk_inner[_blocksz];                                              \-    uint8_t blk_outer[_blocksz];                                              \-                                                                              \-    for (size_t i = 0; i < _blocksz; i++)                                     \-    {                                                                         \-      blk_inner[i] = 0x36 ^ k[i];                                             \-      blk_outer[i] = 0x5c ^ k[i];                                             \-    }                                                                         \-                                                                              \-    _init(&ctx->inner);                                                       \-    _update(&ctx->inner, blk_inner, sizeof blk_inner);                        \-                                                                              \-    /* And outer. */                                                          \-    _init(&ctx->outer);                                                       \-    _update(&ctx->outer, blk_outer, sizeof blk_outer);                        \-  }                                                                           \-                                                                              \-  static inline void HMAC_UPDATE(_name)(HMAC_CTX(_name) *ctx,                 \-                                        const void *data, size_t ndata)       \-  {                                                                           \-    _update(&ctx->inner, data, ndata);                                        \-  }                                                                           \-                                                                              \-  static inline void HMAC_FINAL(_name)(HMAC_CTX(_name) *ctx,                  \-                                       uint8_t out[_hashsz])                  \-  {                                                                           \-    _final(&ctx->inner, out);                                                 \-    _update(&ctx->outer, out, _hashsz);                                       \-    _final(&ctx->outer, out);                                                 \-  }                                                                           \-                                                                              \-                                                                              \-  /* --- PBKDF2 --- */                                                        \-  static inline void PBKDF2_F(_name)(const HMAC_CTX(_name) *startctx,         \-                                     uint32_t counter,                        \-                                     const uint8_t *salt, size_t nsalt,       \-                                     uint32_t iterations,                     \-                                     uint8_t *out)                            \-  {                                                                           \-    uint8_t countbuf[4];                                                      \-    store_be32(countbuf, counter);                                            \-                                                                              \-    /* Prepare loop-invariant padding block. */                               \-    uint8_t Ublock[_blocksz];                                                 \-    md_pad(Ublock, _blocksz, _hashsz, _blocksz + _hashsz);                    \-                                                                              \-    /* First iteration:                                                       \-     *   U_1 = PRF(P, S || INT_32_BE(i))                                      \-     */                                                                       \-    HMAC_CTX(_name) ctx = *startctx;                                          \-    HMAC_UPDATE(_name)(&ctx, salt, nsalt);                                    \-    HMAC_UPDATE(_name)(&ctx, countbuf, sizeof countbuf);                      \-    HMAC_FINAL(_name)(&ctx, Ublock);                                          \-    _ctx result = ctx.outer;                                                  \-                                                                              \-    /* Subsequent iterations:                                                 \-     *   U_c = PRF(P, U_{c-1})                                                \-     */                                                                       \-    for (uint32_t i = 1; i < iterations; i++)                                 \-    {                                                                         \-      /* Complete inner hash with previous U */                               \-      _xcpy(&ctx.inner, &startctx->inner);                                    \-      _xform(&ctx.inner, Ublock);                                             \-      _xtract(&ctx.inner, Ublock);                                            \-      /* Complete outer hash with inner output */                             \-      _xcpy(&ctx.outer, &startctx->outer);                                    \-      _xform(&ctx.outer, Ublock);                                             \-      _xtract(&ctx.outer, Ublock);                                            \-      _xxor(&result, &ctx.outer);                                             \-    }                                                                         \-                                                                              \-    /* Reform result into output buffer. */                                   \-    _xtract(&result, out);                                                    \-  }                                                                           \-                                                                              \-  static inline void PBKDF2(_name)(const uint8_t *pw, size_t npw,             \-                     const uint8_t *salt, size_t nsalt,                       \-                     uint32_t iterations,                                     \-                     uint8_t *out, size_t nout)                               \-  {                                                                           \-    assert(iterations);                                                       \-    assert(out && nout);                                                      \-                                                                              \-    /* Starting point for inner loop. */                                      \-    HMAC_CTX(_name) ctx;                                                      \-    HMAC_INIT(_name)(&ctx, pw, npw);                                          \-                                                                              \-    /* How many blocks do we need? */                                         \-    uint32_t blocks_needed = (uint32_t)(nout + _hashsz - 1) / _hashsz;        \-                                                                              \-    for (uint32_t counter = 1; counter <= blocks_needed; counter++)           \-    {                                                                         \-      uint8_t block[_hashsz];                                                 \-      PBKDF2_F(_name)(&ctx, counter, salt, nsalt, iterations, block);         \-                                                                              \-      size_t offset = (counter - 1) * _hashsz;                                \-      size_t taken = MIN(nout - offset, _hashsz);                             \-      memcpy(out + offset, block, taken);                                     \-    }                                                                         \-  }--static inline void sha1_extract(struct sha1_ctx *restrict ctx, uint8_t *restrict out)-{-	store_be32(out   , ctx->h[0]);-	store_be32(out+4 , ctx->h[1]);-	store_be32(out+8 , ctx->h[2]);-	store_be32(out+12, ctx->h[3]);-	store_be32(out+16, ctx->h[4]);-}--static inline void sha1_cpy(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)-{-  out->h[0] = in->h[0];-  out->h[1] = in->h[1];-  out->h[2] = in->h[2];-  out->h[3] = in->h[3];-  out->h[4] = in->h[4];-}--static inline void sha1_xor(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)-{-  out->h[0] ^= in->h[0];-  out->h[1] ^= in->h[1];-  out->h[2] ^= in->h[2];-  out->h[3] ^= in->h[3];-  out->h[4] ^= in->h[4];-}--void cryptonite_sha1_transform(struct sha1_ctx* ctx, uint8_t block[SHA1_BLOCK_SIZE])-{-  cryptonite_sha1_update(ctx, block, SHA1_BLOCK_SIZE);-}--DECL_PBKDF2(sha1,-            SHA1_BLOCK_SIZE,-            SHA1_DIGEST_SIZE,-            struct sha1_ctx,-            cryptonite_sha1_init,-            cryptonite_sha1_update,-            cryptonite_sha1_transform,-            cryptonite_sha1_finalize,-            sha1_cpy,-            sha1_extract,-            sha1_xor);--static inline void sha256_extract(struct sha256_ctx *restrict ctx, uint8_t *restrict out)-{-	store_be32(out   , ctx->h[0]);-	store_be32(out+4 , ctx->h[1]);-	store_be32(out+8 , ctx->h[2]);-	store_be32(out+12, ctx->h[3]);-	store_be32(out+16, ctx->h[4]);-	store_be32(out+20, ctx->h[5]);-	store_be32(out+24, ctx->h[6]);-	store_be32(out+28, ctx->h[7]);-}--static inline void sha256_cpy(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)-{-	out->h[0] = in->h[0];-	out->h[1] = in->h[1];-	out->h[2] = in->h[2];-	out->h[3] = in->h[3];-	out->h[4] = in->h[4];-	out->h[5] = in->h[5];-	out->h[6] = in->h[6];-	out->h[7] = in->h[7];-}--static inline void sha256_xor(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)-{-	out->h[0] ^= in->h[0];-	out->h[1] ^= in->h[1];-	out->h[2] ^= in->h[2];-	out->h[3] ^= in->h[3];-	out->h[4] ^= in->h[4];-	out->h[5] ^= in->h[5];-	out->h[6] ^= in->h[6];-	out->h[7] ^= in->h[7];-}--void cryptonite_sha256_transform(struct sha256_ctx* ctx, uint8_t block[SHA256_BLOCK_SIZE])-{-  cryptonite_sha256_update(ctx, block, SHA256_BLOCK_SIZE);-}--DECL_PBKDF2(sha256,-            SHA256_BLOCK_SIZE,-            SHA256_DIGEST_SIZE,-            struct sha256_ctx,-            cryptonite_sha256_init,-            cryptonite_sha256_update,-            cryptonite_sha256_transform,-            cryptonite_sha256_finalize,-            sha256_cpy,-            sha256_extract,-            sha256_xor);--static inline void sha512_extract(struct sha512_ctx *restrict ctx, uint8_t *restrict out)-{-	store_be64(out   , ctx->h[0]);-	store_be64(out+8 , ctx->h[1]);-	store_be64(out+16, ctx->h[2]);-	store_be64(out+24, ctx->h[3]);-	store_be64(out+32, ctx->h[4]);-	store_be64(out+40, ctx->h[5]);-	store_be64(out+48, ctx->h[6]);-	store_be64(out+56, ctx->h[7]);-}--static inline void sha512_cpy(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)-{-	out->h[0] = in->h[0];-	out->h[1] = in->h[1];-	out->h[2] = in->h[2];-	out->h[3] = in->h[3];-	out->h[4] = in->h[4];-	out->h[5] = in->h[5];-	out->h[6] = in->h[6];-	out->h[7] = in->h[7];-}--static inline void sha512_xor(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)-{-	out->h[0] ^= in->h[0];-	out->h[1] ^= in->h[1];-	out->h[2] ^= in->h[2];-	out->h[3] ^= in->h[3];-	out->h[4] ^= in->h[4];-	out->h[5] ^= in->h[5];-	out->h[6] ^= in->h[6];-	out->h[7] ^= in->h[7];-}--void cryptonite_sha512_transform(struct sha512_ctx* ctx, uint8_t block[SHA512_BLOCK_SIZE])-{-	cryptonite_sha512_update(ctx, block, SHA512_BLOCK_SIZE);-}--DECL_PBKDF2(sha512,-            SHA512_BLOCK_SIZE,-            SHA512_DIGEST_SIZE,-            struct sha512_ctx,-            cryptonite_sha512_init,-            cryptonite_sha512_update,-            cryptonite_sha512_transform,-            cryptonite_sha512_finalize,-            sha512_cpy,-            sha512_extract,-            sha512_xor);--void cryptonite_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw-                                    , const uint8_t *salt, size_t nsalt-                                    , uint32_t iterations-                                    , uint8_t *out, size_t nout-                                    )-{-  PBKDF2(sha1)(pw, npw, salt, nsalt, iterations, out, nout);-}--void cryptonite_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw-                                      , const uint8_t *salt, size_t nsalt-                                      , uint32_t iterations-                                      , uint8_t *out, size_t nout-                                      )-{-  PBKDF2(sha256)(pw, npw, salt, nsalt, iterations, out, nout);-}--void cryptonite_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw-                                      , const uint8_t *salt, size_t nsalt-                                      , uint32_t iterations-                                      , uint8_t *out, size_t nout-                                      )-{-  PBKDF2(sha512)(pw, npw, salt, nsalt, iterations, out, nout);-}
− cbits/cryptonite_pbkdf2.h 
@@ -1,31 +0,0 @@-#ifndef CRYPTONITE_PBKDF2_H_-#define CRYPTONITE_PBKDF2_H_--#include <stdlib.h>-#include <stdint.h>--#ifdef __cplusplus-extern "C" {-#endif--void cryptonite_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw-                                    , const uint8_t *salt, size_t nsalt-                                    , uint32_t iterations-                                    , uint8_t *out, size_t nout-                                    );-void cryptonite_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw-                                      , const uint8_t *salt, size_t nsalt-                                      , uint32_t iterations-                                      , uint8_t *out, size_t nout-                                      );-void cryptonite_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw-                                      , const uint8_t *salt, size_t nsalt-                                      , uint32_t iterations-                                      , uint8_t *out, size_t nout-                                      );--#ifdef __cplusplus-}-#endif--#endif
− cbits/cryptonite_poly1305.c 
@@ -1,203 +0,0 @@-/*- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- *- * The following code contains some code copied from and inspired by poly1305-donna- * in poly1305_do_chunk and poly1305_finalize which is licensed under MIT or PUBLIC DOMAIN.- * see [poly1305-donna](https://github.com/floodyberry/poly1305-donna)- *- */--#include <stdint.h>-#include <string.h>-#include "cryptonite_poly1305.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final)-{-	/* following is a cleanup copy of code available poly1305-donna */-	const uint32_t hibit = (final) ? 0 : (1 << 24); /* 1 << 128 */-	uint32_t r0,r1,r2,r3,r4;-	uint32_t s1,s2,s3,s4;-	uint32_t h0,h1,h2,h3,h4;-	uint64_t d0,d1,d2,d3,d4;-	uint32_t c;--	/* load r[i], h[i] */-	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];-	r0 = ctx->r[0]; r1 = ctx->r[1]; r2 = ctx->r[2]; r3 = ctx->r[3]; r4 = ctx->r[4];--	/* s[i] = r[i] * 5 */-	s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5;--	while (blocks--) {-		h0 += (load_le32(data+ 0)     ) & 0x3ffffff;-		h1 += (load_le32(data+ 3) >> 2) & 0x3ffffff;-		h2 += (load_le32(data+ 6) >> 4) & 0x3ffffff;-		h3 += (load_le32(data+ 9) >> 6) & 0x3ffffff;-		h4 += (load_le32(data+12) >> 8) | hibit;--		d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1);-		d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2);-		d2 = ((uint64_t)h0 * r2) + ((uint64_t)h1 * r1) + ((uint64_t)h2 * r0) + ((uint64_t)h3 * s4) + ((uint64_t)h4 * s3);-		d3 = ((uint64_t)h0 * r3) + ((uint64_t)h1 * r2) + ((uint64_t)h2 * r1) + ((uint64_t)h3 * r0) + ((uint64_t)h4 * s4);-		d4 = ((uint64_t)h0 * r4) + ((uint64_t)h1 * r3) + ((uint64_t)h2 * r2) + ((uint64_t)h3 * r1) + ((uint64_t)h4 * r0);--		c = (uint32_t)(d0 >> 26); h0 = (uint32_t)d0 & 0x3ffffff;-		d1 += c;      c = (uint32_t)(d1 >> 26); h1 = (uint32_t)d1 & 0x3ffffff;-		d2 += c;      c = (uint32_t)(d2 >> 26); h2 = (uint32_t)d2 & 0x3ffffff;-		d3 += c;      c = (uint32_t)(d3 >> 26); h3 = (uint32_t)d3 & 0x3ffffff;-		d4 += c;      c = (uint32_t)(d4 >> 26); h4 = (uint32_t)d4 & 0x3ffffff;-		h0 += c * 5;  c =           (h0 >> 26); h0 = h0 & 0x3ffffff;-		h1 += c;--		data += 16;-	}--	/* store h[i] */-	ctx->h[0] = h0; ctx->h[1] = h1; ctx->h[2] = h2; ctx->h[3] = h3; ctx->h[4] = h4;-}--void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key)-{-	uint8_t *k = (uint8_t *) key;--	memset(ctx, 0, sizeof(poly1305_ctx));--	ctx->r[0] = (load_le32(&k[ 0])     ) & 0x3ffffff;-	ctx->r[1] = (load_le32(&k[ 3]) >> 2) & 0x3ffff03;-	ctx->r[2] = (load_le32(&k[ 6]) >> 4) & 0x3ffc0ff;-	ctx->r[3] = (load_le32(&k[ 9]) >> 6) & 0x3f03fff;-	ctx->r[4] = (load_le32(&k[12]) >> 8) & 0x00fffff;--	ctx->pad[0] = load_le32(&k[16]);-	ctx->pad[1] = load_le32(&k[20]);-	ctx->pad[2] = load_le32(&k[24]);-	ctx->pad[3] = load_le32(&k[28]);--	ctx->index = 0;-}--void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length)-{-	uint32_t to_fill, nb_blocks_bytes;--	to_fill = 16 - ctx->index;--	/* process partial buffer if there's enough data to make a block */-	if (ctx->index && length >= to_fill) {-		memcpy(ctx->buf + ctx->index, data, to_fill);-		poly1305_do_chunk(ctx, ctx->buf, 1, 0);-		ctx->index = 0;-		length -= to_fill;-		data += to_fill;-	}--	/* process as much 16-block as possible */-	nb_blocks_bytes = length & ~(16 - 1);-	poly1305_do_chunk(ctx, data, nb_blocks_bytes >> 4, 0);-	data += nb_blocks_bytes;-	length &= 0xf;--	/* fill the remaining bytes in the partial buffer */-	if (length) {-		memcpy(ctx->buf + ctx->index, data, length);-		ctx->index += length;-	}-}--void cryptonite_poly1305_finalize(poly1305_mac mac8, poly1305_ctx *ctx)-{-	uint32_t h0,h1,h2,h3,h4,c;-	uint32_t g0,g1,g2,g3,g4;-	uint64_t f;-	uint32_t mask;-	uint32_t *mac = (uint32_t *) mac8;-	int i;--	if (ctx->index) {-		/* append partial final buffer with 10* then process */-		ctx->buf[ctx->index] = 0x1;-		for (i = ctx->index + 1; i < 16; i++)-			ctx->buf[i] = 0x0;-		poly1305_do_chunk(ctx, ctx->buf, 1, 1);-	}--	/* following is a cleanup copy of code available poly1305-donna */--	/* fully carry h */-	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];--	             c = h1 >> 26; h1 = h1 & 0x3ffffff;-	h2 +=     c; c = h2 >> 26; h2 = h2 & 0x3ffffff;-	h3 +=     c; c = h3 >> 26; h3 = h3 & 0x3ffffff;-	h4 +=     c; c = h4 >> 26; h4 = h4 & 0x3ffffff;-	h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;-	h1 +=     c;--	/* compute h + -p */-	g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;-	g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;-	g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;-	g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;-	g4 = h4 + c - (1 << 26);--	/* select h if h < p, or h + -p if h >= p */-	mask = (g4 >> ((sizeof(uint32_t) * 8) - 1)) - 1;-	g0 &= mask;-	g1 &= mask;-	g2 &= mask;-	g3 &= mask;-	g4 &= mask;-	mask = ~mask;-	h0 = (h0 & mask) | g0;-	h1 = (h1 & mask) | g1;-	h2 = (h2 & mask) | g2;-	h3 = (h3 & mask) | g3;-	h4 = (h4 & mask) | g4;--	/* h = h % (2^128) */-	h0 = ((h0      ) | (h1 << 26)) & 0xffffffff;-	h1 = ((h1 >>  6) | (h2 << 20)) & 0xffffffff;-	h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;-	h3 = ((h3 >> 18) | (h4 <<  8)) & 0xffffffff;--	/* mac = (h + pad) % (2^128) */-	f = (uint64_t)h0 + ctx->pad[0];-	mac[0] = cpu_to_le32((uint32_t) f);--	f = (uint64_t)h1 + ctx->pad[1] + (f >> 32);-	mac[1] = cpu_to_le32((uint32_t) f);--	f = (uint64_t)h2 + ctx->pad[2] + (f >> 32);-	mac[2] = cpu_to_le32((uint32_t) f);--	f = (uint64_t)h3 + ctx->pad[3] + (f >> 32);-	mac[3] = cpu_to_le32((uint32_t) f);-}
− cbits/cryptonite_poly1305.h 
@@ -1,50 +0,0 @@-/*- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */-#ifndef CRYPTONITE_POLY1305_H-# define CRYPTONITE_POLY1305_H--/* 8*8+1*16+1*4 = 84 */-typedef struct-{-	uint32_t r[5];-	uint32_t h[5];-	uint32_t pad[4];-	uint32_t index;-	uint8_t buf[16]; /* previous partial block */-} poly1305_ctx;--typedef uint8_t poly1305_mac[16];-typedef uint8_t poly1305_key[32];--void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key);-void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length);-void cryptonite_poly1305_finalize(poly1305_mac mac, poly1305_ctx *ctx);--#endif
− cbits/cryptonite_rc4.c 
@@ -1,63 +0,0 @@-/* initial implementation by- *   Peter White <peter@janrain.com>- */--/* C Standard includes */-#include <stdlib.h>-#include <stdio.h>-#include <string.h>-#include <stdint.h>--/* Local include */-#include "cryptonite_rc4.h"--/* Swap array elements i=State[i] and b=State[j]. */-static void swap(uint8_t *i, uint8_t *j)-{-	uint8_t temp;--	temp = *i;-	*i = *j;-	*j = temp;-}--/* Key scheduling algorithm. Swap array elements based on the key. */-void cryptonite_rc4_init(uint8_t *key, uint32_t keylen, struct rc4_ctx *ctx)-{-	uint32_t i, j;-	memset(ctx, 0, sizeof(struct rc4_ctx));--	/* initialize context */-	for (i = 0; i < 256; i++)-		ctx->state[i] = i;-	for (i = j = 0; i < 256; i++) {-		j = (j + ctx->state[i] + key[i % keylen]) % 256;-		swap(&ctx->state[i], &ctx->state[j]);-	}-}--/* Combine the stream generated by the rc4 with some input */-void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output)-{-	uint32_t i = ctx->i;-	uint32_t j = ctx->j;-	uint32_t m;-	uint8_t si, sj;--	/* The RC4 algorithm */-	for (m = 0; m < len; m++) {-		i = (i + 1) & 0xff;-		si = ctx->state[i];-		j = (j + si) & 0xff;-		sj = ctx->state[j];-		/* swap(&state[i], &state[j]); */-		ctx->state[i] = sj;-		ctx->state[j] = si;-		/* Xor the key stream value into the input */-		*output++ = *input++ ^ (ctx->state[(si + sj) & 0xff]);-	}--	/* Output new S-box indices */-	ctx->i = i;-	ctx->j = j;-}
− cbits/cryptonite_rc4.h 
@@ -1,14 +0,0 @@-#ifndef CRYPTONITE_RC4_H-# define CRYPTONITE_RC4_H--struct rc4_ctx-{-	uint8_t state[256];-	uint32_t i;-	uint32_t j;-};--void cryptonite_rc4_init(uint8_t * key, uint32_t keylen, struct rc4_ctx *ctx);-void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output);--#endif
− cbits/cryptonite_rdrand.c 
@@ -1,126 +0,0 @@-/*- * Copyright (C) Thomas DuBuisson- * Copyright (C) 2013 Vincent Hanquez <tab@snarc.org>- *- * All rights reserved.- * - * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */--#include <stdint.h>-#include <stdlib.h>-#include <stdio.h>-#include <string.h>--int cryptonite_cpu_has_rdrand()-{-	uint32_t ax,bx,cx,dx,func=1;-#if defined(__PIC__) && defined(__i386__)-	__asm__ volatile ("mov %%ebx, %%edi;" "cpuid;" "xchgl %%ebx, %%edi;"-		: "=a" (ax), "=D" (bx), "=c" (cx), "=d" (dx) : "a" (func));-#else-	__asm__ volatile ("cpuid": "=a" (ax), "=b" (bx), "=c" (cx), "=d" (dx) : "a" (func));-#endif-	return (cx & 0x40000000);-}--/* inline encoding of 'rdrand %rax' to cover old binutils- * - no inputs- * - 'cc' to the clobber list as we modify condition code.- * - output of rdrand in rax and have a 8 bit error condition- */-#define inline_rdrand_rax(val, err) \-	asm(".byte 0x48,0x0f,0xc7,0xf0; setc %1" \-	   : "=a" (val), "=q" (err) \-	   : \-	   : "cc")--/* inline encoding of 'rdrand %eax' to cover old binutils- * - no inputs- * - 'cc' to the clobber list as we modify condition code.- * - output of rdrand in eax and have a 8 bit error condition- */-#define inline_rdrand_eax(val, err) \-	asm(".byte 0x0f,0xc7,0xf0; setc %1" \-	   : "=a" (val), "=q" (err) \-	   : \-	   : "cc")--#ifdef __x86_64__-# define RDRAND_SZ 8-# define RDRAND_T  uint64_t-#define inline_rdrand(val, err) err = cryptonite_rdrand_step(&val)-#else-# define RDRAND_SZ 4-# define RDRAND_T  uint32_t-#define inline_rdrand(val, err) err = cryptonite_rdrand_step(&val)-#endif--/* sadly many people are still using an old binutils,- * leading to report that instruction is not recognized.- */-#if 1-/* Returns 1 on success */-static inline int cryptonite_rdrand_step(RDRAND_T *buffer)-{-	unsigned char err;-	asm volatile ("rdrand %0; setc %1" : "=r" (*buffer), "=qm" (err));-	return (int) err;-}-#endif--/* Returns the number of bytes successfully generated */-int cryptonite_get_rand_bytes(uint8_t *buffer, size_t len)-{-	RDRAND_T tmp;-	int aligned = (intptr_t) buffer % RDRAND_SZ;-	int orig_len = len;-	int to_alignment = RDRAND_SZ - aligned;-	uint8_t ok;--	if (aligned != 0) {-		inline_rdrand(tmp, ok);-		if (!ok)-			return 0;-		memcpy(buffer, (uint8_t *) &tmp, to_alignment);-		buffer += to_alignment;-		len -= to_alignment;-	}--	for (; len >= RDRAND_SZ; buffer += RDRAND_SZ, len -= RDRAND_SZ) {-		inline_rdrand(tmp, ok);-		if (!ok)-			return (orig_len - len);-		*((RDRAND_T *) buffer) = tmp;-	}--	if (len > 0) {-		inline_rdrand(tmp, ok);-		if (!ok)-			return (orig_len - len);-		memcpy(buffer, (uint8_t *) &tmp, len);-	}-	return orig_len;-}
− cbits/cryptonite_ripemd.c 
@@ -1,310 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include "cryptonite_ripemd.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include <string.h>--void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0x67452301;-	ctx->h[1] = 0xefcdab89;-	ctx->h[2] = 0x98badcfe;-	ctx->h[3] = 0x10325476;-	ctx->h[4] = 0xc3d2e1f0;-}--#define K1  0x00000000-#define K2  0x5a827999-#define K3  0x6ed9eba1-#define K4  0x8f1bbcdc-#define K5  0xa953fd4e-#define K6  0x50a28be6-#define K7  0x5c4dd124-#define K8  0x6d703ef3-#define K9  0x7a6d76e9--#define f1(x, y, z) (x ^ y ^ z)-#define f2(x, y, z) (z ^ (x & (y ^ z)))-#define f3(x, y, z) ((x | ~y) ^ z)-#define f4(x, y, z) (y ^ (z & (x ^ y)))-#define f5(x, y, z) (x ^ (y | ~z))--#define R(a, b, c, d, e, f, k, i, s)	\-	a += f(b, c, d) + w[i] + k; a = rol32(a, s) + e; c = rol32(c, 10)--static void ripemd160_do_chunk(struct ripemd160_ctx *ctx, uint32_t *buf)-{-	uint32_t a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;-#ifdef ARCH_IS_BIG_ENDIAN-	uint32_t w[16];-	cpu_to_le32_array(w, buf, 16);-#else-	uint32_t *w = buf;-#endif--	a1 = ctx->h[0]; b1 = ctx->h[1]; c1 = ctx->h[2]; d1 = ctx->h[3]; e1 = ctx->h[4];-	a2 = ctx->h[0]; b2 = ctx->h[1]; c2 = ctx->h[2]; d2 = ctx->h[3]; e2 = ctx->h[4];--	/* 5 passes on first state copy */-	R(a1, b1, c1, d1, e1, f1, K1, 0, 11);-	R(e1, a1, b1, c1, d1, f1, K1, 1, 14);-	R(d1, e1, a1, b1, c1, f1, K1, 2, 15);-	R(c1, d1, e1, a1, b1, f1, K1, 3, 12);-	R(b1, c1, d1, e1, a1, f1, K1, 4, 5);-	R(a1, b1, c1, d1, e1, f1, K1, 5, 8);-	R(e1, a1, b1, c1, d1, f1, K1, 6, 7);-	R(d1, e1, a1, b1, c1, f1, K1, 7, 9);-	R(c1, d1, e1, a1, b1, f1, K1, 8, 11);-	R(b1, c1, d1, e1, a1, f1, K1, 9, 13);-	R(a1, b1, c1, d1, e1, f1, K1, 10, 14);-	R(e1, a1, b1, c1, d1, f1, K1, 11, 15);-	R(d1, e1, a1, b1, c1, f1, K1, 12, 6);-	R(c1, d1, e1, a1, b1, f1, K1, 13, 7);-	R(b1, c1, d1, e1, a1, f1, K1, 14, 9);-	R(a1, b1, c1, d1, e1, f1, K1, 15, 8);-	-	R(e1, a1, b1, c1, d1, f2, K2, 7, 7);-	R(d1, e1, a1, b1, c1, f2, K2, 4, 6);-	R(c1, d1, e1, a1, b1, f2, K2, 13, 8);-	R(b1, c1, d1, e1, a1, f2, K2, 1, 13);-	R(a1, b1, c1, d1, e1, f2, K2, 10, 11);-	R(e1, a1, b1, c1, d1, f2, K2, 6, 9);-	R(d1, e1, a1, b1, c1, f2, K2, 15, 7);-	R(c1, d1, e1, a1, b1, f2, K2, 3, 15);-	R(b1, c1, d1, e1, a1, f2, K2, 12, 7);-	R(a1, b1, c1, d1, e1, f2, K2, 0, 12);-	R(e1, a1, b1, c1, d1, f2, K2, 9, 15);-	R(d1, e1, a1, b1, c1, f2, K2, 5, 9);-	R(c1, d1, e1, a1, b1, f2, K2, 2, 11);-	R(b1, c1, d1, e1, a1, f2, K2, 14, 7);-	R(a1, b1, c1, d1, e1, f2, K2, 11, 13);-	R(e1, a1, b1, c1, d1, f2, K2, 8, 12);--	R(d1, e1, a1, b1, c1, f3, K3, 3, 11);-	R(c1, d1, e1, a1, b1, f3, K3, 10, 13);-	R(b1, c1, d1, e1, a1, f3, K3, 14, 6);-	R(a1, b1, c1, d1, e1, f3, K3, 4, 7);-	R(e1, a1, b1, c1, d1, f3, K3, 9, 14);-	R(d1, e1, a1, b1, c1, f3, K3, 15, 9);-	R(c1, d1, e1, a1, b1, f3, K3, 8, 13);-	R(b1, c1, d1, e1, a1, f3, K3, 1, 15);-	R(a1, b1, c1, d1, e1, f3, K3, 2, 14);-	R(e1, a1, b1, c1, d1, f3, K3, 7, 8);-	R(d1, e1, a1, b1, c1, f3, K3, 0, 13);-	R(c1, d1, e1, a1, b1, f3, K3, 6, 6);-	R(b1, c1, d1, e1, a1, f3, K3, 13, 5);-	R(a1, b1, c1, d1, e1, f3, K3, 11, 12);-	R(e1, a1, b1, c1, d1, f3, K3, 5, 7);-	R(d1, e1, a1, b1, c1, f3, K3, 12, 5);--	R(c1, d1, e1, a1, b1, f4, K4, 1, 11);-	R(b1, c1, d1, e1, a1, f4, K4, 9, 12);-	R(a1, b1, c1, d1, e1, f4, K4, 11, 14);-	R(e1, a1, b1, c1, d1, f4, K4, 10, 15);-	R(d1, e1, a1, b1, c1, f4, K4, 0, 14);-	R(c1, d1, e1, a1, b1, f4, K4, 8, 15);-	R(b1, c1, d1, e1, a1, f4, K4, 12, 9);-	R(a1, b1, c1, d1, e1, f4, K4, 4, 8);-	R(e1, a1, b1, c1, d1, f4, K4, 13, 9);-	R(d1, e1, a1, b1, c1, f4, K4, 3, 14);-	R(c1, d1, e1, a1, b1, f4, K4, 7, 5);-	R(b1, c1, d1, e1, a1, f4, K4, 15, 6);-	R(a1, b1, c1, d1, e1, f4, K4, 14, 8);-	R(e1, a1, b1, c1, d1, f4, K4, 5, 6);-	R(d1, e1, a1, b1, c1, f4, K4, 6, 5);-	R(c1, d1, e1, a1, b1, f4, K4, 2, 12);--	R(b1, c1, d1, e1, a1, f5, K5, 4, 9);-	R(a1, b1, c1, d1, e1, f5, K5, 0, 15);-	R(e1, a1, b1, c1, d1, f5, K5, 5, 5);-	R(d1, e1, a1, b1, c1, f5, K5, 9, 11);-	R(c1, d1, e1, a1, b1, f5, K5, 7, 6);-	R(b1, c1, d1, e1, a1, f5, K5, 12, 8);-	R(a1, b1, c1, d1, e1, f5, K5, 2, 13);-	R(e1, a1, b1, c1, d1, f5, K5, 10, 12);-	R(d1, e1, a1, b1, c1, f5, K5, 14, 5);-	R(c1, d1, e1, a1, b1, f5, K5, 1, 12);-	R(b1, c1, d1, e1, a1, f5, K5, 3, 13);-	R(a1, b1, c1, d1, e1, f5, K5, 8, 14);-	R(e1, a1, b1, c1, d1, f5, K5, 11, 11);-	R(d1, e1, a1, b1, c1, f5, K5, 6, 8);-	R(c1, d1, e1, a1, b1, f5, K5, 15, 5);-	R(b1, c1, d1, e1, a1, f5, K5, 13, 6);--	/* 5 passes on second state copy */-	R(a2, b2, c2, d2, e2, f5, K6, 5, 8);-	R(e2, a2, b2, c2, d2, f5, K6, 14, 9);-	R(d2, e2, a2, b2, c2, f5, K6, 7, 9);-	R(c2, d2, e2, a2, b2, f5, K6, 0, 11);-	R(b2, c2, d2, e2, a2, f5, K6, 9, 13);-	R(a2, b2, c2, d2, e2, f5, K6, 2, 15);-	R(e2, a2, b2, c2, d2, f5, K6, 11, 15);-	R(d2, e2, a2, b2, c2, f5, K6, 4, 5);-	R(c2, d2, e2, a2, b2, f5, K6, 13, 7);-	R(b2, c2, d2, e2, a2, f5, K6, 6, 7);-	R(a2, b2, c2, d2, e2, f5, K6, 15, 8);-	R(e2, a2, b2, c2, d2, f5, K6, 8, 11);-	R(d2, e2, a2, b2, c2, f5, K6, 1, 14);-	R(c2, d2, e2, a2, b2, f5, K6, 10, 14);-	R(b2, c2, d2, e2, a2, f5, K6, 3, 12);-	R(a2, b2, c2, d2, e2, f5, K6, 12, 6);--	R(e2, a2, b2, c2, d2, f4, K7, 6, 9);-	R(d2, e2, a2, b2, c2, f4, K7, 11, 13);-	R(c2, d2, e2, a2, b2, f4, K7, 3, 15);-	R(b2, c2, d2, e2, a2, f4, K7, 7, 7);-	R(a2, b2, c2, d2, e2, f4, K7, 0, 12);-	R(e2, a2, b2, c2, d2, f4, K7, 13, 8);-	R(d2, e2, a2, b2, c2, f4, K7, 5, 9);-	R(c2, d2, e2, a2, b2, f4, K7, 10, 11);-	R(b2, c2, d2, e2, a2, f4, K7, 14, 7);-	R(a2, b2, c2, d2, e2, f4, K7, 15, 7);-	R(e2, a2, b2, c2, d2, f4, K7, 8, 12);-	R(d2, e2, a2, b2, c2, f4, K7, 12, 7);-	R(c2, d2, e2, a2, b2, f4, K7, 4, 6);-	R(b2, c2, d2, e2, a2, f4, K7, 9, 15);-	R(a2, b2, c2, d2, e2, f4, K7, 1, 13);-	R(e2, a2, b2, c2, d2, f4, K7, 2, 11);--	R(d2, e2, a2, b2, c2, f3, K8, 15, 9);-	R(c2, d2, e2, a2, b2, f3, K8, 5, 7);-	R(b2, c2, d2, e2, a2, f3, K8, 1, 15);-	R(a2, b2, c2, d2, e2, f3, K8, 3, 11);-	R(e2, a2, b2, c2, d2, f3, K8, 7, 8);-	R(d2, e2, a2, b2, c2, f3, K8, 14, 6);-	R(c2, d2, e2, a2, b2, f3, K8, 6, 6);-	R(b2, c2, d2, e2, a2, f3, K8, 9, 14);-	R(a2, b2, c2, d2, e2, f3, K8, 11, 12);-	R(e2, a2, b2, c2, d2, f3, K8, 8, 13);-	R(d2, e2, a2, b2, c2, f3, K8, 12, 5);-	R(c2, d2, e2, a2, b2, f3, K8, 2, 14);-	R(b2, c2, d2, e2, a2, f3, K8, 10, 13);-	R(a2, b2, c2, d2, e2, f3, K8, 0, 13);-	R(e2, a2, b2, c2, d2, f3, K8, 4, 7);-	R(d2, e2, a2, b2, c2, f3, K8, 13, 5);--	R(c2, d2, e2, a2, b2, f2, K9, 8, 15);-	R(b2, c2, d2, e2, a2, f2, K9, 6, 5);-	R(a2, b2, c2, d2, e2, f2, K9, 4, 8);-	R(e2, a2, b2, c2, d2, f2, K9, 1, 11);-	R(d2, e2, a2, b2, c2, f2, K9, 3, 14);-	R(c2, d2, e2, a2, b2, f2, K9, 11, 14);-	R(b2, c2, d2, e2, a2, f2, K9, 15, 6);-	R(a2, b2, c2, d2, e2, f2, K9, 0, 14);-	R(e2, a2, b2, c2, d2, f2, K9, 5, 6);-	R(d2, e2, a2, b2, c2, f2, K9, 12, 9);-	R(c2, d2, e2, a2, b2, f2, K9, 2, 12);-	R(b2, c2, d2, e2, a2, f2, K9, 13, 9);-	R(a2, b2, c2, d2, e2, f2, K9, 9, 12);-	R(e2, a2, b2, c2, d2, f2, K9, 7, 5);-	R(d2, e2, a2, b2, c2, f2, K9, 10, 15);-	R(c2, d2, e2, a2, b2, f2, K9, 14, 8);--	R(b2, c2, d2, e2, a2, f1, K1, 12, 8);-	R(a2, b2, c2, d2, e2, f1, K1, 15, 5);-	R(e2, a2, b2, c2, d2, f1, K1, 10, 12);-	R(d2, e2, a2, b2, c2, f1, K1, 4, 9);-	R(c2, d2, e2, a2, b2, f1, K1, 1, 12);-	R(b2, c2, d2, e2, a2, f1, K1, 5, 5);-	R(a2, b2, c2, d2, e2, f1, K1, 8, 14);-	R(e2, a2, b2, c2, d2, f1, K1, 7, 6);-	R(d2, e2, a2, b2, c2, f1, K1, 6, 8);-	R(c2, d2, e2, a2, b2, f1, K1, 2, 13);-	R(b2, c2, d2, e2, a2, f1, K1, 13, 6);-	R(a2, b2, c2, d2, e2, f1, K1, 14, 5);-	R(e2, a2, b2, c2, d2, f1, K1, 0, 15);-	R(d2, e2, a2, b2, c2, f1, K1, 3, 13);-	R(c2, d2, e2, a2, b2, f1, K1, 9, 11);-	R(b2, c2, d2, e2, a2, f1, K1, 11, 11);--	d2 += c1 + ctx->h[1];-	ctx->h[1] = ctx->h[2] + d1 + e2;-	ctx->h[2] = ctx->h[3] + e1 + a2;-	ctx->h[3] = ctx->h[4] + a1 + b2;-	ctx->h[4] = ctx->h[0] + b1 + c2;-	ctx->h[0] = d2;-}--void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;-	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		ripemd160_do_chunk(ctx, (uint32_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 4)) {-		uint32_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 4);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			ripemd160_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			ripemd160_do_chunk(ctx, (uint32_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x80, };-	uint64_t bits;-	uint32_t index, padlen;--	/* add padding and update data with it */-	bits = cpu_to_le64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_ripemd160_update(ctx, padding, padlen);--	/* append length */-	cryptonite_ripemd160_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* output digest */-	store_le32(out   , ctx->h[0]);-	store_le32(out+ 4, ctx->h[1]);-	store_le32(out+ 8, ctx->h[2]);-	store_le32(out+12, ctx->h[3]);-	store_le32(out+16, ctx->h[4]);-}
− cbits/cryptonite_ripemd.h 
@@ -1,43 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_RIPEMD_H-#define CRYPTOHASH_RIPEMD_H--#include <stdint.h>--struct ripemd160_ctx-{-	uint64_t sz;-	uint8_t  buf[64];-	uint32_t h[5];-};--#define RIPEMD160_DIGEST_SIZE	20-#define RIPEMD160_CTX_SIZE	sizeof(struct ripemd160_ctx)--void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx);-void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out);--#endif
− cbits/cryptonite_salsa.c 
@@ -1,292 +0,0 @@-/*- * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */--#include <stdint.h>-#include <string.h>-#include <stdio.h>-#include "cryptonite_salsa.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--static const uint8_t sigma[16] = "expand 32-byte k";-static const uint8_t tau[16] = "expand 16-byte k";--#define QR(a,b,c,d) \-	b ^= rol32(a+d, 7); \-	c ^= rol32(b+a, 9); \-	d ^= rol32(c+b, 13); \-	a ^= rol32(d+c, 18);--#define ALIGNED64(PTR) \-	(((uintptr_t)(const void *)(PTR)) % 8 == 0)--#define SALSA_CORE_LOOP \-	for (i = rounds; i > 0; i -= 2) { \-		QR (x0,x4,x8,x12); \-		QR (x5,x9,x13,x1); \-		QR (x10,x14,x2,x6); \-		QR (x15,x3,x7,x11); \-		QR (x0,x1,x2,x3); \-		QR (x5,x6,x7,x4); \-		QR (x10,x11,x8,x9); \-		QR (x15,x12,x13,x14); \-	}--static void salsa_core(int rounds, block *out, const cryptonite_salsa_state *in)-{-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;-	int i;--	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];-	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];-	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];-	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];--	SALSA_CORE_LOOP;--	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];-	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];-	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];-	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];--	out->d[0] = cpu_to_le32(x0);-	out->d[1] = cpu_to_le32(x1);-	out->d[2] = cpu_to_le32(x2);-	out->d[3] = cpu_to_le32(x3);-	out->d[4] = cpu_to_le32(x4);-	out->d[5] = cpu_to_le32(x5);-	out->d[6] = cpu_to_le32(x6);-	out->d[7] = cpu_to_le32(x7);-	out->d[8] = cpu_to_le32(x8);-	out->d[9] = cpu_to_le32(x9);-	out->d[10] = cpu_to_le32(x10);-	out->d[11] = cpu_to_le32(x11);-	out->d[12] = cpu_to_le32(x12);-	out->d[13] = cpu_to_le32(x13);-	out->d[14] = cpu_to_le32(x14);-	out->d[15] = cpu_to_le32(x15);-}--void cryptonite_salsa_core_xor(int rounds, block *out, block *in)-{-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;-	int i;--#define LOAD(i) (out->d[i] ^= in->d[i])-	x0 = LOAD(0); x1 = LOAD(1); x2 = LOAD(2); x3 = LOAD(3);-	x4 = LOAD(4); x5 = LOAD(5); x6 = LOAD(6); x7 = LOAD(7);-	x8 = LOAD(8); x9 = LOAD(9); x10 = LOAD(10); x11 = LOAD(11);-	x12 = LOAD(12); x13 = LOAD(13); x14 = LOAD(14); x15 = LOAD(15);-#undef LOAD--	SALSA_CORE_LOOP;--	out->d[0] += x0; out->d[1] += x1; out->d[2] += x2; out->d[3] += x3;-	out->d[4] += x4; out->d[5] += x5; out->d[6] += x6; out->d[7] += x7;-	out->d[8] += x8; out->d[9] += x9; out->d[10] += x10; out->d[11] += x11;-	out->d[12] += x12; out->d[13] += x13; out->d[14] += x14; out->d[15] += x15;-}--/* only 2 valid values for keylen are 256 (32) and 128 (16) */-void cryptonite_salsa_init_core(cryptonite_salsa_state *st,-                                uint32_t keylen, const uint8_t *key,-                                uint32_t ivlen, const uint8_t *iv)-{-	const uint8_t *constants = (keylen == 32) ? sigma : tau;--	st->d[0] = load_le32_aligned(constants + 0);-	st->d[5] = load_le32_aligned(constants + 4);-	st->d[10] = load_le32_aligned(constants + 8);-	st->d[15] = load_le32_aligned(constants + 12);--	st->d[1] = load_le32(key + 0);-	st->d[2] = load_le32(key + 4);-	st->d[3] = load_le32(key + 8);-	st->d[4] = load_le32(key + 12);-	/* we repeat the key on 128 bits */-	if (keylen == 32)-		key += 16;-	st->d[11] = load_le32(key + 0);-	st->d[12] = load_le32(key + 4);-	st->d[13] = load_le32(key + 8);-	st->d[14] = load_le32(key + 12);--	st->d[9] = 0;-	switch (ivlen) {-	case 8:-		st->d[6] = load_le32(iv + 0);-		st->d[7] = load_le32(iv + 4);-		st->d[8] = 0;-		break;-	case 12:-		st->d[6] = load_le32(iv + 0);-		st->d[7] = load_le32(iv + 4);-		st->d[8] = load_le32(iv + 8);-	default:-		return;-	}-}--void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds,-                           uint32_t keylen, const uint8_t *key,-                           uint32_t ivlen, const uint8_t *iv)-{-	memset(ctx, 0, sizeof(*ctx));-	ctx->nb_rounds = nb_rounds;-	cryptonite_salsa_init_core(&ctx->st, keylen, key, ivlen, iv);-}--void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *ctx, const uint8_t *src, uint32_t bytes)-{-	block out;-	cryptonite_salsa_state *st;-	int i;--	if (!bytes)-		return;--	/* xor the previous buffer first (if any) */-	if (ctx->prev_len > 0) {-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;-		for (i = 0; i < to_copy; i++)-			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);-		ctx->prev_len -= to_copy;-		ctx->prev_ofs += to_copy;-		src += to_copy;-		dst += to_copy;-		bytes -= to_copy;-	}--	if (bytes == 0)-		return;--	st = &ctx->st;--	/* xor new 64-bytes chunks and store the left over if any */-	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {-		/* generate new chunk and update state */-		salsa_core(ctx->nb_rounds, &out, st);-		st->d[8] += 1;-		if (st->d[8] == 0)-			st->d[9] += 1;--		for (i = 0; i < 64; ++i)-			dst[i] = src[i] ^ out.b[i];-	}--	if (bytes > 0) {-		/* generate new chunk and update state */-		salsa_core(ctx->nb_rounds, &out, st);-		st->d[8] += 1;-		if (st->d[8] == 0)-			st->d[9] += 1;--		/* xor as much as needed */-		for (i = 0; i < bytes; i++)-			dst[i] = src[i] ^ out.b[i];-		-		/* copy the left over in the buffer */-		ctx->prev_len = 64 - bytes;-		ctx->prev_ofs = i;-		for (; i < 64; i++) {-			ctx->prev[i] = out.b[i];-		}-	}-}--void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *ctx, uint32_t bytes)-{-	cryptonite_salsa_state *st;-	block out;-	int i;--	if (!bytes)-		return;--	/* xor the previous buffer first (if any) */-	if (ctx->prev_len > 0) {-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;-		for (i = 0; i < to_copy; i++)-			dst[i] = ctx->prev[ctx->prev_ofs+i];-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);-		ctx->prev_len -= to_copy;-		ctx->prev_ofs += to_copy;-		dst += to_copy;-		bytes -= to_copy;-	}--	if (bytes == 0)-		return;--	st = &ctx->st;--	if (ALIGNED64(dst)) {-		/* xor new 64-bytes chunks and store the left over if any */-		for (; bytes >= 64; bytes -= 64, dst += 64) {-			/* generate new chunk and update state */-			salsa_core(ctx->nb_rounds, (block *) dst, st);-			st->d[8] += 1;-			if (st->d[8] == 0)-				st->d[9] += 1;-		}-	} else {-		/* xor new 64-bytes chunks and store the left over if any */-		for (; bytes >= 64; bytes -= 64, dst += 64) {-			/* generate new chunk and update state */-			salsa_core(ctx->nb_rounds, &out, st);-			st->d[8] += 1;-			if (st->d[8] == 0)-				st->d[9] += 1;--			for (i = 0; i < 64; ++i)-				dst[i] = out.b[i];-		}-	}--	if (bytes > 0) {-		/* generate new chunk and update state */-		salsa_core(ctx->nb_rounds, &out, st);-		st->d[8] += 1;-		if (st->d[8] == 0)-			st->d[9] += 1;--		/* xor as much as needed */-		for (i = 0; i < bytes; i++)-			dst[i] = out.b[i];-		-		/* copy the left over in the buffer */-		ctx->prev_len = 64 - bytes;-		ctx->prev_ofs = i;-		for (; i < 64; i++)-			ctx->prev[i] = out.b[i];-	}-}-
− cbits/cryptonite_salsa.h 
@@ -1,57 +0,0 @@-/*- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */-#ifndef CRYPTONITE_SALSA-#define CRYPTONITE_SALSA--typedef union {-	uint64_t q[8];-	uint32_t d[16];-	uint8_t  b[64];-} block;--typedef block cryptonite_salsa_state;--typedef struct {-	cryptonite_salsa_state st;-	uint8_t prev[64];-	uint8_t prev_ofs;-	uint8_t prev_len;-	uint8_t nb_rounds;-} cryptonite_salsa_context;--/* for scrypt */-void cryptonite_salsa_core_xor(int rounds, block *out, block *in);--void cryptonite_salsa_init_core(cryptonite_salsa_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);-void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);-void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *st, const uint8_t *src, uint32_t bytes);-void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *st, uint32_t bytes);--#endif
− cbits/cryptonite_scrypt.c 
@@ -1,81 +0,0 @@-/*- * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- *- * Based on scrypt from Colin Percival's paper- */--#include <stdint.h>-#include <string.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_salsa.h"--static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)-{-	int i;--	array_copy32(X, &in[(2 * r - 1) * 16], 16);--	for (i = 0; i < 2 * r; i += 2) {-		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);-		array_copy32(&out[i * 8], X, 16);--		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);-		array_copy32(&out[i * 8 + r * 16], X, 16);-	}-}--static inline uint64_t integerify(uint32_t *B, const uint32_t r)-{-	return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32;-}--void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)-{-	uint32_t *X = XY;-	uint32_t *Y = &XY[32 * r];-	uint32_t *Z = &XY[64 * r];-	uint64_t i, j;-	int k;-	const int r32 = 32*r;--	for (k = 0; k < r32; k++)-		X[k] = load_le32_aligned(&B[4 * k]);-	for (i = 0; i < N; i += 2) {-		array_copy32(&V[i * r32], X, r32);-		blockmix_salsa8(X, Y, Z, r);-		array_copy32(&V[(i + 1) * r32], Y, r32);-		blockmix_salsa8(Y, X, Z, r);-	}-	for (i = 0; i < N; i += 2) {-		j = integerify(X, r) & (N - 1);-		array_xor32(X, &V[j * r32], r32);-		blockmix_salsa8(X, Y, Z, r);--		j = integerify(Y, r) & (N - 1);-		array_xor32(Y, &V[j * r32], r32);-		blockmix_salsa8(Y, X, Z, r);-	}-	for (k = 0; k < r32; k++)-		store_le32_aligned(&B[4*k], X[k]);-}
− cbits/cryptonite_sha1.c 
@@ -1,246 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_sha1.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--void cryptonite_sha1_init(struct sha1_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0x67452301;-	ctx->h[1] = 0xefcdab89;-	ctx->h[2] = 0x98badcfe;-	ctx->h[3] = 0x10325476;-	ctx->h[4] = 0xc3d2e1f0;-}--#define f1(x, y, z)   (z ^ (x & (y ^ z)))-#define f2(x, y, z)   (x ^ y ^ z)-#define f3(x, y, z)   ((x & y) + (z & (x ^ y)))-#define f4(x, y, z)   f2(x, y, z)--#define K1  0x5a827999-#define K2  0x6ed9eba1-#define K3  0x8f1bbcdc-#define K4  0xca62c1d6--#define R(a, b, c, d, e, f, k, w)  \-	e += rol32(a, 5) + f(b, c, d) + k + w; b = rol32(b, 30)--#define M(i)  (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \-              ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1))--static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf)-{-	uint32_t a, b, c, d, e;-	uint32_t w[16];-#define CPY(i)	w[i] = be32_to_cpu(buf[i])-	CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7);-	CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15);-#undef CPY--	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; e = ctx->h[4];--	R(a, b, c, d, e, f1, K1, w[0]);-	R(e, a, b, c, d, f1, K1, w[1]);-	R(d, e, a, b, c, f1, K1, w[2]);-	R(c, d, e, a, b, f1, K1, w[3]);-	R(b, c, d, e, a, f1, K1, w[4]);-	R(a, b, c, d, e, f1, K1, w[5]);-	R(e, a, b, c, d, f1, K1, w[6]);-	R(d, e, a, b, c, f1, K1, w[7]);-	R(c, d, e, a, b, f1, K1, w[8]);-	R(b, c, d, e, a, f1, K1, w[9]);-	R(a, b, c, d, e, f1, K1, w[10]);-	R(e, a, b, c, d, f1, K1, w[11]);-	R(d, e, a, b, c, f1, K1, w[12]);-	R(c, d, e, a, b, f1, K1, w[13]);-	R(b, c, d, e, a, f1, K1, w[14]);-	R(a, b, c, d, e, f1, K1, w[15]);-	R(e, a, b, c, d, f1, K1, M(16));-	R(d, e, a, b, c, f1, K1, M(17));-	R(c, d, e, a, b, f1, K1, M(18));-	R(b, c, d, e, a, f1, K1, M(19));--	R(a, b, c, d, e, f2, K2, M(20));-	R(e, a, b, c, d, f2, K2, M(21));-	R(d, e, a, b, c, f2, K2, M(22));-	R(c, d, e, a, b, f2, K2, M(23));-	R(b, c, d, e, a, f2, K2, M(24));-	R(a, b, c, d, e, f2, K2, M(25));-	R(e, a, b, c, d, f2, K2, M(26));-	R(d, e, a, b, c, f2, K2, M(27));-	R(c, d, e, a, b, f2, K2, M(28));-	R(b, c, d, e, a, f2, K2, M(29));-	R(a, b, c, d, e, f2, K2, M(30));-	R(e, a, b, c, d, f2, K2, M(31));-	R(d, e, a, b, c, f2, K2, M(32));-	R(c, d, e, a, b, f2, K2, M(33));-	R(b, c, d, e, a, f2, K2, M(34));-	R(a, b, c, d, e, f2, K2, M(35));-	R(e, a, b, c, d, f2, K2, M(36));-	R(d, e, a, b, c, f2, K2, M(37));-	R(c, d, e, a, b, f2, K2, M(38));-	R(b, c, d, e, a, f2, K2, M(39));--	R(a, b, c, d, e, f3, K3, M(40));-	R(e, a, b, c, d, f3, K3, M(41));-	R(d, e, a, b, c, f3, K3, M(42));-	R(c, d, e, a, b, f3, K3, M(43));-	R(b, c, d, e, a, f3, K3, M(44));-	R(a, b, c, d, e, f3, K3, M(45));-	R(e, a, b, c, d, f3, K3, M(46));-	R(d, e, a, b, c, f3, K3, M(47));-	R(c, d, e, a, b, f3, K3, M(48));-	R(b, c, d, e, a, f3, K3, M(49));-	R(a, b, c, d, e, f3, K3, M(50));-	R(e, a, b, c, d, f3, K3, M(51));-	R(d, e, a, b, c, f3, K3, M(52));-	R(c, d, e, a, b, f3, K3, M(53));-	R(b, c, d, e, a, f3, K3, M(54));-	R(a, b, c, d, e, f3, K3, M(55));-	R(e, a, b, c, d, f3, K3, M(56));-	R(d, e, a, b, c, f3, K3, M(57));-	R(c, d, e, a, b, f3, K3, M(58));-	R(b, c, d, e, a, f3, K3, M(59));--	R(a, b, c, d, e, f4, K4, M(60));-	R(e, a, b, c, d, f4, K4, M(61));-	R(d, e, a, b, c, f4, K4, M(62));-	R(c, d, e, a, b, f4, K4, M(63));-	R(b, c, d, e, a, f4, K4, M(64));-	R(a, b, c, d, e, f4, K4, M(65));-	R(e, a, b, c, d, f4, K4, M(66));-	R(d, e, a, b, c, f4, K4, M(67));-	R(c, d, e, a, b, f4, K4, M(68));-	R(b, c, d, e, a, f4, K4, M(69));-	R(a, b, c, d, e, f4, K4, M(70));-	R(e, a, b, c, d, f4, K4, M(71));-	R(d, e, a, b, c, f4, K4, M(72));-	R(c, d, e, a, b, f4, K4, M(73));-	R(b, c, d, e, a, f4, K4, M(74));-	R(a, b, c, d, e, f4, K4, M(75));-	R(e, a, b, c, d, f4, K4, M(76));-	R(d, e, a, b, c, f4, K4, M(77));-	R(c, d, e, a, b, f4, K4, M(78));-	R(b, c, d, e, a, f4, K4, M(79));--	ctx->h[0] += a;-	ctx->h[1] += b;-	ctx->h[2] += c;-	ctx->h[3] += d;-	ctx->h[4] += e;-}--void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;--	/* process partial buffer if there's enough data to make a block */-	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		sha1_do_chunk(ctx, (uint32_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 4)) {-		uint32_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 4);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			sha1_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			sha1_do_chunk(ctx, (uint32_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x80, };-	uint64_t bits;-	uint32_t index, padlen;--	/* add padding and update data with it */-	bits = cpu_to_be64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_sha1_update(ctx, padding, padlen);--	/* append length */-	cryptonite_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* output hash */-	store_be32(out   , ctx->h[0]);-	store_be32(out+ 4, ctx->h[1]);-	store_be32(out+ 8, ctx->h[2]);-	store_be32(out+12, ctx->h[3]);-	store_be32(out+16, ctx->h[4]);-}--#define HASHED(m) SHA1_##m-#define HASHED_LOWER(m) sha1_##m-#define CRYPTONITE_HASHED(m) cryptonite_sha1_##m-#define SHA1_BLOCK_SIZE 64-#define SHA1_BITS_ELEMS 1--static inline uint32_t cryptonite_sha1_get_index(const struct sha1_ctx *ctx)-{-	return (uint32_t) (ctx->sz & 0x3f);-}--static inline void cryptonite_sha1_incr_sz(struct sha1_ctx *ctx, uint64_t *bits, uint32_t n)-{-	ctx->sz += n;-	*bits = cpu_to_be64(ctx->sz << 3);-}--static inline void cryptonite_sha1_select_digest(const struct sha1_ctx *ctx, uint8_t *out, uint32_t out_mask)-{-	xor_be32(out   , ctx->h[0] & out_mask);-	xor_be32(out+ 4, ctx->h[1] & out_mask);-	xor_be32(out+ 8, ctx->h[2] & out_mask);-	xor_be32(out+12, ctx->h[3] & out_mask);-	xor_be32(out+16, ctx->h[4] & out_mask);-}--#include <cryptonite_hash_prefix.c>
− cbits/cryptonite_sha1.h 
@@ -1,46 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SHA1_H-#define CRYPTOHASH_SHA1_H--#include <stdint.h>--# define SHA1_BLOCK_SIZE 64--struct sha1_ctx-{-	uint64_t sz;-	uint8_t  buf[SHA1_BLOCK_SIZE];-	uint32_t h[5];-};--#define SHA1_DIGEST_SIZE	20-#define SHA1_CTX_SIZE 		(sizeof(struct sha1_ctx))--void cryptonite_sha1_init(struct sha1_ctx *ctx);-void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out);-void cryptonite_sha1_finalize_prefix(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--#endif
− cbits/cryptonite_sha256.c 
@@ -1,218 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_sha256.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--void cryptonite_sha224_init(struct sha224_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0xc1059ed8;-	ctx->h[1] = 0x367cd507;-	ctx->h[2] = 0x3070dd17;-	ctx->h[3] = 0xf70e5939;-	ctx->h[4] = 0xffc00b31;-	ctx->h[5] = 0x68581511;-	ctx->h[6] = 0x64f98fa7;-	ctx->h[7] = 0xbefa4fa4;-}--void cryptonite_sha256_init(struct sha256_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0x6a09e667;-	ctx->h[1] = 0xbb67ae85;-	ctx->h[2] = 0x3c6ef372;-	ctx->h[3] = 0xa54ff53a;-	ctx->h[4] = 0x510e527f;-	ctx->h[5] = 0x9b05688c;-	ctx->h[6] = 0x1f83d9ab;-	ctx->h[7] = 0x5be0cd19;-}--/* 232 times the cube root of the first 64 primes 2..311 */-static const uint32_t k[] = {-	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,-	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,-	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,-	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,-	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,-	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,-	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,-	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,-	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,-	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,-	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2-};--#define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))-#define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))-#define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))-#define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))--static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[])-{-	uint32_t a, b, c, d, e, f, g, h, t1, t2;-	int i;-	uint32_t w[64];--	cpu_to_be32_array(w, buf, 16);-	for (i = 16; i < 64; i++)-		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];--	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];-	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];--#define R(a, b, c, d, e, f, g, h, k, w)			\-	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w; 	\-	t2 = e0(a) + ((a & b) | (c & (a | b)));		\-	d += t1;					\-	h = t1 + t2;--	for (i = 0; i < 64; i += 8) {-		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);-		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);-		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);-		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);-		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);-		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);-		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);-		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);-	}--#undef R--	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;-	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;-}--void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len)-{-	return cryptonite_sha256_update(ctx, data, len);-}--void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	/* check for partial buffer */-	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;--	/* process partial buffer if there's enough data to make a block */-	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		sha256_do_chunk(ctx, (uint32_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 4)) {-		uint32_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 4);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			sha256_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			sha256_do_chunk(ctx, (uint32_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out)-{-	uint8_t intermediate[SHA256_DIGEST_SIZE];--	cryptonite_sha256_finalize(ctx, intermediate);-	memcpy(out, intermediate, SHA224_DIGEST_SIZE);-}--void cryptonite_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)-{-	uint8_t intermediate[SHA256_DIGEST_SIZE];--	cryptonite_sha256_finalize_prefix(ctx, data, len, n, intermediate);-	memcpy(out, intermediate, SHA224_DIGEST_SIZE);-}--void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x80, };-	uint64_t bits;-	uint32_t i, index, padlen;--	/* cpu -> big endian */-	bits = cpu_to_be64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_sha256_update(ctx, padding, padlen);--	/* append length */-	cryptonite_sha256_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* store to digest */-	for (i = 0; i < 8; i++)-		store_be32(out+4*i, ctx->h[i]);-}--#define HASHED(m) SHA256_##m-#define HASHED_LOWER(m) sha256_##m-#define CRYPTONITE_HASHED(m) cryptonite_sha256_##m-#define SHA256_BLOCK_SIZE 64-#define SHA256_BITS_ELEMS 1--static inline uint32_t cryptonite_sha256_get_index(const struct sha256_ctx *ctx)-{-	return (uint32_t) (ctx->sz & 0x3f);-}--static inline void cryptonite_sha256_incr_sz(struct sha256_ctx *ctx, uint64_t *bits, uint32_t n)-{-	ctx->sz += n;-	*bits = cpu_to_be64(ctx->sz << 3);-}--static inline void cryptonite_sha256_select_digest(const struct sha256_ctx *ctx, uint8_t *out, uint32_t out_mask)-{-	uint32_t i;-	for (i = 0; i < 8; i++)-		xor_be32(out+4*i, ctx->h[i] & out_mask);-}--#include <cryptonite_hash_prefix.c>
− cbits/cryptonite_sha256.h 
@@ -1,57 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#ifndef CRYPTOHASH_SHA256_H-#define CRYPTOHASH_SHA256_H--#include <stdint.h>--#define SHA256_BLOCK_SIZE 64--struct sha256_ctx-{-	uint64_t sz;-	uint8_t  buf[128];-	uint32_t h[8];-};--#define sha224_ctx 		sha256_ctx--#define SHA224_DIGEST_SIZE	28-#define SHA224_CTX_SIZE		sizeof(struct sha224_ctx)--#define SHA256_DIGEST_SIZE	32-#define SHA256_CTX_SIZE		sizeof(struct sha256_ctx)--void cryptonite_sha224_init(struct sha224_ctx *ctx);-void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out);-void cryptonite_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--void cryptonite_sha256_init(struct sha256_ctx *ctx);-void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out);-void cryptonite_sha256_finalize_prefix(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--#endif
− cbits/cryptonite_sha3.c 
@@ -1,252 +0,0 @@-/*- * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <stdint.h>-#include <string.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_sha3.h"--#define KECCAK_NB_ROUNDS 24--/* rounds constants */-static const uint64_t keccak_rndc[24] =-{-	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,-	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,-	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,-	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,-	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,-	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,-	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,-	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,-};--/* triangular numbers constants */-static const int keccak_rotc[24] =-	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };--static const int keccak_piln[24] =-	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };--static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)-{-	int i, j, r;-	uint64_t tmp, bc[5];--	/* merge buf with state */-	for (i = 0; i < bufsz; i++)-		state[i] ^= le64_to_cpu(buf[i]);--	/* run keccak rounds */-	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {-		/* compute the parity of each columns */-		for (i = 0; i < 5; i++)-			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];--		for (i = 0; i < 5; i++) {-			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);-			for (j = 0; j < 25; j += 5)-				state[j + i] ^= tmp;-		}--		/* rho pi */-		tmp = state[1];-		for (i = 0; i < 24; i++) {-			j = keccak_piln[i];-			bc[0] = state[j];-			state[j] = rol64(tmp, keccak_rotc[i]);-			tmp = bc[0];-		}--		/* bitwise combine along rows using a = a xor (not b and c) */-		for (j = 0; j < 25; j += 5) {-			for (i = 0; i < 5; i++)-				bc[i] = state[j + i];-			#define andn(b,c) (~(b) & (c))-			state[j + 0] ^= andn(bc[1], bc[2]);-			state[j + 1] ^= andn(bc[2], bc[3]);-			state[j + 2] ^= andn(bc[3], bc[4]);-			state[j + 3] ^= andn(bc[4], bc[0]);-			state[j + 4] ^= andn(bc[0], bc[1]);-			#undef andn-		}--		/* xor the round constant */-		state[0] ^= keccak_rndc[r];-	}-}--/*- * Initialize a SHA-3 / SHAKE / cSHAKE context: hashlen is the security level- * (and half the capacity) in bits.- *- * In case of cSHAKE, the message prefix with encoded N and S must be added with- * cryptonite_sha3_update.- */-void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen)-{-	/* assert(hashlen >= SHA3_BITSIZE_MIN && hashlen <= SHA3_BITSIZE_MAX) */-	int bufsz = SHA3_BUF_SIZE(hashlen);-	memset(ctx, 0, sizeof(*ctx) + bufsz);-	ctx->bufsz = bufsz;-}--/* Update a SHA-3 / SHAKE / cSHAKE context */-void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t to_fill;--	to_fill = ctx->bufsz - ctx->bufindex;--	if (ctx->bufindex == ctx->bufsz) {-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);-		ctx->bufindex = 0;-	}--	/* process partial buffer if there's enough data to make a block */-	if (ctx->bufindex && len >= to_fill) {-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);-		len -= to_fill;-		data += to_fill;-		ctx->bufindex = 0;-	}--	if (need_alignment(data, 8)) {-		uint64_t tramp[SHA3_BUF_SIZE_MAX/8];-		ASSERT_ALIGNMENT(tramp, 8);-		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz) {-			memcpy(tramp, data, ctx->bufsz);-			sha3_do_chunk(ctx->state, tramp, ctx->bufsz / 8);-		}-	} else {-		/* process as much ctx->bufsz-block */-		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)-			sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);-	}---	/* append data into buf */-	if (len) {-		memcpy(ctx->buf + ctx->bufindex, data, len);-		ctx->bufindex += len;-	}-}--void cryptonite_sha3_finalize_with_pad_byte(struct sha3_ctx *ctx, uint8_t pad_byte)-{-	/* process full buffer if needed */-	if (ctx->bufindex == ctx->bufsz) {-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);-		ctx->bufindex = 0;-	}--	/* add the 10*1 padding */-	ctx->buf[ctx->bufindex++] = pad_byte;-	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);-	ctx->buf[ctx->bufsz - 1] |= 0x80;--	/* process */-	sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);-	ctx->bufindex = 0;-}--/*- * Extract some bytes from a finalized SHA-3 / SHAKE / cSHAKE context.- * May be called multiple times.- */-void cryptonite_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len)-{-	uint64_t w[25];-	uint8_t *wptr = (uint8_t *) w;-	uint32_t still_avail;--	still_avail = ctx->bufsz - ctx->bufindex;--	if (ctx->bufindex == ctx->bufsz) {-		/* squeeze the sponge again, without any input */-		sha3_do_chunk(ctx->state, NULL, 0);-		ctx->bufindex = 0;-	}--	/* use bytes already available if this block is fully consumed */-	if (ctx->bufindex && len >= still_avail) {-		cpu_to_le64_array(w, ctx->state, 25);-		memcpy(out, wptr + ctx->bufindex, still_avail);-		sha3_do_chunk(ctx->state, NULL, 0);-		len -= still_avail;-		out += still_avail;-		ctx->bufindex = 0;-	}--	/* output as much ctx->bufsz-block */-	for (; len > ctx->bufsz; len -= ctx->bufsz, out += ctx->bufsz) {-		cpu_to_le64_array(w, ctx->state, 25);-		memcpy(out, w, ctx->bufsz);-		sha3_do_chunk(ctx->state, NULL, 0);-	}--	/* output from partial buffer */-	if (len) {-		cpu_to_le64_array(w, ctx->state, 25);-		memcpy(out, wptr + ctx->bufindex, len);-		ctx->bufindex += len;-	}-}--/* Finalize a SHA-3 context and return the digest value */-void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x06);-	cryptonite_sha3_output(ctx, out, hashlen / 8);-}--/* Finalize a SHAKE context. Output is read using cryptonite_sha3_output. */-void cryptonite_sha3_finalize_shake(struct sha3_ctx *ctx)-{-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x1F);-}--/* Finalize a cSHAKE context. Output is read using cryptonite_sha3_output. */-void cryptonite_sha3_finalize_cshake(struct sha3_ctx *ctx)-{-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x04);-}--void cryptonite_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen)-{-	cryptonite_sha3_init(ctx, hashlen);-}--void cryptonite_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len)-{-	cryptonite_sha3_update(ctx, data, len);-}--void cryptonite_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	cryptonite_sha3_finalize_with_pad_byte(ctx, 1);-	cryptonite_sha3_output(ctx, out, hashlen / 8);-}
− cbits/cryptonite_sha3.h 
@@ -1,67 +0,0 @@-/*- * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SHA3_H-#define CRYPTOHASH_SHA3_H--#include <stdint.h>--struct sha3_ctx-{-	uint32_t bufindex;-	uint32_t bufsz;-	uint64_t state[25];-	uint8_t  buf[0]; /* maximum SHAKE128 is 168 bytes, otherwise buffer can be decreased */-};--#define SHA3_CTX_SIZE		sizeof(struct sha3_ctx)-#define SHA3_CTX_BUF_MAX_SIZE   (SHA3_CTX_SIZE + SHA3_BUF_SIZE_MAX)-#define SHA3_BITSIZE_MIN   	128-#define SHA3_BITSIZE_MAX    	512--#define SHA3_BUF_SIZE(bitsize)  (200 - 2 * ((bitsize) / 8))--#define SHA3_BUF_SIZE_MIN       SHA3_BUF_SIZE(SHA3_BITSIZE_MAX)-#define SHA3_BUF_SIZE_MAX       SHA3_BUF_SIZE(SHA3_BITSIZE_MIN)--/*- * buffer size:- *- * 128 bits (shake 128 bits) => 200 - 2 * (128 / 8) = 200 - 2*16 = 200 - 32  = 168 bytes- * 224 bits (SHA3 224 bits)  => 200 - 2 * (224 / 8) = 200 - 2*28 = 200 - 56  = 144 bytes- * 512 bits (SHA3 512 bits)  => 200 - 2 * (512 / 8) = 200 - 2*64 = 200 - 128 = 72 bytes- */--void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen);-void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);--void cryptonite_sha3_finalize_shake(struct sha3_ctx *ctx);-void cryptonite_sha3_finalize_cshake(struct sha3_ctx *ctx);-void cryptonite_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len);--void cryptonite_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen);-void cryptonite_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len);-void cryptonite_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_sha512.c 
@@ -1,307 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"-#include "cryptonite_sha512.h"--void cryptonite_sha384_init(struct sha512_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0xcbbb9d5dc1059ed8ULL;-	ctx->h[1] = 0x629a292a367cd507ULL;-	ctx->h[2] = 0x9159015a3070dd17ULL;-	ctx->h[3] = 0x152fecd8f70e5939ULL;-	ctx->h[4] = 0x67332667ffc00b31ULL;-	ctx->h[5] = 0x8eb44a8768581511ULL;-	ctx->h[6] = 0xdb0c2e0d64f98fa7ULL;-	ctx->h[7] = 0x47b5481dbefa4fa4ULL;-}--void cryptonite_sha512_init(struct sha512_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0x6a09e667f3bcc908ULL;-	ctx->h[1] = 0xbb67ae8584caa73bULL;-	ctx->h[2] = 0x3c6ef372fe94f82bULL;-	ctx->h[3] = 0xa54ff53a5f1d36f1ULL;-	ctx->h[4] = 0x510e527fade682d1ULL;-	ctx->h[5] = 0x9b05688c2b3e6c1fULL;-	ctx->h[6] = 0x1f83d9abfb41bd6bULL;-	ctx->h[7] = 0x5be0cd19137e2179ULL;-}--/* 232 times the cube root of the first 64 primes 2..311 */-static const uint64_t k[] = {-	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,-	0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,-	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,-	0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,-	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,-	0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,-	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,-	0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,-	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,-	0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,-	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,-	0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,-	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,-	0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,-	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,-	0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,-	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,-	0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,-	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,-	0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,-	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,-	0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,-	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,-	0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,-	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,-	0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,-	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,-};--#define e0(x)       (ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39))-#define e1(x)       (ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41))-#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))-#define s1(x)       (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6))--static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf)-{-	uint64_t a, b, c, d, e, f, g, h, t1, t2;-	int i;-	uint64_t w[80];--	cpu_to_be64_array(w, buf, 16);--	for (i = 16; i < 80; i++)-		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];--	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];-	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];--#define R(a, b, c, d, e, f, g, h, k, w)			\-	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w;	\-	t2 = e0(a) + ((a & b) | (c & (a | b)));		\-	d += t1;					\-	h = t1 + t2--	for (i = 0; i < 80; i += 8) {-		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);-		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);-		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);-		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);-		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);-		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);-		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);-		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);-	}--#undef R--	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;-	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;-}--void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len)-{-	return cryptonite_sha512_update(ctx, data, len);-}--void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)-{-	unsigned int index, to_fill;--	/* check for partial buffer */-	index = (unsigned int) (ctx->sz[0] & 0x7f);-	to_fill = 128 - index;--	ctx->sz[0] += len;-	if (ctx->sz[0] < len)-		ctx->sz[1]++;--	/* process partial buffer if there's enough data to make a block */-	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		sha512_do_chunk(ctx, (uint64_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 8)) {-		uint64_t tramp[16];-		ASSERT_ALIGNMENT(tramp, 8);-		for (; len >= 128; len -= 128, data += 128) {-			memcpy(tramp, data, 128);-			sha512_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 128-block as possible */-		for (; len >= 128; len -= 128, data += 128)-			sha512_do_chunk(ctx, (uint64_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out)-{-	uint8_t intermediate[SHA512_DIGEST_SIZE];--	cryptonite_sha512_finalize(ctx, intermediate);-	memcpy(out, intermediate, SHA384_DIGEST_SIZE);-}--void cryptonite_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)-{-	uint8_t intermediate[SHA512_DIGEST_SIZE];--	cryptonite_sha512_finalize_prefix(ctx, data, len, n, intermediate);-	memcpy(out, intermediate, SHA384_DIGEST_SIZE);-}--void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[128] = { 0x80, };-	uint32_t i, index, padlen;-	uint64_t bits[2];--	/* cpu -> big endian */-	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));-	bits[1] = cpu_to_be64((ctx->sz[0] << 3));--	/* pad out to 56 */-	index = (unsigned int) (ctx->sz[0] & 0x7f);-	padlen = (index < 112) ? (112 - index) : ((128 + 112) - index);-	cryptonite_sha512_update(ctx, padding, padlen);--	/* append length */-	cryptonite_sha512_update(ctx, (uint8_t *) bits, sizeof(bits));--	/* store to digest */-	for (i = 0; i < 8; i++)-		store_be64(out+8*i, ctx->h[i]);-}--#define HASHED(m) SHA512_##m-#define HASHED_LOWER(m) sha512_##m-#define CRYPTONITE_HASHED(m) cryptonite_sha512_##m-#define SHA512_BLOCK_SIZE 128-#define SHA512_BITS_ELEMS 2--#include <cryptonite_hash_prefix.h>--static inline uint32_t cryptonite_sha512_get_index(const struct sha512_ctx *ctx)-{-	return (uint32_t) (ctx->sz[0] & 0x7f);-}--static inline void cryptonite_sha512_incr_sz(struct sha512_ctx *ctx, uint64_t *bits, uint32_t n)-{-	ctx->sz[0] += n;-	ctx->sz[1] += 1 & constant_time_lt_64(ctx->sz[0], n);-	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));-	bits[1] = cpu_to_be64((ctx->sz[0] << 3));-}--static inline void cryptonite_sha512_select_digest(const struct sha512_ctx *ctx, uint8_t *out, uint32_t out_mask)-{-	uint32_t i;-	uint64_t out_mask_64 = out_mask;-	out_mask_64 |= out_mask_64 << 32;-	for (i = 0; i < 8; i++)-		xor_be64(out+8*i, ctx->h[i] & out_mask_64);-}--#include <cryptonite_hash_prefix.c>--#include <stdio.h>--void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen)-{-	memset(ctx, 0, sizeof(*ctx));-	if (hashlen >= 512)-		return;-	switch (hashlen) {-	case 224:-		ctx->h[0] = 0x8c3d37c819544da2ULL;-		ctx->h[1] = 0x73e1996689dcd4d6ULL;-		ctx->h[2] = 0x1dfab7ae32ff9c82ULL;-		ctx->h[3] = 0x679dd514582f9fcfULL;-		ctx->h[4] = 0x0f6d2b697bd44da8ULL;-		ctx->h[5] = 0x77e36f7304c48942ULL;-		ctx->h[6] = 0x3f9d85a86a1d36c8ULL;-		ctx->h[7] = 0x1112e6ad91d692a1ULL;-		break;-	case 256:-		ctx->h[0] = 0x22312194fc2bf72cULL;-		ctx->h[1] = 0x9f555fa3c84c64c2ULL;-		ctx->h[2] = 0x2393b86b6f53b151ULL;-		ctx->h[3] = 0x963877195940eabdULL;-		ctx->h[4] = 0x96283ee2a88effe3ULL;-		ctx->h[5] = 0xbe5e1e2553863992ULL;-		ctx->h[6] = 0x2b0199fc2c85b8aaULL;-		ctx->h[7] = 0x0eb72ddc81c52ca2ULL;-		break;-	default: {-		char buf[8+4];-		uint8_t out[64];-		int i;--		cryptonite_sha512_init(ctx);-		for (i = 0; i < 8; i++)-			ctx->h[i] ^= 0xa5a5a5a5a5a5a5a5ULL;--		i = sprintf(buf, "SHA-512/%d", hashlen);-		cryptonite_sha512_update(ctx, (uint8_t *) buf, i);-		cryptonite_sha512_finalize(ctx, out);--		/* re-init the context, otherwise len is changed */-		memset(ctx, 0, sizeof(*ctx));-		for (i = 0; i < 8; i++)-			ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]);-		}-	}-}--void cryptonite_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)-{-	return cryptonite_sha512_update(ctx, data, len);-}--void cryptonite_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	uint8_t intermediate[SHA512_DIGEST_SIZE];--	cryptonite_sha512_finalize(ctx, intermediate);-	memcpy(out, intermediate, hashlen / 8);-}-
− cbits/cryptonite_sha512.h 
@@ -1,61 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SHA512_H-#define CRYPTOHASH_SHA512_H--#include <stdint.h>--# define SHA512_BLOCK_SIZE 128--struct sha512_ctx-{-	uint64_t sz[2];-	uint8_t  buf[SHA512_BLOCK_SIZE];-	uint64_t h[8];-};--#define sha384_ctx sha512_ctx--#define SHA384_DIGEST_SIZE	48-#define SHA384_CTX_SIZE		sizeof(struct sha384_ctx)--#define SHA512_DIGEST_SIZE	64-#define SHA512_CTX_SIZE		sizeof(struct sha512_ctx)--void cryptonite_sha384_init(struct sha384_ctx *ctx);-void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out);-void cryptonite_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--void cryptonite_sha512_init(struct sha512_ctx *ctx);-void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out);-void cryptonite_sha512_finalize_prefix(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);--/* only multiples of 8 are supported as valid t values */-void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen);-void cryptonite_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_skein.h 
@@ -1,46 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SKEIN_H-#define CRYPTOHASH_SKEIN_H--#define SKEIN_VERSION 1ULL-#define SKEIN_IDSTRING 0x33414853ULL--/*-t0 0-63 || t1 64-127-0-95      96-111      112-118    119     120-125  126    127-Position  reserved    TreeLevel  BitPad  Type     First  Final-*/-#define FLAG_FIRST   (1ULL << 62)-#define FLAG_FINAL   (1ULL << 63)-#define FLAG_TYPE(x) (((uint64_t) ((x) & 0x3f)) << 56)--#define TYPE_KEY     0x00-#define TYPE_CFG     0x04-#define TYPE_MSG     0x30-#define TYPE_OUT     0x3f--#define SET_TYPE(ctx, ty) ctx->t0 = 0; ctx->t1 = (ty)--#endif
− cbits/cryptonite_skein256.c 
@@ -1,204 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_skein.h"-#include "cryptonite_skein256.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--static const uint8_t K256_0[2] = { 14, 16, };-static const uint8_t K256_1[2] = { 52, 57, };-static const uint8_t K256_2[2] = { 23, 40, };-static const uint8_t K256_3[2] = {  5, 37, };-static const uint8_t K256_4[2] = { 25, 33, };-static const uint8_t K256_5[2] = { 46, 12, };-static const uint8_t K256_6[2] = { 58, 22, };-static const uint8_t K256_7[2] = { 32, 32, };--static inline void skein256_do_chunk(struct skein256_ctx *ctx, uint64_t *buf, uint32_t len)-{-	uint64_t x[4];-	uint64_t ts[3];-	uint64_t ks[4+1];--	ks[4] = 0x1bd11bdaa9fc1a22ULL;-	ks[0] = ctx->h[0]; ks[4] ^= ctx->h[0];-	ks[1] = ctx->h[1]; ks[4] ^= ctx->h[1];-	ks[2] = ctx->h[2]; ks[4] ^= ctx->h[2];-	ks[3] = ctx->h[3]; ks[4] ^= ctx->h[3];--	ts[0] = ctx->t0;-	ts[1] = ctx->t1;--	ts[0] += len;--	ts[2] = ts[0] ^ ts[1];--#define INJECTKEY(r) \-	x[0] += ks[((r)+0) % (4+1)];                   \-	x[1] += ks[((r)+1) % (4+1)] + ts[((r)+0) % 3]; \-	x[2] += ks[((r)+2) % (4+1)] + ts[((r)+1) % 3]; \-	x[3] += ks[((r)+3) % (4+1)] + (r)--#define ROUND(a,b,c,d,k) \-	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \-	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c];--#define PASS(i) \-	ROUND(0,1,2,3,K256_0); \-	ROUND(0,3,2,1,K256_1); \-	ROUND(0,1,2,3,K256_2); \-	ROUND(0,3,2,1,K256_3); \-	INJECTKEY((i*2) + 1);          \-	ROUND(0,1,2,3,K256_4); \-	ROUND(0,3,2,1,K256_5); \-	ROUND(0,1,2,3,K256_6); \-	ROUND(0,3,2,1,K256_7); \-	INJECTKEY((i*2) + 2)--	x[0] = le64_to_cpu(buf[0]) + ks[0];-	x[1] = le64_to_cpu(buf[1]) + ks[1] + ts[0];-	x[2] = le64_to_cpu(buf[2]) + ks[2] + ts[1];-	x[3] = le64_to_cpu(buf[3]) + ks[3];--	/* 9 pass of 8 rounds = 72 rounds */-	PASS(0);-	PASS(1);-	PASS(2);-	PASS(3);-	PASS(4);-	PASS(5);-	PASS(6);-	PASS(7);-	PASS(8);--	ts[1] &= ~FLAG_FIRST;-	ctx->t0 = ts[0];-	ctx->t1 = ts[1];--	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);-        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);-        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);-        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);-}--void cryptonite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen)-{-	uint64_t buf[4];-	memset(ctx, 0, sizeof(*ctx));--	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));-	-	memset(buf, '\0', sizeof(buf));-	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);-	buf[1] = cpu_to_le64(hashlen);-	buf[2] = 0; /* tree info, not implemented */-	skein256_do_chunk(ctx, buf, 4*8);--	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));-}--void cryptonite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t to_fill;--	if (!len)-		return;--	to_fill = 32 - ctx->bufindex;--	if (ctx->bufindex == 32) {-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);-		ctx->bufindex = 0;-	}--	/* process partial buffer if there's enough data to make a block-	 * and there's without doubt further blocks */-	if (ctx->bufindex && len > to_fill) {-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);-		len -= to_fill;-		data += to_fill;-		ctx->bufindex = 0;-	}--	if (need_alignment(data, 8)) {-		uint64_t tramp[4];-		ASSERT_ALIGNMENT(tramp, 8);-		for (; len > 32; len -= 32, data += 32) {-			memcpy(tramp, data, 32);-			skein256_do_chunk(ctx, tramp, 32);-		}-	} else {-		/* process as much 32-block as possible except the last one in case we finalize */-		for (; len > 32; len -= 32, data += 32)-			skein256_do_chunk(ctx, (uint64_t *) data, 32);-	}--	/* append data into buf */-	if (len) {-		memcpy(ctx->buf + ctx->bufindex, data, len);-		ctx->bufindex += len;-	}-}--void cryptonite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	uint32_t outsize;-	uint64_t x[4];-	int i, j, n;--	ctx->t1 |= FLAG_FINAL;-	/* if buf is not complete pad with 0 bytes */-	if (ctx->bufindex < 32)-		memset(ctx->buf + ctx->bufindex, '\0', 32 - ctx->bufindex);-	skein256_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);--	memset(ctx->buf, '\0', 32);--	/* make sure we have a 8 bit up rounded value */-	outsize = (hashlen + 7) >> 3;--	/* backup h[0--4] */-	for (j = 0; j < 4; j++)-		x[j] = ctx->h[j];-	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */-	for (i = 0; i*32 < outsize; i++) {-		uint64_t w[4];-		*((uint64_t *) ctx->buf) = cpu_to_le64(i);-		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));--		n = outsize - i * 32;-		if (n >= 32) n = 32;--		cpu_to_le64_array(w, ctx->h, 4);-		memcpy(out + i*32, w, n);--		/* restore h[0--4] */-		for (j = 0; j < 4; j++)-			ctx->h[j] = x[j];-	}-}
− cbits/cryptonite_skein256.h 
@@ -1,44 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SKEIN256_H-#define CRYPTOHASH_SKEIN256_H--#include <stdint.h>--struct skein256_ctx-{-	uint8_t  buf[32];-	uint64_t h[4];-	uint64_t t0;-	uint64_t t1;-	uint32_t bufindex;-};--#define SKEIN256_CTX_SIZE		sizeof(struct skein256_ctx)--void cryponite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen);-void cryponite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len);-void cryponite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_skein512.c 
@@ -1,222 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_skein.h"-#include "cryptonite_skein512.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--static const uint8_t K512_0[4] = { 46, 36, 19, 37, };-static const uint8_t K512_1[4] = { 33, 27, 14, 42, };-static const uint8_t K512_2[4] = { 17, 49, 36, 39, };-static const uint8_t K512_3[4] = { 44,  9, 54, 56, };-static const uint8_t K512_4[4] = { 39, 30, 34, 24, };-static const uint8_t K512_5[4] = { 13, 50, 10, 17, };-static const uint8_t K512_6[4] = { 25, 29, 39, 43, };-static const uint8_t K512_7[4] = {  8, 35, 56, 22, };--static inline void skein512_do_chunk(struct skein512_ctx *ctx, uint64_t *buf, uint32_t len)-{-	uint64_t x[8];-	uint64_t ts[3];-	uint64_t ks[8+1];--	ks[8] = 0x1bd11bdaa9fc1a22ULL;-	ks[0] = ctx->h[0]; ks[8] ^= ctx->h[0];-	ks[1] = ctx->h[1]; ks[8] ^= ctx->h[1];-	ks[2] = ctx->h[2]; ks[8] ^= ctx->h[2];-	ks[3] = ctx->h[3]; ks[8] ^= ctx->h[3];-	ks[4] = ctx->h[4]; ks[8] ^= ctx->h[4];-	ks[5] = ctx->h[5]; ks[8] ^= ctx->h[5];-	ks[6] = ctx->h[6]; ks[8] ^= ctx->h[6];-	ks[7] = ctx->h[7]; ks[8] ^= ctx->h[7];--	ts[0] = ctx->t0;-	ts[1] = ctx->t1;--	ts[0] += len;--	ts[2] = ts[0] ^ ts[1];--#define INJECTKEY(r) \-	x[0] += ks[((r)+0) % (8+1)];                   \-	x[1] += ks[((r)+1) % (8+1)];                   \-	x[2] += ks[((r)+2) % (8+1)];                   \-	x[3] += ks[((r)+3) % (8+1)];                   \-	x[4] += ks[((r)+4) % (8+1)];                   \-	x[5] += ks[((r)+5) % (8+1)] + ts[((r)+0) % 3]; \-	x[6] += ks[((r)+6) % (8+1)] + ts[((r)+1) % 3]; \-	x[7] += ks[((r)+7) % (8+1)] + (r)--#define ROUND(a,b,c,d,e,f,g,h,k) \-	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \-	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c]; \-	x[e] += x[f]; x[f] = rol64(x[f],k[2]); x[f] ^= x[e]; \-	x[g] += x[h]; x[h] = rol64(x[h],k[3]); x[h] ^= x[g];--#define PASS(i) \-	ROUND(0,1,2,3,4,5,6,7,K512_0); \-	ROUND(2,1,4,7,6,5,0,3,K512_1); \-	ROUND(4,1,6,3,0,5,2,7,K512_2); \-	ROUND(6,1,0,7,2,5,4,3,K512_3); \-	INJECTKEY((i*2) + 1);          \-	ROUND(0,1,2,3,4,5,6,7,K512_4); \-	ROUND(2,1,4,7,6,5,0,3,K512_5); \-	ROUND(4,1,6,3,0,5,2,7,K512_6); \-	ROUND(6,1,0,7,2,5,4,3,K512_7); \-	INJECTKEY((i*2) + 2)--	x[0] = le64_to_cpu(buf[0]) + ks[0];-	x[1] = le64_to_cpu(buf[1]) + ks[1];-	x[2] = le64_to_cpu(buf[2]) + ks[2];-	x[3] = le64_to_cpu(buf[3]) + ks[3];-	x[4] = le64_to_cpu(buf[4]) + ks[4];-	x[5] = le64_to_cpu(buf[5]) + ks[5] + ts[0];-	x[6] = le64_to_cpu(buf[6]) + ks[6] + ts[1];-	x[7] = le64_to_cpu(buf[7]) + ks[7];--	/* 9 pass of 8 rounds = 72 rounds */-	PASS(0);-	PASS(1);-	PASS(2);-	PASS(3);-	PASS(4);-	PASS(5);-	PASS(6);-	PASS(7);-	PASS(8);--	ts[1] &= ~FLAG_FIRST;-	ctx->t0 = ts[0];-	ctx->t1 = ts[1];--	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);-        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);-        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);-        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);-        ctx->h[4] = x[4] ^ cpu_to_le64(buf[4]);-        ctx->h[5] = x[5] ^ cpu_to_le64(buf[5]);-        ctx->h[6] = x[6] ^ cpu_to_le64(buf[6]);-        ctx->h[7] = x[7] ^ cpu_to_le64(buf[7]);-}--void cryptonite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen)-{-	uint64_t buf[8];-	memset(ctx, 0, sizeof(*ctx));--	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));-	-	memset(buf, '\0', sizeof(buf));-	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);-	buf[1] = cpu_to_le64(hashlen);-	buf[2] = 0; /* tree info, not implemented */-	skein512_do_chunk(ctx, buf, 4*8);--	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));-}--void cryptonite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t to_fill;--	if (!len)-		return;--	to_fill = 64 - ctx->bufindex;--	if (ctx->bufindex == 64) {-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);-		ctx->bufindex = 0;-	}--	/* process partial buffer if there's enough data to make a block-	 * and there's without doubt further blocks */-	if (ctx->bufindex && len > to_fill) {-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);-		len -= to_fill;-		data += to_fill;-		ctx->bufindex = 0;-	}--	if (need_alignment(data, 8)) {-		uint64_t tramp[8];-		ASSERT_ALIGNMENT(tramp, 8);-		for (; len > 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			skein512_do_chunk(ctx, tramp, 64);-		}-	} else {-		/* process as much 64-block as possible except the last one in case we finalize */-		for (; len > 64; len -= 64, data += 64)-			skein512_do_chunk(ctx, (uint64_t *) data, 64);-	}--	/* append data into buf */-	if (len) {-		memcpy(ctx->buf + ctx->bufindex, data, len);-		ctx->bufindex += len;-	}-}--void cryptonite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out)-{-	uint32_t outsize;-	uint64_t x[8];-	int i, j, n;--	ctx->t1 |= FLAG_FINAL;-	/* if buf is not complete pad with 0 bytes */-	if (ctx->bufindex < 64)-		memset(ctx->buf + ctx->bufindex, '\0', 64 - ctx->bufindex);-	skein512_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);--	memset(ctx->buf, '\0', 64);--	/* make sure we have a 8 bit rounded value */-	outsize = (hashlen + 7) >> 3;--	/* backup h[0--7] */-	for (j = 0; j < 8; j++)-		x[j] = ctx->h[j];-	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */-	for (i = 0; i*64 < outsize; i++) {-		uint64_t w[8];-		*((uint64_t *) ctx->buf) = cpu_to_le64(i);-		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));--		n = outsize - i * 64;-		if (n >= 64) n = 64;--		cpu_to_le64_array(w, ctx->h, 8);-		memcpy(out + i*64, w, n);--		/* restore h[0--7] */-		for (j = 0; j < 8; j++)-			ctx->h[j] = x[j];-	}-}
− cbits/cryptonite_skein512.h 
@@ -1,44 +0,0 @@-/*- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_SKEIN512_H-#define CRYPTOHASH_SKEIN512_H--#include <stdint.h>--struct skein512_ctx-{-	uint8_t  buf[64];-	uint64_t h[8];-	uint64_t t0;-	uint64_t t1;-	uint32_t bufindex;-};--#define SKEIN512_CTX_SIZE		sizeof(struct skein512_ctx)--void cryponite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen);-void cryponite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len);-void cryponite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out);--#endif
− cbits/cryptonite_tiger.c 
@@ -1,424 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */--#include <string.h>-#include "cryptonite_tiger.h"-#include "cryptonite_bitfn.h"-#include "cryptonite_align.h"--static const uint64_t t1[256] = {-	0x02aab17cf7e90c5eULL,0xac424b03e243a8ecULL,0x72cd5be30dd5fcd3ULL,0x6d019b93f6f97f3aULL,-	0xcd9978ffd21f9193ULL,0x7573a1c9708029e2ULL,0xb164326b922a83c3ULL,0x46883eee04915870ULL,-	0xeaace3057103ece6ULL,0xc54169b808a3535cULL,0x4ce754918ddec47cULL,0x0aa2f4dfdc0df40cULL,-	0x10b76f18a74dbefaULL,0xc6ccb6235ad1ab6aULL,0x13726121572fe2ffULL,0x1a488c6f199d921eULL,-	0x4bc9f9f4da0007caULL,0x26f5e6f6e85241c7ULL,0x859079dbea5947b6ULL,0x4f1885c5c99e8c92ULL,-	0xd78e761ea96f864bULL,0x8e36428c52b5c17dULL,0x69cf6827373063c1ULL,0xb607c93d9bb4c56eULL,-	0x7d820e760e76b5eaULL,0x645c9cc6f07fdc42ULL,0xbf38a078243342e0ULL,0x5f6b343c9d2e7d04ULL,-	0xf2c28aeb600b0ec6ULL,0x6c0ed85f7254bcacULL,0x71592281a4db4fe5ULL,0x1967fa69ce0fed9fULL,-	0xfd5293f8b96545dbULL,0xc879e9d7f2a7600bULL,0x860248920193194eULL,0xa4f9533b2d9cc0b3ULL,-	0x9053836c15957613ULL,0xdb6dcf8afc357bf1ULL,0x18beea7a7a370f57ULL,0x037117ca50b99066ULL,-	0x6ab30a9774424a35ULL,0xf4e92f02e325249bULL,0x7739db07061ccae1ULL,0xd8f3b49ceca42a05ULL,-	0xbd56be3f51382f73ULL,0x45faed5843b0bb28ULL,0x1c813d5c11bf1f83ULL,0x8af0e4b6d75fa169ULL,-	0x33ee18a487ad9999ULL,0x3c26e8eab1c94410ULL,0xb510102bc0a822f9ULL,0x141eef310ce6123bULL,-	0xfc65b90059ddb154ULL,0xe0158640c5e0e607ULL,0x884e079826c3a3cfULL,0x930d0d9523c535fdULL,-	0x35638d754e9a2b00ULL,0x4085fccf40469dd5ULL,0xc4b17ad28be23a4cULL,0xcab2f0fc6a3e6a2eULL,-	0x2860971a6b943fcdULL,0x3dde6ee212e30446ULL,0x6222f32ae01765aeULL,0x5d550bb5478308feULL,-	0xa9efa98da0eda22aULL,0xc351a71686c40da7ULL,0x1105586d9c867c84ULL,0xdcffee85fda22853ULL,-	0xccfbd0262c5eef76ULL,0xbaf294cb8990d201ULL,0xe69464f52afad975ULL,0x94b013afdf133e14ULL,-	0x06a7d1a32823c958ULL,0x6f95fe5130f61119ULL,0xd92ab34e462c06c0ULL,0xed7bde33887c71d2ULL,-	0x79746d6e6518393eULL,0x5ba419385d713329ULL,0x7c1ba6b948a97564ULL,0x31987c197bfdac67ULL,-	0xde6c23c44b053d02ULL,0x581c49fed002d64dULL,0xdd474d6338261571ULL,0xaa4546c3e473d062ULL,-	0x928fce349455f860ULL,0x48161bbacaab94d9ULL,0x63912430770e6f68ULL,0x6ec8a5e602c6641cULL,-	0x87282515337ddd2bULL,0x2cda6b42034b701bULL,0xb03d37c181cb096dULL,0xe108438266c71c6fULL,-	0x2b3180c7eb51b255ULL,0xdf92b82f96c08bbcULL,0x5c68c8c0a632f3baULL,0x5504cc861c3d0556ULL,-	0xabbfa4e55fb26b8fULL,0x41848b0ab3baceb4ULL,0xb334a273aa445d32ULL,0xbca696f0a85ad881ULL,-	0x24f6ec65b528d56cULL,0x0ce1512e90f4524aULL,0x4e9dd79d5506d35aULL,0x258905fac6ce9779ULL,-	0x2019295b3e109b33ULL,0xf8a9478b73a054ccULL,0x2924f2f934417eb0ULL,0x3993357d536d1bc4ULL,-	0x38a81ac21db6ff8bULL,0x47c4fbf17d6016bfULL,0x1e0faadd7667e3f5ULL,0x7abcff62938beb96ULL,-	0xa78dad948fc179c9ULL,0x8f1f98b72911e50dULL,0x61e48eae27121a91ULL,0x4d62f7ad31859808ULL,-	0xeceba345ef5ceaebULL,0xf5ceb25ebc9684ceULL,0xf633e20cb7f76221ULL,0xa32cdf06ab8293e4ULL,-	0x985a202ca5ee2ca4ULL,0xcf0b8447cc8a8fb1ULL,0x9f765244979859a3ULL,0xa8d516b1a1240017ULL,-	0x0bd7ba3ebb5dc726ULL,0xe54bca55b86adb39ULL,0x1d7a3afd6c478063ULL,0x519ec608e7669eddULL,-	0x0e5715a2d149aa23ULL,0x177d4571848ff194ULL,0xeeb55f3241014c22ULL,0x0f5e5ca13a6e2ec2ULL,-	0x8029927b75f5c361ULL,0xad139fabc3d6e436ULL,0x0d5df1a94ccf402fULL,0x3e8bd948bea5dfc8ULL,-	0xa5a0d357bd3ff77eULL,0xa2d12e251f74f645ULL,0x66fd9e525e81a082ULL,0x2e0c90ce7f687a49ULL,-	0xc2e8bcbeba973bc5ULL,0x000001bce509745fULL,0x423777bbe6dab3d6ULL,0xd1661c7eaef06eb5ULL,-	0xa1781f354daacfd8ULL,0x2d11284a2b16affcULL,0xf1fc4f67fa891d1fULL,0x73ecc25dcb920adaULL,-	0xae610c22c2a12651ULL,0x96e0a810d356b78aULL,0x5a9a381f2fe7870fULL,0xd5ad62ede94e5530ULL,-	0xd225e5e8368d1427ULL,0x65977b70c7af4631ULL,0x99f889b2de39d74fULL,0x233f30bf54e1d143ULL,-	0x9a9675d3d9a63c97ULL,0x5470554ff334f9a8ULL,0x166acb744a4f5688ULL,0x70c74caab2e4aeadULL,-	0xf0d091646f294d12ULL,0x57b82a89684031d1ULL,0xefd95a5a61be0b6bULL,0x2fbd12e969f2f29aULL,-	0x9bd37013feff9fe8ULL,0x3f9b0404d6085a06ULL,0x4940c1f3166cfe15ULL,0x09542c4dcdf3defbULL,-	0xb4c5218385cd5ce3ULL,0xc935b7dc4462a641ULL,0x3417f8a68ed3b63fULL,0xb80959295b215b40ULL,-	0xf99cdaef3b8c8572ULL,0x018c0614f8fcb95dULL,0x1b14accd1a3acdf3ULL,0x84d471f200bb732dULL,-	0xc1a3110e95e8da16ULL,0x430a7220bf1a82b8ULL,0xb77e090d39df210eULL,0x5ef4bd9f3cd05e9dULL,-	0x9d4ff6da7e57a444ULL,0xda1d60e183d4a5f8ULL,0xb287c38417998e47ULL,0xfe3edc121bb31886ULL,-	0xc7fe3ccc980ccbefULL,0xe46fb590189bfd03ULL,0x3732fd469a4c57dcULL,0x7ef700a07cf1ad65ULL,-	0x59c64468a31d8859ULL,0x762fb0b4d45b61f6ULL,0x155baed099047718ULL,0x68755e4c3d50baa6ULL,-	0xe9214e7f22d8b4dfULL,0x2addbf532eac95f4ULL,0x32ae3909b4bd0109ULL,0x834df537b08e3450ULL,-	0xfa209da84220728dULL,0x9e691d9b9efe23f7ULL,0x0446d288c4ae8d7fULL,0x7b4cc524e169785bULL,-	0x21d87f0135ca1385ULL,0xcebb400f137b8aa5ULL,0x272e2b66580796beULL,0x3612264125c2b0deULL,-	0x057702bdad1efbb2ULL,0xd4babb8eacf84be9ULL,0x91583139641bc67bULL,0x8bdc2de08036e024ULL,-	0x603c8156f49f68edULL,0xf7d236f7dbef5111ULL,0x9727c4598ad21e80ULL,0xa08a0896670a5fd7ULL,-	0xcb4a8f4309eba9cbULL,0x81af564b0f7036a1ULL,0xc0b99aa778199abdULL,0x959f1ec83fc8e952ULL,-	0x8c505077794a81b9ULL,0x3acaaf8f056338f0ULL,0x07b43f50627a6778ULL,0x4a44ab49f5eccc77ULL,-	0x3bc3d6e4b679ee98ULL,0x9cc0d4d1cf14108cULL,0x4406c00b206bc8a0ULL,0x82a18854c8d72d89ULL,-	0x67e366b35c3c432cULL,0xb923dd61102b37f2ULL,0x56ab2779d884271dULL,0xbe83e1b0ff1525afULL,-	0xfb7c65d4217e49a9ULL,0x6bdbe0e76d48e7d4ULL,0x08df828745d9179eULL,0x22ea6a9add53bd34ULL,-	0xe36e141c5622200aULL,0x7f805d1b8cb750eeULL,0xafe5c7a59f58e837ULL,0xe27f996a4fb1c23cULL,-	0xd3867dfb0775f0d0ULL,0xd0e673de6e88891aULL,0x123aeb9eafb86c25ULL,0x30f1d5d5c145b895ULL,-	0xbb434a2dee7269e7ULL,0x78cb67ecf931fa38ULL,0xf33b0372323bbf9cULL,0x52d66336fb279c74ULL,-	0x505f33ac0afb4eaaULL,0xe8a5cd99a2cce187ULL,0x534974801e2d30bbULL,0x8d2d5711d5876d90ULL,-	0x1f1a412891bc038eULL,0xd6e2e71d82e56648ULL,0x74036c3a497732b7ULL,0x89b67ed96361f5abULL,-	0xffed95d8f1ea02a2ULL,0xe72b3bd61464d43dULL,0xa6300f170bdc4820ULL,0xebc18760ed78a77aULL,-};--static const uint64_t t2[256] =-{-	0xe6a6be5a05a12138ULL,0xb5a122a5b4f87c98ULL,0x563c6089140b6990ULL,0x4c46cb2e391f5dd5ULL,-	0xd932addbc9b79434ULL,0x08ea70e42015aff5ULL,0xd765a6673e478cf1ULL,0xc4fb757eab278d99ULL,-	0xdf11c6862d6e0692ULL,0xddeb84f10d7f3b16ULL,0x6f2ef604a665ea04ULL,0x4a8e0f0ff0e0dfb3ULL,-	0xa5edeef83dbcba51ULL,0xfc4f0a2a0ea4371eULL,0xe83e1da85cb38429ULL,0xdc8ff882ba1b1ce2ULL,-	0xcd45505e8353e80dULL,0x18d19a00d4db0717ULL,0x34a0cfeda5f38101ULL,0x0be77e518887caf2ULL,-	0x1e341438b3c45136ULL,0xe05797f49089ccf9ULL,0xffd23f9df2591d14ULL,0x543dda228595c5cdULL,-	0x661f81fd99052a33ULL,0x8736e641db0f7b76ULL,0x15227725418e5307ULL,0xe25f7f46162eb2faULL,-	0x48a8b2126c13d9feULL,0xafdc541792e76eeaULL,0x03d912bfc6d1898fULL,0x31b1aafa1b83f51bULL,-	0xf1ac2796e42ab7d9ULL,0x40a3a7d7fcd2ebacULL,0x1056136d0afbbcc5ULL,0x7889e1dd9a6d0c85ULL,-	0xd33525782a7974aaULL,0xa7e25d09078ac09bULL,0xbd4138b3eac6edd0ULL,0x920abfbe71eb9e70ULL,-	0xa2a5d0f54fc2625cULL,0xc054e36b0b1290a3ULL,0xf6dd59ff62fe932bULL,0x3537354511a8ac7dULL,-	0xca845e9172fadcd4ULL,0x84f82b60329d20dcULL,0x79c62ce1cd672f18ULL,0x8b09a2add124642cULL,-	0xd0c1e96a19d9e726ULL,0x5a786a9b4ba9500cULL,0x0e020336634c43f3ULL,0xc17b474aeb66d822ULL,-	0x6a731ae3ec9baac2ULL,0x8226667ae0840258ULL,0x67d4567691caeca5ULL,0x1d94155c4875adb5ULL,-	0x6d00fd985b813fdfULL,0x51286efcb774cd06ULL,0x5e8834471fa744afULL,0xf72ca0aee761ae2eULL,-	0xbe40e4cdaee8e09aULL,0xe9970bbb5118f665ULL,0x726e4beb33df1964ULL,0x703b000729199762ULL,-	0x4631d816f5ef30a7ULL,0xb880b5b51504a6beULL,0x641793c37ed84b6cULL,0x7b21ed77f6e97d96ULL,-	0x776306312ef96b73ULL,0xae528948e86ff3f4ULL,0x53dbd7f286a3f8f8ULL,0x16cadce74cfc1063ULL,-	0x005c19bdfa52c6ddULL,0x68868f5d64d46ad3ULL,0x3a9d512ccf1e186aULL,0x367e62c2385660aeULL,-	0xe359e7ea77dcb1d7ULL,0x526c0773749abe6eULL,0x735ae5f9d09f734bULL,0x493fc7cc8a558ba8ULL,-	0xb0b9c1533041ab45ULL,0x321958ba470a59bdULL,0x852db00b5f46c393ULL,0x91209b2bd336b0e5ULL,-	0x6e604f7d659ef19fULL,0xb99a8ae2782ccb24ULL,0xccf52ab6c814c4c7ULL,0x4727d9afbe11727bULL,-	0x7e950d0c0121b34dULL,0x756f435670ad471fULL,0xf5add442615a6849ULL,0x4e87e09980b9957aULL,-	0x2acfa1df50aee355ULL,0xd898263afd2fd556ULL,0xc8f4924dd80c8fd6ULL,0xcf99ca3d754a173aULL,-	0xfe477bacaf91bf3cULL,0xed5371f6d690c12dULL,0x831a5c285e687094ULL,0xc5d3c90a3708a0a4ULL,-	0x0f7f903717d06580ULL,0x19f9bb13b8fdf27fULL,0xb1bd6f1b4d502843ULL,0x1c761ba38fff4012ULL,-	0x0d1530c4e2e21f3bULL,0x8943ce69a7372c8aULL,0xe5184e11feb5ce66ULL,0x618bdb80bd736621ULL,-	0x7d29bad68b574d0bULL,0x81bb613e25e6fe5bULL,0x071c9c10bc07913fULL,0xc7beeb7909ac2d97ULL,-	0xc3e58d353bc5d757ULL,0xeb017892f38f61e8ULL,0xd4effb9c9b1cc21aULL,0x99727d26f494f7abULL,-	0xa3e063a2956b3e03ULL,0x9d4a8b9a4aa09c30ULL,0x3f6ab7d500090fb4ULL,0x9cc0f2a057268ac0ULL,-	0x3dee9d2dedbf42d1ULL,0x330f49c87960a972ULL,0xc6b2720287421b41ULL,0x0ac59ec07c00369cULL,-	0xef4eac49cb353425ULL,0xf450244eef0129d8ULL,0x8acc46e5caf4deb6ULL,0x2ffeab63989263f7ULL,-	0x8f7cb9fe5d7a4578ULL,0x5bd8f7644e634635ULL,0x427a7315bf2dc900ULL,0x17d0c4aa2125261cULL,-	0x3992486c93518e50ULL,0xb4cbfee0a2d7d4c3ULL,0x7c75d6202c5ddd8dULL,0xdbc295d8e35b6c61ULL,-	0x60b369d302032b19ULL,0xce42685fdce44132ULL,0x06f3ddb9ddf65610ULL,0x8ea4d21db5e148f0ULL,-	0x20b0fce62fcd496fULL,0x2c1b912358b0ee31ULL,0xb28317b818f5a308ULL,0xa89c1e189ca6d2cfULL,-	0x0c6b18576aaadbc8ULL,0xb65deaa91299fae3ULL,0xfb2b794b7f1027e7ULL,0x04e4317f443b5bebULL,-	0x4b852d325939d0a6ULL,0xd5ae6beefb207ffcULL,0x309682b281c7d374ULL,0xbae309a194c3b475ULL,-	0x8cc3f97b13b49f05ULL,0x98a9422ff8293967ULL,0x244b16b01076ff7cULL,0xf8bf571c663d67eeULL,-	0x1f0d6758eee30da1ULL,0xc9b611d97adeb9b7ULL,0xb7afd5887b6c57a2ULL,0x6290ae846b984fe1ULL,-	0x94df4cdeacc1a5fdULL,0x058a5bd1c5483affULL,0x63166cc142ba3c37ULL,0x8db8526eb2f76f40ULL,-	0xe10880036f0d6d4eULL,0x9e0523c9971d311dULL,0x45ec2824cc7cd691ULL,0x575b8359e62382c9ULL,-	0xfa9e400dc4889995ULL,0xd1823ecb45721568ULL,0xdafd983b8206082fULL,0xaa7d29082386a8cbULL,-	0x269fcd4403b87588ULL,0x1b91f5f728bdd1e0ULL,0xe4669f39040201f6ULL,0x7a1d7c218cf04adeULL,-	0x65623c29d79ce5ceULL,0x2368449096c00bb1ULL,0xab9bf1879da503baULL,0xbc23ecb1a458058eULL,-	0x9a58df01bb401eccULL,0xa070e868a85f143dULL,0x4ff188307df2239eULL,0x14d565b41a641183ULL,-	0xee13337452701602ULL,0x950e3dcf3f285e09ULL,0x59930254b9c80953ULL,0x3bf299408930da6dULL,-	0xa955943f53691387ULL,0xa15edecaa9cb8784ULL,0x29142127352be9a0ULL,0x76f0371fff4e7afbULL,-	0x0239f450274f2228ULL,0xbb073af01d5e868bULL,0xbfc80571c10e96c1ULL,0xd267088568222e23ULL,-	0x9671a3d48e80b5b0ULL,0x55b5d38ae193bb81ULL,0x693ae2d0a18b04b8ULL,0x5c48b4ecadd5335fULL,-	0xfd743b194916a1caULL,0x2577018134be98c4ULL,0xe77987e83c54a4adULL,0x28e11014da33e1b9ULL,-	0x270cc59e226aa213ULL,0x71495f756d1a5f60ULL,0x9be853fb60afef77ULL,0xadc786a7f7443dbfULL,-	0x0904456173b29a82ULL,0x58bc7a66c232bd5eULL,0xf306558c673ac8b2ULL,0x41f639c6b6c9772aULL,-	0x216defe99fda35daULL,0x11640cc71c7be615ULL,0x93c43694565c5527ULL,0xea038e6246777839ULL,-	0xf9abf3ce5a3e2469ULL,0x741e768d0fd312d2ULL,0x0144b883ced652c6ULL,0xc20b5a5ba33f8552ULL,-	0x1ae69633c3435a9dULL,0x97a28ca4088cfdecULL,0x8824a43c1e96f420ULL,0x37612fa66eeea746ULL,-	0x6b4cb165f9cf0e5aULL,0x43aa1c06a0abfb4aULL,0x7f4dc26ff162796bULL,0x6cbacc8e54ed9b0fULL,-	0xa6b7ffefd2bb253eULL,0x2e25bc95b0a29d4fULL,0x86d6a58bdef1388cULL,0xded74ac576b6f054ULL,-	0x8030bdbc2b45805dULL,0x3c81af70e94d9289ULL,0x3eff6dda9e3100dbULL,0xb38dc39fdfcc8847ULL,-	0x123885528d17b87eULL,0xf2da0ed240b1b642ULL,0x44cefadcd54bf9a9ULL,0x1312200e433c7ee6ULL,-	0x9ffcc84f3a78c748ULL,0xf0cd1f72248576bbULL,0xec6974053638cfe4ULL,0x2ba7b67c0cec4e4cULL,-	0xac2f4df3e5ce32edULL,0xcb33d14326ea4c11ULL,0xa4e9044cc77e58bcULL,0x5f513293d934fcefULL,-	0x5dc9645506e55444ULL,0x50de418f317de40aULL,0x388cb31a69dde259ULL,0x2db4a83455820a86ULL,-	0x9010a91e84711ae9ULL,0x4df7f0b7b1498371ULL,0xd62a2eabc0977179ULL,0x22fac097aa8d5c0eULL,-}; --static const uint64_t t3[256]= {-	0xf49fcc2ff1daf39bULL,0x487fd5c66ff29281ULL,0xe8a30667fcdca83fULL,0x2c9b4be3d2fcce63ULL,-	0xda3ff74b93fbbbc2ULL,0x2fa165d2fe70ba66ULL,0xa103e279970e93d4ULL,0xbecdec77b0e45e71ULL,-	0xcfb41e723985e497ULL,0xb70aaa025ef75017ULL,0xd42309f03840b8e0ULL,0x8efc1ad035898579ULL,-	0x96c6920be2b2abc5ULL,0x66af4163375a9172ULL,0x2174abdcca7127fbULL,0xb33ccea64a72ff41ULL,-	0xf04a4933083066a5ULL,0x8d970acdd7289af5ULL,0x8f96e8e031c8c25eULL,0xf3fec02276875d47ULL,-	0xec7bf310056190ddULL,0xf5adb0aebb0f1491ULL,0x9b50f8850fd58892ULL,0x4975488358b74de8ULL,-	0xa3354ff691531c61ULL,0x0702bbe481d2c6eeULL,0x89fb24057deded98ULL,0xac3075138596e902ULL,-	0x1d2d3580172772edULL,0xeb738fc28e6bc30dULL,0x5854ef8f63044326ULL,0x9e5c52325add3bbeULL,-	0x90aa53cf325c4623ULL,0xc1d24d51349dd067ULL,0x2051cfeea69ea624ULL,0x13220f0a862e7e4fULL,-	0xce39399404e04864ULL,0xd9c42ca47086fcb7ULL,0x685ad2238a03e7ccULL,0x066484b2ab2ff1dbULL,-	0xfe9d5d70efbf79ecULL,0x5b13b9dd9c481854ULL,0x15f0d475ed1509adULL,0x0bebcd060ec79851ULL,-	0xd58c6791183ab7f8ULL,0xd1187c5052f3eee4ULL,0xc95d1192e54e82ffULL,0x86eea14cb9ac6ca2ULL,-	0x3485beb153677d5dULL,0xdd191d781f8c492aULL,0xf60866baa784ebf9ULL,0x518f643ba2d08c74ULL,-	0x8852e956e1087c22ULL,0xa768cb8dc410ae8dULL,0x38047726bfec8e1aULL,0xa67738b4cd3b45aaULL,-	0xad16691cec0dde19ULL,0xc6d4319380462e07ULL,0xc5a5876d0ba61938ULL,0x16b9fa1fa58fd840ULL,-	0x188ab1173ca74f18ULL,0xabda2f98c99c021fULL,0x3e0580ab134ae816ULL,0x5f3b05b773645abbULL,-	0x2501a2be5575f2f6ULL,0x1b2f74004e7e8ba9ULL,0x1cd7580371e8d953ULL,0x7f6ed89562764e30ULL,-	0xb15926ff596f003dULL,0x9f65293da8c5d6b9ULL,0x6ecef04dd690f84cULL,0x4782275fff33af88ULL,-	0xe41433083f820801ULL,0xfd0dfe409a1af9b5ULL,0x4325a3342cdb396bULL,0x8ae77e62b301b252ULL,-	0xc36f9e9f6655615aULL,0x85455a2d92d32c09ULL,0xf2c7dea949477485ULL,0x63cfb4c133a39ebaULL,-	0x83b040cc6ebc5462ULL,0x3b9454c8fdb326b0ULL,0x56f56a9e87ffd78cULL,0x2dc2940d99f42bc6ULL,-	0x98f7df096b096e2dULL,0x19a6e01e3ad852bfULL,0x42a99ccbdbd4b40bULL,0xa59998af45e9c559ULL,-	0x366295e807d93186ULL,0x6b48181bfaa1f773ULL,0x1fec57e2157a0a1dULL,0x4667446af6201ad5ULL,-	0xe615ebcacfb0f075ULL,0xb8f31f4f68290778ULL,0x22713ed6ce22d11eULL,0x3057c1a72ec3c93bULL,-	0xcb46acc37c3f1f2fULL,0xdbb893fd02aaf50eULL,0x331fd92e600b9fcfULL,0xa498f96148ea3ad6ULL,-	0xa8d8426e8b6a83eaULL,0xa089b274b7735cdcULL,0x87f6b3731e524a11ULL,0x118808e5cbc96749ULL,-	0x9906e4c7b19bd394ULL,0xafed7f7e9b24a20cULL,0x6509eadeeb3644a7ULL,0x6c1ef1d3e8ef0edeULL,-	0xb9c97d43e9798fb4ULL,0xa2f2d784740c28a3ULL,0x7b8496476197566fULL,0x7a5be3e6b65f069dULL,-	0xf96330ed78be6f10ULL,0xeee60de77a076a15ULL,0x2b4bee4aa08b9bd0ULL,0x6a56a63ec7b8894eULL,-	0x02121359ba34fef4ULL,0x4cbf99f8283703fcULL,0x398071350caf30c8ULL,0xd0a77a89f017687aULL,-	0xf1c1a9eb9e423569ULL,0x8c7976282dee8199ULL,0x5d1737a5dd1f7abdULL,0x4f53433c09a9fa80ULL,-	0xfa8b0c53df7ca1d9ULL,0x3fd9dcbc886ccb77ULL,0xc040917ca91b4720ULL,0x7dd00142f9d1dcdfULL,-	0x8476fc1d4f387b58ULL,0x23f8e7c5f3316503ULL,0x032a2244e7e37339ULL,0x5c87a5d750f5a74bULL,-	0x082b4cc43698992eULL,0xdf917becb858f63cULL,0x3270b8fc5bf86ddaULL,0x10ae72bb29b5dd76ULL,-	0x576ac94e7700362bULL,0x1ad112dac61efb8fULL,0x691bc30ec5faa427ULL,0xff246311cc327143ULL,-	0x3142368e30e53206ULL,0x71380e31e02ca396ULL,0x958d5c960aad76f1ULL,0xf8d6f430c16da536ULL,-	0xc8ffd13f1be7e1d2ULL,0x7578ae66004ddbe1ULL,0x05833f01067be646ULL,0xbb34b5ad3bfe586dULL,-	0x095f34c9a12b97f0ULL,0x247ab64525d60ca8ULL,0xdcdbc6f3017477d1ULL,0x4a2e14d4decad24dULL,-	0xbdb5e6d9be0a1eebULL,0x2a7e70f7794301abULL,0xdef42d8a270540fdULL,0x01078ec0a34c22c1ULL,-	0xe5de511af4c16387ULL,0x7ebb3a52bd9a330aULL,0x77697857aa7d6435ULL,0x004e831603ae4c32ULL,-	0xe7a21020ad78e312ULL,0x9d41a70c6ab420f2ULL,0x28e06c18ea1141e6ULL,0xd2b28cbd984f6b28ULL,-	0x26b75f6c446e9d83ULL,0xba47568c4d418d7fULL,0xd80badbfe6183d8eULL,0x0e206d7f5f166044ULL,-	0xe258a43911cbca3eULL,0x723a1746b21dc0bcULL,0xc7caa854f5d7cdd3ULL,0x7cac32883d261d9cULL,-	0x7690c26423ba942cULL,0x17e55524478042b8ULL,0xe0be477656a2389fULL,0x4d289b5e67ab2da0ULL,-	0x44862b9c8fbbfd31ULL,0xb47cc8049d141365ULL,0x822c1b362b91c793ULL,0x4eb14655fb13dfd8ULL,-	0x1ecbba0714e2a97bULL,0x6143459d5cde5f14ULL,0x53a8fbf1d5f0ac89ULL,0x97ea04d81c5e5b00ULL,-	0x622181a8d4fdb3f3ULL,0xe9bcd341572a1208ULL,0x1411258643cce58aULL,0x9144c5fea4c6e0a4ULL,-	0x0d33d06565cf620fULL,0x54a48d489f219ca1ULL,0xc43e5eac6d63c821ULL,0xa9728b3a72770dafULL,-	0xd7934e7b20df87efULL,0xe35503b61a3e86e5ULL,0xcae321fbc819d504ULL,0x129a50b3ac60bfa6ULL,-	0xcd5e68ea7e9fb6c3ULL,0xb01c90199483b1c7ULL,0x3de93cd5c295376cULL,0xaed52edf2ab9ad13ULL,-	0x2e60f512c0a07884ULL,0xbc3d86a3e36210c9ULL,0x35269d9b163951ceULL,0x0c7d6e2ad0cdb5faULL,-	0x59e86297d87f5733ULL,0x298ef221898db0e7ULL,0x55000029d1a5aa7eULL,0x8bc08ae1b5061b45ULL,-	0xc2c31c2b6c92703aULL,0x94cc596baf25ef42ULL,0x0a1d73db22540456ULL,0x04b6a0f9d9c4179aULL,-	0xeffdafa2ae3d3c60ULL,0xf7c8075bb49496c4ULL,0x9cc5c7141d1cd4e3ULL,0x78bd1638218e5534ULL,-	0xb2f11568f850246aULL,0xedfabcfa9502bc29ULL,0x796ce5f2da23051bULL,0xaae128b0dc93537cULL,-	0x3a493da0ee4b29aeULL,0xb5df6b2c416895d7ULL,0xfcabbd25122d7f37ULL,0x70810b58105dc4b1ULL,-	0xe10fdd37f7882a90ULL,0x524dcab5518a3f5cULL,0x3c9e85878451255bULL,0x4029828119bd34e2ULL,-	0x74a05b6f5d3ceccbULL,0xb610021542e13ecaULL,0x0ff979d12f59e2acULL,0x6037da27e4f9cc50ULL,-	0x5e92975a0df1847dULL,0xd66de190d3e623feULL,0x5032d6b87b568048ULL,0x9a36b7ce8235216eULL,-	0x80272a7a24f64b4aULL,0x93efed8b8c6916f7ULL,0x37ddbff44cce1555ULL,0x4b95db5d4b99bd25ULL,-	0x92d3fda169812fc0ULL,0xfb1a4a9a90660bb6ULL,0x730c196946a4b9b2ULL,0x81e289aa7f49da68ULL,-	0x64669a0f83b1a05fULL,0x27b3ff7d9644f48bULL,0xcc6b615c8db675b3ULL,0x674f20b9bcebbe95ULL,-	0x6f31238275655982ULL,0x5ae488713e45cf05ULL,0xbf619f9954c21157ULL,0xeabac46040a8eae9ULL,-	0x454c6fe9f2c0c1cdULL,0x419cf6496412691cULL,0xd3dc3bef265b0f70ULL,0x6d0e60f5c3578a9eULL,-};--static const uint64_t t4[256]=-{-	0x5b0e608526323c55ULL,0x1a46c1a9fa1b59f5ULL, 0xa9e245a17c4c8ffaULL,0x65ca5159db2955d7ULL,-	0x05db0a76ce35afc2ULL,0x81eac77ea9113d45ULL, 0x528ef88ab6ac0a0dULL,0xa09ea253597be3ffULL,-	0x430ddfb3ac48cd56ULL,0xc4b3a67af45ce46fULL, 0x4ececfd8fbe2d05eULL,0x3ef56f10b39935f0ULL,-	0x0b22d6829cd619c6ULL,0x17fd460a74df2069ULL, 0x6cf8cc8e8510ed40ULL,0xd6c824bf3a6ecaa7ULL,-	0x61243d581a817049ULL,0x048bacb6bbc163a2ULL, 0xd9a38ac27d44cc32ULL,0x7fddff5baaf410abULL,-	0xad6d495aa804824bULL,0xe1a6a74f2d8c9f94ULL, 0xd4f7851235dee8e3ULL,0xfd4b7f886540d893ULL,-	0x247c20042aa4bfdaULL,0x096ea1c517d1327cULL, 0xd56966b4361a6685ULL,0x277da5c31221057dULL,-	0x94d59893a43acff7ULL,0x64f0c51ccdc02281ULL, 0x3d33bcc4ff6189dbULL,0xe005cb184ce66af1ULL,-	0xff5ccd1d1db99beaULL,0xb0b854a7fe42980fULL, 0x7bd46a6a718d4b9fULL,0xd10fa8cc22a5fd8cULL,-	0xd31484952be4bd31ULL,0xc7fa975fcb243847ULL, 0x4886ed1e5846c407ULL,0x28cddb791eb70b04ULL,-	0xc2b00be2f573417fULL,0x5c9590452180f877ULL, 0x7a6bddfff370eb00ULL,0xce509e38d6d9d6a4ULL,-	0xebeb0f00647fa702ULL,0x1dcc06cf76606f06ULL, 0xe4d9f28ba286ff0aULL,0xd85a305dc918c262ULL,-	0x475b1d8732225f54ULL,0x2d4fb51668ccb5feULL, 0xa679b9d9d72bba20ULL,0x53841c0d912d43a5ULL,-	0x3b7eaa48bf12a4e8ULL,0x781e0e47f22f1ddfULL, 0xeff20ce60ab50973ULL,0x20d261d19dffb742ULL,-	0x16a12b03062a2e39ULL,0x1960eb2239650495ULL, 0x251c16fed50eb8b8ULL,0x9ac0c330f826016eULL,-	0xed152665953e7671ULL,0x02d63194a6369570ULL, 0x5074f08394b1c987ULL,0x70ba598c90b25ce1ULL,-	0x794a15810b9742f6ULL,0x0d5925e9fcaf8c6cULL, 0x3067716cd868744eULL,0x910ab077e8d7731bULL,-	0x6a61bbdb5ac42f61ULL,0x93513efbf0851567ULL, 0xf494724b9e83e9d5ULL,0xe887e1985c09648dULL,-	0x34b1d3c675370cfdULL,0xdc35e433bc0d255dULL, 0xd0aab84234131be0ULL,0x08042a50b48b7eafULL,-	0x9997c4ee44a3ab35ULL,0x829a7b49201799d0ULL, 0x263b8307b7c54441ULL,0x752f95f4fd6a6ca6ULL,-	0x927217402c08c6e5ULL,0x2a8ab754a795d9eeULL, 0xa442f7552f72943dULL,0x2c31334e19781208ULL,-	0x4fa98d7ceaee6291ULL,0x55c3862f665db309ULL, 0xbd0610175d53b1f3ULL,0x46fe6cb840413f27ULL,-	0x3fe03792df0cfa59ULL,0xcfe700372eb85e8fULL, 0xa7be29e7adbce118ULL,0xe544ee5cde8431ddULL,-	0x8a781b1b41f1873eULL,0xa5c94c78a0d2f0e7ULL, 0x39412e2877b60728ULL,0xa1265ef3afc9a62cULL,-	0xbcc2770c6a2506c5ULL,0x3ab66dd5dce1ce12ULL, 0xe65499d04a675b37ULL,0x7d8f523481bfd216ULL,-	0x0f6f64fcec15f389ULL,0x74efbe618b5b13c8ULL, 0xacdc82b714273e1dULL,0xdd40bfe003199d17ULL,-	0x37e99257e7e061f8ULL,0xfa52626904775aaaULL, 0x8bbbf63a463d56f9ULL,0xf0013f1543a26e64ULL,-	0xa8307e9f879ec898ULL,0xcc4c27a4150177ccULL, 0x1b432f2cca1d3348ULL,0xde1d1f8f9f6fa013ULL,-	0x606602a047a7ddd6ULL,0xd237ab64cc1cb2c7ULL, 0x9b938e7225fcd1d3ULL,0xec4e03708e0ff476ULL,-	0xfeb2fbda3d03c12dULL,0xae0bced2ee43889aULL, 0x22cb8923ebfb4f43ULL,0x69360d013cf7396dULL,-	0x855e3602d2d4e022ULL,0x073805bad01f784cULL, 0x33e17a133852f546ULL,0xdf4874058ac7b638ULL,-	0xba92b29c678aa14aULL,0x0ce89fc76cfaadcdULL, 0x5f9d4e0908339e34ULL,0xf1afe9291f5923b9ULL,-	0x6e3480f60f4a265fULL,0xeebf3a2ab29b841cULL, 0xe21938a88f91b4adULL,0x57dfeff845c6d3c3ULL,-	0x2f006b0bf62caaf2ULL,0x62f479ef6f75ee78ULL, 0x11a55ad41c8916a9ULL,0xf229d29084fed453ULL,-	0x42f1c27b16b000e6ULL,0x2b1f76749823c074ULL, 0x4b76eca3c2745360ULL,0x8c98f463b91691bdULL,-	0x14bcc93cf1ade66aULL,0x8885213e6d458397ULL, 0x8e177df0274d4711ULL,0xb49b73b5503f2951ULL,-	0x10168168c3f96b6bULL,0x0e3d963b63cab0aeULL, 0x8dfc4b5655a1db14ULL,0xf789f1356e14de5cULL,-	0x683e68af4e51dac1ULL,0xc9a84f9d8d4b0fd9ULL, 0x3691e03f52a0f9d1ULL,0x5ed86e46e1878e80ULL,-	0x3c711a0e99d07150ULL,0x5a0865b20c4e9310ULL, 0x56fbfc1fe4f0682eULL,0xea8d5de3105edf9bULL,-	0x71abfdb12379187aULL,0x2eb99de1bee77b9cULL, 0x21ecc0ea33cf4523ULL,0x59a4d7521805c7a1ULL,-	0x3896f5eb56ae7c72ULL,0xaa638f3db18f75dcULL, 0x9f39358dabe9808eULL,0xb7defa91c00b72acULL,-	0x6b5541fd62492d92ULL,0x6dc6dee8f92e4d5bULL, 0x353f57abc4beea7eULL,0x735769d6da5690ceULL,-	0x0a234aa642391484ULL,0xf6f9508028f80d9dULL, 0xb8e319a27ab3f215ULL,0x31ad9c1151341a4dULL,-	0x773c22a57bef5805ULL,0x45c7561a07968633ULL, 0xf913da9e249dbe36ULL,0xda652d9b78a64c68ULL,-	0x4c27a97f3bc334efULL,0x76621220e66b17f4ULL, 0x967743899acd7d0bULL,0xf3ee5bcae0ed6782ULL,-	0x409f753600c879fcULL,0x06d09a39b5926db6ULL, 0x6f83aeb0317ac588ULL,0x01e6ca4a86381f21ULL,-	0x66ff3462d19f3025ULL,0x72207c24ddfd3bfbULL, 0x4af6b6d3e2ece2ebULL,0x9c994dbec7ea08deULL,-	0x49ace597b09a8bc4ULL,0xb38c4766cf0797baULL, 0x131b9373c57c2a75ULL,0xb1822cce61931e58ULL,-	0x9d7555b909ba1c0cULL,0x127fafdd937d11d2ULL, 0x29da3badc66d92e4ULL,0xa2c1d57154c2ecbcULL,-	0x58c5134d82f6fe24ULL,0x1c3ae3515b62274fULL, 0xe907c82e01cb8126ULL,0xf8ed091913e37fcbULL,-	0x3249d8f9c80046c9ULL,0x80cf9bede388fb63ULL, 0x1881539a116cf19eULL,0x5103f3f76bd52457ULL,-	0x15b7e6f5ae47f7a8ULL,0xdbd7c6ded47e9ccfULL, 0x44e55c410228bb1aULL,0xb647d4255edb4e99ULL,-	0x5d11882bb8aafc30ULL,0xf5098bbb29d3212aULL, 0x8fb5ea14e90296b3ULL,0x677b942157dd025aULL,-	0xfb58e7c0a390acb5ULL,0x89d3674c83bd4a01ULL, 0x9e2da4df4bf3b93bULL,0xfcc41e328cab4829ULL,-	0x03f38c96ba582c52ULL,0xcad1bdbd7fd85db2ULL, 0xbbb442c16082ae83ULL,0xb95fe86ba5da9ab0ULL,-	0xb22e04673771a93fULL,0x845358c9493152d8ULL, 0xbe2a488697b4541eULL,0x95a2dc2dd38e6966ULL,-	0xc02c11ac923c852bULL,0x2388b1990df2a87bULL, 0x7c8008fa1b4f37beULL,0x1f70d0c84d54e503ULL,-	0x5490adec7ece57d4ULL,0x002b3c27d9063a3aULL, 0x7eaea3848030a2bfULL,0xc602326ded2003c0ULL,-	0x83a7287d69a94086ULL,0xc57a5fcb30f57a8aULL, 0xb56844e479ebe779ULL,0xa373b40f05dcbce9ULL,-	0xd71a786e88570ee2ULL,0x879cbacdbde8f6a0ULL, 0x976ad1bcc164a32fULL,0xab21e25e9666d78bULL,-	0x901063aae5e5c33cULL,0x9818b34448698d90ULL, 0xe36487ae3e1e8abbULL,0xafbdf931893bdcb4ULL,-	0x6345a0dc5fbbd519ULL,0x8628fe269b9465caULL, 0x1e5d01603f9c51ecULL,0x4de44006a15049b7ULL,-	0xbf6c70e5f776cbb1ULL,0x411218f2ef552bedULL, 0xcb0c0708705a36a3ULL,0xe74d14754f986044ULL,-	0xcd56d9430ea8280eULL,0xc12591d7535f5065ULL, 0xc83223f1720aef96ULL,0xc3a0396f7363a51fULL,-}; --void cryptonite_tiger_init(struct tiger_ctx *ctx)-{-	memset(ctx, 0, sizeof(*ctx));--	ctx->h[0] = 0x0123456789abcdefULL;-	ctx->h[1] = 0xfedcba9876543210ULL;-	ctx->h[2] = 0xf096a5b4c3b2e187ULL;-}--static inline void tiger_do_chunk(struct tiger_ctx *ctx, uint64_t *buf)-{-	uint64_t x0, x1, x2, x3, x4, x5, x6, x7;-	uint64_t a,b,c;-	a = ctx->h[0];-	b = ctx->h[1];-	c = ctx->h[2];--	x0 = cpu_to_le64(buf[0]); x1 = cpu_to_le64(buf[1]); x2 = cpu_to_le64(buf[2]); x3 = cpu_to_le64(buf[3]);-	x4 = cpu_to_le64(buf[4]); x5 = cpu_to_le64(buf[5]); x6 = cpu_to_le64(buf[6]); x7 = cpu_to_le64(buf[7]);--#define BYTEOF(c, n) ((uint8_t) (c >> ((n * 8))))--#define ROUND(a,b,c,x,mul)                                                          \-	c ^= x;                                                                     \-	a -= t1[BYTEOF(c,0)] ^ t2[BYTEOF(c,2)] ^ t3[BYTEOF(c,4)] ^ t4[BYTEOF(c,6)]; \-	b += t4[BYTEOF(c,1)] ^ t3[BYTEOF(c,3)] ^ t2[BYTEOF(c,5)] ^ t1[BYTEOF(c,7)]; \-	b *= mul;--#define PASS(a,b,c,mul)	     \-	ROUND(a,b,c,x0,mul); \-	ROUND(b,c,a,x1,mul); \-	ROUND(c,a,b,x2,mul); \-	ROUND(a,b,c,x3,mul); \-	ROUND(b,c,a,x4,mul); \-	ROUND(c,a,b,x5,mul); \-	ROUND(a,b,c,x6,mul); \-	ROUND(b,c,a,x7,mul)--#define SCHEDULE()                        \-	x0 -= x7 ^ 0xa5a5a5a5a5a5a5a5ULL; \-	x1 ^= x0;                         \-	x2 += x1;                         \-	x3 -= x2 ^ ((~x1)<<19);           \-	x4 ^= x3;                         \-	x5 += x4;                         \-	x6 -= x5 ^ ((~x4)>>23);           \-	x7 ^= x6;                         \-	x0 += x7;                         \-	x1 -= x0 ^ ((~x7)<<19);           \-	x2 ^= x1;                         \-	x3 += x2;                         \-	x4 -= x3 ^ ((~x2)>>23);           \-	x5 ^= x4;                         \-	x6 += x5;                         \-	x7 -= x6 ^ 0x0123456789abcdefULL--	PASS(a,b,c,5);-	SCHEDULE();-	PASS(c,a,b,7);-	SCHEDULE();-	PASS(b,c,a,9);--	ctx->h[0] ^= a;-	ctx->h[1] = b - ctx->h[1];-	ctx->h[2] += c;-}--void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len)-{-	uint32_t index, to_fill;--	index = (uint32_t) (ctx->sz & 0x3f);-	to_fill = 64 - index;--	ctx->sz += len;--	/* process partial buffer if there's enough data to make a block */-	if (index && len >= to_fill) {-		memcpy(ctx->buf + index, data, to_fill);-		tiger_do_chunk(ctx, (uint64_t *) ctx->buf);-		len -= to_fill;-		data += to_fill;-		index = 0;-	}--	if (need_alignment(data, 8)) {-		uint64_t tramp[8];-		ASSERT_ALIGNMENT(tramp, 8);-		for (; len >= 64; len -= 64, data += 64) {-			memcpy(tramp, data, 64);-			tiger_do_chunk(ctx, tramp);-		}-	} else {-		/* process as much 64-block as possible */-		for (; len >= 64; len -= 64, data += 64)-			tiger_do_chunk(ctx, (uint64_t *) data);-	}--	/* append data into buf */-	if (len)-		memcpy(ctx->buf + index, data, len);-}--void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out)-{-	static uint8_t padding[64] = { 0x01, };-	uint64_t bits;-	uint32_t index, padlen;--	/* add padding and update data with it */-	bits = cpu_to_le64(ctx->sz << 3);--	/* pad out to 56 */-	index = (uint32_t) (ctx->sz & 0x3f);-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);-	cryptonite_tiger_update(ctx, padding, padlen);--	/* append length */-	cryptonite_tiger_update(ctx, (uint8_t *) &bits, sizeof(bits));--	/* output hash */-	store_le64(out   , ctx->h[0]);-	store_le64(out+ 8, ctx->h[1]);-	store_le64(out+16, ctx->h[2]);-}
− cbits/cryptonite_tiger.h 
@@ -1,43 +0,0 @@-/*- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- */-#ifndef CRYPTOHASH_TIGER_H-#define CRYPTOHASH_TIGER_H--#include <stdint.h>--struct tiger_ctx-{-	uint64_t sz;-	uint8_t  buf[64];-	uint64_t h[3];-};--#define TIGER_DIGEST_SIZE	24-#define TIGER_CTX_SIZE 		(sizeof(struct tiger_ctx))--void cryptonite_tiger_init(struct tiger_ctx *ctx);-void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len);-void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out);--#endif
− cbits/cryptonite_whirlpool.c 
@@ -1,1026 +0,0 @@-/**- * The Whirlpool hashing function.- *- * <P>- * <b>References</b>- *- * <P>- * The Whirlpool algorithm was developed by- * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and- * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.- *- * See- *      P.S.L.M. Barreto, V. Rijmen,- *      ``The Whirlpool hashing function,''- *      NESSIE submission, 2000 (tweaked version, 2001),- *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>- * - * @author  Paulo S.L.M. Barreto- * @author  Vincent Rijmen.- *- * @version 3.0 (2003.03.12)- *- * =============================================================================- *- * Differences from version 2.1:- *- * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).- *- * =============================================================================- *- * Differences from version 2.0:- *- * - Generation of ISO/IEC 10118-3 test vectors.- * - Bug fix: nonzero carry was ignored when tallying the data length- *      (this bug apparently only manifested itself when feeding data- *      in pieces rather than in a single chunk at once).- * - Support for MS Visual C++ 64-bit integer arithmetic.- *- * Differences from version 1.0:- *- * - Original S-box replaced by the tweaked, hardware-efficient version.- *- * =============================================================================- *- * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE- * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,- * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.- *- */-/* Modified by Stijn van Drongelen for use in the cryptohash library.-*/--#include <stdlib.h>-#include <string.h>--#include "cryptonite_bitfn.h"-#include "cryptonite_whirlpool.h"--/* #define TRACE_INTERMEDIATE_VALUES */--/*- * The number of rounds of the internal dedicated block cipher.- */-#define R 10--/*- * Though Whirlpool is endianness-neutral, the encryption tables are listed- * in BIG-ENDIAN format, which is adopted throughout this implementation- * (but little-endian notation would be equally suitable if consistently- * employed).- */--static const uint64_t C0[256] = {-	0x18186018c07830d8ULL, 0x23238c2305af4626ULL, 0xc6c63fc67ef991b8ULL, 0xe8e887e8136fcdfbULL,-	0x878726874ca113cbULL, 0xb8b8dab8a9626d11ULL, 0x0101040108050209ULL, 0x4f4f214f426e9e0dULL,-	0x3636d836adee6c9bULL, 0xa6a6a2a6590451ffULL, 0xd2d26fd2debdb90cULL, 0xf5f5f3f5fb06f70eULL,-	0x7979f979ef80f296ULL, 0x6f6fa16f5fcede30ULL, 0x91917e91fcef3f6dULL, 0x52525552aa07a4f8ULL,-	0x60609d6027fdc047ULL, 0xbcbccabc89766535ULL, 0x9b9b569baccd2b37ULL, 0x8e8e028e048c018aULL,-	0xa3a3b6a371155bd2ULL, 0x0c0c300c603c186cULL, 0x7b7bf17bff8af684ULL, 0x3535d435b5e16a80ULL,-	0x1d1d741de8693af5ULL, 0xe0e0a7e05347ddb3ULL, 0xd7d77bd7f6acb321ULL, 0xc2c22fc25eed999cULL,-	0x2e2eb82e6d965c43ULL, 0x4b4b314b627a9629ULL, 0xfefedffea321e15dULL, 0x575741578216aed5ULL,-	0x15155415a8412abdULL, 0x7777c1779fb6eee8ULL, 0x3737dc37a5eb6e92ULL, 0xe5e5b3e57b56d79eULL,-	0x9f9f469f8cd92313ULL, 0xf0f0e7f0d317fd23ULL, 0x4a4a354a6a7f9420ULL, 0xdada4fda9e95a944ULL,-	0x58587d58fa25b0a2ULL, 0xc9c903c906ca8fcfULL, 0x2929a429558d527cULL, 0x0a0a280a5022145aULL,-	0xb1b1feb1e14f7f50ULL, 0xa0a0baa0691a5dc9ULL, 0x6b6bb16b7fdad614ULL, 0x85852e855cab17d9ULL,-	0xbdbdcebd8173673cULL, 0x5d5d695dd234ba8fULL, 0x1010401080502090ULL, 0xf4f4f7f4f303f507ULL,-	0xcbcb0bcb16c08bddULL, 0x3e3ef83eedc67cd3ULL, 0x0505140528110a2dULL, 0x676781671fe6ce78ULL,-	0xe4e4b7e47353d597ULL, 0x27279c2725bb4e02ULL, 0x4141194132588273ULL, 0x8b8b168b2c9d0ba7ULL,-	0xa7a7a6a7510153f6ULL, 0x7d7de97dcf94fab2ULL, 0x95956e95dcfb3749ULL, 0xd8d847d88e9fad56ULL,-	0xfbfbcbfb8b30eb70ULL, 0xeeee9fee2371c1cdULL, 0x7c7ced7cc791f8bbULL, 0x6666856617e3cc71ULL,-	0xdddd53dda68ea77bULL, 0x17175c17b84b2eafULL, 0x4747014702468e45ULL, 0x9e9e429e84dc211aULL,-	0xcaca0fca1ec589d4ULL, 0x2d2db42d75995a58ULL, 0xbfbfc6bf9179632eULL, 0x07071c07381b0e3fULL,-	0xadad8ead012347acULL, 0x5a5a755aea2fb4b0ULL, 0x838336836cb51befULL, 0x3333cc3385ff66b6ULL,-	0x636391633ff2c65cULL, 0x02020802100a0412ULL, 0xaaaa92aa39384993ULL, 0x7171d971afa8e2deULL,-	0xc8c807c80ecf8dc6ULL, 0x19196419c87d32d1ULL, 0x494939497270923bULL, 0xd9d943d9869aaf5fULL,-	0xf2f2eff2c31df931ULL, 0xe3e3abe34b48dba8ULL, 0x5b5b715be22ab6b9ULL, 0x88881a8834920dbcULL,-	0x9a9a529aa4c8293eULL, 0x262698262dbe4c0bULL, 0x3232c8328dfa64bfULL, 0xb0b0fab0e94a7d59ULL,-	0xe9e983e91b6acff2ULL, 0x0f0f3c0f78331e77ULL, 0xd5d573d5e6a6b733ULL, 0x80803a8074ba1df4ULL,-	0xbebec2be997c6127ULL, 0xcdcd13cd26de87ebULL, 0x3434d034bde46889ULL, 0x48483d487a759032ULL,-	0xffffdbffab24e354ULL, 0x7a7af57af78ff48dULL, 0x90907a90f4ea3d64ULL, 0x5f5f615fc23ebe9dULL,-	0x202080201da0403dULL, 0x6868bd6867d5d00fULL, 0x1a1a681ad07234caULL, 0xaeae82ae192c41b7ULL,-	0xb4b4eab4c95e757dULL, 0x54544d549a19a8ceULL, 0x93937693ece53b7fULL, 0x222288220daa442fULL,-	0x64648d6407e9c863ULL, 0xf1f1e3f1db12ff2aULL, 0x7373d173bfa2e6ccULL, 0x12124812905a2482ULL,-	0x40401d403a5d807aULL, 0x0808200840281048ULL, 0xc3c32bc356e89b95ULL, 0xecec97ec337bc5dfULL,-	0xdbdb4bdb9690ab4dULL, 0xa1a1bea1611f5fc0ULL, 0x8d8d0e8d1c830791ULL, 0x3d3df43df5c97ac8ULL,-	0x97976697ccf1335bULL, 0x0000000000000000ULL, 0xcfcf1bcf36d483f9ULL, 0x2b2bac2b4587566eULL,-	0x7676c57697b3ece1ULL, 0x8282328264b019e6ULL, 0xd6d67fd6fea9b128ULL, 0x1b1b6c1bd87736c3ULL,-	0xb5b5eeb5c15b7774ULL, 0xafaf86af112943beULL, 0x6a6ab56a77dfd41dULL, 0x50505d50ba0da0eaULL,-	0x45450945124c8a57ULL, 0xf3f3ebf3cb18fb38ULL, 0x3030c0309df060adULL, 0xefef9bef2b74c3c4ULL,-	0x3f3ffc3fe5c37edaULL, 0x55554955921caac7ULL, 0xa2a2b2a2791059dbULL, 0xeaea8fea0365c9e9ULL,-	0x656589650fecca6aULL, 0xbabad2bab9686903ULL, 0x2f2fbc2f65935e4aULL, 0xc0c027c04ee79d8eULL,-	0xdede5fdebe81a160ULL, 0x1c1c701ce06c38fcULL, 0xfdfdd3fdbb2ee746ULL, 0x4d4d294d52649a1fULL,-	0x92927292e4e03976ULL, 0x7575c9758fbceafaULL, 0x06061806301e0c36ULL, 0x8a8a128a249809aeULL,-	0xb2b2f2b2f940794bULL, 0xe6e6bfe66359d185ULL, 0x0e0e380e70361c7eULL, 0x1f1f7c1ff8633ee7ULL,-	0x6262956237f7c455ULL, 0xd4d477d4eea3b53aULL, 0xa8a89aa829324d81ULL, 0x96966296c4f43152ULL,-	0xf9f9c3f99b3aef62ULL, 0xc5c533c566f697a3ULL, 0x2525942535b14a10ULL, 0x59597959f220b2abULL,-	0x84842a8454ae15d0ULL, 0x7272d572b7a7e4c5ULL, 0x3939e439d5dd72ecULL, 0x4c4c2d4c5a619816ULL,-	0x5e5e655eca3bbc94ULL, 0x7878fd78e785f09fULL, 0x3838e038ddd870e5ULL, 0x8c8c0a8c14860598ULL,-	0xd1d163d1c6b2bf17ULL, 0xa5a5aea5410b57e4ULL, 0xe2e2afe2434dd9a1ULL, 0x616199612ff8c24eULL,-	0xb3b3f6b3f1457b42ULL, 0x2121842115a54234ULL, 0x9c9c4a9c94d62508ULL, 0x1e1e781ef0663ceeULL,-	0x4343114322528661ULL, 0xc7c73bc776fc93b1ULL, 0xfcfcd7fcb32be54fULL, 0x0404100420140824ULL,-	0x51515951b208a2e3ULL, 0x99995e99bcc72f25ULL, 0x6d6da96d4fc4da22ULL, 0x0d0d340d68391a65ULL,-	0xfafacffa8335e979ULL, 0xdfdf5bdfb684a369ULL, 0x7e7ee57ed79bfca9ULL, 0x242490243db44819ULL,-	0x3b3bec3bc5d776feULL, 0xabab96ab313d4b9aULL, 0xcece1fce3ed181f0ULL, 0x1111441188552299ULL,-	0x8f8f068f0c890383ULL, 0x4e4e254e4a6b9c04ULL, 0xb7b7e6b7d1517366ULL, 0xebeb8beb0b60cbe0ULL,-	0x3c3cf03cfdcc78c1ULL, 0x81813e817cbf1ffdULL, 0x94946a94d4fe3540ULL, 0xf7f7fbf7eb0cf31cULL,-	0xb9b9deb9a1676f18ULL, 0x13134c13985f268bULL, 0x2c2cb02c7d9c5851ULL, 0xd3d36bd3d6b8bb05ULL,-	0xe7e7bbe76b5cd38cULL, 0x6e6ea56e57cbdc39ULL, 0xc4c437c46ef395aaULL, 0x03030c03180f061bULL,-	0x565645568a13acdcULL, 0x44440d441a49885eULL, 0x7f7fe17fdf9efea0ULL, 0xa9a99ea921374f88ULL,-	0x2a2aa82a4d825467ULL, 0xbbbbd6bbb16d6b0aULL, 0xc1c123c146e29f87ULL, 0x53535153a202a6f1ULL,-	0xdcdc57dcae8ba572ULL, 0x0b0b2c0b58271653ULL, 0x9d9d4e9d9cd32701ULL, 0x6c6cad6c47c1d82bULL,-	0x3131c43195f562a4ULL, 0x7474cd7487b9e8f3ULL, 0xf6f6fff6e309f115ULL, 0x464605460a438c4cULL,-	0xacac8aac092645a5ULL, 0x89891e893c970fb5ULL, 0x14145014a04428b4ULL, 0xe1e1a3e15b42dfbaULL,-	0x16165816b04e2ca6ULL, 0x3a3ae83acdd274f7ULL, 0x6969b9696fd0d206ULL, 0x09092409482d1241ULL,-	0x7070dd70a7ade0d7ULL, 0xb6b6e2b6d954716fULL, 0xd0d067d0ceb7bd1eULL, 0xeded93ed3b7ec7d6ULL,-	0xcccc17cc2edb85e2ULL, 0x424215422a578468ULL, 0x98985a98b4c22d2cULL, 0xa4a4aaa4490e55edULL,-	0x2828a0285d885075ULL, 0x5c5c6d5cda31b886ULL, 0xf8f8c7f8933fed6bULL, 0x8686228644a411c2ULL,-};--static const uint64_t C1[256] = {-	0xd818186018c07830ULL, 0x2623238c2305af46ULL, 0xb8c6c63fc67ef991ULL, 0xfbe8e887e8136fcdULL,-	0xcb878726874ca113ULL, 0x11b8b8dab8a9626dULL, 0x0901010401080502ULL, 0x0d4f4f214f426e9eULL,-	0x9b3636d836adee6cULL, 0xffa6a6a2a6590451ULL, 0x0cd2d26fd2debdb9ULL, 0x0ef5f5f3f5fb06f7ULL,-	0x967979f979ef80f2ULL, 0x306f6fa16f5fcedeULL, 0x6d91917e91fcef3fULL, 0xf852525552aa07a4ULL,-	0x4760609d6027fdc0ULL, 0x35bcbccabc897665ULL, 0x379b9b569baccd2bULL, 0x8a8e8e028e048c01ULL,-	0xd2a3a3b6a371155bULL, 0x6c0c0c300c603c18ULL, 0x847b7bf17bff8af6ULL, 0x803535d435b5e16aULL,-	0xf51d1d741de8693aULL, 0xb3e0e0a7e05347ddULL, 0x21d7d77bd7f6acb3ULL, 0x9cc2c22fc25eed99ULL,-	0x432e2eb82e6d965cULL, 0x294b4b314b627a96ULL, 0x5dfefedffea321e1ULL, 0xd5575741578216aeULL,-	0xbd15155415a8412aULL, 0xe87777c1779fb6eeULL, 0x923737dc37a5eb6eULL, 0x9ee5e5b3e57b56d7ULL,-	0x139f9f469f8cd923ULL, 0x23f0f0e7f0d317fdULL, 0x204a4a354a6a7f94ULL, 0x44dada4fda9e95a9ULL,-	0xa258587d58fa25b0ULL, 0xcfc9c903c906ca8fULL, 0x7c2929a429558d52ULL, 0x5a0a0a280a502214ULL,-	0x50b1b1feb1e14f7fULL, 0xc9a0a0baa0691a5dULL, 0x146b6bb16b7fdad6ULL, 0xd985852e855cab17ULL,-	0x3cbdbdcebd817367ULL, 0x8f5d5d695dd234baULL, 0x9010104010805020ULL, 0x07f4f4f7f4f303f5ULL,-	0xddcbcb0bcb16c08bULL, 0xd33e3ef83eedc67cULL, 0x2d0505140528110aULL, 0x78676781671fe6ceULL,-	0x97e4e4b7e47353d5ULL, 0x0227279c2725bb4eULL, 0x7341411941325882ULL, 0xa78b8b168b2c9d0bULL,-	0xf6a7a7a6a7510153ULL, 0xb27d7de97dcf94faULL, 0x4995956e95dcfb37ULL, 0x56d8d847d88e9fadULL,-	0x70fbfbcbfb8b30ebULL, 0xcdeeee9fee2371c1ULL, 0xbb7c7ced7cc791f8ULL, 0x716666856617e3ccULL,-	0x7bdddd53dda68ea7ULL, 0xaf17175c17b84b2eULL, 0x454747014702468eULL, 0x1a9e9e429e84dc21ULL,-	0xd4caca0fca1ec589ULL, 0x582d2db42d75995aULL, 0x2ebfbfc6bf917963ULL, 0x3f07071c07381b0eULL,-	0xacadad8ead012347ULL, 0xb05a5a755aea2fb4ULL, 0xef838336836cb51bULL, 0xb63333cc3385ff66ULL,-	0x5c636391633ff2c6ULL, 0x1202020802100a04ULL, 0x93aaaa92aa393849ULL, 0xde7171d971afa8e2ULL,-	0xc6c8c807c80ecf8dULL, 0xd119196419c87d32ULL, 0x3b49493949727092ULL, 0x5fd9d943d9869aafULL,-	0x31f2f2eff2c31df9ULL, 0xa8e3e3abe34b48dbULL, 0xb95b5b715be22ab6ULL, 0xbc88881a8834920dULL,-	0x3e9a9a529aa4c829ULL, 0x0b262698262dbe4cULL, 0xbf3232c8328dfa64ULL, 0x59b0b0fab0e94a7dULL,-	0xf2e9e983e91b6acfULL, 0x770f0f3c0f78331eULL, 0x33d5d573d5e6a6b7ULL, 0xf480803a8074ba1dULL,-	0x27bebec2be997c61ULL, 0xebcdcd13cd26de87ULL, 0x893434d034bde468ULL, 0x3248483d487a7590ULL,-	0x54ffffdbffab24e3ULL, 0x8d7a7af57af78ff4ULL, 0x6490907a90f4ea3dULL, 0x9d5f5f615fc23ebeULL,-	0x3d202080201da040ULL, 0x0f6868bd6867d5d0ULL, 0xca1a1a681ad07234ULL, 0xb7aeae82ae192c41ULL,-	0x7db4b4eab4c95e75ULL, 0xce54544d549a19a8ULL, 0x7f93937693ece53bULL, 0x2f222288220daa44ULL,-	0x6364648d6407e9c8ULL, 0x2af1f1e3f1db12ffULL, 0xcc7373d173bfa2e6ULL, 0x8212124812905a24ULL,-	0x7a40401d403a5d80ULL, 0x4808082008402810ULL, 0x95c3c32bc356e89bULL, 0xdfecec97ec337bc5ULL,-	0x4ddbdb4bdb9690abULL, 0xc0a1a1bea1611f5fULL, 0x918d8d0e8d1c8307ULL, 0xc83d3df43df5c97aULL,-	0x5b97976697ccf133ULL, 0x0000000000000000ULL, 0xf9cfcf1bcf36d483ULL, 0x6e2b2bac2b458756ULL,-	0xe17676c57697b3ecULL, 0xe68282328264b019ULL, 0x28d6d67fd6fea9b1ULL, 0xc31b1b6c1bd87736ULL,-	0x74b5b5eeb5c15b77ULL, 0xbeafaf86af112943ULL, 0x1d6a6ab56a77dfd4ULL, 0xea50505d50ba0da0ULL,-	0x5745450945124c8aULL, 0x38f3f3ebf3cb18fbULL, 0xad3030c0309df060ULL, 0xc4efef9bef2b74c3ULL,-	0xda3f3ffc3fe5c37eULL, 0xc755554955921caaULL, 0xdba2a2b2a2791059ULL, 0xe9eaea8fea0365c9ULL,-	0x6a656589650feccaULL, 0x03babad2bab96869ULL, 0x4a2f2fbc2f65935eULL, 0x8ec0c027c04ee79dULL,-	0x60dede5fdebe81a1ULL, 0xfc1c1c701ce06c38ULL, 0x46fdfdd3fdbb2ee7ULL, 0x1f4d4d294d52649aULL,-	0x7692927292e4e039ULL, 0xfa7575c9758fbceaULL, 0x3606061806301e0cULL, 0xae8a8a128a249809ULL,-	0x4bb2b2f2b2f94079ULL, 0x85e6e6bfe66359d1ULL, 0x7e0e0e380e70361cULL, 0xe71f1f7c1ff8633eULL,-	0x556262956237f7c4ULL, 0x3ad4d477d4eea3b5ULL, 0x81a8a89aa829324dULL, 0x5296966296c4f431ULL,-	0x62f9f9c3f99b3aefULL, 0xa3c5c533c566f697ULL, 0x102525942535b14aULL, 0xab59597959f220b2ULL,-	0xd084842a8454ae15ULL, 0xc57272d572b7a7e4ULL, 0xec3939e439d5dd72ULL, 0x164c4c2d4c5a6198ULL,-	0x945e5e655eca3bbcULL, 0x9f7878fd78e785f0ULL, 0xe53838e038ddd870ULL, 0x988c8c0a8c148605ULL,-	0x17d1d163d1c6b2bfULL, 0xe4a5a5aea5410b57ULL, 0xa1e2e2afe2434dd9ULL, 0x4e616199612ff8c2ULL,-	0x42b3b3f6b3f1457bULL, 0x342121842115a542ULL, 0x089c9c4a9c94d625ULL, 0xee1e1e781ef0663cULL,-	0x6143431143225286ULL, 0xb1c7c73bc776fc93ULL, 0x4ffcfcd7fcb32be5ULL, 0x2404041004201408ULL,-	0xe351515951b208a2ULL, 0x2599995e99bcc72fULL, 0x226d6da96d4fc4daULL, 0x650d0d340d68391aULL,-	0x79fafacffa8335e9ULL, 0x69dfdf5bdfb684a3ULL, 0xa97e7ee57ed79bfcULL, 0x19242490243db448ULL,-	0xfe3b3bec3bc5d776ULL, 0x9aabab96ab313d4bULL, 0xf0cece1fce3ed181ULL, 0x9911114411885522ULL,-	0x838f8f068f0c8903ULL, 0x044e4e254e4a6b9cULL, 0x66b7b7e6b7d15173ULL, 0xe0ebeb8beb0b60cbULL,-	0xc13c3cf03cfdcc78ULL, 0xfd81813e817cbf1fULL, 0x4094946a94d4fe35ULL, 0x1cf7f7fbf7eb0cf3ULL,-	0x18b9b9deb9a1676fULL, 0x8b13134c13985f26ULL, 0x512c2cb02c7d9c58ULL, 0x05d3d36bd3d6b8bbULL,-	0x8ce7e7bbe76b5cd3ULL, 0x396e6ea56e57cbdcULL, 0xaac4c437c46ef395ULL, 0x1b03030c03180f06ULL,-	0xdc565645568a13acULL, 0x5e44440d441a4988ULL, 0xa07f7fe17fdf9efeULL, 0x88a9a99ea921374fULL,-	0x672a2aa82a4d8254ULL, 0x0abbbbd6bbb16d6bULL, 0x87c1c123c146e29fULL, 0xf153535153a202a6ULL,-	0x72dcdc57dcae8ba5ULL, 0x530b0b2c0b582716ULL, 0x019d9d4e9d9cd327ULL, 0x2b6c6cad6c47c1d8ULL,-	0xa43131c43195f562ULL, 0xf37474cd7487b9e8ULL, 0x15f6f6fff6e309f1ULL, 0x4c464605460a438cULL,-	0xa5acac8aac092645ULL, 0xb589891e893c970fULL, 0xb414145014a04428ULL, 0xbae1e1a3e15b42dfULL,-	0xa616165816b04e2cULL, 0xf73a3ae83acdd274ULL, 0x066969b9696fd0d2ULL, 0x4109092409482d12ULL,-	0xd77070dd70a7ade0ULL, 0x6fb6b6e2b6d95471ULL, 0x1ed0d067d0ceb7bdULL, 0xd6eded93ed3b7ec7ULL,-	0xe2cccc17cc2edb85ULL, 0x68424215422a5784ULL, 0x2c98985a98b4c22dULL, 0xeda4a4aaa4490e55ULL,-	0x752828a0285d8850ULL, 0x865c5c6d5cda31b8ULL, 0x6bf8f8c7f8933fedULL, 0xc28686228644a411ULL,-};--static const uint64_t C2[256] = {-	0x30d818186018c078ULL, 0x462623238c2305afULL, 0x91b8c6c63fc67ef9ULL, 0xcdfbe8e887e8136fULL,-	0x13cb878726874ca1ULL, 0x6d11b8b8dab8a962ULL, 0x0209010104010805ULL, 0x9e0d4f4f214f426eULL,-	0x6c9b3636d836adeeULL, 0x51ffa6a6a2a65904ULL, 0xb90cd2d26fd2debdULL, 0xf70ef5f5f3f5fb06ULL,-	0xf2967979f979ef80ULL, 0xde306f6fa16f5fceULL, 0x3f6d91917e91fcefULL, 0xa4f852525552aa07ULL,-	0xc04760609d6027fdULL, 0x6535bcbccabc8976ULL, 0x2b379b9b569baccdULL, 0x018a8e8e028e048cULL,-	0x5bd2a3a3b6a37115ULL, 0x186c0c0c300c603cULL, 0xf6847b7bf17bff8aULL, 0x6a803535d435b5e1ULL,-	0x3af51d1d741de869ULL, 0xddb3e0e0a7e05347ULL, 0xb321d7d77bd7f6acULL, 0x999cc2c22fc25eedULL,-	0x5c432e2eb82e6d96ULL, 0x96294b4b314b627aULL, 0xe15dfefedffea321ULL, 0xaed5575741578216ULL,-	0x2abd15155415a841ULL, 0xeee87777c1779fb6ULL, 0x6e923737dc37a5ebULL, 0xd79ee5e5b3e57b56ULL,-	0x23139f9f469f8cd9ULL, 0xfd23f0f0e7f0d317ULL, 0x94204a4a354a6a7fULL, 0xa944dada4fda9e95ULL,-	0xb0a258587d58fa25ULL, 0x8fcfc9c903c906caULL, 0x527c2929a429558dULL, 0x145a0a0a280a5022ULL,-	0x7f50b1b1feb1e14fULL, 0x5dc9a0a0baa0691aULL, 0xd6146b6bb16b7fdaULL, 0x17d985852e855cabULL,-	0x673cbdbdcebd8173ULL, 0xba8f5d5d695dd234ULL, 0x2090101040108050ULL, 0xf507f4f4f7f4f303ULL,-	0x8bddcbcb0bcb16c0ULL, 0x7cd33e3ef83eedc6ULL, 0x0a2d050514052811ULL, 0xce78676781671fe6ULL,-	0xd597e4e4b7e47353ULL, 0x4e0227279c2725bbULL, 0x8273414119413258ULL, 0x0ba78b8b168b2c9dULL,-	0x53f6a7a7a6a75101ULL, 0xfab27d7de97dcf94ULL, 0x374995956e95dcfbULL, 0xad56d8d847d88e9fULL,-	0xeb70fbfbcbfb8b30ULL, 0xc1cdeeee9fee2371ULL, 0xf8bb7c7ced7cc791ULL, 0xcc716666856617e3ULL,-	0xa77bdddd53dda68eULL, 0x2eaf17175c17b84bULL, 0x8e45474701470246ULL, 0x211a9e9e429e84dcULL,-	0x89d4caca0fca1ec5ULL, 0x5a582d2db42d7599ULL, 0x632ebfbfc6bf9179ULL, 0x0e3f07071c07381bULL,-	0x47acadad8ead0123ULL, 0xb4b05a5a755aea2fULL, 0x1bef838336836cb5ULL, 0x66b63333cc3385ffULL,-	0xc65c636391633ff2ULL, 0x041202020802100aULL, 0x4993aaaa92aa3938ULL, 0xe2de7171d971afa8ULL,-	0x8dc6c8c807c80ecfULL, 0x32d119196419c87dULL, 0x923b494939497270ULL, 0xaf5fd9d943d9869aULL,-	0xf931f2f2eff2c31dULL, 0xdba8e3e3abe34b48ULL, 0xb6b95b5b715be22aULL, 0x0dbc88881a883492ULL,-	0x293e9a9a529aa4c8ULL, 0x4c0b262698262dbeULL, 0x64bf3232c8328dfaULL, 0x7d59b0b0fab0e94aULL,-	0xcff2e9e983e91b6aULL, 0x1e770f0f3c0f7833ULL, 0xb733d5d573d5e6a6ULL, 0x1df480803a8074baULL,-	0x6127bebec2be997cULL, 0x87ebcdcd13cd26deULL, 0x68893434d034bde4ULL, 0x903248483d487a75ULL,-	0xe354ffffdbffab24ULL, 0xf48d7a7af57af78fULL, 0x3d6490907a90f4eaULL, 0xbe9d5f5f615fc23eULL,-	0x403d202080201da0ULL, 0xd00f6868bd6867d5ULL, 0x34ca1a1a681ad072ULL, 0x41b7aeae82ae192cULL,-	0x757db4b4eab4c95eULL, 0xa8ce54544d549a19ULL, 0x3b7f93937693ece5ULL, 0x442f222288220daaULL,-	0xc86364648d6407e9ULL, 0xff2af1f1e3f1db12ULL, 0xe6cc7373d173bfa2ULL, 0x248212124812905aULL,-	0x807a40401d403a5dULL, 0x1048080820084028ULL, 0x9b95c3c32bc356e8ULL, 0xc5dfecec97ec337bULL,-	0xab4ddbdb4bdb9690ULL, 0x5fc0a1a1bea1611fULL, 0x07918d8d0e8d1c83ULL, 0x7ac83d3df43df5c9ULL,-	0x335b97976697ccf1ULL, 0x0000000000000000ULL, 0x83f9cfcf1bcf36d4ULL, 0x566e2b2bac2b4587ULL,-	0xece17676c57697b3ULL, 0x19e68282328264b0ULL, 0xb128d6d67fd6fea9ULL, 0x36c31b1b6c1bd877ULL,-	0x7774b5b5eeb5c15bULL, 0x43beafaf86af1129ULL, 0xd41d6a6ab56a77dfULL, 0xa0ea50505d50ba0dULL,-	0x8a5745450945124cULL, 0xfb38f3f3ebf3cb18ULL, 0x60ad3030c0309df0ULL, 0xc3c4efef9bef2b74ULL,-	0x7eda3f3ffc3fe5c3ULL, 0xaac755554955921cULL, 0x59dba2a2b2a27910ULL, 0xc9e9eaea8fea0365ULL,-	0xca6a656589650fecULL, 0x6903babad2bab968ULL, 0x5e4a2f2fbc2f6593ULL, 0x9d8ec0c027c04ee7ULL,-	0xa160dede5fdebe81ULL, 0x38fc1c1c701ce06cULL, 0xe746fdfdd3fdbb2eULL, 0x9a1f4d4d294d5264ULL,-	0x397692927292e4e0ULL, 0xeafa7575c9758fbcULL, 0x0c3606061806301eULL, 0x09ae8a8a128a2498ULL,-	0x794bb2b2f2b2f940ULL, 0xd185e6e6bfe66359ULL, 0x1c7e0e0e380e7036ULL, 0x3ee71f1f7c1ff863ULL,-	0xc4556262956237f7ULL, 0xb53ad4d477d4eea3ULL, 0x4d81a8a89aa82932ULL, 0x315296966296c4f4ULL,-	0xef62f9f9c3f99b3aULL, 0x97a3c5c533c566f6ULL, 0x4a102525942535b1ULL, 0xb2ab59597959f220ULL,-	0x15d084842a8454aeULL, 0xe4c57272d572b7a7ULL, 0x72ec3939e439d5ddULL, 0x98164c4c2d4c5a61ULL,-	0xbc945e5e655eca3bULL, 0xf09f7878fd78e785ULL, 0x70e53838e038ddd8ULL, 0x05988c8c0a8c1486ULL,-	0xbf17d1d163d1c6b2ULL, 0x57e4a5a5aea5410bULL, 0xd9a1e2e2afe2434dULL, 0xc24e616199612ff8ULL,-	0x7b42b3b3f6b3f145ULL, 0x42342121842115a5ULL, 0x25089c9c4a9c94d6ULL, 0x3cee1e1e781ef066ULL,-	0x8661434311432252ULL, 0x93b1c7c73bc776fcULL, 0xe54ffcfcd7fcb32bULL, 0x0824040410042014ULL,-	0xa2e351515951b208ULL, 0x2f2599995e99bcc7ULL, 0xda226d6da96d4fc4ULL, 0x1a650d0d340d6839ULL,-	0xe979fafacffa8335ULL, 0xa369dfdf5bdfb684ULL, 0xfca97e7ee57ed79bULL, 0x4819242490243db4ULL,-	0x76fe3b3bec3bc5d7ULL, 0x4b9aabab96ab313dULL, 0x81f0cece1fce3ed1ULL, 0x2299111144118855ULL,-	0x03838f8f068f0c89ULL, 0x9c044e4e254e4a6bULL, 0x7366b7b7e6b7d151ULL, 0xcbe0ebeb8beb0b60ULL,-	0x78c13c3cf03cfdccULL, 0x1ffd81813e817cbfULL, 0x354094946a94d4feULL, 0xf31cf7f7fbf7eb0cULL,-	0x6f18b9b9deb9a167ULL, 0x268b13134c13985fULL, 0x58512c2cb02c7d9cULL, 0xbb05d3d36bd3d6b8ULL,-	0xd38ce7e7bbe76b5cULL, 0xdc396e6ea56e57cbULL, 0x95aac4c437c46ef3ULL, 0x061b03030c03180fULL,-	0xacdc565645568a13ULL, 0x885e44440d441a49ULL, 0xfea07f7fe17fdf9eULL, 0x4f88a9a99ea92137ULL,-	0x54672a2aa82a4d82ULL, 0x6b0abbbbd6bbb16dULL, 0x9f87c1c123c146e2ULL, 0xa6f153535153a202ULL,-	0xa572dcdc57dcae8bULL, 0x16530b0b2c0b5827ULL, 0x27019d9d4e9d9cd3ULL, 0xd82b6c6cad6c47c1ULL,-	0x62a43131c43195f5ULL, 0xe8f37474cd7487b9ULL, 0xf115f6f6fff6e309ULL, 0x8c4c464605460a43ULL,-	0x45a5acac8aac0926ULL, 0x0fb589891e893c97ULL, 0x28b414145014a044ULL, 0xdfbae1e1a3e15b42ULL,-	0x2ca616165816b04eULL, 0x74f73a3ae83acdd2ULL, 0xd2066969b9696fd0ULL, 0x124109092409482dULL,-	0xe0d77070dd70a7adULL, 0x716fb6b6e2b6d954ULL, 0xbd1ed0d067d0ceb7ULL, 0xc7d6eded93ed3b7eULL,-	0x85e2cccc17cc2edbULL, 0x8468424215422a57ULL, 0x2d2c98985a98b4c2ULL, 0x55eda4a4aaa4490eULL,-	0x50752828a0285d88ULL, 0xb8865c5c6d5cda31ULL, 0xed6bf8f8c7f8933fULL, 0x11c28686228644a4ULL,-};--static const uint64_t C3[256] = {-	0x7830d818186018c0ULL, 0xaf462623238c2305ULL, 0xf991b8c6c63fc67eULL, 0x6fcdfbe8e887e813ULL,-	0xa113cb878726874cULL, 0x626d11b8b8dab8a9ULL, 0x0502090101040108ULL, 0x6e9e0d4f4f214f42ULL,-	0xee6c9b3636d836adULL, 0x0451ffa6a6a2a659ULL, 0xbdb90cd2d26fd2deULL, 0x06f70ef5f5f3f5fbULL,-	0x80f2967979f979efULL, 0xcede306f6fa16f5fULL, 0xef3f6d91917e91fcULL, 0x07a4f852525552aaULL,-	0xfdc04760609d6027ULL, 0x766535bcbccabc89ULL, 0xcd2b379b9b569bacULL, 0x8c018a8e8e028e04ULL,-	0x155bd2a3a3b6a371ULL, 0x3c186c0c0c300c60ULL, 0x8af6847b7bf17bffULL, 0xe16a803535d435b5ULL,-	0x693af51d1d741de8ULL, 0x47ddb3e0e0a7e053ULL, 0xacb321d7d77bd7f6ULL, 0xed999cc2c22fc25eULL,-	0x965c432e2eb82e6dULL, 0x7a96294b4b314b62ULL, 0x21e15dfefedffea3ULL, 0x16aed55757415782ULL,-	0x412abd15155415a8ULL, 0xb6eee87777c1779fULL, 0xeb6e923737dc37a5ULL, 0x56d79ee5e5b3e57bULL,-	0xd923139f9f469f8cULL, 0x17fd23f0f0e7f0d3ULL, 0x7f94204a4a354a6aULL, 0x95a944dada4fda9eULL,-	0x25b0a258587d58faULL, 0xca8fcfc9c903c906ULL, 0x8d527c2929a42955ULL, 0x22145a0a0a280a50ULL,-	0x4f7f50b1b1feb1e1ULL, 0x1a5dc9a0a0baa069ULL, 0xdad6146b6bb16b7fULL, 0xab17d985852e855cULL,-	0x73673cbdbdcebd81ULL, 0x34ba8f5d5d695dd2ULL, 0x5020901010401080ULL, 0x03f507f4f4f7f4f3ULL,-	0xc08bddcbcb0bcb16ULL, 0xc67cd33e3ef83eedULL, 0x110a2d0505140528ULL, 0xe6ce78676781671fULL,-	0x53d597e4e4b7e473ULL, 0xbb4e0227279c2725ULL, 0x5882734141194132ULL, 0x9d0ba78b8b168b2cULL,-	0x0153f6a7a7a6a751ULL, 0x94fab27d7de97dcfULL, 0xfb374995956e95dcULL, 0x9fad56d8d847d88eULL,-	0x30eb70fbfbcbfb8bULL, 0x71c1cdeeee9fee23ULL, 0x91f8bb7c7ced7cc7ULL, 0xe3cc716666856617ULL,-	0x8ea77bdddd53dda6ULL, 0x4b2eaf17175c17b8ULL, 0x468e454747014702ULL, 0xdc211a9e9e429e84ULL,-	0xc589d4caca0fca1eULL, 0x995a582d2db42d75ULL, 0x79632ebfbfc6bf91ULL, 0x1b0e3f07071c0738ULL,-	0x2347acadad8ead01ULL, 0x2fb4b05a5a755aeaULL, 0xb51bef838336836cULL, 0xff66b63333cc3385ULL,-	0xf2c65c636391633fULL, 0x0a04120202080210ULL, 0x384993aaaa92aa39ULL, 0xa8e2de7171d971afULL,-	0xcf8dc6c8c807c80eULL, 0x7d32d119196419c8ULL, 0x70923b4949394972ULL, 0x9aaf5fd9d943d986ULL,-	0x1df931f2f2eff2c3ULL, 0x48dba8e3e3abe34bULL, 0x2ab6b95b5b715be2ULL, 0x920dbc88881a8834ULL,-	0xc8293e9a9a529aa4ULL, 0xbe4c0b262698262dULL, 0xfa64bf3232c8328dULL, 0x4a7d59b0b0fab0e9ULL,-	0x6acff2e9e983e91bULL, 0x331e770f0f3c0f78ULL, 0xa6b733d5d573d5e6ULL, 0xba1df480803a8074ULL,-	0x7c6127bebec2be99ULL, 0xde87ebcdcd13cd26ULL, 0xe468893434d034bdULL, 0x75903248483d487aULL,-	0x24e354ffffdbffabULL, 0x8ff48d7a7af57af7ULL, 0xea3d6490907a90f4ULL, 0x3ebe9d5f5f615fc2ULL,-	0xa0403d202080201dULL, 0xd5d00f6868bd6867ULL, 0x7234ca1a1a681ad0ULL, 0x2c41b7aeae82ae19ULL,-	0x5e757db4b4eab4c9ULL, 0x19a8ce54544d549aULL, 0xe53b7f93937693ecULL, 0xaa442f222288220dULL,-	0xe9c86364648d6407ULL, 0x12ff2af1f1e3f1dbULL, 0xa2e6cc7373d173bfULL, 0x5a24821212481290ULL,-	0x5d807a40401d403aULL, 0x2810480808200840ULL, 0xe89b95c3c32bc356ULL, 0x7bc5dfecec97ec33ULL,-	0x90ab4ddbdb4bdb96ULL, 0x1f5fc0a1a1bea161ULL, 0x8307918d8d0e8d1cULL, 0xc97ac83d3df43df5ULL,-	0xf1335b97976697ccULL, 0x0000000000000000ULL, 0xd483f9cfcf1bcf36ULL, 0x87566e2b2bac2b45ULL,-	0xb3ece17676c57697ULL, 0xb019e68282328264ULL, 0xa9b128d6d67fd6feULL, 0x7736c31b1b6c1bd8ULL,-	0x5b7774b5b5eeb5c1ULL, 0x2943beafaf86af11ULL, 0xdfd41d6a6ab56a77ULL, 0x0da0ea50505d50baULL,-	0x4c8a574545094512ULL, 0x18fb38f3f3ebf3cbULL, 0xf060ad3030c0309dULL, 0x74c3c4efef9bef2bULL,-	0xc37eda3f3ffc3fe5ULL, 0x1caac75555495592ULL, 0x1059dba2a2b2a279ULL, 0x65c9e9eaea8fea03ULL,-	0xecca6a656589650fULL, 0x686903babad2bab9ULL, 0x935e4a2f2fbc2f65ULL, 0xe79d8ec0c027c04eULL,-	0x81a160dede5fdebeULL, 0x6c38fc1c1c701ce0ULL, 0x2ee746fdfdd3fdbbULL, 0x649a1f4d4d294d52ULL,-	0xe0397692927292e4ULL, 0xbceafa7575c9758fULL, 0x1e0c360606180630ULL, 0x9809ae8a8a128a24ULL,-	0x40794bb2b2f2b2f9ULL, 0x59d185e6e6bfe663ULL, 0x361c7e0e0e380e70ULL, 0x633ee71f1f7c1ff8ULL,-	0xf7c4556262956237ULL, 0xa3b53ad4d477d4eeULL, 0x324d81a8a89aa829ULL, 0xf4315296966296c4ULL,-	0x3aef62f9f9c3f99bULL, 0xf697a3c5c533c566ULL, 0xb14a102525942535ULL, 0x20b2ab59597959f2ULL,-	0xae15d084842a8454ULL, 0xa7e4c57272d572b7ULL, 0xdd72ec3939e439d5ULL, 0x6198164c4c2d4c5aULL,-	0x3bbc945e5e655ecaULL, 0x85f09f7878fd78e7ULL, 0xd870e53838e038ddULL, 0x8605988c8c0a8c14ULL,-	0xb2bf17d1d163d1c6ULL, 0x0b57e4a5a5aea541ULL, 0x4dd9a1e2e2afe243ULL, 0xf8c24e616199612fULL,-	0x457b42b3b3f6b3f1ULL, 0xa542342121842115ULL, 0xd625089c9c4a9c94ULL, 0x663cee1e1e781ef0ULL,-	0x5286614343114322ULL, 0xfc93b1c7c73bc776ULL, 0x2be54ffcfcd7fcb3ULL, 0x1408240404100420ULL,-	0x08a2e351515951b2ULL, 0xc72f2599995e99bcULL, 0xc4da226d6da96d4fULL, 0x391a650d0d340d68ULL,-	0x35e979fafacffa83ULL, 0x84a369dfdf5bdfb6ULL, 0x9bfca97e7ee57ed7ULL, 0xb44819242490243dULL,-	0xd776fe3b3bec3bc5ULL, 0x3d4b9aabab96ab31ULL, 0xd181f0cece1fce3eULL, 0x5522991111441188ULL,-	0x8903838f8f068f0cULL, 0x6b9c044e4e254e4aULL, 0x517366b7b7e6b7d1ULL, 0x60cbe0ebeb8beb0bULL,-	0xcc78c13c3cf03cfdULL, 0xbf1ffd81813e817cULL, 0xfe354094946a94d4ULL, 0x0cf31cf7f7fbf7ebULL,-	0x676f18b9b9deb9a1ULL, 0x5f268b13134c1398ULL, 0x9c58512c2cb02c7dULL, 0xb8bb05d3d36bd3d6ULL,-	0x5cd38ce7e7bbe76bULL, 0xcbdc396e6ea56e57ULL, 0xf395aac4c437c46eULL, 0x0f061b03030c0318ULL,-	0x13acdc565645568aULL, 0x49885e44440d441aULL, 0x9efea07f7fe17fdfULL, 0x374f88a9a99ea921ULL,-	0x8254672a2aa82a4dULL, 0x6d6b0abbbbd6bbb1ULL, 0xe29f87c1c123c146ULL, 0x02a6f153535153a2ULL,-	0x8ba572dcdc57dcaeULL, 0x2716530b0b2c0b58ULL, 0xd327019d9d4e9d9cULL, 0xc1d82b6c6cad6c47ULL,-	0xf562a43131c43195ULL, 0xb9e8f37474cd7487ULL, 0x09f115f6f6fff6e3ULL, 0x438c4c464605460aULL,-	0x2645a5acac8aac09ULL, 0x970fb589891e893cULL, 0x4428b414145014a0ULL, 0x42dfbae1e1a3e15bULL,-	0x4e2ca616165816b0ULL, 0xd274f73a3ae83acdULL, 0xd0d2066969b9696fULL, 0x2d12410909240948ULL,-	0xade0d77070dd70a7ULL, 0x54716fb6b6e2b6d9ULL, 0xb7bd1ed0d067d0ceULL, 0x7ec7d6eded93ed3bULL,-	0xdb85e2cccc17cc2eULL, 0x578468424215422aULL, 0xc22d2c98985a98b4ULL, 0x0e55eda4a4aaa449ULL,-	0x8850752828a0285dULL, 0x31b8865c5c6d5cdaULL, 0x3fed6bf8f8c7f893ULL, 0xa411c28686228644ULL,-};--static const uint64_t C4[256] = {-	0xc07830d818186018ULL, 0x05af462623238c23ULL, 0x7ef991b8c6c63fc6ULL, 0x136fcdfbe8e887e8ULL,-	0x4ca113cb87872687ULL, 0xa9626d11b8b8dab8ULL, 0x0805020901010401ULL, 0x426e9e0d4f4f214fULL,-	0xadee6c9b3636d836ULL, 0x590451ffa6a6a2a6ULL, 0xdebdb90cd2d26fd2ULL, 0xfb06f70ef5f5f3f5ULL,-	0xef80f2967979f979ULL, 0x5fcede306f6fa16fULL, 0xfcef3f6d91917e91ULL, 0xaa07a4f852525552ULL,-	0x27fdc04760609d60ULL, 0x89766535bcbccabcULL, 0xaccd2b379b9b569bULL, 0x048c018a8e8e028eULL,-	0x71155bd2a3a3b6a3ULL, 0x603c186c0c0c300cULL, 0xff8af6847b7bf17bULL, 0xb5e16a803535d435ULL,-	0xe8693af51d1d741dULL, 0x5347ddb3e0e0a7e0ULL, 0xf6acb321d7d77bd7ULL, 0x5eed999cc2c22fc2ULL,-	0x6d965c432e2eb82eULL, 0x627a96294b4b314bULL, 0xa321e15dfefedffeULL, 0x8216aed557574157ULL,-	0xa8412abd15155415ULL, 0x9fb6eee87777c177ULL, 0xa5eb6e923737dc37ULL, 0x7b56d79ee5e5b3e5ULL,-	0x8cd923139f9f469fULL, 0xd317fd23f0f0e7f0ULL, 0x6a7f94204a4a354aULL, 0x9e95a944dada4fdaULL,-	0xfa25b0a258587d58ULL, 0x06ca8fcfc9c903c9ULL, 0x558d527c2929a429ULL, 0x5022145a0a0a280aULL,-	0xe14f7f50b1b1feb1ULL, 0x691a5dc9a0a0baa0ULL, 0x7fdad6146b6bb16bULL, 0x5cab17d985852e85ULL,-	0x8173673cbdbdcebdULL, 0xd234ba8f5d5d695dULL, 0x8050209010104010ULL, 0xf303f507f4f4f7f4ULL,-	0x16c08bddcbcb0bcbULL, 0xedc67cd33e3ef83eULL, 0x28110a2d05051405ULL, 0x1fe6ce7867678167ULL,-	0x7353d597e4e4b7e4ULL, 0x25bb4e0227279c27ULL, 0x3258827341411941ULL, 0x2c9d0ba78b8b168bULL,-	0x510153f6a7a7a6a7ULL, 0xcf94fab27d7de97dULL, 0xdcfb374995956e95ULL, 0x8e9fad56d8d847d8ULL,-	0x8b30eb70fbfbcbfbULL, 0x2371c1cdeeee9feeULL, 0xc791f8bb7c7ced7cULL, 0x17e3cc7166668566ULL,-	0xa68ea77bdddd53ddULL, 0xb84b2eaf17175c17ULL, 0x02468e4547470147ULL, 0x84dc211a9e9e429eULL,-	0x1ec589d4caca0fcaULL, 0x75995a582d2db42dULL, 0x9179632ebfbfc6bfULL, 0x381b0e3f07071c07ULL,-	0x012347acadad8eadULL, 0xea2fb4b05a5a755aULL, 0x6cb51bef83833683ULL, 0x85ff66b63333cc33ULL,-	0x3ff2c65c63639163ULL, 0x100a041202020802ULL, 0x39384993aaaa92aaULL, 0xafa8e2de7171d971ULL,-	0x0ecf8dc6c8c807c8ULL, 0xc87d32d119196419ULL, 0x7270923b49493949ULL, 0x869aaf5fd9d943d9ULL,-	0xc31df931f2f2eff2ULL, 0x4b48dba8e3e3abe3ULL, 0xe22ab6b95b5b715bULL, 0x34920dbc88881a88ULL,-	0xa4c8293e9a9a529aULL, 0x2dbe4c0b26269826ULL, 0x8dfa64bf3232c832ULL, 0xe94a7d59b0b0fab0ULL,-	0x1b6acff2e9e983e9ULL, 0x78331e770f0f3c0fULL, 0xe6a6b733d5d573d5ULL, 0x74ba1df480803a80ULL,-	0x997c6127bebec2beULL, 0x26de87ebcdcd13cdULL, 0xbde468893434d034ULL, 0x7a75903248483d48ULL,-	0xab24e354ffffdbffULL, 0xf78ff48d7a7af57aULL, 0xf4ea3d6490907a90ULL, 0xc23ebe9d5f5f615fULL,-	0x1da0403d20208020ULL, 0x67d5d00f6868bd68ULL, 0xd07234ca1a1a681aULL, 0x192c41b7aeae82aeULL,-	0xc95e757db4b4eab4ULL, 0x9a19a8ce54544d54ULL, 0xece53b7f93937693ULL, 0x0daa442f22228822ULL,-	0x07e9c86364648d64ULL, 0xdb12ff2af1f1e3f1ULL, 0xbfa2e6cc7373d173ULL, 0x905a248212124812ULL,-	0x3a5d807a40401d40ULL, 0x4028104808082008ULL, 0x56e89b95c3c32bc3ULL, 0x337bc5dfecec97ecULL,-	0x9690ab4ddbdb4bdbULL, 0x611f5fc0a1a1bea1ULL, 0x1c8307918d8d0e8dULL, 0xf5c97ac83d3df43dULL,-	0xccf1335b97976697ULL, 0x0000000000000000ULL, 0x36d483f9cfcf1bcfULL, 0x4587566e2b2bac2bULL,-	0x97b3ece17676c576ULL, 0x64b019e682823282ULL, 0xfea9b128d6d67fd6ULL, 0xd87736c31b1b6c1bULL,-	0xc15b7774b5b5eeb5ULL, 0x112943beafaf86afULL, 0x77dfd41d6a6ab56aULL, 0xba0da0ea50505d50ULL,-	0x124c8a5745450945ULL, 0xcb18fb38f3f3ebf3ULL, 0x9df060ad3030c030ULL, 0x2b74c3c4efef9befULL,-	0xe5c37eda3f3ffc3fULL, 0x921caac755554955ULL, 0x791059dba2a2b2a2ULL, 0x0365c9e9eaea8feaULL,-	0x0fecca6a65658965ULL, 0xb9686903babad2baULL, 0x65935e4a2f2fbc2fULL, 0x4ee79d8ec0c027c0ULL,-	0xbe81a160dede5fdeULL, 0xe06c38fc1c1c701cULL, 0xbb2ee746fdfdd3fdULL, 0x52649a1f4d4d294dULL,-	0xe4e0397692927292ULL, 0x8fbceafa7575c975ULL, 0x301e0c3606061806ULL, 0x249809ae8a8a128aULL,-	0xf940794bb2b2f2b2ULL, 0x6359d185e6e6bfe6ULL, 0x70361c7e0e0e380eULL, 0xf8633ee71f1f7c1fULL,-	0x37f7c45562629562ULL, 0xeea3b53ad4d477d4ULL, 0x29324d81a8a89aa8ULL, 0xc4f4315296966296ULL,-	0x9b3aef62f9f9c3f9ULL, 0x66f697a3c5c533c5ULL, 0x35b14a1025259425ULL, 0xf220b2ab59597959ULL,-	0x54ae15d084842a84ULL, 0xb7a7e4c57272d572ULL, 0xd5dd72ec3939e439ULL, 0x5a6198164c4c2d4cULL,-	0xca3bbc945e5e655eULL, 0xe785f09f7878fd78ULL, 0xddd870e53838e038ULL, 0x148605988c8c0a8cULL,-	0xc6b2bf17d1d163d1ULL, 0x410b57e4a5a5aea5ULL, 0x434dd9a1e2e2afe2ULL, 0x2ff8c24e61619961ULL,-	0xf1457b42b3b3f6b3ULL, 0x15a5423421218421ULL, 0x94d625089c9c4a9cULL, 0xf0663cee1e1e781eULL,-	0x2252866143431143ULL, 0x76fc93b1c7c73bc7ULL, 0xb32be54ffcfcd7fcULL, 0x2014082404041004ULL,-	0xb208a2e351515951ULL, 0xbcc72f2599995e99ULL, 0x4fc4da226d6da96dULL, 0x68391a650d0d340dULL,-	0x8335e979fafacffaULL, 0xb684a369dfdf5bdfULL, 0xd79bfca97e7ee57eULL, 0x3db4481924249024ULL,-	0xc5d776fe3b3bec3bULL, 0x313d4b9aabab96abULL, 0x3ed181f0cece1fceULL, 0x8855229911114411ULL,-	0x0c8903838f8f068fULL, 0x4a6b9c044e4e254eULL, 0xd1517366b7b7e6b7ULL, 0x0b60cbe0ebeb8bebULL,-	0xfdcc78c13c3cf03cULL, 0x7cbf1ffd81813e81ULL, 0xd4fe354094946a94ULL, 0xeb0cf31cf7f7fbf7ULL,-	0xa1676f18b9b9deb9ULL, 0x985f268b13134c13ULL, 0x7d9c58512c2cb02cULL, 0xd6b8bb05d3d36bd3ULL,-	0x6b5cd38ce7e7bbe7ULL, 0x57cbdc396e6ea56eULL, 0x6ef395aac4c437c4ULL, 0x180f061b03030c03ULL,-	0x8a13acdc56564556ULL, 0x1a49885e44440d44ULL, 0xdf9efea07f7fe17fULL, 0x21374f88a9a99ea9ULL,-	0x4d8254672a2aa82aULL, 0xb16d6b0abbbbd6bbULL, 0x46e29f87c1c123c1ULL, 0xa202a6f153535153ULL,-	0xae8ba572dcdc57dcULL, 0x582716530b0b2c0bULL, 0x9cd327019d9d4e9dULL, 0x47c1d82b6c6cad6cULL,-	0x95f562a43131c431ULL, 0x87b9e8f37474cd74ULL, 0xe309f115f6f6fff6ULL, 0x0a438c4c46460546ULL,-	0x092645a5acac8aacULL, 0x3c970fb589891e89ULL, 0xa04428b414145014ULL, 0x5b42dfbae1e1a3e1ULL,-	0xb04e2ca616165816ULL, 0xcdd274f73a3ae83aULL, 0x6fd0d2066969b969ULL, 0x482d124109092409ULL,-	0xa7ade0d77070dd70ULL, 0xd954716fb6b6e2b6ULL, 0xceb7bd1ed0d067d0ULL, 0x3b7ec7d6eded93edULL,-	0x2edb85e2cccc17ccULL, 0x2a57846842421542ULL, 0xb4c22d2c98985a98ULL, 0x490e55eda4a4aaa4ULL,-	0x5d8850752828a028ULL, 0xda31b8865c5c6d5cULL, 0x933fed6bf8f8c7f8ULL, 0x44a411c286862286ULL,-};--static const uint64_t C5[256] = {-	0x18c07830d8181860ULL, 0x2305af462623238cULL, 0xc67ef991b8c6c63fULL, 0xe8136fcdfbe8e887ULL,-	0x874ca113cb878726ULL, 0xb8a9626d11b8b8daULL, 0x0108050209010104ULL, 0x4f426e9e0d4f4f21ULL,-	0x36adee6c9b3636d8ULL, 0xa6590451ffa6a6a2ULL, 0xd2debdb90cd2d26fULL, 0xf5fb06f70ef5f5f3ULL,-	0x79ef80f2967979f9ULL, 0x6f5fcede306f6fa1ULL, 0x91fcef3f6d91917eULL, 0x52aa07a4f8525255ULL,-	0x6027fdc04760609dULL, 0xbc89766535bcbccaULL, 0x9baccd2b379b9b56ULL, 0x8e048c018a8e8e02ULL,-	0xa371155bd2a3a3b6ULL, 0x0c603c186c0c0c30ULL, 0x7bff8af6847b7bf1ULL, 0x35b5e16a803535d4ULL,-	0x1de8693af51d1d74ULL, 0xe05347ddb3e0e0a7ULL, 0xd7f6acb321d7d77bULL, 0xc25eed999cc2c22fULL,-	0x2e6d965c432e2eb8ULL, 0x4b627a96294b4b31ULL, 0xfea321e15dfefedfULL, 0x578216aed5575741ULL,-	0x15a8412abd151554ULL, 0x779fb6eee87777c1ULL, 0x37a5eb6e923737dcULL, 0xe57b56d79ee5e5b3ULL,-	0x9f8cd923139f9f46ULL, 0xf0d317fd23f0f0e7ULL, 0x4a6a7f94204a4a35ULL, 0xda9e95a944dada4fULL,-	0x58fa25b0a258587dULL, 0xc906ca8fcfc9c903ULL, 0x29558d527c2929a4ULL, 0x0a5022145a0a0a28ULL,-	0xb1e14f7f50b1b1feULL, 0xa0691a5dc9a0a0baULL, 0x6b7fdad6146b6bb1ULL, 0x855cab17d985852eULL,-	0xbd8173673cbdbdceULL, 0x5dd234ba8f5d5d69ULL, 0x1080502090101040ULL, 0xf4f303f507f4f4f7ULL,-	0xcb16c08bddcbcb0bULL, 0x3eedc67cd33e3ef8ULL, 0x0528110a2d050514ULL, 0x671fe6ce78676781ULL,-	0xe47353d597e4e4b7ULL, 0x2725bb4e0227279cULL, 0x4132588273414119ULL, 0x8b2c9d0ba78b8b16ULL,-	0xa7510153f6a7a7a6ULL, 0x7dcf94fab27d7de9ULL, 0x95dcfb374995956eULL, 0xd88e9fad56d8d847ULL,-	0xfb8b30eb70fbfbcbULL, 0xee2371c1cdeeee9fULL, 0x7cc791f8bb7c7cedULL, 0x6617e3cc71666685ULL,-	0xdda68ea77bdddd53ULL, 0x17b84b2eaf17175cULL, 0x4702468e45474701ULL, 0x9e84dc211a9e9e42ULL,-	0xca1ec589d4caca0fULL, 0x2d75995a582d2db4ULL, 0xbf9179632ebfbfc6ULL, 0x07381b0e3f07071cULL,-	0xad012347acadad8eULL, 0x5aea2fb4b05a5a75ULL, 0x836cb51bef838336ULL, 0x3385ff66b63333ccULL,-	0x633ff2c65c636391ULL, 0x02100a0412020208ULL, 0xaa39384993aaaa92ULL, 0x71afa8e2de7171d9ULL,-	0xc80ecf8dc6c8c807ULL, 0x19c87d32d1191964ULL, 0x497270923b494939ULL, 0xd9869aaf5fd9d943ULL,-	0xf2c31df931f2f2efULL, 0xe34b48dba8e3e3abULL, 0x5be22ab6b95b5b71ULL, 0x8834920dbc88881aULL,-	0x9aa4c8293e9a9a52ULL, 0x262dbe4c0b262698ULL, 0x328dfa64bf3232c8ULL, 0xb0e94a7d59b0b0faULL,-	0xe91b6acff2e9e983ULL, 0x0f78331e770f0f3cULL, 0xd5e6a6b733d5d573ULL, 0x8074ba1df480803aULL,-	0xbe997c6127bebec2ULL, 0xcd26de87ebcdcd13ULL, 0x34bde468893434d0ULL, 0x487a75903248483dULL,-	0xffab24e354ffffdbULL, 0x7af78ff48d7a7af5ULL, 0x90f4ea3d6490907aULL, 0x5fc23ebe9d5f5f61ULL,-	0x201da0403d202080ULL, 0x6867d5d00f6868bdULL, 0x1ad07234ca1a1a68ULL, 0xae192c41b7aeae82ULL,-	0xb4c95e757db4b4eaULL, 0x549a19a8ce54544dULL, 0x93ece53b7f939376ULL, 0x220daa442f222288ULL,-	0x6407e9c86364648dULL, 0xf1db12ff2af1f1e3ULL, 0x73bfa2e6cc7373d1ULL, 0x12905a2482121248ULL,-	0x403a5d807a40401dULL, 0x0840281048080820ULL, 0xc356e89b95c3c32bULL, 0xec337bc5dfecec97ULL,-	0xdb9690ab4ddbdb4bULL, 0xa1611f5fc0a1a1beULL, 0x8d1c8307918d8d0eULL, 0x3df5c97ac83d3df4ULL,-	0x97ccf1335b979766ULL, 0x0000000000000000ULL, 0xcf36d483f9cfcf1bULL, 0x2b4587566e2b2bacULL,-	0x7697b3ece17676c5ULL, 0x8264b019e6828232ULL, 0xd6fea9b128d6d67fULL, 0x1bd87736c31b1b6cULL,-	0xb5c15b7774b5b5eeULL, 0xaf112943beafaf86ULL, 0x6a77dfd41d6a6ab5ULL, 0x50ba0da0ea50505dULL,-	0x45124c8a57454509ULL, 0xf3cb18fb38f3f3ebULL, 0x309df060ad3030c0ULL, 0xef2b74c3c4efef9bULL,-	0x3fe5c37eda3f3ffcULL, 0x55921caac7555549ULL, 0xa2791059dba2a2b2ULL, 0xea0365c9e9eaea8fULL,-	0x650fecca6a656589ULL, 0xbab9686903babad2ULL, 0x2f65935e4a2f2fbcULL, 0xc04ee79d8ec0c027ULL,-	0xdebe81a160dede5fULL, 0x1ce06c38fc1c1c70ULL, 0xfdbb2ee746fdfdd3ULL, 0x4d52649a1f4d4d29ULL,-	0x92e4e03976929272ULL, 0x758fbceafa7575c9ULL, 0x06301e0c36060618ULL, 0x8a249809ae8a8a12ULL,-	0xb2f940794bb2b2f2ULL, 0xe66359d185e6e6bfULL, 0x0e70361c7e0e0e38ULL, 0x1ff8633ee71f1f7cULL,-	0x6237f7c455626295ULL, 0xd4eea3b53ad4d477ULL, 0xa829324d81a8a89aULL, 0x96c4f43152969662ULL,-	0xf99b3aef62f9f9c3ULL, 0xc566f697a3c5c533ULL, 0x2535b14a10252594ULL, 0x59f220b2ab595979ULL,-	0x8454ae15d084842aULL, 0x72b7a7e4c57272d5ULL, 0x39d5dd72ec3939e4ULL, 0x4c5a6198164c4c2dULL,-	0x5eca3bbc945e5e65ULL, 0x78e785f09f7878fdULL, 0x38ddd870e53838e0ULL, 0x8c148605988c8c0aULL,-	0xd1c6b2bf17d1d163ULL, 0xa5410b57e4a5a5aeULL, 0xe2434dd9a1e2e2afULL, 0x612ff8c24e616199ULL,-	0xb3f1457b42b3b3f6ULL, 0x2115a54234212184ULL, 0x9c94d625089c9c4aULL, 0x1ef0663cee1e1e78ULL,-	0x4322528661434311ULL, 0xc776fc93b1c7c73bULL, 0xfcb32be54ffcfcd7ULL, 0x0420140824040410ULL,-	0x51b208a2e3515159ULL, 0x99bcc72f2599995eULL, 0x6d4fc4da226d6da9ULL, 0x0d68391a650d0d34ULL,-	0xfa8335e979fafacfULL, 0xdfb684a369dfdf5bULL, 0x7ed79bfca97e7ee5ULL, 0x243db44819242490ULL,-	0x3bc5d776fe3b3becULL, 0xab313d4b9aabab96ULL, 0xce3ed181f0cece1fULL, 0x1188552299111144ULL,-	0x8f0c8903838f8f06ULL, 0x4e4a6b9c044e4e25ULL, 0xb7d1517366b7b7e6ULL, 0xeb0b60cbe0ebeb8bULL,-	0x3cfdcc78c13c3cf0ULL, 0x817cbf1ffd81813eULL, 0x94d4fe354094946aULL, 0xf7eb0cf31cf7f7fbULL,-	0xb9a1676f18b9b9deULL, 0x13985f268b13134cULL, 0x2c7d9c58512c2cb0ULL, 0xd3d6b8bb05d3d36bULL,-	0xe76b5cd38ce7e7bbULL, 0x6e57cbdc396e6ea5ULL, 0xc46ef395aac4c437ULL, 0x03180f061b03030cULL,-	0x568a13acdc565645ULL, 0x441a49885e44440dULL, 0x7fdf9efea07f7fe1ULL, 0xa921374f88a9a99eULL,-	0x2a4d8254672a2aa8ULL, 0xbbb16d6b0abbbbd6ULL, 0xc146e29f87c1c123ULL, 0x53a202a6f1535351ULL,-	0xdcae8ba572dcdc57ULL, 0x0b582716530b0b2cULL, 0x9d9cd327019d9d4eULL, 0x6c47c1d82b6c6cadULL,-	0x3195f562a43131c4ULL, 0x7487b9e8f37474cdULL, 0xf6e309f115f6f6ffULL, 0x460a438c4c464605ULL,-	0xac092645a5acac8aULL, 0x893c970fb589891eULL, 0x14a04428b4141450ULL, 0xe15b42dfbae1e1a3ULL,-	0x16b04e2ca6161658ULL, 0x3acdd274f73a3ae8ULL, 0x696fd0d2066969b9ULL, 0x09482d1241090924ULL,-	0x70a7ade0d77070ddULL, 0xb6d954716fb6b6e2ULL, 0xd0ceb7bd1ed0d067ULL, 0xed3b7ec7d6eded93ULL,-	0xcc2edb85e2cccc17ULL, 0x422a578468424215ULL, 0x98b4c22d2c98985aULL, 0xa4490e55eda4a4aaULL,-	0x285d8850752828a0ULL, 0x5cda31b8865c5c6dULL, 0xf8933fed6bf8f8c7ULL, 0x8644a411c2868622ULL,-};--static const uint64_t C6[256] = {-	0x6018c07830d81818ULL, 0x8c2305af46262323ULL, 0x3fc67ef991b8c6c6ULL, 0x87e8136fcdfbe8e8ULL,-	0x26874ca113cb8787ULL, 0xdab8a9626d11b8b8ULL, 0x0401080502090101ULL, 0x214f426e9e0d4f4fULL,-	0xd836adee6c9b3636ULL, 0xa2a6590451ffa6a6ULL, 0x6fd2debdb90cd2d2ULL, 0xf3f5fb06f70ef5f5ULL,-	0xf979ef80f2967979ULL, 0xa16f5fcede306f6fULL, 0x7e91fcef3f6d9191ULL, 0x5552aa07a4f85252ULL,-	0x9d6027fdc0476060ULL, 0xcabc89766535bcbcULL, 0x569baccd2b379b9bULL, 0x028e048c018a8e8eULL,-	0xb6a371155bd2a3a3ULL, 0x300c603c186c0c0cULL, 0xf17bff8af6847b7bULL, 0xd435b5e16a803535ULL,-	0x741de8693af51d1dULL, 0xa7e05347ddb3e0e0ULL, 0x7bd7f6acb321d7d7ULL, 0x2fc25eed999cc2c2ULL,-	0xb82e6d965c432e2eULL, 0x314b627a96294b4bULL, 0xdffea321e15dfefeULL, 0x41578216aed55757ULL,-	0x5415a8412abd1515ULL, 0xc1779fb6eee87777ULL, 0xdc37a5eb6e923737ULL, 0xb3e57b56d79ee5e5ULL,-	0x469f8cd923139f9fULL, 0xe7f0d317fd23f0f0ULL, 0x354a6a7f94204a4aULL, 0x4fda9e95a944dadaULL,-	0x7d58fa25b0a25858ULL, 0x03c906ca8fcfc9c9ULL, 0xa429558d527c2929ULL, 0x280a5022145a0a0aULL,-	0xfeb1e14f7f50b1b1ULL, 0xbaa0691a5dc9a0a0ULL, 0xb16b7fdad6146b6bULL, 0x2e855cab17d98585ULL,-	0xcebd8173673cbdbdULL, 0x695dd234ba8f5d5dULL, 0x4010805020901010ULL, 0xf7f4f303f507f4f4ULL,-	0x0bcb16c08bddcbcbULL, 0xf83eedc67cd33e3eULL, 0x140528110a2d0505ULL, 0x81671fe6ce786767ULL,-	0xb7e47353d597e4e4ULL, 0x9c2725bb4e022727ULL, 0x1941325882734141ULL, 0x168b2c9d0ba78b8bULL,-	0xa6a7510153f6a7a7ULL, 0xe97dcf94fab27d7dULL, 0x6e95dcfb37499595ULL, 0x47d88e9fad56d8d8ULL,-	0xcbfb8b30eb70fbfbULL, 0x9fee2371c1cdeeeeULL, 0xed7cc791f8bb7c7cULL, 0x856617e3cc716666ULL,-	0x53dda68ea77bddddULL, 0x5c17b84b2eaf1717ULL, 0x014702468e454747ULL, 0x429e84dc211a9e9eULL,-	0x0fca1ec589d4cacaULL, 0xb42d75995a582d2dULL, 0xc6bf9179632ebfbfULL, 0x1c07381b0e3f0707ULL,-	0x8ead012347acadadULL, 0x755aea2fb4b05a5aULL, 0x36836cb51bef8383ULL, 0xcc3385ff66b63333ULL,-	0x91633ff2c65c6363ULL, 0x0802100a04120202ULL, 0x92aa39384993aaaaULL, 0xd971afa8e2de7171ULL,-	0x07c80ecf8dc6c8c8ULL, 0x6419c87d32d11919ULL, 0x39497270923b4949ULL, 0x43d9869aaf5fd9d9ULL,-	0xeff2c31df931f2f2ULL, 0xabe34b48dba8e3e3ULL, 0x715be22ab6b95b5bULL, 0x1a8834920dbc8888ULL,-	0x529aa4c8293e9a9aULL, 0x98262dbe4c0b2626ULL, 0xc8328dfa64bf3232ULL, 0xfab0e94a7d59b0b0ULL,-	0x83e91b6acff2e9e9ULL, 0x3c0f78331e770f0fULL, 0x73d5e6a6b733d5d5ULL, 0x3a8074ba1df48080ULL,-	0xc2be997c6127bebeULL, 0x13cd26de87ebcdcdULL, 0xd034bde468893434ULL, 0x3d487a7590324848ULL,-	0xdbffab24e354ffffULL, 0xf57af78ff48d7a7aULL, 0x7a90f4ea3d649090ULL, 0x615fc23ebe9d5f5fULL,-	0x80201da0403d2020ULL, 0xbd6867d5d00f6868ULL, 0x681ad07234ca1a1aULL, 0x82ae192c41b7aeaeULL,-	0xeab4c95e757db4b4ULL, 0x4d549a19a8ce5454ULL, 0x7693ece53b7f9393ULL, 0x88220daa442f2222ULL,-	0x8d6407e9c8636464ULL, 0xe3f1db12ff2af1f1ULL, 0xd173bfa2e6cc7373ULL, 0x4812905a24821212ULL,-	0x1d403a5d807a4040ULL, 0x2008402810480808ULL, 0x2bc356e89b95c3c3ULL, 0x97ec337bc5dfececULL,-	0x4bdb9690ab4ddbdbULL, 0xbea1611f5fc0a1a1ULL, 0x0e8d1c8307918d8dULL, 0xf43df5c97ac83d3dULL,-	0x6697ccf1335b9797ULL, 0x0000000000000000ULL, 0x1bcf36d483f9cfcfULL, 0xac2b4587566e2b2bULL,-	0xc57697b3ece17676ULL, 0x328264b019e68282ULL, 0x7fd6fea9b128d6d6ULL, 0x6c1bd87736c31b1bULL,-	0xeeb5c15b7774b5b5ULL, 0x86af112943beafafULL, 0xb56a77dfd41d6a6aULL, 0x5d50ba0da0ea5050ULL,-	0x0945124c8a574545ULL, 0xebf3cb18fb38f3f3ULL, 0xc0309df060ad3030ULL, 0x9bef2b74c3c4efefULL,-	0xfc3fe5c37eda3f3fULL, 0x4955921caac75555ULL, 0xb2a2791059dba2a2ULL, 0x8fea0365c9e9eaeaULL,-	0x89650fecca6a6565ULL, 0xd2bab9686903babaULL, 0xbc2f65935e4a2f2fULL, 0x27c04ee79d8ec0c0ULL,-	0x5fdebe81a160dedeULL, 0x701ce06c38fc1c1cULL, 0xd3fdbb2ee746fdfdULL, 0x294d52649a1f4d4dULL,-	0x7292e4e039769292ULL, 0xc9758fbceafa7575ULL, 0x1806301e0c360606ULL, 0x128a249809ae8a8aULL,-	0xf2b2f940794bb2b2ULL, 0xbfe66359d185e6e6ULL, 0x380e70361c7e0e0eULL, 0x7c1ff8633ee71f1fULL,-	0x956237f7c4556262ULL, 0x77d4eea3b53ad4d4ULL, 0x9aa829324d81a8a8ULL, 0x6296c4f431529696ULL,-	0xc3f99b3aef62f9f9ULL, 0x33c566f697a3c5c5ULL, 0x942535b14a102525ULL, 0x7959f220b2ab5959ULL,-	0x2a8454ae15d08484ULL, 0xd572b7a7e4c57272ULL, 0xe439d5dd72ec3939ULL, 0x2d4c5a6198164c4cULL,-	0x655eca3bbc945e5eULL, 0xfd78e785f09f7878ULL, 0xe038ddd870e53838ULL, 0x0a8c148605988c8cULL,-	0x63d1c6b2bf17d1d1ULL, 0xaea5410b57e4a5a5ULL, 0xafe2434dd9a1e2e2ULL, 0x99612ff8c24e6161ULL,-	0xf6b3f1457b42b3b3ULL, 0x842115a542342121ULL, 0x4a9c94d625089c9cULL, 0x781ef0663cee1e1eULL,-	0x1143225286614343ULL, 0x3bc776fc93b1c7c7ULL, 0xd7fcb32be54ffcfcULL, 0x1004201408240404ULL,-	0x5951b208a2e35151ULL, 0x5e99bcc72f259999ULL, 0xa96d4fc4da226d6dULL, 0x340d68391a650d0dULL,-	0xcffa8335e979fafaULL, 0x5bdfb684a369dfdfULL, 0xe57ed79bfca97e7eULL, 0x90243db448192424ULL,-	0xec3bc5d776fe3b3bULL, 0x96ab313d4b9aababULL, 0x1fce3ed181f0ceceULL, 0x4411885522991111ULL,-	0x068f0c8903838f8fULL, 0x254e4a6b9c044e4eULL, 0xe6b7d1517366b7b7ULL, 0x8beb0b60cbe0ebebULL,-	0xf03cfdcc78c13c3cULL, 0x3e817cbf1ffd8181ULL, 0x6a94d4fe35409494ULL, 0xfbf7eb0cf31cf7f7ULL,-	0xdeb9a1676f18b9b9ULL, 0x4c13985f268b1313ULL, 0xb02c7d9c58512c2cULL, 0x6bd3d6b8bb05d3d3ULL,-	0xbbe76b5cd38ce7e7ULL, 0xa56e57cbdc396e6eULL, 0x37c46ef395aac4c4ULL, 0x0c03180f061b0303ULL,-	0x45568a13acdc5656ULL, 0x0d441a49885e4444ULL, 0xe17fdf9efea07f7fULL, 0x9ea921374f88a9a9ULL,-	0xa82a4d8254672a2aULL, 0xd6bbb16d6b0abbbbULL, 0x23c146e29f87c1c1ULL, 0x5153a202a6f15353ULL,-	0x57dcae8ba572dcdcULL, 0x2c0b582716530b0bULL, 0x4e9d9cd327019d9dULL, 0xad6c47c1d82b6c6cULL,-	0xc43195f562a43131ULL, 0xcd7487b9e8f37474ULL, 0xfff6e309f115f6f6ULL, 0x05460a438c4c4646ULL,-	0x8aac092645a5acacULL, 0x1e893c970fb58989ULL, 0x5014a04428b41414ULL, 0xa3e15b42dfbae1e1ULL,-	0x5816b04e2ca61616ULL, 0xe83acdd274f73a3aULL, 0xb9696fd0d2066969ULL, 0x2409482d12410909ULL,-	0xdd70a7ade0d77070ULL, 0xe2b6d954716fb6b6ULL, 0x67d0ceb7bd1ed0d0ULL, 0x93ed3b7ec7d6ededULL,-	0x17cc2edb85e2ccccULL, 0x15422a5784684242ULL, 0x5a98b4c22d2c9898ULL, 0xaaa4490e55eda4a4ULL,-	0xa0285d8850752828ULL, 0x6d5cda31b8865c5cULL, 0xc7f8933fed6bf8f8ULL, 0x228644a411c28686ULL,-};--static const uint64_t C7[256] = {-	0x186018c07830d818ULL, 0x238c2305af462623ULL, 0xc63fc67ef991b8c6ULL, 0xe887e8136fcdfbe8ULL,-	0x8726874ca113cb87ULL, 0xb8dab8a9626d11b8ULL, 0x0104010805020901ULL, 0x4f214f426e9e0d4fULL,-	0x36d836adee6c9b36ULL, 0xa6a2a6590451ffa6ULL, 0xd26fd2debdb90cd2ULL, 0xf5f3f5fb06f70ef5ULL,-	0x79f979ef80f29679ULL, 0x6fa16f5fcede306fULL, 0x917e91fcef3f6d91ULL, 0x525552aa07a4f852ULL,-	0x609d6027fdc04760ULL, 0xbccabc89766535bcULL, 0x9b569baccd2b379bULL, 0x8e028e048c018a8eULL,-	0xa3b6a371155bd2a3ULL, 0x0c300c603c186c0cULL, 0x7bf17bff8af6847bULL, 0x35d435b5e16a8035ULL,-	0x1d741de8693af51dULL, 0xe0a7e05347ddb3e0ULL, 0xd77bd7f6acb321d7ULL, 0xc22fc25eed999cc2ULL,-	0x2eb82e6d965c432eULL, 0x4b314b627a96294bULL, 0xfedffea321e15dfeULL, 0x5741578216aed557ULL,-	0x155415a8412abd15ULL, 0x77c1779fb6eee877ULL, 0x37dc37a5eb6e9237ULL, 0xe5b3e57b56d79ee5ULL,-	0x9f469f8cd923139fULL, 0xf0e7f0d317fd23f0ULL, 0x4a354a6a7f94204aULL, 0xda4fda9e95a944daULL,-	0x587d58fa25b0a258ULL, 0xc903c906ca8fcfc9ULL, 0x29a429558d527c29ULL, 0x0a280a5022145a0aULL,-	0xb1feb1e14f7f50b1ULL, 0xa0baa0691a5dc9a0ULL, 0x6bb16b7fdad6146bULL, 0x852e855cab17d985ULL,-	0xbdcebd8173673cbdULL, 0x5d695dd234ba8f5dULL, 0x1040108050209010ULL, 0xf4f7f4f303f507f4ULL,-	0xcb0bcb16c08bddcbULL, 0x3ef83eedc67cd33eULL, 0x05140528110a2d05ULL, 0x6781671fe6ce7867ULL,-	0xe4b7e47353d597e4ULL, 0x279c2725bb4e0227ULL, 0x4119413258827341ULL, 0x8b168b2c9d0ba78bULL,-	0xa7a6a7510153f6a7ULL, 0x7de97dcf94fab27dULL, 0x956e95dcfb374995ULL, 0xd847d88e9fad56d8ULL,-	0xfbcbfb8b30eb70fbULL, 0xee9fee2371c1cdeeULL, 0x7ced7cc791f8bb7cULL, 0x66856617e3cc7166ULL,-	0xdd53dda68ea77bddULL, 0x175c17b84b2eaf17ULL, 0x47014702468e4547ULL, 0x9e429e84dc211a9eULL,-	0xca0fca1ec589d4caULL, 0x2db42d75995a582dULL, 0xbfc6bf9179632ebfULL, 0x071c07381b0e3f07ULL,-	0xad8ead012347acadULL, 0x5a755aea2fb4b05aULL, 0x8336836cb51bef83ULL, 0x33cc3385ff66b633ULL,-	0x6391633ff2c65c63ULL, 0x020802100a041202ULL, 0xaa92aa39384993aaULL, 0x71d971afa8e2de71ULL,-	0xc807c80ecf8dc6c8ULL, 0x196419c87d32d119ULL, 0x4939497270923b49ULL, 0xd943d9869aaf5fd9ULL,-	0xf2eff2c31df931f2ULL, 0xe3abe34b48dba8e3ULL, 0x5b715be22ab6b95bULL, 0x881a8834920dbc88ULL,-	0x9a529aa4c8293e9aULL, 0x2698262dbe4c0b26ULL, 0x32c8328dfa64bf32ULL, 0xb0fab0e94a7d59b0ULL,-	0xe983e91b6acff2e9ULL, 0x0f3c0f78331e770fULL, 0xd573d5e6a6b733d5ULL, 0x803a8074ba1df480ULL,-	0xbec2be997c6127beULL, 0xcd13cd26de87ebcdULL, 0x34d034bde4688934ULL, 0x483d487a75903248ULL,-	0xffdbffab24e354ffULL, 0x7af57af78ff48d7aULL, 0x907a90f4ea3d6490ULL, 0x5f615fc23ebe9d5fULL,-	0x2080201da0403d20ULL, 0x68bd6867d5d00f68ULL, 0x1a681ad07234ca1aULL, 0xae82ae192c41b7aeULL,-	0xb4eab4c95e757db4ULL, 0x544d549a19a8ce54ULL, 0x937693ece53b7f93ULL, 0x2288220daa442f22ULL,-	0x648d6407e9c86364ULL, 0xf1e3f1db12ff2af1ULL, 0x73d173bfa2e6cc73ULL, 0x124812905a248212ULL,-	0x401d403a5d807a40ULL, 0x0820084028104808ULL, 0xc32bc356e89b95c3ULL, 0xec97ec337bc5dfecULL,-	0xdb4bdb9690ab4ddbULL, 0xa1bea1611f5fc0a1ULL, 0x8d0e8d1c8307918dULL, 0x3df43df5c97ac83dULL,-	0x976697ccf1335b97ULL, 0x0000000000000000ULL, 0xcf1bcf36d483f9cfULL, 0x2bac2b4587566e2bULL,-	0x76c57697b3ece176ULL, 0x82328264b019e682ULL, 0xd67fd6fea9b128d6ULL, 0x1b6c1bd87736c31bULL,-	0xb5eeb5c15b7774b5ULL, 0xaf86af112943beafULL, 0x6ab56a77dfd41d6aULL, 0x505d50ba0da0ea50ULL,-	0x450945124c8a5745ULL, 0xf3ebf3cb18fb38f3ULL, 0x30c0309df060ad30ULL, 0xef9bef2b74c3c4efULL,-	0x3ffc3fe5c37eda3fULL, 0x554955921caac755ULL, 0xa2b2a2791059dba2ULL, 0xea8fea0365c9e9eaULL,-	0x6589650fecca6a65ULL, 0xbad2bab9686903baULL, 0x2fbc2f65935e4a2fULL, 0xc027c04ee79d8ec0ULL,-	0xde5fdebe81a160deULL, 0x1c701ce06c38fc1cULL, 0xfdd3fdbb2ee746fdULL, 0x4d294d52649a1f4dULL,-	0x927292e4e0397692ULL, 0x75c9758fbceafa75ULL, 0x061806301e0c3606ULL, 0x8a128a249809ae8aULL,-	0xb2f2b2f940794bb2ULL, 0xe6bfe66359d185e6ULL, 0x0e380e70361c7e0eULL, 0x1f7c1ff8633ee71fULL,-	0x62956237f7c45562ULL, 0xd477d4eea3b53ad4ULL, 0xa89aa829324d81a8ULL, 0x966296c4f4315296ULL,-	0xf9c3f99b3aef62f9ULL, 0xc533c566f697a3c5ULL, 0x25942535b14a1025ULL, 0x597959f220b2ab59ULL,-	0x842a8454ae15d084ULL, 0x72d572b7a7e4c572ULL, 0x39e439d5dd72ec39ULL, 0x4c2d4c5a6198164cULL,-	0x5e655eca3bbc945eULL, 0x78fd78e785f09f78ULL, 0x38e038ddd870e538ULL, 0x8c0a8c148605988cULL,-	0xd163d1c6b2bf17d1ULL, 0xa5aea5410b57e4a5ULL, 0xe2afe2434dd9a1e2ULL, 0x6199612ff8c24e61ULL,-	0xb3f6b3f1457b42b3ULL, 0x21842115a5423421ULL, 0x9c4a9c94d625089cULL, 0x1e781ef0663cee1eULL,-	0x4311432252866143ULL, 0xc73bc776fc93b1c7ULL, 0xfcd7fcb32be54ffcULL, 0x0410042014082404ULL,-	0x515951b208a2e351ULL, 0x995e99bcc72f2599ULL, 0x6da96d4fc4da226dULL, 0x0d340d68391a650dULL,-	0xfacffa8335e979faULL, 0xdf5bdfb684a369dfULL, 0x7ee57ed79bfca97eULL, 0x2490243db4481924ULL,-	0x3bec3bc5d776fe3bULL, 0xab96ab313d4b9aabULL, 0xce1fce3ed181f0ceULL, 0x1144118855229911ULL,-	0x8f068f0c8903838fULL, 0x4e254e4a6b9c044eULL, 0xb7e6b7d1517366b7ULL, 0xeb8beb0b60cbe0ebULL,-	0x3cf03cfdcc78c13cULL, 0x813e817cbf1ffd81ULL, 0x946a94d4fe354094ULL, 0xf7fbf7eb0cf31cf7ULL,-	0xb9deb9a1676f18b9ULL, 0x134c13985f268b13ULL, 0x2cb02c7d9c58512cULL, 0xd36bd3d6b8bb05d3ULL,-	0xe7bbe76b5cd38ce7ULL, 0x6ea56e57cbdc396eULL, 0xc437c46ef395aac4ULL, 0x030c03180f061b03ULL,-	0x5645568a13acdc56ULL, 0x440d441a49885e44ULL, 0x7fe17fdf9efea07fULL, 0xa99ea921374f88a9ULL,-	0x2aa82a4d8254672aULL, 0xbbd6bbb16d6b0abbULL, 0xc123c146e29f87c1ULL, 0x535153a202a6f153ULL,-	0xdc57dcae8ba572dcULL, 0x0b2c0b582716530bULL, 0x9d4e9d9cd327019dULL, 0x6cad6c47c1d82b6cULL,-	0x31c43195f562a431ULL, 0x74cd7487b9e8f374ULL, 0xf6fff6e309f115f6ULL, 0x4605460a438c4c46ULL,-	0xac8aac092645a5acULL, 0x891e893c970fb589ULL, 0x145014a04428b414ULL, 0xe1a3e15b42dfbae1ULL,-	0x165816b04e2ca616ULL, 0x3ae83acdd274f73aULL, 0x69b9696fd0d20669ULL, 0x092409482d124109ULL,-	0x70dd70a7ade0d770ULL, 0xb6e2b6d954716fb6ULL, 0xd067d0ceb7bd1ed0ULL, 0xed93ed3b7ec7d6edULL,-	0xcc17cc2edb85e2ccULL, 0x4215422a57846842ULL, 0x985a98b4c22d2c98ULL, 0xa4aaa4490e55eda4ULL,-	0x28a0285d88507528ULL, 0x5c6d5cda31b8865cULL, 0xf8c7f8933fed6bf8ULL, 0x86228644a411c286ULL,-};--static const uint64_t rc[R + 1] = {-	0x0000000000000000ULL,-	0x1823c6e887b8014fULL,-	0x36a6d2f5796f9152ULL,-	0x60bc9b8ea30c7b35ULL,-	0x1de0d7c22e4bfe57ULL,-	0x157737e59ff04adaULL,-	0x58c9290ab1a06b85ULL,-	0xbd5d10f4cb3e0567ULL,-	0xe427418ba77d95d8ULL,-	0xfbee7c66dd17479eULL,-	0xca2dbf07ad5a8333ULL,-};--/* This might not be true for all platforms and compilers. */-#define SANE_ARRAY_PACKING 1--#if defined(SANE_ARRAY_PACKING) && (defined(ARCH_IS_LITTLE_ENDIAN) || defined(ARCH_IS_BIG_ENDIAN))--#if defined(ARCH_IS_LITTLE_ENDIAN)-#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 7]] \-	^ C1[mu[((n+7)%8) * 8 + 6]] \-	^ C2[mu[((n+6)%8) * 8 + 5]] \-	^ C3[mu[((n+5)%8) * 8 + 4]] \-	^ C4[mu[((n+4)%8) * 8 + 3]] \-	^ C5[mu[((n+3)%8) * 8 + 2]] \-	^ C6[mu[((n+2)%8) * 8 + 1]] \-	^ C7[mu[((n+1)%8) * 8 + 0]] \-	; } while (0)-#else-#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 0]] \-	^ C1[mu[((n+7)%8) * 8 + 1]] \-	^ C2[mu[((n+6)%8) * 8 + 2]] \-	^ C3[mu[((n+5)%8) * 8 + 3]] \-	^ C4[mu[((n+4)%8) * 8 + 4]] \-	^ C5[mu[((n+3)%8) * 8 + 5]] \-	^ C6[mu[((n+2)%8) * 8 + 6]] \-	^ C7[mu[((n+1)%8) * 8 + 7]] \-	; } while (0)-#endif--static void transformMatrix(uint64_t m[8])-{-	uint64_t L[8];-	uint8_t *mu = (uint8_t*)m;--	LB(0);-	LB(1);-	LB(2);-	LB(3);-	LB(4);-	LB(5);-	LB(6);-	LB(7);--	array_copy64(m, L, 8);-}--#else--static void transformMatrix(uint64_t m[8])-{-	uint64_t L[8];--	L[0] =-		C0[(int)(m[0] >> 56)       ] ^-		C1[(int)(m[7] >> 48) & 0xff] ^-		C2[(int)(m[6] >> 40) & 0xff] ^-		C3[(int)(m[5] >> 32) & 0xff] ^-		C4[(int)(m[4] >> 24) & 0xff] ^-		C5[(int)(m[3] >> 16) & 0xff] ^-		C6[(int)(m[2] >>  8) & 0xff] ^-		C7[(int)(m[1]      ) & 0xff];-	L[1] =-		C0[(int)(m[1] >> 56)       ] ^-		C1[(int)(m[0] >> 48) & 0xff] ^-		C2[(int)(m[7] >> 40) & 0xff] ^-		C3[(int)(m[6] >> 32) & 0xff] ^-		C4[(int)(m[5] >> 24) & 0xff] ^-		C5[(int)(m[4] >> 16) & 0xff] ^-		C6[(int)(m[3] >>  8) & 0xff] ^-		C7[(int)(m[2]      ) & 0xff];-	L[2] =-		C0[(int)(m[2] >> 56)       ] ^-		C1[(int)(m[1] >> 48) & 0xff] ^-		C2[(int)(m[0] >> 40) & 0xff] ^-		C3[(int)(m[7] >> 32) & 0xff] ^-		C4[(int)(m[6] >> 24) & 0xff] ^-		C5[(int)(m[5] >> 16) & 0xff] ^-		C6[(int)(m[4] >>  8) & 0xff] ^-		C7[(int)(m[3]      ) & 0xff];-	L[3] =-		C0[(int)(m[3] >> 56)       ] ^-		C1[(int)(m[2] >> 48) & 0xff] ^-		C2[(int)(m[1] >> 40) & 0xff] ^-		C3[(int)(m[0] >> 32) & 0xff] ^-		C4[(int)(m[7] >> 24) & 0xff] ^-		C5[(int)(m[6] >> 16) & 0xff] ^-		C6[(int)(m[5] >>  8) & 0xff] ^-		C7[(int)(m[4]      ) & 0xff];-	L[4] =-		C0[(int)(m[4] >> 56)       ] ^-		C1[(int)(m[3] >> 48) & 0xff] ^-		C2[(int)(m[2] >> 40) & 0xff] ^-		C3[(int)(m[1] >> 32) & 0xff] ^-		C4[(int)(m[0] >> 24) & 0xff] ^-		C5[(int)(m[7] >> 16) & 0xff] ^-		C6[(int)(m[6] >>  8) & 0xff] ^-		C7[(int)(m[5]      ) & 0xff];-	L[5] =-		C0[(int)(m[5] >> 56)       ] ^-		C1[(int)(m[4] >> 48) & 0xff] ^-		C2[(int)(m[3] >> 40) & 0xff] ^-		C3[(int)(m[2] >> 32) & 0xff] ^-		C4[(int)(m[1] >> 24) & 0xff] ^-		C5[(int)(m[0] >> 16) & 0xff] ^-		C6[(int)(m[7] >>  8) & 0xff] ^-		C7[(int)(m[6]      ) & 0xff];-	L[6] =-		C0[(int)(m[6] >> 56)       ] ^-		C1[(int)(m[5] >> 48) & 0xff] ^-		C2[(int)(m[4] >> 40) & 0xff] ^-		C3[(int)(m[3] >> 32) & 0xff] ^-		C4[(int)(m[2] >> 24) & 0xff] ^-		C5[(int)(m[1] >> 16) & 0xff] ^-		C6[(int)(m[0] >>  8) & 0xff] ^-		C7[(int)(m[7]      ) & 0xff];-	L[7] =-		C0[(int)(m[7] >> 56)       ] ^-		C1[(int)(m[6] >> 48) & 0xff] ^-		C2[(int)(m[5] >> 40) & 0xff] ^-		C3[(int)(m[4] >> 32) & 0xff] ^-		C4[(int)(m[3] >> 24) & 0xff] ^-		C5[(int)(m[2] >> 16) & 0xff] ^-		C6[(int)(m[1] >>  8) & 0xff] ^-		C7[(int)(m[0]      ) & 0xff];--	array_copy64(m, L, 8);-}--#endif--static void inplaceXor(uint64_t dst[8], uint64_t src[8])-{-	dst[0] ^= src[0];-	dst[1] ^= src[1];-	dst[2] ^= src[2];-	dst[3] ^= src[3];-	dst[4] ^= src[4];-	dst[5] ^= src[5];-	dst[6] ^= src[6];-	dst[7] ^= src[7];-}--/**- * The core Whirlpool transform.- */-static void processBuffer(whirlpool_ctx * const ctx)-{-	int i, r;-	uint64_t K[8];        /* the round key */-	uint64_t block[8];    /* mu(buffer) */-	uint64_t state[8];    /* the cipher state */-	uint8_t *buffer = ctx->buffer;--	/*-	 * map the buffer to a block:-	 */-	for (i = 0; i < 8; i++, buffer += 8) {-		block[i] =-			(((uint64_t)buffer[0]        ) << 56) ^-			(((uint64_t)buffer[1] & 0xffL) << 48) ^-			(((uint64_t)buffer[2] & 0xffL) << 40) ^-			(((uint64_t)buffer[3] & 0xffL) << 32) ^-			(((uint64_t)buffer[4] & 0xffL) << 24) ^-			(((uint64_t)buffer[5] & 0xffL) << 16) ^-			(((uint64_t)buffer[6] & 0xffL) <<  8) ^-			(((uint64_t)buffer[7] & 0xffL)      );-	}--	/*-	 * compute and apply K^0 to the cipher state:-	 */-	array_copy64(K, ctx->hash, 8);-	array_copy64(state, block, 8);-	inplaceXor(state, K);--	/*-	 * iterate over all rounds:-	 */-	for (r = 1; r <= R; r++) {-		/*-		 * compute K^r from K^{r-1}:-		 */-		transformMatrix(K);-		K[0] ^= rc[r];--		/*-		 * apply the r-th round transformation:-		 */-		transformMatrix(state);-		inplaceXor(state, K);-	}-	/*-	 * apply the Miyaguchi-Preneel compression function:-	 */-	inplaceXor(ctx->hash, state);-	inplaceXor(ctx->hash, block);-}--/**- * Initialize the hashing state.- */-void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx)-{-	int i;--	memset(ctx->bitLength, 0, 32);-	ctx->bufferBits = ctx->bufferPos = 0;-	ctx->buffer[0] = 0; /* it's only necessary to cleanup buffer[bufferPos] */-	for (i = 0; i < 8; i++) {-		ctx->hash[i] = 0L; /* initial value */-	}-}--/**- * Delivers input data to the hashing algorithm.- *- * @param    source        plaintext data to hash.- * @param    sourceBits    how many bits of plaintext to process.- *- * This method maintains the invariant: bufferBits < DIGESTBITS- */-void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t sourceBytes)-{-	/*-	   sourcePos-	   |-	   +-------+-------+--------	   ||||||||||||||||||||| source-	   +-------+-------+--------	   +-------+-------+-------+-------+-------+--------	   ||||||||||||||||||||||                           buffer-	   +-------+-------+-------+-------+-------+--------	   |-	   bufferPos-	   */-	int sourceBits   = sourceBytes * 8;-	int sourcePos    = 0; /* index of leftmost source uint8_t containing data (1 to 8 bits). */-	int sourceGap    = (8 - ((int)sourceBits & 7)) & 7; /* space on source[sourcePos]. */-	int bufferRem    = ctx->bufferBits & 7; /* occupied bits on buffer[bufferPos]. */-	int i;-	uint32_t b, carry;-	uint8_t *buffer       = ctx->buffer;-	uint8_t *bitLength    = ctx->bitLength;-	int bufferBits   = ctx->bufferBits;-	int bufferPos    = ctx->bufferPos;--	/*-	 * tally the length of the added data:-	 */-	uint64_t value = sourceBits;-	for (i = 31, carry = 0; i >= 0 && (carry != 0 || value != 0ULL); i--) {-		carry += bitLength[i] + ((uint32_t)value & 0xff);-		bitLength[i] = (uint8_t)carry;-		carry >>= 8;-		value >>= 8;-	}-	/*-	 * process data in chunks of 8 bits (a more efficient approach would be to take whole-word chunks):-	 */-	while (sourceBits > 8) {-		/* N.B. at least source[sourcePos] and source[sourcePos+1] contain data. */-		/*-		 * take a byte from the source:-		 */-		b = ((source[sourcePos] << sourceGap) & 0xff) |-			((source[sourcePos + 1] & 0xff) >> (8 - sourceGap));-		/*-		 * process this byte:-		 */-		buffer[bufferPos++] |= (uint8_t)(b >> bufferRem);-		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */-		if (bufferBits == DIGESTBITS) {-			/*-			 * process data block:-			 */-			processBuffer(ctx);-			/*-			 * reset buffer:-			 */-			bufferBits = bufferPos = 0;-		}-		buffer[bufferPos] = b << (8 - bufferRem);-		bufferBits += bufferRem;-		/*-		 * proceed to remaining data:-		 */-		sourceBits -= 8;-		sourcePos++;-	}-	/* now 0 <= sourceBits <= 8;-	 * furthermore, all data (if any is left) is in source[sourcePos].-	 */-	if (sourceBits > 0) {-		b = (source[sourcePos] << sourceGap) & 0xff; /* bits are left-justified on b. */-		/*-		 * process the remaining bits:-		 */-		buffer[bufferPos] |= b >> bufferRem;-	} else {-		b = 0;-	}-	if (bufferRem + sourceBits < 8) {-		/*-		 * all remaining data fits on buffer[bufferPos],-		 * and there still remains some space.-		 */-		bufferBits += sourceBits;-	} else {-		/*-		 * buffer[bufferPos] is full:-		 */-		bufferPos++;-		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */-		sourceBits -= 8 - bufferRem;-		/* now 0 <= sourceBits < 8;-		 * furthermore, all data (if any is left) is in source[sourcePos].-		 */-		if (bufferBits == DIGESTBITS) {-			/*-			 * process data block:-			 */-			processBuffer(ctx);-			/*-			 * reset buffer:-			 */-			bufferBits = bufferPos = 0;-		}-		buffer[bufferPos] = b << (8 - bufferRem);-		bufferBits += (int)sourceBits;-	}-	ctx->bufferBits   = bufferBits;-	ctx->bufferPos    = bufferPos;-}--/**- * Get the hash value from the hashing state.- * - * This method uses the invariant: bufferBits < DIGESTBITS- */-void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result)-{-	int i;-	uint8_t *buffer    = ctx->buffer;-	uint8_t *bitLength = ctx->bitLength;-	int bufferBits     = ctx->bufferBits;-	int bufferPos      = ctx->bufferPos;-	uint8_t *digest    = result;--	/*-	 * append a '1'-bit:-	 */-	buffer[bufferPos] |= 0x80U >> (bufferBits & 7);-	bufferPos++; /* all remaining bits on the current uint8_t are set to zero. */-	/*-	 * pad with zero bits to complete (N*WBLOCKBITS - LENGTHBITS) bits:-	 */-	if (bufferPos > WBLOCKBYTES - LENGTHBYTES) {-		if (bufferPos < WBLOCKBYTES) {-			memset(&buffer[bufferPos], 0, WBLOCKBYTES - bufferPos);-		}-		/*-		 * process data block:-		 */-		processBuffer(ctx);-		/*-		 * reset buffer:-		 */-		bufferPos = 0;-	}-	if (bufferPos < WBLOCKBYTES - LENGTHBYTES) {-		memset(&buffer[bufferPos], 0, (WBLOCKBYTES - LENGTHBYTES) - bufferPos);-	}-	bufferPos = WBLOCKBYTES - LENGTHBYTES;-	/*-	 * append bit length of hashed data:-	 */-	memcpy(&buffer[WBLOCKBYTES - LENGTHBYTES], bitLength, LENGTHBYTES);-	/*-	 * process data block:-	 */-	processBuffer(ctx);-	/*-	 * return the completed message digest:-	 */-	for (i = 0; i < DIGESTBYTES/8; i++) {-		digest[0] = (uint8_t)(ctx->hash[i] >> 56);-		digest[1] = (uint8_t)(ctx->hash[i] >> 48);-		digest[2] = (uint8_t)(ctx->hash[i] >> 40);-		digest[3] = (uint8_t)(ctx->hash[i] >> 32);-		digest[4] = (uint8_t)(ctx->hash[i] >> 24);-		digest[5] = (uint8_t)(ctx->hash[i] >> 16);-		digest[6] = (uint8_t)(ctx->hash[i] >>  8);-		digest[7] = (uint8_t)(ctx->hash[i]      );-		digest += 8;-	}-	ctx->bufferBits   = bufferBits;-	ctx->bufferPos    = bufferPos;-}
− cbits/cryptonite_whirlpool.h 
@@ -1,31 +0,0 @@-#ifndef CRYPTOHASH_WHIRLPOOL_H
-#define CRYPTOHASH_WHIRLPOOL_H
-
-#include <stdint.h>
-
-/*
- * Whirlpool-specific definitions.
- */
-
-#define DIGESTBYTES 64
-#define DIGESTBITS  (8*DIGESTBYTES) /* 512 */
-
-#define WBLOCKBYTES 64
-#define WBLOCKBITS  (8*WBLOCKBYTES) /* 512 */
-
-#define LENGTHBYTES 32
-#define LENGTHBITS  (8*LENGTHBYTES) /* 256 */
-
-typedef struct whirlpool_ctx {
-	uint8_t  bitLength[LENGTHBYTES]; /* global number of hashed bits (256-bit counter) */
-	uint8_t  buffer[WBLOCKBYTES];    /* buffer of data to hash */
-	uint32_t bufferBits;             /* current number of bits on the buffer */
-	uint32_t bufferPos;              /* current (possibly incomplete) byte slot on the buffer */
-	uint64_t hash[DIGESTBYTES/8];    /* the hashing state */
-} whirlpool_ctx;
-
-void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx);
-void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t len);
-void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result);
-
-#endif
− cbits/cryptonite_xsalsa.c 
@@ -1,90 +0,0 @@-/*- * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>- * - * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */-#include <stdint.h>-#include <string.h>-#include "cryptonite_xsalsa.h"-#include "cryptonite_align.h"-#include "cryptonite_bitfn.h"--/* XSalsa20 algorithm as described in https://cr.yp.to/snuffle/xsalsa-20081128.pdf */-void cryptonite_xsalsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds,-                            uint32_t keylen, const uint8_t *key,-                            uint32_t ivlen, const uint8_t *iv)-{-  memset(ctx, 0, sizeof(*ctx));-  ctx->nb_rounds = nb_rounds;--  /* Create initial 512-bit input block:-       (x0, x5, x10, x15) is the Salsa20 constant-       (x1, x2, x3, x4, x11, x12, x13, x14) is a 256-bit key-       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce-  */-  cryptonite_salsa_init_core(&ctx->st, keylen, key, 8, iv);--  /* Continue initialization in a separate function that may also-     be called independently */-  cryptonite_xsalsa_derive(ctx, ivlen - 8, iv + 8);-}--void cryptonite_xsalsa_derive(cryptonite_salsa_context *ctx,-                              uint32_t ivlen, const uint8_t *iv)-{-  /* Finish creating initial 512-bit input block:-       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce--     Except iv has been shifted by 64 bits so there are now only 128 bits ahead.-  */-  ctx->st.d[ 8] += load_le32(iv + 0);-  ctx->st.d[ 9] += load_le32(iv + 4);--  /* Compute (z0, z1, . . . , z15) = doubleround ^(r/2) (x0, x1, . . . , x15) */-  block hSalsa;-  memset(&hSalsa, 0, sizeof(block));-  cryptonite_salsa_core_xor(ctx->nb_rounds, &hSalsa, &ctx->st);- -  /* Build a new 512-bit input block (x′0, x′1, . . . , x′15):-       (x′0, x′5, x′10, x′15) is the Salsa20 constant-       (x′1,x′2,x′3,x′4,x′11,x′12,x′13,x′14) = (z0,z5,z10,z15,z6,z7,z8,z9)-       (x′6,x′7) is the last 64 bits of the 192-bit nonce-       (x′8, x′9) is a 64-bit block counter.-  */-  ctx->st.d[ 1] = hSalsa.d[ 0] - ctx->st.d[ 0];-  ctx->st.d[ 2] = hSalsa.d[ 5] - ctx->st.d[ 5];-  ctx->st.d[ 3] = hSalsa.d[10] - ctx->st.d[10];-  ctx->st.d[ 4] = hSalsa.d[15] - ctx->st.d[15];-  ctx->st.d[11] = hSalsa.d[ 6] - ctx->st.d[ 6];-  ctx->st.d[12] = hSalsa.d[ 7] - ctx->st.d[ 7];-  ctx->st.d[13] = hSalsa.d[ 8] - ctx->st.d[ 8];-  ctx->st.d[14] = hSalsa.d[ 9] - ctx->st.d[ 9];-  ctx->st.d[ 6] = load_le32(iv + 8);-  ctx->st.d[ 7] = load_le32(iv + 12);-  ctx->st.d[ 8] = 0;-  ctx->st.d[ 9] = 0;-}
− cbits/cryptonite_xsalsa.h 
@@ -1,38 +0,0 @@-/*- * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>- *- * All rights reserved.- *- * Redistribution and use in source and binary forms, with or without- * modification, are permitted provided that the following conditions- * are met:- * 1. Redistributions of source code must retain the above copyright- *    notice, this list of conditions and the following disclaimer.- * 2. Redistributions in binary form must reproduce the above copyright- *    notice, this list of conditions and the following disclaimer in the- *    documentation and/or other materials provided with the distribution.- * 3. Neither the name of the author nor the names of his contributors- *    may be used to endorse or promote products derived from this software- *    without specific prior written permission.- *- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF- * SUCH DAMAGE.- */-#ifndef CRYPTONITE_XSALSA-#define CRYPTONITE_XSALSA--#include "cryptonite_salsa.h"--void cryptonite_xsalsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);-void cryptonite_xsalsa_derive(cryptonite_salsa_context *ctx, uint32_t ivlen, const uint8_t *iv);--#endif
cbits/curve25519/curve25519-donna-c64.c view
@@ -428,7 +428,7 @@ }  int-cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {+crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {   limb bp[5], x[5], z[5], zmone[5];   uint8_t e[32];   int i;
cbits/curve25519/curve25519-donna.c view
@@ -841,7 +841,7 @@ }  int-cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {+crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {   limb bp[10], x[10], z[11], zmone[10];   uint8_t e[32];   int i;
cbits/decaf/ed448goldilocks/decaf.c view
@@ -19,1624 +19,1624 @@ #include <decaf/ed448.h>  /* Template stuff */-#define API_NS(_id) cryptonite_decaf_448_##_id-#define SCALAR_BITS CRYPTONITE_DECAF_448_SCALAR_BITS-#define SCALAR_SER_BYTES CRYPTONITE_DECAF_448_SCALAR_BYTES-#define SCALAR_LIMBS CRYPTONITE_DECAF_448_SCALAR_LIMBS-#define scalar_t API_NS(scalar_t)-#define point_t API_NS(point_t)-#define precomputed_s API_NS(precomputed_s)-#define IMAGINE_TWIST 0-#define COFACTOR 4--/* Comb config: number of combs, n, t, s. */-#define COMBS_N 5-#define COMBS_T 5-#define COMBS_S 18-#define CRYPTONITE_DECAF_WINDOW_BITS 5-#define CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS 5-#define CRYPTONITE_DECAF_WNAF_VAR_TABLE_BITS 3--#define EDDSA_USE_SIGMA_ISOGENY 0--static const int EDWARDS_D = -39081;-static const scalar_t point_scalarmul_adjustment = {{{-    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)-}}}, precomputed_scalarmul_adjustment = {{{-    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)-}}};--const uint8_t cryptonite_decaf_x448_base_point[CRYPTONITE_DECAF_X448_PUBLIC_BYTES] = { 0x05 };--#if COFACTOR==8 || EDDSA_USE_SIGMA_ISOGENY-    static const gf SQRT_ONE_MINUS_D = {FIELD_LITERAL(-        /* NONE */-    )};-#endif--/* End of template stuff */--/* Sanity */-#if (COFACTOR == 8) && !IMAGINE_TWIST && !UNSAFE_CURVE_HAS_POINTS_AT_INFINITY-/* FUTURE MAGIC: Curve41417 doesn't have these properties. */-#error "Currently require IMAGINE_TWIST (and thus p=5 mod 8) for cofactor 8"-        /* OK, but why?-         * Two reasons: #1: There are bugs when COFACTOR == && IMAGINE_TWIST-         # #2: -         */-#endif--#if IMAGINE_TWIST && (P_MOD_8 != 5)-    #error "Cannot use IMAGINE_TWIST except for p == 5 mod 8"-#endif--#if (COFACTOR != 8) && (COFACTOR != 4)-    #error "COFACTOR must be 4 or 8"-#endif- -#if IMAGINE_TWIST-    extern const gf SQRT_MINUS_ONE;-#endif--#define WBITS CRYPTONITE_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */--extern const point_t API_NS(point_base);--/* Projective Niels coordinates */-typedef struct { gf a, b, c; } niels_s, niels_t[1];-typedef struct { niels_t n; gf z; } VECTOR_ALIGNED pniels_s, pniels_t[1];--/* Precomputed base */-struct precomputed_s { niels_t table [COMBS_N<<(COMBS_T-1)]; };--extern const gf API_NS(precomputed_base_as_fe)[];-const precomputed_s *API_NS(precomputed_base) =-    (const precomputed_s *) &API_NS(precomputed_base_as_fe);--const size_t API_NS(sizeof_precomputed_s) = sizeof(precomputed_s);-const size_t API_NS(alignof_precomputed_s) = sizeof(big_register_t);--/** Inverse. */-static void-cryptonite_gf_invert(gf y, const gf x, int assert_nonzero) {-    gf t1, t2;-    cryptonite_gf_sqr(t1, x); // o^2-    mask_t ret = cryptonite_gf_isr(t2, t1); // +-1/sqrt(o^2) = +-1/o-    (void)ret;-    if (assert_nonzero) assert(ret);-    cryptonite_gf_sqr(t1, t2);-    cryptonite_gf_mul(t2, t1, x); // not direct to y in case of alias.-    cryptonite_gf_copy(y, t2);-}--/** Return high bit of x = low bit of 2x mod p */-static mask_t cryptonite_gf_lobit(const gf x) {-    gf y;-    cryptonite_gf_copy(y,x);-    cryptonite_gf_strong_reduce(y);-    return -(y->limb[0]&1);-}--/** identity = (0,1) */-const point_t API_NS(point_identity) = {{{{{0}}},{{{1}}},{{{1}}},{{{0}}}}};--void API_NS(deisogenize) (-    cryptonite_gf_s *__restrict__ s,-    cryptonite_gf_s *__restrict__ minus_t_over_s,-    const point_t p,-    mask_t toggle_hibit_s,-    mask_t toggle_hibit_t_over_s,-    mask_t toggle_rotation-);--void API_NS(deisogenize) (-    cryptonite_gf_s *__restrict__ s,-    cryptonite_gf_s *__restrict__ minus_t_over_s,-    const point_t p,-    mask_t toggle_hibit_s,-    mask_t toggle_hibit_t_over_s,-    mask_t toggle_rotation-) {-#if COFACTOR == 4 && !IMAGINE_TWIST-    (void) toggle_rotation;-    -    gf b, d;-    cryptonite_gf_s *c = s, *a = minus_t_over_s;-    cryptonite_gf_mulw(a, p->y, 1-EDWARDS_D);-    cryptonite_gf_mul(c, a, p->t);     /* -dYT, with EDWARDS_D = d-1 */-    cryptonite_gf_mul(a, p->x, p->z); -    cryptonite_gf_sub(d, c, a);  /* aXZ-dYT with a=-1 */-    cryptonite_gf_add(a, p->z, p->y); -    cryptonite_gf_sub(b, p->z, p->y); -    cryptonite_gf_mul(c, b, a);-    cryptonite_gf_mulw(b, c, -EDWARDS_D); /* (a-d)(Z+Y)(Z-Y) */-    mask_t ok = cryptonite_gf_isr (a,b); /* r in the paper */-    (void)ok; assert(ok | cryptonite_gf_eq(b,ZERO));-    cryptonite_gf_mulw (b, a, -EDWARDS_D); /* u in the paper */--    cryptonite_gf_mul(c,a,d); /* r(aZX-dYT) */-    cryptonite_gf_mul(a,b,p->z); /* uZ */-    cryptonite_gf_add(a,a,a); /* 2uZ */-    -    mask_t tg = toggle_hibit_t_over_s ^ ~cryptonite_gf_hibit(minus_t_over_s);-    cryptonite_gf_cond_neg(minus_t_over_s, tg); /* t/s <-? -t/s */-    cryptonite_gf_cond_neg(c, tg); /* u <- -u if negative. */-    -    cryptonite_gf_add(d,c,p->y);-    cryptonite_gf_mul(s,b,d);-    cryptonite_gf_cond_neg(s, toggle_hibit_s ^ cryptonite_gf_hibit(s));-#else-    /* More complicated because of rotation */-    /* MAGIC This code is wrong for certain non-Curve25519 curves;-     * check if it's because of Cofactor==8 or IMAGINE_TWIST */-    -    gf c, d;-    cryptonite_gf_s *b = s, *a = minus_t_over_s;--    #if IMAGINE_TWIST-        gf x, t;-        cryptonite_gf_div_qnr(x,p->x);-        cryptonite_gf_div_qnr(t,p->t);-        cryptonite_gf_add ( a, p->z, x );-        cryptonite_gf_sub ( b, p->z, x );-        cryptonite_gf_mul ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 - X^2 */-    #else-        const cryptonite_gf_s *x = p->x, *t = p->t;-        cryptonite_gf_sqr ( a, p->z );-        cryptonite_gf_sqr ( b, p->x );-        cryptonite_gf_add ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 + X^2 */-    #endif-    /* Here: c = "zx" in the SAGE code = Z^2 - aX^2 */-    -    cryptonite_gf_mul ( a, p->z, t ); /* "tz" = T*Z */-    cryptonite_gf_sqr ( b, a );-    cryptonite_gf_mul ( d, b, c ); /* (TZ)^2 * (Z^2-aX^2) */-    mask_t ok = cryptonite_gf_isr(b, d);-    (void)ok; assert(ok | cryptonite_gf_eq(d,ZERO));-    cryptonite_gf_mul ( d, b, a ); /* "osx" = 1 / sqrt(z^2-ax^2) */-    cryptonite_gf_mul ( a, b, c ); -    cryptonite_gf_mul ( b, a, d ); /* 1/tz */--    mask_t rotate;-    #if (COFACTOR == 8)-        gf e;-        cryptonite_gf_sqr(e, p->z);-        cryptonite_gf_mul(a, e, b); /* z^2 / tz = z/t = 1/xy */-        rotate = cryptonite_gf_hibit(a) ^ toggle_rotation;-        /* Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x */-        cryptonite_gf_mul ( a, b, c ); -        cryptonite_gf_cond_sel ( a, a, SQRT_ONE_MINUS_D, rotate );-        cryptonite_gf_cond_sel ( e, p->y, x, rotate );-    #else-        const cryptonite_gf_s *e = x;-        (void)toggle_rotation;-        rotate = 0;-    #endif-    -    cryptonite_gf_mul ( c, a, d ); // new "osx"-    cryptonite_gf_mul ( a, c, p->z );-    cryptonite_gf_add ( minus_t_over_s, a, a ); // 2 * "osx" * Z-    cryptonite_gf_mul ( d, b, p->z );-    -    mask_t tg = toggle_hibit_t_over_s ^~ cryptonite_gf_hibit(minus_t_over_s);-    cryptonite_gf_cond_neg ( minus_t_over_s, tg );-    cryptonite_gf_cond_neg ( c, rotate ^ tg );-    cryptonite_gf_add ( d, d, c );-    cryptonite_gf_mul ( s, d, e ); /* here "x" = y unless rotate */-    cryptonite_gf_cond_neg ( s, toggle_hibit_s ^ cryptonite_gf_hibit(s) );-#endif-}--void API_NS(point_encode)( unsigned char ser[SER_BYTES], const point_t p ) {-    gf s, mtos;-    API_NS(deisogenize)(s,mtos,p,0,0,0);-    cryptonite_gf_serialize(ser,s,0);-}--cryptonite_decaf_error_t API_NS(point_decode) (-    point_t p,-    const unsigned char ser[SER_BYTES],-    cryptonite_decaf_bool_t allow_identity-) {-    gf s, a, b, c, d, e, f;-    mask_t succ = cryptonite_gf_deserialize(s, ser, 0);-    mask_t zero = cryptonite_gf_eq(s, ZERO);-    succ &= bool_to_mask(allow_identity) | ~zero;-    cryptonite_gf_sqr ( a, s ); /* s^2 */-#if IMAGINE_TWIST-    cryptonite_gf_sub ( f, ONE, a ); /* f = 1-as^2 = 1-s^2*/-#else-    cryptonite_gf_add ( f, ONE, a ); /* f = 1-as^2 = 1+s^2 */-#endif-    succ &= ~ cryptonite_gf_eq( f, ZERO );-    cryptonite_gf_sqr ( b, f );  /* (1-as^2)^2 = 1 - 2as^2 + a^2 s^4 */-    cryptonite_gf_mulw ( c, a, 4*IMAGINE_TWIST-4*EDWARDS_D ); -    cryptonite_gf_add ( c, c, b ); /* t^2 = 1 + (2a-4d) s^2 + s^4 */-    cryptonite_gf_mul ( d, f, s ); /* s * (1-as^2) for denoms */-    cryptonite_gf_sqr ( e, d );    /* s^2 * (1-as^2)^2 */-    cryptonite_gf_mul ( b, c, e ); /* t^2 * s^2 * (1-as^2)^2 */-    -    succ &= cryptonite_gf_isr(e,b) | cryptonite_gf_eq(b,ZERO); /* e = 1/(t s (1-as^2)) */-    cryptonite_gf_mul ( b, e, d ); /* 1 / t */-    cryptonite_gf_mul ( d, e, c ); /* t / (s(1-as^2)) */-    cryptonite_gf_mul ( e, d, f ); /* t / s */-    mask_t negtos = cryptonite_gf_hibit(e);-    cryptonite_gf_cond_neg(b, negtos);-    cryptonite_gf_cond_neg(d, negtos);--#if IMAGINE_TWIST-    cryptonite_gf_add ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */-#else-    cryptonite_gf_sub ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */-#endif--#if COFACTOR == 8-    cryptonite_gf_mul ( a, p->z, d); /* t(1+s^2) / s(1-s^2) = 2/xy */-    succ &= ~cryptonite_gf_lobit(a); /* = ~cryptonite_gf_hibit(a/2), since cryptonite_gf_hibit(x) = cryptonite_gf_lobit(2x) */-#endif-    -    cryptonite_gf_mul ( a, f, b ); /* y = (1-s^2) / t */-    cryptonite_gf_mul ( p->y, p->z, a ); /* Y = yZ */-#if IMAGINE_TWIST-    cryptonite_gf_add ( b, s, s );-    cryptonite_gf_mul(p->x, b, SQRT_MINUS_ONE); /* Curve25519 */-#else-    cryptonite_gf_add ( p->x, s, s );-#endif-    cryptonite_gf_mul ( p->t, p->x, a ); /* T = 2s (1-as^2)/t */-    -#if UNSAFE_CURVE_HAS_POINTS_AT_INFINITY-    /* This can't happen for any of the supported configurations.-     *-     * If it can happen (because s=1), it's because the curve has points-     * at infinity, which means that there may be critical security bugs-     * elsewhere in the library.  In that case, it's better that you hit-     * the assertion in point_valid, which will happen in the test suite-     * since it tests s=1.-     *-     * This debugging option is to allow testing of IMAGINE_TWIST = 0 on-     * Ed25519, without hitting that assertion.  Don't use it in-     * production.-     */-    succ &= ~cryptonite_gf_eq(p->z,ZERO);-#endif-    -    p->y->limb[0] -= zero;-    assert(API_NS(point_valid)(p) | ~succ);-    -    return cryptonite_decaf_succeed_if(mask_to_bool(succ));-}--#if IMAGINE_TWIST-#define TWISTED_D (-(EDWARDS_D))-#else-#define TWISTED_D ((EDWARDS_D)-1)-#endif--#if TWISTED_D < 0-#define EFF_D (-(TWISTED_D))-#define NEG_D 1-#else-#define EFF_D TWISTED_D-#define NEG_D 0-#endif--void API_NS(point_sub) (-    point_t p,-    const point_t q,-    const point_t r-) {-    gf a, b, c, d;-    cryptonite_gf_sub_nr ( b, q->y, q->x ); /* 3+e */-    cryptonite_gf_sub_nr ( d, r->y, r->x ); /* 3+e */-    cryptonite_gf_add_nr ( c, r->y, r->x ); /* 2+e */-    cryptonite_gf_mul ( a, c, b );-    cryptonite_gf_add_nr ( b, q->y, q->x ); /* 2+e */-    cryptonite_gf_mul ( p->y, d, b );-    cryptonite_gf_mul ( b, r->t, q->t );-    cryptonite_gf_mulw ( p->x, b, 2*EFF_D );-    cryptonite_gf_add_nr ( b, a, p->y );    /* 2+e */-    cryptonite_gf_sub_nr ( c, p->y, a );    /* 3+e */-    cryptonite_gf_mul ( a, q->z, r->z );-    cryptonite_gf_add_nr ( a, a, a );       /* 2+e */-    if (GF_HEADROOM <= 3) cryptonite_gf_weak_reduce(a); /* or 1+e */-#if NEG_D-    cryptonite_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */-    cryptonite_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */-#else-    cryptonite_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */-    cryptonite_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */-#endif-    cryptonite_gf_mul ( p->z, a, p->y );-    cryptonite_gf_mul ( p->x, p->y, c );-    cryptonite_gf_mul ( p->y, a, b );-    cryptonite_gf_mul ( p->t, b, c );-}-    -void API_NS(point_add) (-    point_t p,-    const point_t q,-    const point_t r-) {-    gf a, b, c, d;-    cryptonite_gf_sub_nr ( b, q->y, q->x ); /* 3+e */-    cryptonite_gf_sub_nr ( c, r->y, r->x ); /* 3+e */-    cryptonite_gf_add_nr ( d, r->y, r->x ); /* 2+e */-    cryptonite_gf_mul ( a, c, b );-    cryptonite_gf_add_nr ( b, q->y, q->x ); /* 2+e */-    cryptonite_gf_mul ( p->y, d, b );-    cryptonite_gf_mul ( b, r->t, q->t );-    cryptonite_gf_mulw ( p->x, b, 2*EFF_D );-    cryptonite_gf_add_nr ( b, a, p->y );    /* 2+e */-    cryptonite_gf_sub_nr ( c, p->y, a );    /* 3+e */-    cryptonite_gf_mul ( a, q->z, r->z );-    cryptonite_gf_add_nr ( a, a, a );       /* 2+e */-    if (GF_HEADROOM <= 3) cryptonite_gf_weak_reduce(a); /* or 1+e */-#if NEG_D-    cryptonite_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */-    cryptonite_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */-#else-    cryptonite_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */-    cryptonite_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */-#endif-    cryptonite_gf_mul ( p->z, a, p->y );-    cryptonite_gf_mul ( p->x, p->y, c );-    cryptonite_gf_mul ( p->y, a, b );-    cryptonite_gf_mul ( p->t, b, c );-}--static CRYPTONITE_DECAF_NOINLINE void-point_double_internal (-    point_t p,-    const point_t q,-    int before_double-) {-    gf a, b, c, d;-    cryptonite_gf_sqr ( c, q->x );-    cryptonite_gf_sqr ( a, q->y );-    cryptonite_gf_add_nr ( d, c, a );             /* 2+e */-    cryptonite_gf_add_nr ( p->t, q->y, q->x );    /* 2+e */-    cryptonite_gf_sqr ( b, p->t );-    cryptonite_gf_subx_nr ( b, b, d, 3 );         /* 4+e */-    cryptonite_gf_sub_nr ( p->t, a, c );          /* 3+e */-    cryptonite_gf_sqr ( p->x, q->z );-    cryptonite_gf_add_nr ( p->z, p->x, p->x );    /* 2+e */-    cryptonite_gf_subx_nr ( a, p->z, p->t, 4 );   /* 6+e */-    if (GF_HEADROOM == 5) cryptonite_gf_weak_reduce(a); /* or 1+e */-    cryptonite_gf_mul ( p->x, a, b );-    cryptonite_gf_mul ( p->z, p->t, a );-    cryptonite_gf_mul ( p->y, p->t, d );-    if (!before_double) cryptonite_gf_mul ( p->t, b, d );-}--void API_NS(point_double)(point_t p, const point_t q) {-    point_double_internal(p,q,0);-}--void API_NS(point_negate) (-   point_t nega,-   const point_t a-) {-    cryptonite_gf_sub(nega->x, ZERO, a->x);-    cryptonite_gf_copy(nega->y, a->y);-    cryptonite_gf_copy(nega->z, a->z);-    cryptonite_gf_sub(nega->t, ZERO, a->t);-}--/* Operations on [p]niels */-static CRYPTONITE_DECAF_INLINE void-cond_neg_niels (-    niels_t n,-    mask_t neg-) {-    cryptonite_gf_cond_swap(n->a, n->b, neg);-    cryptonite_gf_cond_neg(n->c, neg);-}--static CRYPTONITE_DECAF_NOINLINE void pt_to_pniels (-    pniels_t b,-    const point_t a-) {-    cryptonite_gf_sub ( b->n->a, a->y, a->x );-    cryptonite_gf_add ( b->n->b, a->x, a->y );-    cryptonite_gf_mulw ( b->n->c, a->t, 2*TWISTED_D );-    cryptonite_gf_add ( b->z, a->z, a->z );-}--static CRYPTONITE_DECAF_NOINLINE void pniels_to_pt (-    point_t e,-    const pniels_t d-) {-    gf eu;-    cryptonite_gf_add ( eu, d->n->b, d->n->a );-    cryptonite_gf_sub ( e->y, d->n->b, d->n->a );-    cryptonite_gf_mul ( e->t, e->y, eu);-    cryptonite_gf_mul ( e->x, d->z, e->y );-    cryptonite_gf_mul ( e->y, d->z, eu );-    cryptonite_gf_sqr ( e->z, d->z );-}--static CRYPTONITE_DECAF_NOINLINE void-niels_to_pt (-    point_t e,-    const niels_t n-) {-    cryptonite_gf_add ( e->y, n->b, n->a );-    cryptonite_gf_sub ( e->x, n->b, n->a );-    cryptonite_gf_mul ( e->t, e->y, e->x );-    cryptonite_gf_copy ( e->z, ONE );-}--static CRYPTONITE_DECAF_NOINLINE void-add_niels_to_pt (-    point_t d,-    const niels_t e,-    int before_double-) {-    gf a, b, c;-    cryptonite_gf_sub_nr ( b, d->y, d->x ); /* 3+e */-    cryptonite_gf_mul ( a, e->a, b );-    cryptonite_gf_add_nr ( b, d->x, d->y ); /* 2+e */-    cryptonite_gf_mul ( d->y, e->b, b );-    cryptonite_gf_mul ( d->x, e->c, d->t );-    cryptonite_gf_add_nr ( c, a, d->y );    /* 2+e */-    cryptonite_gf_sub_nr ( b, d->y, a );    /* 3+e */-    cryptonite_gf_sub_nr ( d->y, d->z, d->x ); /* 3+e */-    cryptonite_gf_add_nr ( a, d->x, d->z ); /* 2+e */-    cryptonite_gf_mul ( d->z, a, d->y );-    cryptonite_gf_mul ( d->x, d->y, b );-    cryptonite_gf_mul ( d->y, a, c );-    if (!before_double) cryptonite_gf_mul ( d->t, b, c );-}--static CRYPTONITE_DECAF_NOINLINE void-sub_niels_from_pt (-    point_t d,-    const niels_t e,-    int before_double-) {-    gf a, b, c;-    cryptonite_gf_sub_nr ( b, d->y, d->x ); /* 3+e */-    cryptonite_gf_mul ( a, e->b, b );-    cryptonite_gf_add_nr ( b, d->x, d->y ); /* 2+e */-    cryptonite_gf_mul ( d->y, e->a, b );-    cryptonite_gf_mul ( d->x, e->c, d->t );-    cryptonite_gf_add_nr ( c, a, d->y );    /* 2+e */-    cryptonite_gf_sub_nr ( b, d->y, a );    /* 3+e */-    cryptonite_gf_add_nr ( d->y, d->z, d->x ); /* 2+e */-    cryptonite_gf_sub_nr ( a, d->z, d->x ); /* 3+e */-    cryptonite_gf_mul ( d->z, a, d->y );-    cryptonite_gf_mul ( d->x, d->y, b );-    cryptonite_gf_mul ( d->y, a, c );-    if (!before_double) cryptonite_gf_mul ( d->t, b, c );-}--static void-add_pniels_to_pt (-    point_t p,-    const pniels_t pn,-    int before_double-) {-    gf L0;-    cryptonite_gf_mul ( L0, p->z, pn->z );-    cryptonite_gf_copy ( p->z, L0 );-    add_niels_to_pt( p, pn->n, before_double );-}--static void-sub_pniels_from_pt (-    point_t p,-    const pniels_t pn,-    int before_double-) {-    gf L0;-    cryptonite_gf_mul ( L0, p->z, pn->z );-    cryptonite_gf_copy ( p->z, L0 );-    sub_niels_from_pt( p, pn->n, before_double );-}--static CRYPTONITE_DECAF_NOINLINE void-prepare_fixed_window(-    pniels_t *multiples,-    const point_t b,-    int ntable-) {-    point_t tmp;-    pniels_t pn;-    int i;-    -    point_double_internal(tmp, b, 0);-    pt_to_pniels(pn, tmp);-    pt_to_pniels(multiples[0], b);-    API_NS(point_copy)(tmp, b);-    for (i=1; i<ntable; i++) {-        add_pniels_to_pt(tmp, pn, 0);-        pt_to_pniels(multiples[i], tmp);-    }-    -    cryptonite_decaf_bzero(pn,sizeof(pn));-    cryptonite_decaf_bzero(tmp,sizeof(tmp));-}--void API_NS(point_scalarmul) (-    point_t a,-    const point_t b,-    const scalar_t scalar-) {-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,-        WINDOW_MASK = (1<<WINDOW)-1,-        WINDOW_T_MASK = WINDOW_MASK >> 1,-        NTABLE = 1<<(WINDOW-1);-        -    scalar_t scalar1x;-    API_NS(scalar_add)(scalar1x, scalar, point_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar1x,scalar1x);-    -    /* Set up a precomputed table with odd multiples of b. */-    pniels_t pn, multiples[NTABLE];-    point_t tmp;-    prepare_fixed_window(multiples, b, NTABLE);--    /* Initialize. */-    int i,j,first=1;-    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;--    for (; i>=0; i-=WINDOW) {-        /* Fetch another block of bits */-        word_t bits = scalar1x->limb[i/WBITS] >> (i%WBITS);-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {-            bits ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));-        }-        bits &= WINDOW_MASK;-        mask_t inv = (bits>>(WINDOW-1))-1;-        bits ^= inv;-    -        /* Add in from table.  Compute t only on last iteration. */-        constant_time_lookup(pn, multiples, sizeof(pn), NTABLE, bits & WINDOW_T_MASK);-        cond_neg_niels(pn->n, inv);-        if (first) {-            pniels_to_pt(tmp, pn);-            first = 0;-        } else {-           /* Using Hisil et al's lookahead method instead of extensible here-            * for no particular reason.  Double WINDOW times, but only compute t on-            * the last one.-            */-            for (j=0; j<WINDOW-1; j++)-                point_double_internal(tmp, tmp, -1);-            point_double_internal(tmp, tmp, 0);-            add_pniels_to_pt(tmp, pn, i ? -1 : 0);-        }-    }-    -    /* Write out the answer */-    API_NS(point_copy)(a,tmp);-    -    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));-    cryptonite_decaf_bzero(pn,sizeof(pn));-    cryptonite_decaf_bzero(multiples,sizeof(multiples));-    cryptonite_decaf_bzero(tmp,sizeof(tmp));-}--void API_NS(point_double_scalarmul) (-    point_t a,-    const point_t b,-    const scalar_t scalarb,-    const point_t c,-    const scalar_t scalarc-) {-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,-        WINDOW_MASK = (1<<WINDOW)-1,-        WINDOW_T_MASK = WINDOW_MASK >> 1,-        NTABLE = 1<<(WINDOW-1);-        -    scalar_t scalar1x, scalar2x;-    API_NS(scalar_add)(scalar1x, scalarb, point_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar1x,scalar1x);-    API_NS(scalar_add)(scalar2x, scalarc, point_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar2x,scalar2x);-    -    /* Set up a precomputed table with odd multiples of b. */-    pniels_t pn, multiples1[NTABLE], multiples2[NTABLE];-    point_t tmp;-    prepare_fixed_window(multiples1, b, NTABLE);-    prepare_fixed_window(multiples2, c, NTABLE);--    /* Initialize. */-    int i,j,first=1;-    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;--    for (; i>=0; i-=WINDOW) {-        /* Fetch another block of bits */-        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),-                     bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {-            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));-            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));-        }-        bits1 &= WINDOW_MASK;-        bits2 &= WINDOW_MASK;-        mask_t inv1 = (bits1>>(WINDOW-1))-1;-        mask_t inv2 = (bits2>>(WINDOW-1))-1;-        bits1 ^= inv1;-        bits2 ^= inv2;-    -        /* Add in from table.  Compute t only on last iteration. */-        constant_time_lookup(pn, multiples1, sizeof(pn), NTABLE, bits1 & WINDOW_T_MASK);-        cond_neg_niels(pn->n, inv1);-        if (first) {-            pniels_to_pt(tmp, pn);-            first = 0;-        } else {-           /* Using Hisil et al's lookahead method instead of extensible here-            * for no particular reason.  Double WINDOW times, but only compute t on-            * the last one.-            */-            for (j=0; j<WINDOW-1; j++)-                point_double_internal(tmp, tmp, -1);-            point_double_internal(tmp, tmp, 0);-            add_pniels_to_pt(tmp, pn, 0);-        }-        constant_time_lookup(pn, multiples2, sizeof(pn), NTABLE, bits2 & WINDOW_T_MASK);-        cond_neg_niels(pn->n, inv2);-        add_pniels_to_pt(tmp, pn, i?-1:0);-    }-    -    /* Write out the answer */-    API_NS(point_copy)(a,tmp);-    --    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));-    cryptonite_decaf_bzero(scalar2x,sizeof(scalar2x));-    cryptonite_decaf_bzero(pn,sizeof(pn));-    cryptonite_decaf_bzero(multiples1,sizeof(multiples1));-    cryptonite_decaf_bzero(multiples2,sizeof(multiples2));-    cryptonite_decaf_bzero(tmp,sizeof(tmp));-}--void API_NS(point_dual_scalarmul) (-    point_t a1,-    point_t a2,-    const point_t b,-    const scalar_t scalar1,-    const scalar_t scalar2-) {-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,-        WINDOW_MASK = (1<<WINDOW)-1,-        WINDOW_T_MASK = WINDOW_MASK >> 1,-        NTABLE = 1<<(WINDOW-1);-        -    scalar_t scalar1x, scalar2x;-    API_NS(scalar_add)(scalar1x, scalar1, point_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar1x,scalar1x);-    API_NS(scalar_add)(scalar2x, scalar2, point_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar2x,scalar2x);-    -    /* Set up a precomputed table with odd multiples of b. */-    point_t multiples1[NTABLE], multiples2[NTABLE], working, tmp;-    pniels_t pn;-    -    API_NS(point_copy)(working, b);--    /* Initialize. */-    int i,j;-    -    for (i=0; i<NTABLE; i++) {-        API_NS(point_copy)(multiples1[i], API_NS(point_identity));-        API_NS(point_copy)(multiples2[i], API_NS(point_identity));-    }--    for (i=0; i<SCALAR_BITS; i+=WINDOW) {   -        if (i) {-            for (j=0; j<WINDOW-1; j++)-                point_double_internal(working, working, -1);-            point_double_internal(working, working, 0);-        }-        -        /* Fetch another block of bits */-        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),-               bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {-            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));-            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));-        }-        bits1 &= WINDOW_MASK;-        bits2 &= WINDOW_MASK;-        mask_t inv1 = (bits1>>(WINDOW-1))-1;-        mask_t inv2 = (bits2>>(WINDOW-1))-1;-        bits1 ^= inv1;-        bits2 ^= inv2;-        -        pt_to_pniels(pn, working);--        constant_time_lookup(tmp, multiples1, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);-        cond_neg_niels(pn->n, inv1);-        /* add_pniels_to_pt(multiples1[bits1 & WINDOW_T_MASK], pn, 0); */-        add_pniels_to_pt(tmp, pn, 0);-        constant_time_insert(multiples1, tmp, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);-        -        -        constant_time_lookup(tmp, multiples2, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);-        cond_neg_niels(pn->n, inv1^inv2);-        /* add_pniels_to_pt(multiples2[bits2 & WINDOW_T_MASK], pn, 0); */-        add_pniels_to_pt(tmp, pn, 0);-        constant_time_insert(multiples2, tmp, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);-    }-    -    if (NTABLE > 1) {-        API_NS(point_copy)(working, multiples1[NTABLE-1]);-        API_NS(point_copy)(tmp    , multiples2[NTABLE-1]);-    -        for (i=NTABLE-1; i>1; i--) {-            API_NS(point_add)(multiples1[i-1], multiples1[i-1], multiples1[i]);-            API_NS(point_add)(multiples2[i-1], multiples2[i-1], multiples2[i]);-            API_NS(point_add)(working, working, multiples1[i-1]);-            API_NS(point_add)(tmp,     tmp,     multiples2[i-1]);-        }-    -        API_NS(point_add)(multiples1[0], multiples1[0], multiples1[1]);-        API_NS(point_add)(multiples2[0], multiples2[0], multiples2[1]);-        point_double_internal(working, working, 0);-        point_double_internal(tmp,         tmp, 0);-        API_NS(point_add)(a1, working, multiples1[0]);-        API_NS(point_add)(a2, tmp,     multiples2[0]);-    } else {-        API_NS(point_copy)(a1, multiples1[0]);-        API_NS(point_copy)(a2, multiples2[0]);-    }--    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));-    cryptonite_decaf_bzero(scalar2x,sizeof(scalar2x));-    cryptonite_decaf_bzero(pn,sizeof(pn));-    cryptonite_decaf_bzero(multiples1,sizeof(multiples1));-    cryptonite_decaf_bzero(multiples2,sizeof(multiples2));-    cryptonite_decaf_bzero(tmp,sizeof(tmp));-    cryptonite_decaf_bzero(working,sizeof(working));-}--cryptonite_decaf_bool_t API_NS(point_eq) ( const point_t p, const point_t q ) {-    /* equality mod 2-torsion compares x/y */-    gf a, b;-    cryptonite_gf_mul ( a, p->y, q->x );-    cryptonite_gf_mul ( b, q->y, p->x );-    mask_t succ = cryptonite_gf_eq(a,b);-    -    #if (COFACTOR == 8) && IMAGINE_TWIST-        cryptonite_gf_mul ( a, p->y, q->y );-        cryptonite_gf_mul ( b, q->x, p->x );-        #if !(IMAGINE_TWIST)-            cryptonite_gf_sub ( a, ZERO, a );-        #else-           /* Interesting note: the 4tor would normally be rotation.-            * But because of the *i twist, it's actually-            * (x,y) <-> (iy,ix)-            */-    -           /* No code, just a comment. */-        #endif-        succ |= cryptonite_gf_eq(a,b);-    #endif-    -    return mask_to_bool(succ);-}--cryptonite_decaf_bool_t API_NS(point_valid) (-    const point_t p-) {-    gf a,b,c;-    cryptonite_gf_mul(a,p->x,p->y);-    cryptonite_gf_mul(b,p->z,p->t);-    mask_t out = cryptonite_gf_eq(a,b);-    cryptonite_gf_sqr(a,p->x);-    cryptonite_gf_sqr(b,p->y);-    cryptonite_gf_sub(a,b,a);-    cryptonite_gf_sqr(b,p->t);-    cryptonite_gf_mulw(c,b,TWISTED_D);-    cryptonite_gf_sqr(b,p->z);-    cryptonite_gf_add(b,b,c);-    out &= cryptonite_gf_eq(a,b);-    out &= ~cryptonite_gf_eq(p->z,ZERO);-    return mask_to_bool(out);-}--void API_NS(point_debugging_torque) (-    point_t q,-    const point_t p-) {-#if COFACTOR == 8 && IMAGINE_TWIST-    gf tmp;-    cryptonite_gf_mul(tmp,p->x,SQRT_MINUS_ONE);-    cryptonite_gf_mul(q->x,p->y,SQRT_MINUS_ONE);-    cryptonite_gf_copy(q->y,tmp);-    cryptonite_gf_copy(q->z,p->z);-    cryptonite_gf_sub(q->t,ZERO,p->t);-#else-    cryptonite_gf_sub(q->x,ZERO,p->x);-    cryptonite_gf_sub(q->y,ZERO,p->y);-    cryptonite_gf_copy(q->z,p->z);-    cryptonite_gf_copy(q->t,p->t);-#endif-}--void API_NS(point_debugging_pscale) (-    point_t q,-    const point_t p,-    const uint8_t factor[SER_BYTES]-) {-    gf gfac,tmp;-    /* NB this means you'll never pscale by negative numbers for p521 */-    ignore_result(cryptonite_gf_deserialize(gfac,factor,0));-    cryptonite_gf_cond_sel(gfac,gfac,ONE,cryptonite_gf_eq(gfac,ZERO));-    cryptonite_gf_mul(tmp,p->x,gfac);-    cryptonite_gf_copy(q->x,tmp);-    cryptonite_gf_mul(tmp,p->y,gfac);-    cryptonite_gf_copy(q->y,tmp);-    cryptonite_gf_mul(tmp,p->z,gfac);-    cryptonite_gf_copy(q->z,tmp);-    cryptonite_gf_mul(tmp,p->t,gfac);-    cryptonite_gf_copy(q->t,tmp);-}--static void cryptonite_gf_batch_invert (-    gf *__restrict__ out,-    const gf *in,-    unsigned int n-) {-    gf t1;-    assert(n>1);-  -    cryptonite_gf_copy(out[1], in[0]);-    int i;-    for (i=1; i<(int) (n-1); i++) {-        cryptonite_gf_mul(out[i+1], out[i], in[i]);-    }-    cryptonite_gf_mul(out[0], out[n-1], in[n-1]);--    cryptonite_gf_invert(out[0], out[0], 1);--    for (i=n-1; i>0; i--) {-        cryptonite_gf_mul(t1, out[i], out[0]);-        cryptonite_gf_copy(out[i], t1);-        cryptonite_gf_mul(t1, out[0], in[i]);-        cryptonite_gf_copy(out[0], t1);-    }-}--static void batch_normalize_niels (-    niels_t *table,-    const gf *zs,-    gf *__restrict__ zis,-    int n-) {-    int i;-    gf product;-    cryptonite_gf_batch_invert(zis, zs, n);--    for (i=0; i<n; i++) {-        cryptonite_gf_mul(product, table[i]->a, zis[i]);-        cryptonite_gf_strong_reduce(product);-        cryptonite_gf_copy(table[i]->a, product);-        -        cryptonite_gf_mul(product, table[i]->b, zis[i]);-        cryptonite_gf_strong_reduce(product);-        cryptonite_gf_copy(table[i]->b, product);-        -        cryptonite_gf_mul(product, table[i]->c, zis[i]);-        cryptonite_gf_strong_reduce(product);-        cryptonite_gf_copy(table[i]->c, product);-    }-    -    cryptonite_decaf_bzero(product,sizeof(product));-}--void API_NS(precompute) (-    precomputed_s *table,-    const point_t base-) { -    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;-    assert(n*t*s >= SCALAR_BITS);-  -    point_t working, start, doubles[t-1];-    API_NS(point_copy)(working, base);-    pniels_t pn_tmp;-  -    gf zs[n<<(t-1)], zis[n<<(t-1)];-  -    unsigned int i,j,k;-    -    /* Compute n tables */-    for (i=0; i<n; i++) {--        /* Doubling phase */-        for (j=0; j<t; j++) {-            if (j) API_NS(point_add)(start, start, working);-            else API_NS(point_copy)(start, working);--            if (j==t-1 && i==n-1) break;--            point_double_internal(working, working,0);-            if (j<t-1) API_NS(point_copy)(doubles[j], working);--            for (k=0; k<s-1; k++)-                point_double_internal(working, working, k<s-2);-        }--        /* Gray-code phase */-        for (j=0;; j++) {-            int gray = j ^ (j>>1);-            int idx = (((i+1)<<(t-1))-1) ^ gray;--            pt_to_pniels(pn_tmp, start);-            memcpy(table->table[idx], pn_tmp->n, sizeof(pn_tmp->n));-            cryptonite_gf_copy(zs[idx], pn_tmp->z);-			-            if (j >= (1u<<(t-1)) - 1) break;-            int delta = (j+1) ^ ((j+1)>>1) ^ gray;--            for (k=0; delta>1; k++)-                delta >>=1;-            -            if (gray & (1<<k)) {-                API_NS(point_add)(start, start, doubles[k]);-            } else {-                API_NS(point_sub)(start, start, doubles[k]);-            }-        }-    }-    -    batch_normalize_niels(table->table,(const gf *)zs,zis,n<<(t-1));-    -    cryptonite_decaf_bzero(zs,sizeof(zs));-    cryptonite_decaf_bzero(zis,sizeof(zis));-    cryptonite_decaf_bzero(pn_tmp,sizeof(pn_tmp));-    cryptonite_decaf_bzero(working,sizeof(working));-    cryptonite_decaf_bzero(start,sizeof(start));-    cryptonite_decaf_bzero(doubles,sizeof(doubles));-}--static CRYPTONITE_DECAF_INLINE void-constant_time_lookup_niels (-    niels_s *__restrict__ ni,-    const niels_t *table,-    int nelts,-    int idx-) {-    constant_time_lookup(ni, table, sizeof(niels_s), nelts, idx);-}--void API_NS(precomputed_scalarmul) (-    point_t out,-    const precomputed_s *table,-    const scalar_t scalar-) {-    int i;-    unsigned j,k;-    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;-    -    scalar_t scalar1x;-    API_NS(scalar_add)(scalar1x, scalar, precomputed_scalarmul_adjustment);-    API_NS(scalar_halve)(scalar1x,scalar1x);-    -    niels_t ni;-    -    for (i=s-1; i>=0; i--) {-        if (i != (int)s-1) point_double_internal(out,out,0);-        -        for (j=0; j<n; j++) {-            int tab = 0;-         -            for (k=0; k<t; k++) {-                unsigned int bit = i + s*(k + j*t);-                if (bit < SCALAR_BITS) {-                    tab |= (scalar1x->limb[bit/WBITS] >> (bit%WBITS) & 1) << k;-                }-            }-            -            mask_t invert = (tab>>(t-1))-1;-            tab ^= invert;-            tab &= (1<<(t-1)) - 1;--            constant_time_lookup_niels(ni, &table->table[j<<(t-1)], 1<<(t-1), tab);--            cond_neg_niels(ni, invert);-            if ((i!=(int)s-1)||j) {-                add_niels_to_pt(out, ni, j==n-1 && i);-            } else {-                niels_to_pt(out, ni);-            }-        }-    }-    -    cryptonite_decaf_bzero(ni,sizeof(ni));-    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));-}--void API_NS(point_cond_sel) (-    point_t out,-    const point_t a,-    const point_t b,-    cryptonite_decaf_bool_t pick_b-) {-    constant_time_select(out,a,b,sizeof(point_t),bool_to_mask(pick_b),0);-}--/* FUTURE: restore Curve25519 Montgomery ladder? */-cryptonite_decaf_error_t API_NS(direct_scalarmul) (-    uint8_t scaled[SER_BYTES],-    const uint8_t base[SER_BYTES],-    const scalar_t scalar,-    cryptonite_decaf_bool_t allow_identity,-    cryptonite_decaf_bool_t short_circuit-) {-    point_t basep;-    cryptonite_decaf_error_t succ = API_NS(point_decode)(basep, base, allow_identity);-    if (short_circuit && succ != CRYPTONITE_DECAF_SUCCESS) return succ;-    API_NS(point_cond_sel)(basep, API_NS(point_base), basep, succ);-    API_NS(point_scalarmul)(basep, basep, scalar);-    API_NS(point_encode)(scaled, basep);-    API_NS(point_destroy)(basep);-    return succ;-}--void API_NS(point_mul_by_cofactor_and_encode_like_eddsa) (-    uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const point_t p-) {-    -    /* The point is now on the twisted curve.  Move it to untwisted. */-    gf x, y, z, t;-    point_t q;-#if COFACTOR == 8-    API_NS(point_double)(q,p);-#else-    API_NS(point_copy)(q,p);-#endif-    -#if EDDSA_USE_SIGMA_ISOGENY-    {-        /* Use 4-isogeny like ed25519:-         *   2*x*y*sqrt(d/a-1)/(ax^2 + y^2 - 2)-         *   (y^2 - ax^2)/(y^2 + ax^2)-         * with a = -1, d = -EDWARDS_D:-         *   -2xysqrt(EDWARDS_D-1)/(2z^2-y^2+x^2)-         *   (y^2+x^2)/(y^2-x^2)-         */-        gf u;-        cryptonite_gf_sqr ( x, q->x ); // x^2-        cryptonite_gf_sqr ( t, q->y ); // y^2-        cryptonite_gf_add( u, x, t ); // x^2 + y^2-        cryptonite_gf_add( z, q->y, q->x );-        cryptonite_gf_sqr ( y, z);-        cryptonite_gf_sub ( y, u, y ); // -2xy-        cryptonite_gf_sub ( z, t, x ); // y^2 - x^2-        cryptonite_gf_sqr ( x, q->z );-        cryptonite_gf_add ( t, x, x);-        cryptonite_gf_sub ( t, t, z);  // 2z^2 - y^2 + x^2-        cryptonite_gf_mul ( x, y, z ); // 2xy(y^2-x^2)-        cryptonite_gf_mul ( y, u, t ); // (x^2+y^2)(2z^2-y^2+x^2)-        cryptonite_gf_mul ( u, z, t );-        cryptonite_gf_copy( z, u );-        cryptonite_gf_mul ( u, x, SQRT_ONE_MINUS_D );-        cryptonite_gf_copy( x, u );-        cryptonite_decaf_bzero(u,sizeof(u));-    }-#elif IMAGINE_TWIST-    {-        API_NS(point_double)(q,q);-        API_NS(point_double)(q,q);-        cryptonite_gf_mul_qnr(x, q->x);-        cryptonite_gf_copy(y, q->y);-        cryptonite_gf_copy(z, q->z);-    }-#else-    {-        /* 4-isogeny: 2xy/(y^+x^2), (y^2-x^2)/(2z^2-y^2+x^2) */-        gf u;-        cryptonite_gf_sqr ( x, q->x );-        cryptonite_gf_sqr ( t, q->y );-        cryptonite_gf_add( u, x, t );-        cryptonite_gf_add( z, q->y, q->x );-        cryptonite_gf_sqr ( y, z);-        cryptonite_gf_sub ( y, u, y );-        cryptonite_gf_sub ( z, t, x );-        cryptonite_gf_sqr ( x, q->z );-        cryptonite_gf_add ( t, x, x); -        cryptonite_gf_sub ( t, t, z);-        cryptonite_gf_mul ( x, t, y );-        cryptonite_gf_mul ( y, z, u );-        cryptonite_gf_mul ( z, u, t );-        cryptonite_decaf_bzero(u,sizeof(u));-    }-#endif-    /* Affinize */-    cryptonite_gf_invert(z,z,1);-    cryptonite_gf_mul(t,x,z);-    cryptonite_gf_mul(x,y,z);-    -    /* Encode */-    enc[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] = 0;-    cryptonite_gf_serialize(enc, x, 1);-    enc[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] |= 0x80 & cryptonite_gf_lobit(t);--    cryptonite_decaf_bzero(x,sizeof(x));-    cryptonite_decaf_bzero(y,sizeof(y));-    cryptonite_decaf_bzero(z,sizeof(z));-    cryptonite_decaf_bzero(t,sizeof(t));-    API_NS(point_destroy)(q);-}---cryptonite_decaf_error_t API_NS(point_decode_like_eddsa_and_ignore_cofactor) (-    point_t p,-    const uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]-) {-    uint8_t enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES];-    memcpy(enc2,enc,sizeof(enc2));--    mask_t low = ~word_is_zero(enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] & 0x80);-    enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] &= ~0x80;-    -    mask_t succ = cryptonite_gf_deserialize(p->y, enc2, 1);-#if 0 == 0-    succ &= word_is_zero(enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1]);-#endif--    cryptonite_gf_sqr(p->x,p->y);-    cryptonite_gf_sub(p->z,ONE,p->x); /* num = 1-y^2 */-    #if EDDSA_USE_SIGMA_ISOGENY-        cryptonite_gf_mulw(p->t,p->z,EDWARDS_D); /* d-dy^2 */-        cryptonite_gf_mulw(p->x,p->z,EDWARDS_D-1); /* num = (1-y^2)(d-1) */-        cryptonite_gf_copy(p->z,p->x);-    #else-        cryptonite_gf_mulw(p->t,p->x,EDWARDS_D); /* dy^2 */-    #endif-    cryptonite_gf_sub(p->t,ONE,p->t); /* denom = 1-dy^2 or 1-d + dy^2 */-    -    cryptonite_gf_mul(p->x,p->z,p->t);-    succ &= cryptonite_gf_isr(p->t,p->x); /* 1/sqrt(num * denom) */-    -    cryptonite_gf_mul(p->x,p->t,p->z); /* sqrt(num / denom) */-    cryptonite_gf_cond_neg(p->x,~cryptonite_gf_lobit(p->x)^low);-    cryptonite_gf_copy(p->z,ONE);-  -    #if EDDSA_USE_SIGMA_ISOGENY-    {-       /* Use 4-isogeny like ed25519:-        *   2*x*y/sqrt(1-d/a)/(ax^2 + y^2 - 2)-        *   (y^2 - ax^2)/(y^2 + ax^2)-        * (MAGIC: above formula may be off by a factor of -a-        * or something somewhere; check it for other a)-        *-        * with a = -1, d = -EDWARDS_D:-        *   -2xy/sqrt(1-EDWARDS_D)/(2z^2-y^2+x^2)-        *   (y^2+x^2)/(y^2-x^2)-        */-        gf a, b, c, d;-        cryptonite_gf_sqr ( c, p->x );-        cryptonite_gf_sqr ( a, p->y );-        cryptonite_gf_add ( d, c, a ); // x^2 + y^2-        cryptonite_gf_add ( p->t, p->y, p->x );-        cryptonite_gf_sqr ( b, p->t );-        cryptonite_gf_sub ( b, b, d ); // 2xy-        cryptonite_gf_sub ( p->t, a, c ); // y^2 - x^2-        cryptonite_gf_sqr ( p->x, p->z );-        cryptonite_gf_add ( p->z, p->x, p->x );-        cryptonite_gf_sub ( a, p->z, p->t ); // 2z^2 - y^2 + x^2-        cryptonite_gf_mul ( c, a, SQRT_ONE_MINUS_D );-        cryptonite_gf_mul ( p->x, b, p->t); // (2xy)(y^2-x^2)-        cryptonite_gf_mul ( p->z, p->t, c ); // (y^2-x^2)sd(2z^2 - y^2 + x^2)-        cryptonite_gf_mul ( p->y, d, c ); // (y^2+x^2)sd(2z^2 - y^2 + x^2)-        cryptonite_gf_mul ( p->t, d, b );-        cryptonite_decaf_bzero(a,sizeof(a));-        cryptonite_decaf_bzero(b,sizeof(b));-        cryptonite_decaf_bzero(c,sizeof(c));-        cryptonite_decaf_bzero(d,sizeof(d));-    } -    #elif IMAGINE_TWIST-    {-        cryptonite_gf_mul(p->t,p->x,SQRT_MINUS_ONE);-        cryptonite_gf_copy(p->x,p->t);-        cryptonite_gf_mul(p->t,p->x,p->y);-    }-    #else-    {-        /* 4-isogeny 2xy/(y^2-ax^2), (y^2+ax^2)/(2-y^2-ax^2) */-        gf a, b, c, d;-        cryptonite_gf_sqr ( c, p->x );-        cryptonite_gf_sqr ( a, p->y );-        cryptonite_gf_add ( d, c, a );-        cryptonite_gf_add ( p->t, p->y, p->x );-        cryptonite_gf_sqr ( b, p->t );-        cryptonite_gf_sub ( b, b, d );-        cryptonite_gf_sub ( p->t, a, c );-        cryptonite_gf_sqr ( p->x, p->z );-        cryptonite_gf_add ( p->z, p->x, p->x );-        cryptonite_gf_sub ( a, p->z, d );-        cryptonite_gf_mul ( p->x, a, b );-        cryptonite_gf_mul ( p->z, p->t, a );-        cryptonite_gf_mul ( p->y, p->t, d );-        cryptonite_gf_mul ( p->t, b, d );-        cryptonite_decaf_bzero(a,sizeof(a));-        cryptonite_decaf_bzero(b,sizeof(b));-        cryptonite_decaf_bzero(c,sizeof(c));-        cryptonite_decaf_bzero(d,sizeof(d));-    }-    #endif-    -    cryptonite_decaf_bzero(enc2,sizeof(enc2));-    assert(API_NS(point_valid)(p) || ~succ);-    return cryptonite_decaf_succeed_if(mask_to_bool(succ));-}--cryptonite_decaf_error_t cryptonite_decaf_x448 (-    uint8_t out[X_PUBLIC_BYTES],-    const uint8_t base[X_PUBLIC_BYTES],-    const uint8_t scalar[X_PRIVATE_BYTES]-) {-    gf x1, x2, z2, x3, z3, t1, t2;-    ignore_result(cryptonite_gf_deserialize(x1,base,1));-    cryptonite_gf_copy(x2,ONE);-    cryptonite_gf_copy(z2,ZERO);-    cryptonite_gf_copy(x3,x1);-    cryptonite_gf_copy(z3,ONE);-    -    int t;-    mask_t swap = 0;-    -    for (t = X_PRIVATE_BITS-1; t>=0; t--) {-        uint8_t sb = scalar[t/8];-        -        /* Scalar conditioning */-        if (t/8==0) sb &= -(uint8_t)COFACTOR;-        else if (t == X_PRIVATE_BITS-1) sb = -1;-        -        mask_t k_t = (sb>>(t%8)) & 1;-        k_t = -k_t; /* set to all 0s or all 1s */-        -        swap ^= k_t;-        cryptonite_gf_cond_swap(x2,x3,swap);-        cryptonite_gf_cond_swap(z2,z3,swap);-        swap = k_t;-        -        cryptonite_gf_add_nr(t1,x2,z2); /* A = x2 + z2 */        /* 2+e */-        cryptonite_gf_sub_nr(t2,x2,z2); /* B = x2 - z2 */        /* 3+e */-        cryptonite_gf_sub_nr(z2,x3,z3); /* D = x3 - z3 */        /* 3+e */-        cryptonite_gf_mul(x2,t1,z2);    /* DA */-        cryptonite_gf_add_nr(z2,z3,x3); /* C = x3 + z3 */        /* 2+e */-        cryptonite_gf_mul(x3,t2,z2);    /* CB */-        cryptonite_gf_sub_nr(z3,x2,x3); /* DA-CB */              /* 3+e */-        cryptonite_gf_sqr(z2,z3);       /* (DA-CB)^2 */-        cryptonite_gf_mul(z3,x1,z2);    /* z3 = x1(DA-CB)^2 */-        cryptonite_gf_add_nr(z2,x2,x3); /* (DA+CB) */            /* 2+e */-        cryptonite_gf_sqr(x3,z2);       /* x3 = (DA+CB)^2 */-        -        cryptonite_gf_sqr(z2,t1);       /* AA = A^2 */-        cryptonite_gf_sqr(t1,t2);       /* BB = B^2 */-        cryptonite_gf_mul(x2,z2,t1);    /* x2 = AA*BB */-        cryptonite_gf_sub_nr(t2,z2,t1); /* E = AA-BB */          /* 3+e */-        -        cryptonite_gf_mulw(t1,t2,-EDWARDS_D); /* E*-d = a24*E */-        cryptonite_gf_add_nr(t1,t1,z2); /* AA + a24*E */         /* 2+e */-        cryptonite_gf_mul(z2,t2,t1); /* z2 = E(AA+a24*E) */-    }-    -    /* Finish */-    cryptonite_gf_cond_swap(x2,x3,swap);-    cryptonite_gf_cond_swap(z2,z3,swap);-    cryptonite_gf_invert(z2,z2,0);-    cryptonite_gf_mul(x1,x2,z2);-    cryptonite_gf_serialize(out,x1,1);-    mask_t nz = ~cryptonite_gf_eq(x1,ZERO);-    -    cryptonite_decaf_bzero(x1,sizeof(x1));-    cryptonite_decaf_bzero(x2,sizeof(x2));-    cryptonite_decaf_bzero(z2,sizeof(z2));-    cryptonite_decaf_bzero(x3,sizeof(x3));-    cryptonite_decaf_bzero(z3,sizeof(z3));-    cryptonite_decaf_bzero(t1,sizeof(t1));-    cryptonite_decaf_bzero(t2,sizeof(t2));-    -    return cryptonite_decaf_succeed_if(mask_to_bool(nz));-}--/* Thanks Johan Pascal */-void cryptonite_decaf_ed448_convert_public_key_to_x448 (-    uint8_t x[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]-) {-    gf y;-    {-        uint8_t enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES];-        memcpy(enc2,ed,sizeof(enc2));--        /* retrieve y from the ed compressed point */-        enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES-1] &= ~0x80;-        ignore_result(cryptonite_gf_deserialize(y, enc2, 0));-        cryptonite_decaf_bzero(enc2,sizeof(enc2));-    }-    -    {-        gf n,d;-        -#if EDDSA_USE_SIGMA_ISOGENY-        /* u = (1+y)/(1-y)*/-        cryptonite_gf_add(n, y, ONE); /* n = y+1 */-        cryptonite_gf_sub(d, ONE, y); /* d = 1-y */-        cryptonite_gf_invert(d, d, 0); /* d = 1/(1-y) */-        cryptonite_gf_mul(y, n, d); /* u = (y+1)/(1-y) */-        cryptonite_gf_serialize(x,y,1);-#else /* EDDSA_USE_SIGMA_ISOGENY */-        /* u = y^2 * (1-dy^2) / (1-y^2) */-        cryptonite_gf_sqr(n,y); /* y^2*/-        cryptonite_gf_sub(d,ONE,n); /* 1-y^2*/-        cryptonite_gf_invert(d,d,0); /* 1/(1-y^2)*/-        cryptonite_gf_mul(y,n,d); /* y^2 / (1-y^2) */-        cryptonite_gf_mulw(d,n,EDWARDS_D); /* dy^2*/-        cryptonite_gf_sub(d, ONE, d); /* 1-dy^2*/-        cryptonite_gf_mul(n, y, d); /* y^2 * (1-dy^2) / (1-y^2) */-        cryptonite_gf_serialize(x,n,1);-#endif /* EDDSA_USE_SIGMA_ISOGENY */-        -        cryptonite_decaf_bzero(y,sizeof(y));-        cryptonite_decaf_bzero(n,sizeof(n));-        cryptonite_decaf_bzero(d,sizeof(d));-    }-}--void cryptonite_decaf_x448_generate_key (-    uint8_t out[X_PUBLIC_BYTES],-    const uint8_t scalar[X_PRIVATE_BYTES]-) {-    cryptonite_decaf_x448_derive_public_key(out,scalar);-}--void cryptonite_decaf_x448_derive_public_key (-    uint8_t out[X_PUBLIC_BYTES],-    const uint8_t scalar[X_PRIVATE_BYTES]-) {-    /* Scalar conditioning */-    uint8_t scalar2[X_PRIVATE_BYTES];-    memcpy(scalar2,scalar,sizeof(scalar2));-    scalar2[0] &= -(uint8_t)COFACTOR;-    -    scalar2[X_PRIVATE_BYTES-1] &= ~(-1u<<((X_PRIVATE_BITS+7)%8));-    scalar2[X_PRIVATE_BYTES-1] |= 1<<((X_PRIVATE_BITS+7)%8);-    -    scalar_t the_scalar;-    API_NS(scalar_decode_long)(the_scalar,scalar2,sizeof(scalar2));-    -    /* We're gonna isogenize by 2, so divide by 2.-     *-     * Why by 2, even though it's a 4-isogeny?-     *-     * The isogeny map looks like-     * Montgomery <-2-> Jacobi <-2-> Edwards-     *-     * Since the Jacobi base point is the PREimage of the iso to-     * the Montgomery curve, and we're going-     * Jacobi -> Edwards -> Jacobi -> Montgomery,-     * we pick up only a factor of 2 over Jacobi -> Montgomery. -     */-    API_NS(scalar_halve)(the_scalar,the_scalar);-    point_t p;-    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),the_scalar);-    -    /* Isogenize to Montgomery curve.-     *-     * Why isn't this just a separate function, eg cryptonite_decaf_encode_like_x448?-     * Basically because in general it does the wrong thing if there is a cofactor-     * component in the input.  In this function though, there isn't a cofactor-     * component in the input.-     */-    cryptonite_gf_invert(p->t,p->x,0); /* 1/x */-    cryptonite_gf_mul(p->z,p->t,p->y); /* y/x */-    cryptonite_gf_sqr(p->y,p->z); /* (y/x)^2 */-#if IMAGINE_TWIST-    cryptonite_gf_sub(p->y,ZERO,p->y);-#endif-    cryptonite_gf_serialize(out,p->y,1);-        -    cryptonite_decaf_bzero(scalar2,sizeof(scalar2));-    API_NS(scalar_destroy)(the_scalar);-    API_NS(point_destroy)(p);-}--/**- * @cond internal- * Control for variable-time scalar multiply algorithms.- */-struct smvt_control {-  int power, addend;-};--static int recode_wnaf (-    struct smvt_control *control, /* [nbits/(table_bits+1) + 3] */-    const scalar_t scalar,-    unsigned int table_bits-) {-    unsigned int table_size = SCALAR_BITS/(table_bits+1) + 3;-    int position = table_size - 1; /* at the end */-    -    /* place the end marker */-    control[position].power = -1;-    control[position].addend = 0;-    position--;--    /* PERF: Could negate scalar if it's large.  But then would need more cases-     * in the actual code that uses it, all for an expected reduction of like 1/5 op.-     * Probably not worth it.-     */-    -    uint64_t current = scalar->limb[0] & 0xFFFF;-    uint32_t mask = (1<<(table_bits+1))-1;--    unsigned int w;-    const unsigned int B_OVER_16 = sizeof(scalar->limb[0]) / 2;-    for (w = 1; w<(SCALAR_BITS-1)/16+3; w++) {-        if (w < (SCALAR_BITS-1)/16+1) {-            /* Refill the 16 high bits of current */-            current += (uint32_t)((scalar->limb[w/B_OVER_16]>>(16*(w%B_OVER_16)))<<16);-        }-        -        while (current & 0xFFFF) {-            assert(position >= 0);-            uint32_t pos = __builtin_ctz((uint32_t)current), odd = (uint32_t)current >> pos;-            int32_t delta = odd & mask;-            if (odd & 1<<(table_bits+1)) delta -= (1<<(table_bits+1));-            current -= delta << pos;-            control[position].power = pos + 16*(w-1);-            control[position].addend = delta;-            position--;-        }-        current >>= 16;-    }-    assert(current==0);-    -    position++;-    unsigned int n = table_size - position;-    unsigned int i;-    for (i=0; i<n; i++) {-        control[i] = control[i+position];-    }-    return n-1;-}--static void-prepare_wnaf_table(-    pniels_t *output,-    const point_t working,-    unsigned int tbits-) {-    point_t tmp;-    int i;-    pt_to_pniels(output[0], working);--    if (tbits == 0) return;--    API_NS(point_double)(tmp,working);-    pniels_t twop;-    pt_to_pniels(twop, tmp);--    add_pniels_to_pt(tmp, output[0],0);-    pt_to_pniels(output[1], tmp);--    for (i=2; i < 1<<tbits; i++) {-        add_pniels_to_pt(tmp, twop,0);-        pt_to_pniels(output[i], tmp);-    }-    -    API_NS(point_destroy)(tmp);-    cryptonite_decaf_bzero(twop,sizeof(twop));-}--extern const gf API_NS(precomputed_wnaf_as_fe)[];-static const niels_t *API_NS(wnaf_base) = (const niels_t *)API_NS(precomputed_wnaf_as_fe);-const size_t API_NS(sizeof_precomputed_wnafs)-    = sizeof(niels_t)<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS;--void API_NS(precompute_wnafs) (-    niels_t out[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS],-    const point_t base-);--void API_NS(precompute_wnafs) (-    niels_t out[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS],-    const point_t base-) {-    pniels_t tmp[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS];-    gf zs[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS], zis[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS];-    int i;-    prepare_wnaf_table(tmp,base,CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS);-    for (i=0; i<1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS; i++) {-        memcpy(out[i], tmp[i]->n, sizeof(niels_t));-        cryptonite_gf_copy(zs[i], tmp[i]->z);-    }-    batch_normalize_niels(out, (const gf *)zs, zis, 1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS);-    -    cryptonite_decaf_bzero(tmp,sizeof(tmp));-    cryptonite_decaf_bzero(zs,sizeof(zs));-    cryptonite_decaf_bzero(zis,sizeof(zis));-}--void API_NS(base_double_scalarmul_non_secret) (-    point_t combo,-    const scalar_t scalar1,-    const point_t base2,-    const scalar_t scalar2-) {-    const int table_bits_var = CRYPTONITE_DECAF_WNAF_VAR_TABLE_BITS,-        table_bits_pre = CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS;-    struct smvt_control control_var[SCALAR_BITS/(table_bits_var+1)+3];-    struct smvt_control control_pre[SCALAR_BITS/(table_bits_pre+1)+3];-    -    int ncb_pre = recode_wnaf(control_pre, scalar1, table_bits_pre);-    int ncb_var = recode_wnaf(control_var, scalar2, table_bits_var);-  -    pniels_t precmp_var[1<<table_bits_var];-    prepare_wnaf_table(precmp_var, base2, table_bits_var);-  -    int contp=0, contv=0, i = control_var[0].power;--    if (i < 0) {-        API_NS(point_copy)(combo, API_NS(point_identity));-        return;-    } else if (i > control_pre[0].power) {-        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);-        contv++;-    } else if (i == control_pre[0].power && i >=0 ) {-        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);-        add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1], i);-        contv++; contp++;-    } else {-        i = control_pre[0].power;-        niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1]);-        contp++;-    }-    -    for (i--; i >= 0; i--) {-        int cv = (i==control_var[contv].power), cp = (i==control_pre[contp].power);-        point_double_internal(combo,combo,i && !(cv||cp));--        if (cv) {-            assert(control_var[contv].addend);--            if (control_var[contv].addend > 0) {-                add_pniels_to_pt(combo, precmp_var[control_var[contv].addend >> 1], i&&!cp);-            } else {-                sub_pniels_from_pt(combo, precmp_var[(-control_var[contv].addend) >> 1], i&&!cp);-            }-            contv++;-        }--        if (cp) {-            assert(control_pre[contp].addend);--            if (control_pre[contp].addend > 0) {-                add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[contp].addend >> 1], i);-            } else {-                sub_niels_from_pt(combo, API_NS(wnaf_base)[(-control_pre[contp].addend) >> 1], i);-            }-            contp++;-        }-    }-    -    /* This function is non-secret, but whatever this is cheap. */-    cryptonite_decaf_bzero(control_var,sizeof(control_var));-    cryptonite_decaf_bzero(control_pre,sizeof(control_pre));-    cryptonite_decaf_bzero(precmp_var,sizeof(precmp_var));--    assert(contv == ncb_var); (void)ncb_var;-    assert(contp == ncb_pre); (void)ncb_pre;-}--void API_NS(point_destroy) (-    point_t point-) {-    cryptonite_decaf_bzero(point, sizeof(point_t));-}--void API_NS(precomputed_destroy) (-    precomputed_s *pre-) {-    cryptonite_decaf_bzero(pre, API_NS(sizeof_precomputed_s));+#define API_NS(_id) crypton_decaf_448_##_id+#define SCALAR_BITS CRYPTON_DECAF_448_SCALAR_BITS+#define SCALAR_SER_BYTES CRYPTON_DECAF_448_SCALAR_BYTES+#define SCALAR_LIMBS CRYPTON_DECAF_448_SCALAR_LIMBS+#define scalar_t API_NS(scalar_t)+#define point_t API_NS(point_t)+#define precomputed_s API_NS(precomputed_s)+#define IMAGINE_TWIST 0+#define COFACTOR 4++/* Comb config: number of combs, n, t, s. */+#define COMBS_N 5+#define COMBS_T 5+#define COMBS_S 18+#define CRYPTON_DECAF_WINDOW_BITS 5+#define CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS 5+#define CRYPTON_DECAF_WNAF_VAR_TABLE_BITS 3++#define EDDSA_USE_SIGMA_ISOGENY 0++static const int EDWARDS_D = -39081;+static const scalar_t point_scalarmul_adjustment = {{{+    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)+}}}, precomputed_scalarmul_adjustment = {{{+    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)+}}};++const uint8_t crypton_decaf_x448_base_point[CRYPTON_DECAF_X448_PUBLIC_BYTES] = { 0x05 };++#if COFACTOR==8 || EDDSA_USE_SIGMA_ISOGENY+    static const gf SQRT_ONE_MINUS_D = {FIELD_LITERAL(+        /* NONE */+    )};+#endif++/* End of template stuff */++/* Sanity */+#if (COFACTOR == 8) && !IMAGINE_TWIST && !UNSAFE_CURVE_HAS_POINTS_AT_INFINITY+/* FUTURE MAGIC: Curve41417 doesn't have these properties. */+#error "Currently require IMAGINE_TWIST (and thus p=5 mod 8) for cofactor 8"+        /* OK, but why?+         * Two reasons: #1: There are bugs when COFACTOR == && IMAGINE_TWIST+         # #2: +         */+#endif++#if IMAGINE_TWIST && (P_MOD_8 != 5)+    #error "Cannot use IMAGINE_TWIST except for p == 5 mod 8"+#endif++#if (COFACTOR != 8) && (COFACTOR != 4)+    #error "COFACTOR must be 4 or 8"+#endif+ +#if IMAGINE_TWIST+    extern const gf SQRT_MINUS_ONE;+#endif++#define WBITS CRYPTON_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */++extern const point_t API_NS(point_base);++/* Projective Niels coordinates */+typedef struct { gf a, b, c; } niels_s, niels_t[1];+typedef struct { niels_t n; gf z; } VECTOR_ALIGNED pniels_s, pniels_t[1];++/* Precomputed base */+struct precomputed_s { niels_t table [COMBS_N<<(COMBS_T-1)]; };++extern const gf API_NS(precomputed_base_as_fe)[];+const precomputed_s *API_NS(precomputed_base) =+    (const precomputed_s *) &API_NS(precomputed_base_as_fe);++const size_t API_NS(sizeof_precomputed_s) = sizeof(precomputed_s);+const size_t API_NS(alignof_precomputed_s) = sizeof(big_register_t);++/** Inverse. */+static void+crypton_gf_invert(gf y, const gf x, int assert_nonzero) {+    gf t1, t2;+    crypton_gf_sqr(t1, x); // o^2+    mask_t ret = crypton_gf_isr(t2, t1); // +-1/sqrt(o^2) = +-1/o+    (void)ret;+    if (assert_nonzero) assert(ret);+    crypton_gf_sqr(t1, t2);+    crypton_gf_mul(t2, t1, x); // not direct to y in case of alias.+    crypton_gf_copy(y, t2);+}++/** Return high bit of x = low bit of 2x mod p */+static mask_t crypton_gf_lobit(const gf x) {+    gf y;+    crypton_gf_copy(y,x);+    crypton_gf_strong_reduce(y);+    return -(y->limb[0]&1);+}++/** identity = (0,1) */+const point_t API_NS(point_identity) = {{{{{0}}},{{{1}}},{{{1}}},{{{0}}}}};++void API_NS(deisogenize) (+    crypton_gf_s *__restrict__ s,+    crypton_gf_s *__restrict__ minus_t_over_s,+    const point_t p,+    mask_t toggle_hibit_s,+    mask_t toggle_hibit_t_over_s,+    mask_t toggle_rotation+);++void API_NS(deisogenize) (+    crypton_gf_s *__restrict__ s,+    crypton_gf_s *__restrict__ minus_t_over_s,+    const point_t p,+    mask_t toggle_hibit_s,+    mask_t toggle_hibit_t_over_s,+    mask_t toggle_rotation+) {+#if COFACTOR == 4 && !IMAGINE_TWIST+    (void) toggle_rotation;+    +    gf b, d;+    crypton_gf_s *c = s, *a = minus_t_over_s;+    crypton_gf_mulw(a, p->y, 1-EDWARDS_D);+    crypton_gf_mul(c, a, p->t);     /* -dYT, with EDWARDS_D = d-1 */+    crypton_gf_mul(a, p->x, p->z); +    crypton_gf_sub(d, c, a);  /* aXZ-dYT with a=-1 */+    crypton_gf_add(a, p->z, p->y); +    crypton_gf_sub(b, p->z, p->y); +    crypton_gf_mul(c, b, a);+    crypton_gf_mulw(b, c, -EDWARDS_D); /* (a-d)(Z+Y)(Z-Y) */+    mask_t ok = crypton_gf_isr (a,b); /* r in the paper */+    (void)ok; assert(ok | crypton_gf_eq(b,ZERO));+    crypton_gf_mulw (b, a, -EDWARDS_D); /* u in the paper */++    crypton_gf_mul(c,a,d); /* r(aZX-dYT) */+    crypton_gf_mul(a,b,p->z); /* uZ */+    crypton_gf_add(a,a,a); /* 2uZ */+    +    mask_t tg = toggle_hibit_t_over_s ^ ~crypton_gf_hibit(minus_t_over_s);+    crypton_gf_cond_neg(minus_t_over_s, tg); /* t/s <-? -t/s */+    crypton_gf_cond_neg(c, tg); /* u <- -u if negative. */+    +    crypton_gf_add(d,c,p->y);+    crypton_gf_mul(s,b,d);+    crypton_gf_cond_neg(s, toggle_hibit_s ^ crypton_gf_hibit(s));+#else+    /* More complicated because of rotation */+    /* MAGIC This code is wrong for certain non-Curve25519 curves;+     * check if it's because of Cofactor==8 or IMAGINE_TWIST */+    +    gf c, d;+    crypton_gf_s *b = s, *a = minus_t_over_s;++    #if IMAGINE_TWIST+        gf x, t;+        crypton_gf_div_qnr(x,p->x);+        crypton_gf_div_qnr(t,p->t);+        crypton_gf_add ( a, p->z, x );+        crypton_gf_sub ( b, p->z, x );+        crypton_gf_mul ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 - X^2 */+    #else+        const crypton_gf_s *x = p->x, *t = p->t;+        crypton_gf_sqr ( a, p->z );+        crypton_gf_sqr ( b, p->x );+        crypton_gf_add ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 + X^2 */+    #endif+    /* Here: c = "zx" in the SAGE code = Z^2 - aX^2 */+    +    crypton_gf_mul ( a, p->z, t ); /* "tz" = T*Z */+    crypton_gf_sqr ( b, a );+    crypton_gf_mul ( d, b, c ); /* (TZ)^2 * (Z^2-aX^2) */+    mask_t ok = crypton_gf_isr(b, d);+    (void)ok; assert(ok | crypton_gf_eq(d,ZERO));+    crypton_gf_mul ( d, b, a ); /* "osx" = 1 / sqrt(z^2-ax^2) */+    crypton_gf_mul ( a, b, c ); +    crypton_gf_mul ( b, a, d ); /* 1/tz */++    mask_t rotate;+    #if (COFACTOR == 8)+        gf e;+        crypton_gf_sqr(e, p->z);+        crypton_gf_mul(a, e, b); /* z^2 / tz = z/t = 1/xy */+        rotate = crypton_gf_hibit(a) ^ toggle_rotation;+        /* Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x */+        crypton_gf_mul ( a, b, c ); +        crypton_gf_cond_sel ( a, a, SQRT_ONE_MINUS_D, rotate );+        crypton_gf_cond_sel ( e, p->y, x, rotate );+    #else+        const crypton_gf_s *e = x;+        (void)toggle_rotation;+        rotate = 0;+    #endif+    +    crypton_gf_mul ( c, a, d ); // new "osx"+    crypton_gf_mul ( a, c, p->z );+    crypton_gf_add ( minus_t_over_s, a, a ); // 2 * "osx" * Z+    crypton_gf_mul ( d, b, p->z );+    +    mask_t tg = toggle_hibit_t_over_s ^~ crypton_gf_hibit(minus_t_over_s);+    crypton_gf_cond_neg ( minus_t_over_s, tg );+    crypton_gf_cond_neg ( c, rotate ^ tg );+    crypton_gf_add ( d, d, c );+    crypton_gf_mul ( s, d, e ); /* here "x" = y unless rotate */+    crypton_gf_cond_neg ( s, toggle_hibit_s ^ crypton_gf_hibit(s) );+#endif+}++void API_NS(point_encode)( unsigned char ser[SER_BYTES], const point_t p ) {+    gf s, mtos;+    API_NS(deisogenize)(s,mtos,p,0,0,0);+    crypton_gf_serialize(ser,s,0);+}++crypton_decaf_error_t API_NS(point_decode) (+    point_t p,+    const unsigned char ser[SER_BYTES],+    crypton_decaf_bool_t allow_identity+) {+    gf s, a, b, c, d, e, f;+    mask_t succ = crypton_gf_deserialize(s, ser, 0);+    mask_t zero = crypton_gf_eq(s, ZERO);+    succ &= bool_to_mask(allow_identity) | ~zero;+    crypton_gf_sqr ( a, s ); /* s^2 */+#if IMAGINE_TWIST+    crypton_gf_sub ( f, ONE, a ); /* f = 1-as^2 = 1-s^2*/+#else+    crypton_gf_add ( f, ONE, a ); /* f = 1-as^2 = 1+s^2 */+#endif+    succ &= ~ crypton_gf_eq( f, ZERO );+    crypton_gf_sqr ( b, f );  /* (1-as^2)^2 = 1 - 2as^2 + a^2 s^4 */+    crypton_gf_mulw ( c, a, 4*IMAGINE_TWIST-4*EDWARDS_D ); +    crypton_gf_add ( c, c, b ); /* t^2 = 1 + (2a-4d) s^2 + s^4 */+    crypton_gf_mul ( d, f, s ); /* s * (1-as^2) for denoms */+    crypton_gf_sqr ( e, d );    /* s^2 * (1-as^2)^2 */+    crypton_gf_mul ( b, c, e ); /* t^2 * s^2 * (1-as^2)^2 */+    +    succ &= crypton_gf_isr(e,b) | crypton_gf_eq(b,ZERO); /* e = 1/(t s (1-as^2)) */+    crypton_gf_mul ( b, e, d ); /* 1 / t */+    crypton_gf_mul ( d, e, c ); /* t / (s(1-as^2)) */+    crypton_gf_mul ( e, d, f ); /* t / s */+    mask_t negtos = crypton_gf_hibit(e);+    crypton_gf_cond_neg(b, negtos);+    crypton_gf_cond_neg(d, negtos);++#if IMAGINE_TWIST+    crypton_gf_add ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */+#else+    crypton_gf_sub ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */+#endif++#if COFACTOR == 8+    crypton_gf_mul ( a, p->z, d); /* t(1+s^2) / s(1-s^2) = 2/xy */+    succ &= ~crypton_gf_lobit(a); /* = ~crypton_gf_hibit(a/2), since crypton_gf_hibit(x) = crypton_gf_lobit(2x) */+#endif+    +    crypton_gf_mul ( a, f, b ); /* y = (1-s^2) / t */+    crypton_gf_mul ( p->y, p->z, a ); /* Y = yZ */+#if IMAGINE_TWIST+    crypton_gf_add ( b, s, s );+    crypton_gf_mul(p->x, b, SQRT_MINUS_ONE); /* Curve25519 */+#else+    crypton_gf_add ( p->x, s, s );+#endif+    crypton_gf_mul ( p->t, p->x, a ); /* T = 2s (1-as^2)/t */+    +#if UNSAFE_CURVE_HAS_POINTS_AT_INFINITY+    /* This can't happen for any of the supported configurations.+     *+     * If it can happen (because s=1), it's because the curve has points+     * at infinity, which means that there may be critical security bugs+     * elsewhere in the library.  In that case, it's better that you hit+     * the assertion in point_valid, which will happen in the test suite+     * since it tests s=1.+     *+     * This debugging option is to allow testing of IMAGINE_TWIST = 0 on+     * Ed25519, without hitting that assertion.  Don't use it in+     * production.+     */+    succ &= ~crypton_gf_eq(p->z,ZERO);+#endif+    +    p->y->limb[0] -= zero;+    assert(API_NS(point_valid)(p) | ~succ);+    +    return crypton_decaf_succeed_if(mask_to_bool(succ));+}++#if IMAGINE_TWIST+#define TWISTED_D (-(EDWARDS_D))+#else+#define TWISTED_D ((EDWARDS_D)-1)+#endif++#if TWISTED_D < 0+#define EFF_D (-(TWISTED_D))+#define NEG_D 1+#else+#define EFF_D TWISTED_D+#define NEG_D 0+#endif++void API_NS(point_sub) (+    point_t p,+    const point_t q,+    const point_t r+) {+    gf a, b, c, d;+    crypton_gf_sub_nr ( b, q->y, q->x ); /* 3+e */+    crypton_gf_sub_nr ( d, r->y, r->x ); /* 3+e */+    crypton_gf_add_nr ( c, r->y, r->x ); /* 2+e */+    crypton_gf_mul ( a, c, b );+    crypton_gf_add_nr ( b, q->y, q->x ); /* 2+e */+    crypton_gf_mul ( p->y, d, b );+    crypton_gf_mul ( b, r->t, q->t );+    crypton_gf_mulw ( p->x, b, 2*EFF_D );+    crypton_gf_add_nr ( b, a, p->y );    /* 2+e */+    crypton_gf_sub_nr ( c, p->y, a );    /* 3+e */+    crypton_gf_mul ( a, q->z, r->z );+    crypton_gf_add_nr ( a, a, a );       /* 2+e */+    if (GF_HEADROOM <= 3) crypton_gf_weak_reduce(a); /* or 1+e */+#if NEG_D+    crypton_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */+    crypton_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */+#else+    crypton_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */+    crypton_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */+#endif+    crypton_gf_mul ( p->z, a, p->y );+    crypton_gf_mul ( p->x, p->y, c );+    crypton_gf_mul ( p->y, a, b );+    crypton_gf_mul ( p->t, b, c );+}+    +void API_NS(point_add) (+    point_t p,+    const point_t q,+    const point_t r+) {+    gf a, b, c, d;+    crypton_gf_sub_nr ( b, q->y, q->x ); /* 3+e */+    crypton_gf_sub_nr ( c, r->y, r->x ); /* 3+e */+    crypton_gf_add_nr ( d, r->y, r->x ); /* 2+e */+    crypton_gf_mul ( a, c, b );+    crypton_gf_add_nr ( b, q->y, q->x ); /* 2+e */+    crypton_gf_mul ( p->y, d, b );+    crypton_gf_mul ( b, r->t, q->t );+    crypton_gf_mulw ( p->x, b, 2*EFF_D );+    crypton_gf_add_nr ( b, a, p->y );    /* 2+e */+    crypton_gf_sub_nr ( c, p->y, a );    /* 3+e */+    crypton_gf_mul ( a, q->z, r->z );+    crypton_gf_add_nr ( a, a, a );       /* 2+e */+    if (GF_HEADROOM <= 3) crypton_gf_weak_reduce(a); /* or 1+e */+#if NEG_D+    crypton_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */+    crypton_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */+#else+    crypton_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */+    crypton_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */+#endif+    crypton_gf_mul ( p->z, a, p->y );+    crypton_gf_mul ( p->x, p->y, c );+    crypton_gf_mul ( p->y, a, b );+    crypton_gf_mul ( p->t, b, c );+}++static CRYPTON_DECAF_NOINLINE void+point_double_internal (+    point_t p,+    const point_t q,+    int before_double+) {+    gf a, b, c, d;+    crypton_gf_sqr ( c, q->x );+    crypton_gf_sqr ( a, q->y );+    crypton_gf_add_nr ( d, c, a );             /* 2+e */+    crypton_gf_add_nr ( p->t, q->y, q->x );    /* 2+e */+    crypton_gf_sqr ( b, p->t );+    crypton_gf_subx_nr ( b, b, d, 3 );         /* 4+e */+    crypton_gf_sub_nr ( p->t, a, c );          /* 3+e */+    crypton_gf_sqr ( p->x, q->z );+    crypton_gf_add_nr ( p->z, p->x, p->x );    /* 2+e */+    crypton_gf_subx_nr ( a, p->z, p->t, 4 );   /* 6+e */+    if (GF_HEADROOM == 5) crypton_gf_weak_reduce(a); /* or 1+e */+    crypton_gf_mul ( p->x, a, b );+    crypton_gf_mul ( p->z, p->t, a );+    crypton_gf_mul ( p->y, p->t, d );+    if (!before_double) crypton_gf_mul ( p->t, b, d );+}++void API_NS(point_double)(point_t p, const point_t q) {+    point_double_internal(p,q,0);+}++void API_NS(point_negate) (+   point_t nega,+   const point_t a+) {+    crypton_gf_sub(nega->x, ZERO, a->x);+    crypton_gf_copy(nega->y, a->y);+    crypton_gf_copy(nega->z, a->z);+    crypton_gf_sub(nega->t, ZERO, a->t);+}++/* Operations on [p]niels */+static CRYPTON_DECAF_INLINE void+cond_neg_niels (+    niels_t n,+    mask_t neg+) {+    crypton_gf_cond_swap(n->a, n->b, neg);+    crypton_gf_cond_neg(n->c, neg);+}++static CRYPTON_DECAF_NOINLINE void pt_to_pniels (+    pniels_t b,+    const point_t a+) {+    crypton_gf_sub ( b->n->a, a->y, a->x );+    crypton_gf_add ( b->n->b, a->x, a->y );+    crypton_gf_mulw ( b->n->c, a->t, 2*TWISTED_D );+    crypton_gf_add ( b->z, a->z, a->z );+}++static CRYPTON_DECAF_NOINLINE void pniels_to_pt (+    point_t e,+    const pniels_t d+) {+    gf eu;+    crypton_gf_add ( eu, d->n->b, d->n->a );+    crypton_gf_sub ( e->y, d->n->b, d->n->a );+    crypton_gf_mul ( e->t, e->y, eu);+    crypton_gf_mul ( e->x, d->z, e->y );+    crypton_gf_mul ( e->y, d->z, eu );+    crypton_gf_sqr ( e->z, d->z );+}++static CRYPTON_DECAF_NOINLINE void+niels_to_pt (+    point_t e,+    const niels_t n+) {+    crypton_gf_add ( e->y, n->b, n->a );+    crypton_gf_sub ( e->x, n->b, n->a );+    crypton_gf_mul ( e->t, e->y, e->x );+    crypton_gf_copy ( e->z, ONE );+}++static CRYPTON_DECAF_NOINLINE void+add_niels_to_pt (+    point_t d,+    const niels_t e,+    int before_double+) {+    gf a, b, c;+    crypton_gf_sub_nr ( b, d->y, d->x ); /* 3+e */+    crypton_gf_mul ( a, e->a, b );+    crypton_gf_add_nr ( b, d->x, d->y ); /* 2+e */+    crypton_gf_mul ( d->y, e->b, b );+    crypton_gf_mul ( d->x, e->c, d->t );+    crypton_gf_add_nr ( c, a, d->y );    /* 2+e */+    crypton_gf_sub_nr ( b, d->y, a );    /* 3+e */+    crypton_gf_sub_nr ( d->y, d->z, d->x ); /* 3+e */+    crypton_gf_add_nr ( a, d->x, d->z ); /* 2+e */+    crypton_gf_mul ( d->z, a, d->y );+    crypton_gf_mul ( d->x, d->y, b );+    crypton_gf_mul ( d->y, a, c );+    if (!before_double) crypton_gf_mul ( d->t, b, c );+}++static CRYPTON_DECAF_NOINLINE void+sub_niels_from_pt (+    point_t d,+    const niels_t e,+    int before_double+) {+    gf a, b, c;+    crypton_gf_sub_nr ( b, d->y, d->x ); /* 3+e */+    crypton_gf_mul ( a, e->b, b );+    crypton_gf_add_nr ( b, d->x, d->y ); /* 2+e */+    crypton_gf_mul ( d->y, e->a, b );+    crypton_gf_mul ( d->x, e->c, d->t );+    crypton_gf_add_nr ( c, a, d->y );    /* 2+e */+    crypton_gf_sub_nr ( b, d->y, a );    /* 3+e */+    crypton_gf_add_nr ( d->y, d->z, d->x ); /* 2+e */+    crypton_gf_sub_nr ( a, d->z, d->x ); /* 3+e */+    crypton_gf_mul ( d->z, a, d->y );+    crypton_gf_mul ( d->x, d->y, b );+    crypton_gf_mul ( d->y, a, c );+    if (!before_double) crypton_gf_mul ( d->t, b, c );+}++static void+add_pniels_to_pt (+    point_t p,+    const pniels_t pn,+    int before_double+) {+    gf L0;+    crypton_gf_mul ( L0, p->z, pn->z );+    crypton_gf_copy ( p->z, L0 );+    add_niels_to_pt( p, pn->n, before_double );+}++static void+sub_pniels_from_pt (+    point_t p,+    const pniels_t pn,+    int before_double+) {+    gf L0;+    crypton_gf_mul ( L0, p->z, pn->z );+    crypton_gf_copy ( p->z, L0 );+    sub_niels_from_pt( p, pn->n, before_double );+}++static CRYPTON_DECAF_NOINLINE void+prepare_fixed_window(+    pniels_t *multiples,+    const point_t b,+    int ntable+) {+    point_t tmp;+    pniels_t pn;+    int i;+    +    point_double_internal(tmp, b, 0);+    pt_to_pniels(pn, tmp);+    pt_to_pniels(multiples[0], b);+    API_NS(point_copy)(tmp, b);+    for (i=1; i<ntable; i++) {+        add_pniels_to_pt(tmp, pn, 0);+        pt_to_pniels(multiples[i], tmp);+    }+    +    crypton_decaf_bzero(pn,sizeof(pn));+    crypton_decaf_bzero(tmp,sizeof(tmp));+}++void API_NS(point_scalarmul) (+    point_t a,+    const point_t b,+    const scalar_t scalar+) {+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,+        WINDOW_MASK = (1<<WINDOW)-1,+        WINDOW_T_MASK = WINDOW_MASK >> 1,+        NTABLE = 1<<(WINDOW-1);+        +    scalar_t scalar1x;+    API_NS(scalar_add)(scalar1x, scalar, point_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar1x,scalar1x);+    +    /* Set up a precomputed table with odd multiples of b. */+    pniels_t pn, multiples[NTABLE];+    point_t tmp;+    prepare_fixed_window(multiples, b, NTABLE);++    /* Initialize. */+    int i,j,first=1;+    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;++    for (; i>=0; i-=WINDOW) {+        /* Fetch another block of bits */+        word_t bits = scalar1x->limb[i/WBITS] >> (i%WBITS);+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {+            bits ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));+        }+        bits &= WINDOW_MASK;+        mask_t inv = (bits>>(WINDOW-1))-1;+        bits ^= inv;+    +        /* Add in from table.  Compute t only on last iteration. */+        constant_time_lookup(pn, multiples, sizeof(pn), NTABLE, bits & WINDOW_T_MASK);+        cond_neg_niels(pn->n, inv);+        if (first) {+            pniels_to_pt(tmp, pn);+            first = 0;+        } else {+           /* Using Hisil et al's lookahead method instead of extensible here+            * for no particular reason.  Double WINDOW times, but only compute t on+            * the last one.+            */+            for (j=0; j<WINDOW-1; j++)+                point_double_internal(tmp, tmp, -1);+            point_double_internal(tmp, tmp, 0);+            add_pniels_to_pt(tmp, pn, i ? -1 : 0);+        }+    }+    +    /* Write out the answer */+    API_NS(point_copy)(a,tmp);+    +    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));+    crypton_decaf_bzero(pn,sizeof(pn));+    crypton_decaf_bzero(multiples,sizeof(multiples));+    crypton_decaf_bzero(tmp,sizeof(tmp));+}++void API_NS(point_double_scalarmul) (+    point_t a,+    const point_t b,+    const scalar_t scalarb,+    const point_t c,+    const scalar_t scalarc+) {+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,+        WINDOW_MASK = (1<<WINDOW)-1,+        WINDOW_T_MASK = WINDOW_MASK >> 1,+        NTABLE = 1<<(WINDOW-1);+        +    scalar_t scalar1x, scalar2x;+    API_NS(scalar_add)(scalar1x, scalarb, point_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar1x,scalar1x);+    API_NS(scalar_add)(scalar2x, scalarc, point_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar2x,scalar2x);+    +    /* Set up a precomputed table with odd multiples of b. */+    pniels_t pn, multiples1[NTABLE], multiples2[NTABLE];+    point_t tmp;+    prepare_fixed_window(multiples1, b, NTABLE);+    prepare_fixed_window(multiples2, c, NTABLE);++    /* Initialize. */+    int i,j,first=1;+    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;++    for (; i>=0; i-=WINDOW) {+        /* Fetch another block of bits */+        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),+                     bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {+            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));+            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));+        }+        bits1 &= WINDOW_MASK;+        bits2 &= WINDOW_MASK;+        mask_t inv1 = (bits1>>(WINDOW-1))-1;+        mask_t inv2 = (bits2>>(WINDOW-1))-1;+        bits1 ^= inv1;+        bits2 ^= inv2;+    +        /* Add in from table.  Compute t only on last iteration. */+        constant_time_lookup(pn, multiples1, sizeof(pn), NTABLE, bits1 & WINDOW_T_MASK);+        cond_neg_niels(pn->n, inv1);+        if (first) {+            pniels_to_pt(tmp, pn);+            first = 0;+        } else {+           /* Using Hisil et al's lookahead method instead of extensible here+            * for no particular reason.  Double WINDOW times, but only compute t on+            * the last one.+            */+            for (j=0; j<WINDOW-1; j++)+                point_double_internal(tmp, tmp, -1);+            point_double_internal(tmp, tmp, 0);+            add_pniels_to_pt(tmp, pn, 0);+        }+        constant_time_lookup(pn, multiples2, sizeof(pn), NTABLE, bits2 & WINDOW_T_MASK);+        cond_neg_niels(pn->n, inv2);+        add_pniels_to_pt(tmp, pn, i?-1:0);+    }+    +    /* Write out the answer */+    API_NS(point_copy)(a,tmp);+    ++    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));+    crypton_decaf_bzero(scalar2x,sizeof(scalar2x));+    crypton_decaf_bzero(pn,sizeof(pn));+    crypton_decaf_bzero(multiples1,sizeof(multiples1));+    crypton_decaf_bzero(multiples2,sizeof(multiples2));+    crypton_decaf_bzero(tmp,sizeof(tmp));+}++void API_NS(point_dual_scalarmul) (+    point_t a1,+    point_t a2,+    const point_t b,+    const scalar_t scalar1,+    const scalar_t scalar2+) {+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,+        WINDOW_MASK = (1<<WINDOW)-1,+        WINDOW_T_MASK = WINDOW_MASK >> 1,+        NTABLE = 1<<(WINDOW-1);+        +    scalar_t scalar1x, scalar2x;+    API_NS(scalar_add)(scalar1x, scalar1, point_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar1x,scalar1x);+    API_NS(scalar_add)(scalar2x, scalar2, point_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar2x,scalar2x);+    +    /* Set up a precomputed table with odd multiples of b. */+    point_t multiples1[NTABLE], multiples2[NTABLE], working, tmp;+    pniels_t pn;+    +    API_NS(point_copy)(working, b);++    /* Initialize. */+    int i,j;+    +    for (i=0; i<NTABLE; i++) {+        API_NS(point_copy)(multiples1[i], API_NS(point_identity));+        API_NS(point_copy)(multiples2[i], API_NS(point_identity));+    }++    for (i=0; i<SCALAR_BITS; i+=WINDOW) {   +        if (i) {+            for (j=0; j<WINDOW-1; j++)+                point_double_internal(working, working, -1);+            point_double_internal(working, working, 0);+        }+        +        /* Fetch another block of bits */+        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),+               bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {+            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));+            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));+        }+        bits1 &= WINDOW_MASK;+        bits2 &= WINDOW_MASK;+        mask_t inv1 = (bits1>>(WINDOW-1))-1;+        mask_t inv2 = (bits2>>(WINDOW-1))-1;+        bits1 ^= inv1;+        bits2 ^= inv2;+        +        pt_to_pniels(pn, working);++        constant_time_lookup(tmp, multiples1, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);+        cond_neg_niels(pn->n, inv1);+        /* add_pniels_to_pt(multiples1[bits1 & WINDOW_T_MASK], pn, 0); */+        add_pniels_to_pt(tmp, pn, 0);+        constant_time_insert(multiples1, tmp, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);+        +        +        constant_time_lookup(tmp, multiples2, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);+        cond_neg_niels(pn->n, inv1^inv2);+        /* add_pniels_to_pt(multiples2[bits2 & WINDOW_T_MASK], pn, 0); */+        add_pniels_to_pt(tmp, pn, 0);+        constant_time_insert(multiples2, tmp, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);+    }+    +    if (NTABLE > 1) {+        API_NS(point_copy)(working, multiples1[NTABLE-1]);+        API_NS(point_copy)(tmp    , multiples2[NTABLE-1]);+    +        for (i=NTABLE-1; i>1; i--) {+            API_NS(point_add)(multiples1[i-1], multiples1[i-1], multiples1[i]);+            API_NS(point_add)(multiples2[i-1], multiples2[i-1], multiples2[i]);+            API_NS(point_add)(working, working, multiples1[i-1]);+            API_NS(point_add)(tmp,     tmp,     multiples2[i-1]);+        }+    +        API_NS(point_add)(multiples1[0], multiples1[0], multiples1[1]);+        API_NS(point_add)(multiples2[0], multiples2[0], multiples2[1]);+        point_double_internal(working, working, 0);+        point_double_internal(tmp,         tmp, 0);+        API_NS(point_add)(a1, working, multiples1[0]);+        API_NS(point_add)(a2, tmp,     multiples2[0]);+    } else {+        API_NS(point_copy)(a1, multiples1[0]);+        API_NS(point_copy)(a2, multiples2[0]);+    }++    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));+    crypton_decaf_bzero(scalar2x,sizeof(scalar2x));+    crypton_decaf_bzero(pn,sizeof(pn));+    crypton_decaf_bzero(multiples1,sizeof(multiples1));+    crypton_decaf_bzero(multiples2,sizeof(multiples2));+    crypton_decaf_bzero(tmp,sizeof(tmp));+    crypton_decaf_bzero(working,sizeof(working));+}++crypton_decaf_bool_t API_NS(point_eq) ( const point_t p, const point_t q ) {+    /* equality mod 2-torsion compares x/y */+    gf a, b;+    crypton_gf_mul ( a, p->y, q->x );+    crypton_gf_mul ( b, q->y, p->x );+    mask_t succ = crypton_gf_eq(a,b);+    +    #if (COFACTOR == 8) && IMAGINE_TWIST+        crypton_gf_mul ( a, p->y, q->y );+        crypton_gf_mul ( b, q->x, p->x );+        #if !(IMAGINE_TWIST)+            crypton_gf_sub ( a, ZERO, a );+        #else+           /* Interesting note: the 4tor would normally be rotation.+            * But because of the *i twist, it's actually+            * (x,y) <-> (iy,ix)+            */+    +           /* No code, just a comment. */+        #endif+        succ |= crypton_gf_eq(a,b);+    #endif+    +    return mask_to_bool(succ);+}++crypton_decaf_bool_t API_NS(point_valid) (+    const point_t p+) {+    gf a,b,c;+    crypton_gf_mul(a,p->x,p->y);+    crypton_gf_mul(b,p->z,p->t);+    mask_t out = crypton_gf_eq(a,b);+    crypton_gf_sqr(a,p->x);+    crypton_gf_sqr(b,p->y);+    crypton_gf_sub(a,b,a);+    crypton_gf_sqr(b,p->t);+    crypton_gf_mulw(c,b,TWISTED_D);+    crypton_gf_sqr(b,p->z);+    crypton_gf_add(b,b,c);+    out &= crypton_gf_eq(a,b);+    out &= ~crypton_gf_eq(p->z,ZERO);+    return mask_to_bool(out);+}++void API_NS(point_debugging_torque) (+    point_t q,+    const point_t p+) {+#if COFACTOR == 8 && IMAGINE_TWIST+    gf tmp;+    crypton_gf_mul(tmp,p->x,SQRT_MINUS_ONE);+    crypton_gf_mul(q->x,p->y,SQRT_MINUS_ONE);+    crypton_gf_copy(q->y,tmp);+    crypton_gf_copy(q->z,p->z);+    crypton_gf_sub(q->t,ZERO,p->t);+#else+    crypton_gf_sub(q->x,ZERO,p->x);+    crypton_gf_sub(q->y,ZERO,p->y);+    crypton_gf_copy(q->z,p->z);+    crypton_gf_copy(q->t,p->t);+#endif+}++void API_NS(point_debugging_pscale) (+    point_t q,+    const point_t p,+    const uint8_t factor[SER_BYTES]+) {+    gf gfac,tmp;+    /* NB this means you'll never pscale by negative numbers for p521 */+    ignore_result(crypton_gf_deserialize(gfac,factor,0));+    crypton_gf_cond_sel(gfac,gfac,ONE,crypton_gf_eq(gfac,ZERO));+    crypton_gf_mul(tmp,p->x,gfac);+    crypton_gf_copy(q->x,tmp);+    crypton_gf_mul(tmp,p->y,gfac);+    crypton_gf_copy(q->y,tmp);+    crypton_gf_mul(tmp,p->z,gfac);+    crypton_gf_copy(q->z,tmp);+    crypton_gf_mul(tmp,p->t,gfac);+    crypton_gf_copy(q->t,tmp);+}++static void crypton_gf_batch_invert (+    gf *__restrict__ out,+    const gf *in,+    unsigned int n+) {+    gf t1;+    assert(n>1);+  +    crypton_gf_copy(out[1], in[0]);+    int i;+    for (i=1; i<(int) (n-1); i++) {+        crypton_gf_mul(out[i+1], out[i], in[i]);+    }+    crypton_gf_mul(out[0], out[n-1], in[n-1]);++    crypton_gf_invert(out[0], out[0], 1);++    for (i=n-1; i>0; i--) {+        crypton_gf_mul(t1, out[i], out[0]);+        crypton_gf_copy(out[i], t1);+        crypton_gf_mul(t1, out[0], in[i]);+        crypton_gf_copy(out[0], t1);+    }+}++static void batch_normalize_niels (+    niels_t *table,+    const gf *zs,+    gf *__restrict__ zis,+    int n+) {+    int i;+    gf product;+    crypton_gf_batch_invert(zis, zs, n);++    for (i=0; i<n; i++) {+        crypton_gf_mul(product, table[i]->a, zis[i]);+        crypton_gf_strong_reduce(product);+        crypton_gf_copy(table[i]->a, product);+        +        crypton_gf_mul(product, table[i]->b, zis[i]);+        crypton_gf_strong_reduce(product);+        crypton_gf_copy(table[i]->b, product);+        +        crypton_gf_mul(product, table[i]->c, zis[i]);+        crypton_gf_strong_reduce(product);+        crypton_gf_copy(table[i]->c, product);+    }+    +    crypton_decaf_bzero(product,sizeof(product));+}++void API_NS(precompute) (+    precomputed_s *table,+    const point_t base+) { +    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;+    assert(n*t*s >= SCALAR_BITS);+  +    point_t working, start, doubles[t-1];+    API_NS(point_copy)(working, base);+    pniels_t pn_tmp;+  +    gf zs[n<<(t-1)], zis[n<<(t-1)];+  +    unsigned int i,j,k;+    +    /* Compute n tables */+    for (i=0; i<n; i++) {++        /* Doubling phase */+        for (j=0; j<t; j++) {+            if (j) API_NS(point_add)(start, start, working);+            else API_NS(point_copy)(start, working);++            if (j==t-1 && i==n-1) break;++            point_double_internal(working, working,0);+            if (j<t-1) API_NS(point_copy)(doubles[j], working);++            for (k=0; k<s-1; k++)+                point_double_internal(working, working, k<s-2);+        }++        /* Gray-code phase */+        for (j=0;; j++) {+            int gray = j ^ (j>>1);+            int idx = (((i+1)<<(t-1))-1) ^ gray;++            pt_to_pniels(pn_tmp, start);+            memcpy(table->table[idx], pn_tmp->n, sizeof(pn_tmp->n));+            crypton_gf_copy(zs[idx], pn_tmp->z);+			+            if (j >= (1u<<(t-1)) - 1) break;+            int delta = (j+1) ^ ((j+1)>>1) ^ gray;++            for (k=0; delta>1; k++)+                delta >>=1;+            +            if (gray & (1<<k)) {+                API_NS(point_add)(start, start, doubles[k]);+            } else {+                API_NS(point_sub)(start, start, doubles[k]);+            }+        }+    }+    +    batch_normalize_niels(table->table,(const gf *)zs,zis,n<<(t-1));+    +    crypton_decaf_bzero(zs,sizeof(zs));+    crypton_decaf_bzero(zis,sizeof(zis));+    crypton_decaf_bzero(pn_tmp,sizeof(pn_tmp));+    crypton_decaf_bzero(working,sizeof(working));+    crypton_decaf_bzero(start,sizeof(start));+    crypton_decaf_bzero(doubles,sizeof(doubles));+}++static CRYPTON_DECAF_INLINE void+constant_time_lookup_niels (+    niels_s *__restrict__ ni,+    const niels_t *table,+    int nelts,+    int idx+) {+    constant_time_lookup(ni, table, sizeof(niels_s), nelts, idx);+}++void API_NS(precomputed_scalarmul) (+    point_t out,+    const precomputed_s *table,+    const scalar_t scalar+) {+    int i;+    unsigned j,k;+    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;+    +    scalar_t scalar1x;+    API_NS(scalar_add)(scalar1x, scalar, precomputed_scalarmul_adjustment);+    API_NS(scalar_halve)(scalar1x,scalar1x);+    +    niels_t ni;+    +    for (i=s-1; i>=0; i--) {+        if (i != (int)s-1) point_double_internal(out,out,0);+        +        for (j=0; j<n; j++) {+            int tab = 0;+         +            for (k=0; k<t; k++) {+                unsigned int bit = i + s*(k + j*t);+                if (bit < SCALAR_BITS) {+                    tab |= (scalar1x->limb[bit/WBITS] >> (bit%WBITS) & 1) << k;+                }+            }+            +            mask_t invert = (tab>>(t-1))-1;+            tab ^= invert;+            tab &= (1<<(t-1)) - 1;++            constant_time_lookup_niels(ni, &table->table[j<<(t-1)], 1<<(t-1), tab);++            cond_neg_niels(ni, invert);+            if ((i!=(int)s-1)||j) {+                add_niels_to_pt(out, ni, j==n-1 && i);+            } else {+                niels_to_pt(out, ni);+            }+        }+    }+    +    crypton_decaf_bzero(ni,sizeof(ni));+    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));+}++void API_NS(point_cond_sel) (+    point_t out,+    const point_t a,+    const point_t b,+    crypton_decaf_bool_t pick_b+) {+    constant_time_select(out,a,b,sizeof(point_t),bool_to_mask(pick_b),0);+}++/* FUTURE: restore Curve25519 Montgomery ladder? */+crypton_decaf_error_t API_NS(direct_scalarmul) (+    uint8_t scaled[SER_BYTES],+    const uint8_t base[SER_BYTES],+    const scalar_t scalar,+    crypton_decaf_bool_t allow_identity,+    crypton_decaf_bool_t short_circuit+) {+    point_t basep;+    crypton_decaf_error_t succ = API_NS(point_decode)(basep, base, allow_identity);+    if (short_circuit && succ != CRYPTON_DECAF_SUCCESS) return succ;+    API_NS(point_cond_sel)(basep, API_NS(point_base), basep, succ);+    API_NS(point_scalarmul)(basep, basep, scalar);+    API_NS(point_encode)(scaled, basep);+    API_NS(point_destroy)(basep);+    return succ;+}++void API_NS(point_mul_by_cofactor_and_encode_like_eddsa) (+    uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const point_t p+) {+    +    /* The point is now on the twisted curve.  Move it to untwisted. */+    gf x, y, z, t;+    point_t q;+#if COFACTOR == 8+    API_NS(point_double)(q,p);+#else+    API_NS(point_copy)(q,p);+#endif+    +#if EDDSA_USE_SIGMA_ISOGENY+    {+        /* Use 4-isogeny like ed25519:+         *   2*x*y*sqrt(d/a-1)/(ax^2 + y^2 - 2)+         *   (y^2 - ax^2)/(y^2 + ax^2)+         * with a = -1, d = -EDWARDS_D:+         *   -2xysqrt(EDWARDS_D-1)/(2z^2-y^2+x^2)+         *   (y^2+x^2)/(y^2-x^2)+         */+        gf u;+        crypton_gf_sqr ( x, q->x ); // x^2+        crypton_gf_sqr ( t, q->y ); // y^2+        crypton_gf_add( u, x, t ); // x^2 + y^2+        crypton_gf_add( z, q->y, q->x );+        crypton_gf_sqr ( y, z);+        crypton_gf_sub ( y, u, y ); // -2xy+        crypton_gf_sub ( z, t, x ); // y^2 - x^2+        crypton_gf_sqr ( x, q->z );+        crypton_gf_add ( t, x, x);+        crypton_gf_sub ( t, t, z);  // 2z^2 - y^2 + x^2+        crypton_gf_mul ( x, y, z ); // 2xy(y^2-x^2)+        crypton_gf_mul ( y, u, t ); // (x^2+y^2)(2z^2-y^2+x^2)+        crypton_gf_mul ( u, z, t );+        crypton_gf_copy( z, u );+        crypton_gf_mul ( u, x, SQRT_ONE_MINUS_D );+        crypton_gf_copy( x, u );+        crypton_decaf_bzero(u,sizeof(u));+    }+#elif IMAGINE_TWIST+    {+        API_NS(point_double)(q,q);+        API_NS(point_double)(q,q);+        crypton_gf_mul_qnr(x, q->x);+        crypton_gf_copy(y, q->y);+        crypton_gf_copy(z, q->z);+    }+#else+    {+        /* 4-isogeny: 2xy/(y^+x^2), (y^2-x^2)/(2z^2-y^2+x^2) */+        gf u;+        crypton_gf_sqr ( x, q->x );+        crypton_gf_sqr ( t, q->y );+        crypton_gf_add( u, x, t );+        crypton_gf_add( z, q->y, q->x );+        crypton_gf_sqr ( y, z);+        crypton_gf_sub ( y, u, y );+        crypton_gf_sub ( z, t, x );+        crypton_gf_sqr ( x, q->z );+        crypton_gf_add ( t, x, x); +        crypton_gf_sub ( t, t, z);+        crypton_gf_mul ( x, t, y );+        crypton_gf_mul ( y, z, u );+        crypton_gf_mul ( z, u, t );+        crypton_decaf_bzero(u,sizeof(u));+    }+#endif+    /* Affinize */+    crypton_gf_invert(z,z,1);+    crypton_gf_mul(t,x,z);+    crypton_gf_mul(x,y,z);+    +    /* Encode */+    enc[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] = 0;+    crypton_gf_serialize(enc, x, 1);+    enc[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] |= 0x80 & crypton_gf_lobit(t);++    crypton_decaf_bzero(x,sizeof(x));+    crypton_decaf_bzero(y,sizeof(y));+    crypton_decaf_bzero(z,sizeof(z));+    crypton_decaf_bzero(t,sizeof(t));+    API_NS(point_destroy)(q);+}+++crypton_decaf_error_t API_NS(point_decode_like_eddsa_and_ignore_cofactor) (+    point_t p,+    const uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]+) {+    uint8_t enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES];+    memcpy(enc2,enc,sizeof(enc2));++    mask_t low = ~word_is_zero(enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] & 0x80);+    enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] &= ~0x80;+    +    mask_t succ = crypton_gf_deserialize(p->y, enc2, 1);+#if 0 == 0+    succ &= word_is_zero(enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1]);+#endif++    crypton_gf_sqr(p->x,p->y);+    crypton_gf_sub(p->z,ONE,p->x); /* num = 1-y^2 */+    #if EDDSA_USE_SIGMA_ISOGENY+        crypton_gf_mulw(p->t,p->z,EDWARDS_D); /* d-dy^2 */+        crypton_gf_mulw(p->x,p->z,EDWARDS_D-1); /* num = (1-y^2)(d-1) */+        crypton_gf_copy(p->z,p->x);+    #else+        crypton_gf_mulw(p->t,p->x,EDWARDS_D); /* dy^2 */+    #endif+    crypton_gf_sub(p->t,ONE,p->t); /* denom = 1-dy^2 or 1-d + dy^2 */+    +    crypton_gf_mul(p->x,p->z,p->t);+    succ &= crypton_gf_isr(p->t,p->x); /* 1/sqrt(num * denom) */+    +    crypton_gf_mul(p->x,p->t,p->z); /* sqrt(num / denom) */+    crypton_gf_cond_neg(p->x,~crypton_gf_lobit(p->x)^low);+    crypton_gf_copy(p->z,ONE);+  +    #if EDDSA_USE_SIGMA_ISOGENY+    {+       /* Use 4-isogeny like ed25519:+        *   2*x*y/sqrt(1-d/a)/(ax^2 + y^2 - 2)+        *   (y^2 - ax^2)/(y^2 + ax^2)+        * (MAGIC: above formula may be off by a factor of -a+        * or something somewhere; check it for other a)+        *+        * with a = -1, d = -EDWARDS_D:+        *   -2xy/sqrt(1-EDWARDS_D)/(2z^2-y^2+x^2)+        *   (y^2+x^2)/(y^2-x^2)+        */+        gf a, b, c, d;+        crypton_gf_sqr ( c, p->x );+        crypton_gf_sqr ( a, p->y );+        crypton_gf_add ( d, c, a ); // x^2 + y^2+        crypton_gf_add ( p->t, p->y, p->x );+        crypton_gf_sqr ( b, p->t );+        crypton_gf_sub ( b, b, d ); // 2xy+        crypton_gf_sub ( p->t, a, c ); // y^2 - x^2+        crypton_gf_sqr ( p->x, p->z );+        crypton_gf_add ( p->z, p->x, p->x );+        crypton_gf_sub ( a, p->z, p->t ); // 2z^2 - y^2 + x^2+        crypton_gf_mul ( c, a, SQRT_ONE_MINUS_D );+        crypton_gf_mul ( p->x, b, p->t); // (2xy)(y^2-x^2)+        crypton_gf_mul ( p->z, p->t, c ); // (y^2-x^2)sd(2z^2 - y^2 + x^2)+        crypton_gf_mul ( p->y, d, c ); // (y^2+x^2)sd(2z^2 - y^2 + x^2)+        crypton_gf_mul ( p->t, d, b );+        crypton_decaf_bzero(a,sizeof(a));+        crypton_decaf_bzero(b,sizeof(b));+        crypton_decaf_bzero(c,sizeof(c));+        crypton_decaf_bzero(d,sizeof(d));+    } +    #elif IMAGINE_TWIST+    {+        crypton_gf_mul(p->t,p->x,SQRT_MINUS_ONE);+        crypton_gf_copy(p->x,p->t);+        crypton_gf_mul(p->t,p->x,p->y);+    }+    #else+    {+        /* 4-isogeny 2xy/(y^2-ax^2), (y^2+ax^2)/(2-y^2-ax^2) */+        gf a, b, c, d;+        crypton_gf_sqr ( c, p->x );+        crypton_gf_sqr ( a, p->y );+        crypton_gf_add ( d, c, a );+        crypton_gf_add ( p->t, p->y, p->x );+        crypton_gf_sqr ( b, p->t );+        crypton_gf_sub ( b, b, d );+        crypton_gf_sub ( p->t, a, c );+        crypton_gf_sqr ( p->x, p->z );+        crypton_gf_add ( p->z, p->x, p->x );+        crypton_gf_sub ( a, p->z, d );+        crypton_gf_mul ( p->x, a, b );+        crypton_gf_mul ( p->z, p->t, a );+        crypton_gf_mul ( p->y, p->t, d );+        crypton_gf_mul ( p->t, b, d );+        crypton_decaf_bzero(a,sizeof(a));+        crypton_decaf_bzero(b,sizeof(b));+        crypton_decaf_bzero(c,sizeof(c));+        crypton_decaf_bzero(d,sizeof(d));+    }+    #endif+    +    crypton_decaf_bzero(enc2,sizeof(enc2));+    assert(API_NS(point_valid)(p) || ~succ);+    return crypton_decaf_succeed_if(mask_to_bool(succ));+}++crypton_decaf_error_t crypton_decaf_x448 (+    uint8_t out[X_PUBLIC_BYTES],+    const uint8_t base[X_PUBLIC_BYTES],+    const uint8_t scalar[X_PRIVATE_BYTES]+) {+    gf x1, x2, z2, x3, z3, t1, t2;+    ignore_result(crypton_gf_deserialize(x1,base,1));+    crypton_gf_copy(x2,ONE);+    crypton_gf_copy(z2,ZERO);+    crypton_gf_copy(x3,x1);+    crypton_gf_copy(z3,ONE);+    +    int t;+    mask_t swap = 0;+    +    for (t = X_PRIVATE_BITS-1; t>=0; t--) {+        uint8_t sb = scalar[t/8];+        +        /* Scalar conditioning */+        if (t/8==0) sb &= -(uint8_t)COFACTOR;+        else if (t == X_PRIVATE_BITS-1) sb = -1;+        +        mask_t k_t = (sb>>(t%8)) & 1;+        k_t = -k_t; /* set to all 0s or all 1s */+        +        swap ^= k_t;+        crypton_gf_cond_swap(x2,x3,swap);+        crypton_gf_cond_swap(z2,z3,swap);+        swap = k_t;+        +        crypton_gf_add_nr(t1,x2,z2); /* A = x2 + z2 */        /* 2+e */+        crypton_gf_sub_nr(t2,x2,z2); /* B = x2 - z2 */        /* 3+e */+        crypton_gf_sub_nr(z2,x3,z3); /* D = x3 - z3 */        /* 3+e */+        crypton_gf_mul(x2,t1,z2);    /* DA */+        crypton_gf_add_nr(z2,z3,x3); /* C = x3 + z3 */        /* 2+e */+        crypton_gf_mul(x3,t2,z2);    /* CB */+        crypton_gf_sub_nr(z3,x2,x3); /* DA-CB */              /* 3+e */+        crypton_gf_sqr(z2,z3);       /* (DA-CB)^2 */+        crypton_gf_mul(z3,x1,z2);    /* z3 = x1(DA-CB)^2 */+        crypton_gf_add_nr(z2,x2,x3); /* (DA+CB) */            /* 2+e */+        crypton_gf_sqr(x3,z2);       /* x3 = (DA+CB)^2 */+        +        crypton_gf_sqr(z2,t1);       /* AA = A^2 */+        crypton_gf_sqr(t1,t2);       /* BB = B^2 */+        crypton_gf_mul(x2,z2,t1);    /* x2 = AA*BB */+        crypton_gf_sub_nr(t2,z2,t1); /* E = AA-BB */          /* 3+e */+        +        crypton_gf_mulw(t1,t2,-EDWARDS_D); /* E*-d = a24*E */+        crypton_gf_add_nr(t1,t1,z2); /* AA + a24*E */         /* 2+e */+        crypton_gf_mul(z2,t2,t1); /* z2 = E(AA+a24*E) */+    }+    +    /* Finish */+    crypton_gf_cond_swap(x2,x3,swap);+    crypton_gf_cond_swap(z2,z3,swap);+    crypton_gf_invert(z2,z2,0);+    crypton_gf_mul(x1,x2,z2);+    crypton_gf_serialize(out,x1,1);+    mask_t nz = ~crypton_gf_eq(x1,ZERO);+    +    crypton_decaf_bzero(x1,sizeof(x1));+    crypton_decaf_bzero(x2,sizeof(x2));+    crypton_decaf_bzero(z2,sizeof(z2));+    crypton_decaf_bzero(x3,sizeof(x3));+    crypton_decaf_bzero(z3,sizeof(z3));+    crypton_decaf_bzero(t1,sizeof(t1));+    crypton_decaf_bzero(t2,sizeof(t2));+    +    return crypton_decaf_succeed_if(mask_to_bool(nz));+}++/* Thanks Johan Pascal */+void crypton_decaf_ed448_convert_public_key_to_x448 (+    uint8_t x[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]+) {+    gf y;+    {+        uint8_t enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES];+        memcpy(enc2,ed,sizeof(enc2));++        /* retrieve y from the ed compressed point */+        enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES-1] &= ~0x80;+        ignore_result(crypton_gf_deserialize(y, enc2, 0));+        crypton_decaf_bzero(enc2,sizeof(enc2));+    }+    +    {+        gf n,d;+        +#if EDDSA_USE_SIGMA_ISOGENY+        /* u = (1+y)/(1-y)*/+        crypton_gf_add(n, y, ONE); /* n = y+1 */+        crypton_gf_sub(d, ONE, y); /* d = 1-y */+        crypton_gf_invert(d, d, 0); /* d = 1/(1-y) */+        crypton_gf_mul(y, n, d); /* u = (y+1)/(1-y) */+        crypton_gf_serialize(x,y,1);+#else /* EDDSA_USE_SIGMA_ISOGENY */+        /* u = y^2 * (1-dy^2) / (1-y^2) */+        crypton_gf_sqr(n,y); /* y^2*/+        crypton_gf_sub(d,ONE,n); /* 1-y^2*/+        crypton_gf_invert(d,d,0); /* 1/(1-y^2)*/+        crypton_gf_mul(y,n,d); /* y^2 / (1-y^2) */+        crypton_gf_mulw(d,n,EDWARDS_D); /* dy^2*/+        crypton_gf_sub(d, ONE, d); /* 1-dy^2*/+        crypton_gf_mul(n, y, d); /* y^2 * (1-dy^2) / (1-y^2) */+        crypton_gf_serialize(x,n,1);+#endif /* EDDSA_USE_SIGMA_ISOGENY */+        +        crypton_decaf_bzero(y,sizeof(y));+        crypton_decaf_bzero(n,sizeof(n));+        crypton_decaf_bzero(d,sizeof(d));+    }+}++void crypton_decaf_x448_generate_key (+    uint8_t out[X_PUBLIC_BYTES],+    const uint8_t scalar[X_PRIVATE_BYTES]+) {+    crypton_decaf_x448_derive_public_key(out,scalar);+}++void crypton_decaf_x448_derive_public_key (+    uint8_t out[X_PUBLIC_BYTES],+    const uint8_t scalar[X_PRIVATE_BYTES]+) {+    /* Scalar conditioning */+    uint8_t scalar2[X_PRIVATE_BYTES];+    memcpy(scalar2,scalar,sizeof(scalar2));+    scalar2[0] &= -(uint8_t)COFACTOR;+    +    scalar2[X_PRIVATE_BYTES-1] &= ~(-1u<<((X_PRIVATE_BITS+7)%8));+    scalar2[X_PRIVATE_BYTES-1] |= 1<<((X_PRIVATE_BITS+7)%8);+    +    scalar_t the_scalar;+    API_NS(scalar_decode_long)(the_scalar,scalar2,sizeof(scalar2));+    +    /* We're gonna isogenize by 2, so divide by 2.+     *+     * Why by 2, even though it's a 4-isogeny?+     *+     * The isogeny map looks like+     * Montgomery <-2-> Jacobi <-2-> Edwards+     *+     * Since the Jacobi base point is the PREimage of the iso to+     * the Montgomery curve, and we're going+     * Jacobi -> Edwards -> Jacobi -> Montgomery,+     * we pick up only a factor of 2 over Jacobi -> Montgomery. +     */+    API_NS(scalar_halve)(the_scalar,the_scalar);+    point_t p;+    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),the_scalar);+    +    /* Isogenize to Montgomery curve.+     *+     * Why isn't this just a separate function, eg crypton_decaf_encode_like_x448?+     * Basically because in general it does the wrong thing if there is a cofactor+     * component in the input.  In this function though, there isn't a cofactor+     * component in the input.+     */+    crypton_gf_invert(p->t,p->x,0); /* 1/x */+    crypton_gf_mul(p->z,p->t,p->y); /* y/x */+    crypton_gf_sqr(p->y,p->z); /* (y/x)^2 */+#if IMAGINE_TWIST+    crypton_gf_sub(p->y,ZERO,p->y);+#endif+    crypton_gf_serialize(out,p->y,1);+        +    crypton_decaf_bzero(scalar2,sizeof(scalar2));+    API_NS(scalar_destroy)(the_scalar);+    API_NS(point_destroy)(p);+}++/**+ * @cond internal+ * Control for variable-time scalar multiply algorithms.+ */+struct smvt_control {+  int power, addend;+};++static int recode_wnaf (+    struct smvt_control *control, /* [nbits/(table_bits+1) + 3] */+    const scalar_t scalar,+    unsigned int table_bits+) {+    unsigned int table_size = SCALAR_BITS/(table_bits+1) + 3;+    int position = table_size - 1; /* at the end */+    +    /* place the end marker */+    control[position].power = -1;+    control[position].addend = 0;+    position--;++    /* PERF: Could negate scalar if it's large.  But then would need more cases+     * in the actual code that uses it, all for an expected reduction of like 1/5 op.+     * Probably not worth it.+     */+    +    uint64_t current = scalar->limb[0] & 0xFFFF;+    uint32_t mask = (1<<(table_bits+1))-1;++    unsigned int w;+    const unsigned int B_OVER_16 = sizeof(scalar->limb[0]) / 2;+    for (w = 1; w<(SCALAR_BITS-1)/16+3; w++) {+        if (w < (SCALAR_BITS-1)/16+1) {+            /* Refill the 16 high bits of current */+            current += (uint32_t)((scalar->limb[w/B_OVER_16]>>(16*(w%B_OVER_16)))<<16);+        }+        +        while (current & 0xFFFF) {+            assert(position >= 0);+            uint32_t pos = __builtin_ctz((uint32_t)current), odd = (uint32_t)current >> pos;+            int32_t delta = odd & mask;+            if (odd & 1<<(table_bits+1)) delta -= (1<<(table_bits+1));+            current -= delta << pos;+            control[position].power = pos + 16*(w-1);+            control[position].addend = delta;+            position--;+        }+        current >>= 16;+    }+    assert(current==0);+    +    position++;+    unsigned int n = table_size - position;+    unsigned int i;+    for (i=0; i<n; i++) {+        control[i] = control[i+position];+    }+    return n-1;+}++static void+prepare_wnaf_table(+    pniels_t *output,+    const point_t working,+    unsigned int tbits+) {+    point_t tmp;+    int i;+    pt_to_pniels(output[0], working);++    if (tbits == 0) return;++    API_NS(point_double)(tmp,working);+    pniels_t twop;+    pt_to_pniels(twop, tmp);++    add_pniels_to_pt(tmp, output[0],0);+    pt_to_pniels(output[1], tmp);++    for (i=2; i < 1<<tbits; i++) {+        add_pniels_to_pt(tmp, twop,0);+        pt_to_pniels(output[i], tmp);+    }+    +    API_NS(point_destroy)(tmp);+    crypton_decaf_bzero(twop,sizeof(twop));+}++extern const gf API_NS(precomputed_wnaf_as_fe)[];+static const niels_t *API_NS(wnaf_base) = (const niels_t *)API_NS(precomputed_wnaf_as_fe);+const size_t API_NS(sizeof_precomputed_wnafs)+    = sizeof(niels_t)<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS;++void API_NS(precompute_wnafs) (+    niels_t out[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS],+    const point_t base+);++void API_NS(precompute_wnafs) (+    niels_t out[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS],+    const point_t base+) {+    pniels_t tmp[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS];+    gf zs[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS], zis[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS];+    int i;+    prepare_wnaf_table(tmp,base,CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS);+    for (i=0; i<1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS; i++) {+        memcpy(out[i], tmp[i]->n, sizeof(niels_t));+        crypton_gf_copy(zs[i], tmp[i]->z);+    }+    batch_normalize_niels(out, (const gf *)zs, zis, 1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS);+    +    crypton_decaf_bzero(tmp,sizeof(tmp));+    crypton_decaf_bzero(zs,sizeof(zs));+    crypton_decaf_bzero(zis,sizeof(zis));+}++void API_NS(base_double_scalarmul_non_secret) (+    point_t combo,+    const scalar_t scalar1,+    const point_t base2,+    const scalar_t scalar2+) {+    const int table_bits_var = CRYPTON_DECAF_WNAF_VAR_TABLE_BITS,+        table_bits_pre = CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS;+    struct smvt_control control_var[SCALAR_BITS/(table_bits_var+1)+3];+    struct smvt_control control_pre[SCALAR_BITS/(table_bits_pre+1)+3];+    +    int ncb_pre = recode_wnaf(control_pre, scalar1, table_bits_pre);+    int ncb_var = recode_wnaf(control_var, scalar2, table_bits_var);+  +    pniels_t precmp_var[1<<table_bits_var];+    prepare_wnaf_table(precmp_var, base2, table_bits_var);+  +    int contp=0, contv=0, i = control_var[0].power;++    if (i < 0) {+        API_NS(point_copy)(combo, API_NS(point_identity));+        return;+    } else if (i > control_pre[0].power) {+        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);+        contv++;+    } else if (i == control_pre[0].power && i >=0 ) {+        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);+        add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1], i);+        contv++; contp++;+    } else {+        i = control_pre[0].power;+        niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1]);+        contp++;+    }+    +    for (i--; i >= 0; i--) {+        int cv = (i==control_var[contv].power), cp = (i==control_pre[contp].power);+        point_double_internal(combo,combo,i && !(cv||cp));++        if (cv) {+            assert(control_var[contv].addend);++            if (control_var[contv].addend > 0) {+                add_pniels_to_pt(combo, precmp_var[control_var[contv].addend >> 1], i&&!cp);+            } else {+                sub_pniels_from_pt(combo, precmp_var[(-control_var[contv].addend) >> 1], i&&!cp);+            }+            contv++;+        }++        if (cp) {+            assert(control_pre[contp].addend);++            if (control_pre[contp].addend > 0) {+                add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[contp].addend >> 1], i);+            } else {+                sub_niels_from_pt(combo, API_NS(wnaf_base)[(-control_pre[contp].addend) >> 1], i);+            }+            contp++;+        }+    }+    +    /* This function is non-secret, but whatever this is cheap. */+    crypton_decaf_bzero(control_var,sizeof(control_var));+    crypton_decaf_bzero(control_pre,sizeof(control_pre));+    crypton_decaf_bzero(precmp_var,sizeof(precmp_var));++    assert(contv == ncb_var); (void)ncb_var;+    assert(contp == ncb_pre); (void)ncb_pre;+}++void API_NS(point_destroy) (+    point_t point+) {+    crypton_decaf_bzero(point, sizeof(point_t));+}++void API_NS(precomputed_destroy) (+    precomputed_s *pre+) {+    crypton_decaf_bzero(pre, API_NS(sizeof_precomputed_s)); }
cbits/decaf/ed448goldilocks/decaf_tables.c view
@@ -3,7 +3,7 @@  #include <decaf.h> -#define API_NS(_id) cryptonite_decaf_448_##_id+#define API_NS(_id) crypton_decaf_448_##_id const API_NS(point_t) API_NS(point_base) = {{ {FIELD_LITERAL(0x00fffffffffffffe,0x00ffffffffffffff,0x00ffffffffffffff,0x00ffffffffffffff,0x0000000000000003,0x0000000000000000,0x0000000000000000,0x0000000000000000)},   {FIELD_LITERAL(0x0081e6d37f752992,0x003078ead1c28721,0x00135cfd2394666c,0x0041149c50506061,0x0031d30e4f5490b3,0x00902014990dc141,0x0052341b04c1e328,0x0014237853c10a1b)},
cbits/decaf/ed448goldilocks/eddsa.c view
@@ -18,23 +18,23 @@ #include <decaf/sha512.h> #include <string.h> -#define API_NAME "cryptonite_decaf_448"-#define API_NS(_id) cryptonite_decaf_448_##_id+#define API_NAME "crypton_decaf_448"+#define API_NS(_id) crypton_decaf_448_##_id -#define hash_ctx_t   cryptonite_decaf_shake256_ctx_t-#define hash_init    cryptonite_decaf_shake256_init-#define hash_update  cryptonite_decaf_shake256_update-#define hash_final   cryptonite_decaf_shake256_final-#define hash_destroy cryptonite_decaf_shake256_destroy-#define hash_hash    cryptonite_decaf_shake256_hash+#define hash_ctx_t   crypton_decaf_shake256_ctx_t+#define hash_init    crypton_decaf_shake256_init+#define hash_update  crypton_decaf_shake256_update+#define hash_final   crypton_decaf_shake256_final+#define hash_destroy crypton_decaf_shake256_destroy+#define hash_hash    crypton_decaf_shake256_hash -#define NO_CONTEXT CRYPTONITE_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS+#define NO_CONTEXT CRYPTON_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS #define EDDSA_USE_SIGMA_ISOGENY 0 #define COFACTOR 4  #if NO_CONTEXT-const uint8_t CRYPTONITE_NO_CONTEXT_POINTS_HERE = 0;-const uint8_t * const CRYPTONITE_DECAF_ED448_NO_CONTEXT = &CRYPTONITE_NO_CONTEXT_POINTS_HERE;+const uint8_t CRYPTON_NO_CONTEXT_POINTS_HERE = 0;+const uint8_t * const CRYPTON_DECAF_ED448_NO_CONTEXT = &CRYPTON_NO_CONTEXT_POINTS_HERE; #endif  /* EDDSA_BASE_POINT_RATIO = 1 or 2@@ -44,17 +44,17 @@ #define EDDSA_BASE_POINT_RATIO (1+EDDSA_USE_SIGMA_ISOGENY)  static void clamp (-    uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]+    uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES] ) {     /* Blarg */     secret_scalar_ser[0] &= -COFACTOR;     uint8_t hibit = (1<<0)>>1;     if (hibit == 0) {-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] = 0;-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] = 0;+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;     } else {-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] &= hibit-1;-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] |= hibit;+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] &= hibit-1;+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] |= hibit;     } } @@ -68,7 +68,7 @@     hash_init(hash);  #if NO_CONTEXT-    if (context_len == 0 && context == CRYPTONITE_DECAF_ED448_NO_CONTEXT) {+    if (context_len == 0 && context == CRYPTON_DECAF_ED448_NO_CONTEXT) {         (void)prehashed;         (void)for_prehash;         (void)context;@@ -83,39 +83,39 @@     hash_update(hash,context,context_len); } -void cryptonite_decaf_ed448_prehash_init (+void crypton_decaf_ed448_prehash_init (     hash_ctx_t hash ) {     hash_init(hash); }  /* In this file because it uses the hash */-void cryptonite_decaf_ed448_convert_private_key_to_x448 (-    uint8_t x[CRYPTONITE_DECAF_X448_PRIVATE_BYTES],-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]+void crypton_decaf_ed448_convert_private_key_to_x448 (+    uint8_t x[CRYPTON_DECAF_X448_PRIVATE_BYTES],+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES] ) {     /* pass the private key through hash_hash function */-    /* and keep the first CRYPTONITE_DECAF_X448_PRIVATE_BYTES bytes */+    /* and keep the first CRYPTON_DECAF_X448_PRIVATE_BYTES bytes */     hash_hash(         x,-        CRYPTONITE_DECAF_X448_PRIVATE_BYTES,+        CRYPTON_DECAF_X448_PRIVATE_BYTES,         ed,-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES     ); }     -void cryptonite_decaf_ed448_derive_public_key (-    uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]+void crypton_decaf_ed448_derive_public_key (+    uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES] ) {     /* only this much used for keygen */-    uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];+    uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];          hash_hash(         secret_scalar_ser,         sizeof(secret_scalar_ser),         privkey,-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES     );     clamp(secret_scalar_ser);         @@ -140,13 +140,13 @@     /* Cleanup */     API_NS(scalar_destroy)(secret_scalar);     API_NS(point_destroy)(p);-    cryptonite_decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser));+    crypton_decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser)); } -void cryptonite_decaf_ed448_sign (-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],+void crypton_decaf_ed448_sign (+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],     const uint8_t *message,     size_t message_len,     uint8_t prehashed,@@ -158,14 +158,14 @@     {         /* Schedule the secret key */         struct {-            uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];-            uint8_t seed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];+            uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];+            uint8_t seed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];         } __attribute__((packed)) expanded;         hash_hash(             (uint8_t *)&expanded,             sizeof(expanded),             privkey,-            CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES+            CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES         );         clamp(expanded.secret_scalar_ser);            API_NS(scalar_decode_long)(secret_scalar, expanded.secret_scalar_ser, sizeof(expanded.secret_scalar_ser));@@ -174,19 +174,19 @@         hash_init_with_dom(hash,prehashed,0,context,context_len);         hash_update(hash,expanded.seed,sizeof(expanded.seed));         hash_update(hash,message,message_len);-        cryptonite_decaf_bzero(&expanded, sizeof(expanded));+        crypton_decaf_bzero(&expanded, sizeof(expanded));     }          /* Decode the nonce */     API_NS(scalar_t) nonce_scalar;     {-        uint8_t nonce[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];+        uint8_t nonce[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];         hash_final(hash,nonce,sizeof(nonce));         API_NS(scalar_decode_long)(nonce_scalar, nonce, sizeof(nonce));-        cryptonite_decaf_bzero(nonce, sizeof(nonce));+        crypton_decaf_bzero(nonce, sizeof(nonce));     }     -    uint8_t nonce_point[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES] = {0};+    uint8_t nonce_point[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES] = {0};     {         /* Scalarmul to create the nonce-point */         API_NS(scalar_t) nonce_scalar_2;@@ -207,21 +207,21 @@         /* Compute the challenge */         hash_init_with_dom(hash,prehashed,0,context,context_len);         hash_update(hash,nonce_point,sizeof(nonce_point));-        hash_update(hash,pubkey,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);+        hash_update(hash,pubkey,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);         hash_update(hash,message,message_len);-        uint8_t challenge[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];+        uint8_t challenge[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];         hash_final(hash,challenge,sizeof(challenge));         hash_destroy(hash);         API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));-        cryptonite_decaf_bzero(challenge,sizeof(challenge));+        crypton_decaf_bzero(challenge,sizeof(challenge));     }          API_NS(scalar_mul)(challenge_scalar,challenge_scalar,secret_scalar);     API_NS(scalar_add)(challenge_scalar,challenge_scalar,nonce_scalar);     -    cryptonite_decaf_bzero(signature,CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES);+    crypton_decaf_bzero(signature,CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES);     memcpy(signature,nonce_point,sizeof(nonce_point));-    API_NS(scalar_encode)(&signature[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],challenge_scalar);+    API_NS(scalar_encode)(&signature[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],challenge_scalar);          API_NS(scalar_destroy)(secret_scalar);     API_NS(scalar_destroy)(nonce_scalar);@@ -229,29 +229,29 @@ }  -void cryptonite_decaf_ed448_sign_prehash (-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const cryptonite_decaf_ed448_prehash_ctx_t hash,+void crypton_decaf_ed448_sign_prehash (+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const crypton_decaf_ed448_prehash_ctx_t hash,     const uint8_t *context,     uint8_t context_len ) {     uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */     {-        cryptonite_decaf_ed448_prehash_ctx_t hash_too;+        crypton_decaf_ed448_prehash_ctx_t hash_too;         memcpy(hash_too,hash,sizeof(hash_too));         hash_final(hash_too,hash_output,sizeof(hash_output));         hash_destroy(hash_too);     } -    cryptonite_decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);-    cryptonite_decaf_bzero(hash_output,sizeof(hash_output));+    crypton_decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);+    crypton_decaf_bzero(hash_output,sizeof(hash_output)); } -cryptonite_decaf_error_t cryptonite_decaf_ed448_verify (-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],+crypton_decaf_error_t crypton_decaf_ed448_verify (+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],     const uint8_t *message,     size_t message_len,     uint8_t prehashed,@@ -259,33 +259,33 @@     uint8_t context_len ) {      API_NS(point_t) pk_point, r_point;-    cryptonite_decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);-    if (CRYPTONITE_DECAF_SUCCESS != error) { return error; }+    crypton_decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);+    if (CRYPTON_DECAF_SUCCESS != error) { return error; }          error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(r_point,signature);-    if (CRYPTONITE_DECAF_SUCCESS != error) { return error; }+    if (CRYPTON_DECAF_SUCCESS != error) { return error; }          API_NS(scalar_t) challenge_scalar;     {         /* Compute the challenge */         hash_ctx_t hash;         hash_init_with_dom(hash,prehashed,0,context,context_len);-        hash_update(hash,signature,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);-        hash_update(hash,pubkey,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);+        hash_update(hash,signature,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);+        hash_update(hash,pubkey,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);         hash_update(hash,message,message_len);-        uint8_t challenge[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];+        uint8_t challenge[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];         hash_final(hash,challenge,sizeof(challenge));         hash_destroy(hash);         API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));-        cryptonite_decaf_bzero(challenge,sizeof(challenge));+        crypton_decaf_bzero(challenge,sizeof(challenge));     }     API_NS(scalar_sub)(challenge_scalar, API_NS(scalar_zero), challenge_scalar);          API_NS(scalar_t) response_scalar;     API_NS(scalar_decode_long)(         response_scalar,-        &signature[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES+        &signature[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES     ); #if EDDSA_BASE_POINT_RATIO == 2     API_NS(scalar_add)(response_scalar,response_scalar,response_scalar);@@ -299,28 +299,28 @@         pk_point,         challenge_scalar     );-    return cryptonite_decaf_succeed_if(API_NS(point_eq(pk_point,r_point)));+    return crypton_decaf_succeed_if(API_NS(point_eq(pk_point,r_point))); }  -cryptonite_decaf_error_t cryptonite_decaf_ed448_verify_prehash (-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const cryptonite_decaf_ed448_prehash_ctx_t hash,+crypton_decaf_error_t crypton_decaf_ed448_verify_prehash (+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const crypton_decaf_ed448_prehash_ctx_t hash,     const uint8_t *context,     uint8_t context_len ) {-    cryptonite_decaf_error_t ret;+    crypton_decaf_error_t ret;          uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */     {-        cryptonite_decaf_ed448_prehash_ctx_t hash_too;+        crypton_decaf_ed448_prehash_ctx_t hash_too;         memcpy(hash_too,hash,sizeof(hash_too));         hash_final(hash_too,hash_output,sizeof(hash_output));         hash_destroy(hash_too);     }     -    ret = cryptonite_decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);+    ret = crypton_decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);          return ret; }
cbits/decaf/ed448goldilocks/scalar.c view
@@ -16,13 +16,13 @@ #include <decaf.h>  /* Template stuff */-#define API_NS(_id) cryptonite_decaf_448_##_id-#define SCALAR_BITS CRYPTONITE_DECAF_448_SCALAR_BITS-#define SCALAR_SER_BYTES CRYPTONITE_DECAF_448_SCALAR_BYTES-#define SCALAR_LIMBS CRYPTONITE_DECAF_448_SCALAR_LIMBS+#define API_NS(_id) crypton_decaf_448_##_id+#define SCALAR_BITS CRYPTON_DECAF_448_SCALAR_BITS+#define SCALAR_SER_BYTES CRYPTON_DECAF_448_SCALAR_BYTES+#define SCALAR_LIMBS CRYPTON_DECAF_448_SCALAR_LIMBS #define scalar_t API_NS(scalar_t) -static const cryptonite_decaf_word_t MONTGOMERY_FACTOR = (cryptonite_decaf_word_t)0x3bd440fae918bc5ull;+static const crypton_decaf_word_t MONTGOMERY_FACTOR = (crypton_decaf_word_t)0x3bd440fae918bc5ull; static const scalar_t sc_p = {{{     SC_LIMB(0x2378c292ab5844f3), SC_LIMB(0x216cc2728dc58f55), SC_LIMB(0xc44edb49aed63690), SC_LIMB(0xffffffff7cca23e9), SC_LIMB(0xffffffffffffffff), SC_LIMB(0xffffffffffffffff), SC_LIMB(0x3fffffffffffffff) }}}, sc_r2 = {{{@@ -30,28 +30,28 @@ }}}; /* End of template stuff */ -#define WBITS CRYPTONITE_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */+#define WBITS CRYPTON_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */  const scalar_t API_NS(scalar_one) = {{{1}}}, API_NS(scalar_zero) = {{{0}}};  /** {extra,accum} - sub +? p  * Must have extra <= 1  */-static CRYPTONITE_DECAF_NOINLINE void sc_subx(+static CRYPTON_DECAF_NOINLINE void sc_subx(     scalar_t out,-    const cryptonite_decaf_word_t accum[SCALAR_LIMBS],+    const crypton_decaf_word_t accum[SCALAR_LIMBS],     const scalar_t sub,     const scalar_t p,-    cryptonite_decaf_word_t extra+    crypton_decaf_word_t extra ) {-    cryptonite_decaf_dsword_t chain = 0;+    crypton_decaf_dsword_t chain = 0;     unsigned int i;     for (i=0; i<SCALAR_LIMBS; i++) {         chain = (chain + accum[i]) - sub->limb[i];         out->limb[i] = chain;         chain >>= WBITS;     }-    cryptonite_decaf_word_t borrow = chain+extra; /* = 0 or -1 */+    crypton_decaf_word_t borrow = chain+extra; /* = 0 or -1 */          chain = 0;     for (i=0; i<SCALAR_LIMBS; i++) {@@ -61,22 +61,22 @@     } } -static CRYPTONITE_DECAF_NOINLINE void sc_montmul (+static CRYPTON_DECAF_NOINLINE void sc_montmul (     scalar_t out,     const scalar_t a,     const scalar_t b ) {     unsigned int i,j;-    cryptonite_decaf_word_t accum[SCALAR_LIMBS+1] = {0};-    cryptonite_decaf_word_t hi_carry = 0;+    crypton_decaf_word_t accum[SCALAR_LIMBS+1] = {0};+    crypton_decaf_word_t hi_carry = 0;          for (i=0; i<SCALAR_LIMBS; i++) {-        cryptonite_decaf_word_t mand = a->limb[i];-        const cryptonite_decaf_word_t *mier = b->limb;+        crypton_decaf_word_t mand = a->limb[i];+        const crypton_decaf_word_t *mier = b->limb;         -        cryptonite_decaf_dword_t chain = 0;+        crypton_decaf_dword_t chain = 0;         for (j=0; j<SCALAR_LIMBS; j++) {-            chain += ((cryptonite_decaf_dword_t)mand)*mier[j] + accum[j];+            chain += ((crypton_decaf_dword_t)mand)*mier[j] + accum[j];             accum[j] = chain;             chain >>= WBITS;         }@@ -86,7 +86,7 @@         chain = 0;         mier = sc_p->limb;         for (j=0; j<SCALAR_LIMBS; j++) {-            chain += (cryptonite_decaf_dword_t)mand*mier[j] + accum[j];+            chain += (crypton_decaf_dword_t)mand*mier[j] + accum[j];             if (j) accum[j-1] = chain;             chain >>= WBITS;         }@@ -109,11 +109,11 @@ }  /* PERF: could implement this */-static CRYPTONITE_DECAF_INLINE void sc_montsqr (scalar_t out, const scalar_t a) {+static CRYPTON_DECAF_INLINE void sc_montsqr (scalar_t out, const scalar_t a) {     sc_montmul(out,a,a); } -cryptonite_decaf_error_t API_NS(scalar_invert) (+crypton_decaf_error_t API_NS(scalar_invert) (     scalar_t out,     const scalar_t a ) {@@ -139,7 +139,7 @@                  if (started) sc_montsqr(out,out);         -        cryptonite_decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;+        crypton_decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;         if (i >= 0 && i<WBITS) {             assert(w >= 2);             w-=2;@@ -169,8 +169,8 @@          /* Demontgomerize */     sc_montmul(out,out,API_NS(scalar_one));-    cryptonite_decaf_bzero(precmp, sizeof(precmp));-    return cryptonite_decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero)));+    crypton_decaf_bzero(precmp, sizeof(precmp));+    return crypton_decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero))); }  void API_NS(scalar_sub) (@@ -186,7 +186,7 @@     const scalar_t a,     const scalar_t b ) {-    cryptonite_decaf_dword_t chain = 0;+    crypton_decaf_dword_t chain = 0;     unsigned int i;     for (i=0; i<SCALAR_LIMBS; i++) {         chain = (chain + a->limb[i]) + b->limb[i];@@ -203,20 +203,20 @@ ) {     memset(out,0,sizeof(scalar_t));     unsigned int i = 0;-    for (; i<sizeof(uint64_t)/sizeof(cryptonite_decaf_word_t); i++) {+    for (; i<sizeof(uint64_t)/sizeof(crypton_decaf_word_t); i++) {         out->limb[i] = w;-#if CRYPTONITE_DECAF_WORD_BITS < 64-        w >>= 8*sizeof(cryptonite_decaf_word_t);+#if CRYPTON_DECAF_WORD_BITS < 64+        w >>= 8*sizeof(crypton_decaf_word_t); #endif     } } -cryptonite_decaf_bool_t+crypton_decaf_bool_t API_NS(scalar_eq) (     const scalar_t a,     const scalar_t b ) {-    cryptonite_decaf_word_t diff = 0;+    crypton_decaf_word_t diff = 0;     unsigned int i;     for (i=0; i<SCALAR_LIMBS; i++) {         diff |= a->limb[i] ^ b->limb[i];@@ -224,28 +224,28 @@     return mask_to_bool(word_is_zero(diff)); } -static CRYPTONITE_DECAF_INLINE void scalar_decode_short (+static CRYPTON_DECAF_INLINE void scalar_decode_short (     scalar_t s,     const unsigned char *ser,     unsigned int nbytes ) {     unsigned int i,j,k=0;     for (i=0; i<SCALAR_LIMBS; i++) {-        cryptonite_decaf_word_t out = 0;-        for (j=0; j<sizeof(cryptonite_decaf_word_t) && k<nbytes; j++,k++) {-            out |= ((cryptonite_decaf_word_t)ser[k])<<(8*j);+        crypton_decaf_word_t out = 0;+        for (j=0; j<sizeof(crypton_decaf_word_t) && k<nbytes; j++,k++) {+            out |= ((crypton_decaf_word_t)ser[k])<<(8*j);         }         s->limb[i] = out;     } } -cryptonite_decaf_error_t API_NS(scalar_decode)(+crypton_decaf_error_t API_NS(scalar_decode)(     scalar_t s,     const unsigned char ser[SCALAR_SER_BYTES] ) {     unsigned int i;     scalar_decode_short(s, ser, SCALAR_SER_BYTES);-    cryptonite_decaf_dsword_t accum = 0;+    crypton_decaf_dsword_t accum = 0;     for (i=0; i<SCALAR_LIMBS; i++) {         accum = (accum + s->limb[i] - sc_p->limb[i]) >> WBITS;     }@@ -253,13 +253,13 @@          API_NS(scalar_mul)(s,s,API_NS(scalar_one)); /* ham-handed reduce */     -    return cryptonite_decaf_succeed_if(~word_is_zero(accum));+    return crypton_decaf_succeed_if(~word_is_zero(accum)); }  void API_NS(scalar_destroy) (     scalar_t scalar ) {-    cryptonite_decaf_bzero(scalar, sizeof(scalar_t));+    crypton_decaf_bzero(scalar, sizeof(scalar_t)); }  void API_NS(scalar_decode_long)(@@ -306,7 +306,7 @@ ) {     unsigned int i,j,k=0;     for (i=0; i<SCALAR_LIMBS; i++) {-        for (j=0; j<sizeof(cryptonite_decaf_word_t); j++,k++) {+        for (j=0; j<sizeof(crypton_decaf_word_t); j++,k++) {             ser[k] = s->limb[i] >> (8*j);         }     }@@ -316,7 +316,7 @@     scalar_t out,     const scalar_t a,     const scalar_t b,-    cryptonite_decaf_bool_t pick_b+    crypton_decaf_bool_t pick_b ) {     constant_time_select(out,a,b,sizeof(scalar_t),bool_to_mask(pick_b),sizeof(out->limb[0])); }@@ -325,13 +325,13 @@     scalar_t out,     const scalar_t a ) {-    cryptonite_decaf_word_t mask = -(a->limb[0] & 1);-    cryptonite_decaf_dword_t chain = 0;+    crypton_decaf_word_t mask = -(a->limb[0] & 1);+    crypton_decaf_dword_t chain = 0;     unsigned int i;     for (i=0; i<SCALAR_LIMBS; i++) {         chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);         out->limb[i] = chain;-        chain >>= CRYPTONITE_DECAF_WORD_BITS;+        chain >>= CRYPTON_DECAF_WORD_BITS;     }     for (i=0; i<SCALAR_LIMBS-1; i++) {         out->limb[i] = out->limb[i]>>1 | out->limb[i+1]<<(WBITS-1);
cbits/decaf/include/decaf.h view
@@ -17,16 +17,16 @@  * every string is the encoding of a valid group element.  *  * The formulas contain no data-dependent branches, timing or memory accesses,- * except for cryptonite_decaf_XXX_base_double_scalarmul_non_secret.+ * except for crypton_decaf_XXX_base_double_scalarmul_non_secret.  *  * @warning This file was automatically generated in Python.  * Please do not edit it.  */ -#ifndef __CRYPTONITE_DECAF_H__-#define __CRYPTONITE_DECAF_H__ 1+#ifndef __CRYPTON_DECAF_H__+#define __CRYPTON_DECAF_H__ 1  #include <decaf/point_255.h> #include <decaf/point_448.h> -#endif /* __CRYPTONITE_DECAF_H__ */+#endif /* __CRYPTON_DECAF_H__ */
cbits/decaf/include/decaf/common.h view
@@ -9,8 +9,8 @@  * @brief Common utility headers for Decaf library.  */ -#ifndef __CRYPTONITE_DECAF_COMMON_H__-#define __CRYPTONITE_DECAF_COMMON_H__ 1+#ifndef __CRYPTON_DECAF_COMMON_H__+#define __CRYPTON_DECAF_COMMON_H__ 1  #include <stdint.h> #include <sys/types.h>@@ -24,18 +24,18 @@ #if defined(DOXYGEN) && !defined(__attribute__) #define __attribute__((x)) #endif-#define CRYPTONITE_DECAF_API_VIS __attribute__((visibility("default")))-#define CRYPTONITE_DECAF_NOINLINE  __attribute__((noinline))-#define CRYPTONITE_DECAF_WARN_UNUSED __attribute__((warn_unused_result))-#define CRYPTONITE_DECAF_NONNULL __attribute__((nonnull))-#define CRYPTONITE_DECAF_INLINE inline __attribute__((always_inline,unused))+#define CRYPTON_DECAF_API_VIS __attribute__((visibility("default")))+#define CRYPTON_DECAF_NOINLINE  __attribute__((noinline))+#define CRYPTON_DECAF_WARN_UNUSED __attribute__((warn_unused_result))+#define CRYPTON_DECAF_NONNULL __attribute__((nonnull))+#define CRYPTON_DECAF_INLINE inline __attribute__((always_inline,unused)) // Cribbed from libnotmuch #if defined (__clang_major__) && __clang_major__ >= 3 \     || defined (__GNUC__) && __GNUC__ >= 5 \     || defined (__GNUC__) && __GNUC__ == 4 && __GNUC_MINOR__ >= 5-#define CRYPTONITE_DECAF_DEPRECATED(msg) __attribute__ ((deprecated(msg)))+#define CRYPTON_DECAF_DEPRECATED(msg) __attribute__ ((deprecated(msg))) #else-#define CRYPTONITE_DECAF_DEPRECATED(msg) __attribute__ ((deprecated))+#define CRYPTON_DECAF_DEPRECATED(msg) __attribute__ ((deprecated)) #endif /** @endcond */ @@ -46,71 +46,71 @@  * platform to support dynamic linking, since even if you header was built  * with eg arch_neon, you might end up linking a library built with arch_arm32.  */-#ifndef CRYPTONITE_DECAF_WORD_BITS+#ifndef CRYPTON_DECAF_WORD_BITS     #if (defined(__ILP64__) || defined(__amd64__) || defined(__x86_64__) || (((__UINT_FAST32_MAX__)>>30)>>30))-        #define CRYPTONITE_DECAF_WORD_BITS 64 /**< The number of bits in a word */+        #define CRYPTON_DECAF_WORD_BITS 64 /**< The number of bits in a word */     #else-        #define CRYPTONITE_DECAF_WORD_BITS 32 /**< The number of bits in a word */+        #define CRYPTON_DECAF_WORD_BITS 32 /**< The number of bits in a word */     #endif #endif     -#if CRYPTONITE_DECAF_WORD_BITS == 64-typedef uint64_t cryptonite_decaf_word_t;      /**< Word size for internal computations */-typedef int64_t cryptonite_decaf_sword_t;      /**< Signed word size for internal computations */-typedef uint64_t cryptonite_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */-typedef __uint128_t cryptonite_decaf_dword_t;  /**< Double-word size for internal computations */-typedef __int128_t cryptonite_decaf_dsword_t;  /**< Signed double-word size for internal computations */-#elif CRYPTONITE_DECAF_WORD_BITS == 32         /**< The number of bits in a word */-typedef uint32_t cryptonite_decaf_word_t;      /**< Word size for internal computations */-typedef int32_t cryptonite_decaf_sword_t;      /**< Signed word size for internal computations */-typedef uint32_t cryptonite_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */-typedef uint64_t cryptonite_decaf_dword_t;     /**< Double-word size for internal computations */-typedef int64_t cryptonite_decaf_dsword_t;     /**< Signed double-word size for internal computations */+#if CRYPTON_DECAF_WORD_BITS == 64+typedef uint64_t crypton_decaf_word_t;      /**< Word size for internal computations */+typedef int64_t crypton_decaf_sword_t;      /**< Signed word size for internal computations */+typedef uint64_t crypton_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */+typedef __uint128_t crypton_decaf_dword_t;  /**< Double-word size for internal computations */+typedef __int128_t crypton_decaf_dsword_t;  /**< Signed double-word size for internal computations */+#elif CRYPTON_DECAF_WORD_BITS == 32         /**< The number of bits in a word */+typedef uint32_t crypton_decaf_word_t;      /**< Word size for internal computations */+typedef int32_t crypton_decaf_sword_t;      /**< Signed word size for internal computations */+typedef uint32_t crypton_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */+typedef uint64_t crypton_decaf_dword_t;     /**< Double-word size for internal computations */+typedef int64_t crypton_decaf_dsword_t;     /**< Signed double-word size for internal computations */ #else-#error "Only supporting CRYPTONITE_DECAF_WORD_BITS = 32 or 64 for now"+#error "Only supporting CRYPTON_DECAF_WORD_BITS = 32 or 64 for now" #endif     -/** CRYPTONITE_DECAF_TRUE = -1 so that CRYPTONITE_DECAF_TRUE & x = x */-static const cryptonite_decaf_bool_t CRYPTONITE_DECAF_TRUE = -(cryptonite_decaf_bool_t)1;+/** CRYPTON_DECAF_TRUE = -1 so that CRYPTON_DECAF_TRUE & x = x */+static const crypton_decaf_bool_t CRYPTON_DECAF_TRUE = -(crypton_decaf_bool_t)1; -/** CRYPTONITE_DECAF_FALSE = 0 so that CRYPTONITE_DECAF_FALSE & x = 0 */-static const cryptonite_decaf_bool_t CRYPTONITE_DECAF_FALSE = 0;+/** CRYPTON_DECAF_FALSE = 0 so that CRYPTON_DECAF_FALSE & x = 0 */+static const crypton_decaf_bool_t CRYPTON_DECAF_FALSE = 0;  /** Another boolean type used to indicate success or failure. */ typedef enum {-    CRYPTONITE_DECAF_SUCCESS = -1, /**< The operation succeeded. */-    CRYPTONITE_DECAF_FAILURE = 0   /**< The operation failed. */-} cryptonite_decaf_error_t;+    CRYPTON_DECAF_SUCCESS = -1, /**< The operation succeeded. */+    CRYPTON_DECAF_FAILURE = 0   /**< The operation failed. */+} crypton_decaf_error_t;   /** Return success if x is true */-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_error_t-cryptonite_decaf_succeed_if(cryptonite_decaf_bool_t x) {-    return (cryptonite_decaf_error_t)x;+static CRYPTON_DECAF_INLINE crypton_decaf_error_t+crypton_decaf_succeed_if(crypton_decaf_bool_t x) {+    return (crypton_decaf_error_t)x; } -/** Return CRYPTONITE_DECAF_TRUE iff x == CRYPTONITE_DECAF_SUCCESS */-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_bool_t-cryptonite_decaf_successful(cryptonite_decaf_error_t e) {-    cryptonite_decaf_dword_t w = ((cryptonite_decaf_word_t)e) ^  ((cryptonite_decaf_word_t)CRYPTONITE_DECAF_SUCCESS);-    return (w-1)>>CRYPTONITE_DECAF_WORD_BITS;+/** Return CRYPTON_DECAF_TRUE iff x == CRYPTON_DECAF_SUCCESS */+static CRYPTON_DECAF_INLINE crypton_decaf_bool_t+crypton_decaf_successful(crypton_decaf_error_t e) {+    crypton_decaf_dword_t w = ((crypton_decaf_word_t)e) ^  ((crypton_decaf_word_t)CRYPTON_DECAF_SUCCESS);+    return (w-1)>>CRYPTON_DECAF_WORD_BITS; }      /** Overwrite data with zeros.  Uses memset_s if available. */-void cryptonite_decaf_bzero (+void crypton_decaf_bzero (     void *data,     size_t size-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS; -/** Compare two buffers, returning CRYPTONITE_DECAF_TRUE if they are equal. */-cryptonite_decaf_bool_t cryptonite_decaf_memeq (+/** Compare two buffers, returning CRYPTON_DECAF_TRUE if they are equal. */+crypton_decaf_bool_t crypton_decaf_memeq (     const void *data1,     const void *data2,     size_t size-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_API_VIS;+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_API_VIS;      #ifdef __cplusplus } /* extern "C" */ #endif     -#endif /* __CRYPTONITE_DECAF_COMMON_H__ */+#endif /* __CRYPTON_DECAF_COMMON_H__ */
cbits/decaf/include/decaf/ed448.h view
@@ -12,8 +12,8 @@  * Please do not edit it.  */ -#ifndef __CRYPTONITE_DECAF_ED448_H__-#define __CRYPTONITE_DECAF_ED448_H__ 1+#ifndef __CRYPTON_DECAF_ED448_H__+#define __CRYPTON_DECAF_ED448_H__ 1  #include <decaf/point_448.h> #include <decaf/shake.h>@@ -24,22 +24,22 @@ #endif  /** Number of bytes in an EdDSA public key. */-#define CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES 57+#define CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES 57  /** Number of bytes in an EdDSA private key. */-#define CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES+#define CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES  /** Number of bytes in an EdDSA private key. */-#define CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES (CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES + CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES)+#define CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES (CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES + CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES)  /** Does EdDSA support non-contextual signatures? */-#define CRYPTONITE_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS 0+#define CRYPTON_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS 0  /** Prehash context renaming macros. */-#define cryptonite_decaf_ed448_prehash_ctx_s   cryptonite_decaf_shake256_ctx_s-#define cryptonite_decaf_ed448_prehash_ctx_t   cryptonite_decaf_shake256_ctx_t-#define cryptonite_decaf_ed448_prehash_update  cryptonite_decaf_shake256_update-#define cryptonite_decaf_ed448_prehash_destroy cryptonite_decaf_shake256_destroy+#define crypton_decaf_ed448_prehash_ctx_s   crypton_decaf_shake256_ctx_s+#define crypton_decaf_ed448_prehash_ctx_t   crypton_decaf_shake256_ctx_t+#define crypton_decaf_ed448_prehash_update  crypton_decaf_shake256_update+#define crypton_decaf_ed448_prehash_destroy crypton_decaf_shake256_destroy  /**  * @brief EdDSA key generation.  This function uses a different (non-Decaf)@@ -48,10 +48,10 @@  * @param [out] pubkey The public key.  * @param [in] privkey The private key.  */    -void cryptonite_decaf_ed448_derive_public_key (-    uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_ed448_derive_public_key (+    uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA signing.@@ -70,16 +70,16 @@  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives  * you no seat belt.  */  -void cryptonite_decaf_ed448_sign (-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],+void crypton_decaf_ed448_sign (+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],     const uint8_t *message,     size_t message_len,     uint8_t prehashed,     const uint8_t *context,     uint8_t context_len-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2,3))) CRYPTONITE_DECAF_NOINLINE;+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2,3))) CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA signing with prehash.@@ -96,23 +96,23 @@  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives  * you no seat belt.  */  -void cryptonite_decaf_ed448_sign_prehash (-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const cryptonite_decaf_ed448_prehash_ctx_t hash,+void crypton_decaf_ed448_sign_prehash (+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const crypton_decaf_ed448_prehash_ctx_t hash,     const uint8_t *context,     uint8_t context_len-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2,3,4))) CRYPTONITE_DECAF_NOINLINE;+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2,3,4))) CRYPTON_DECAF_NOINLINE;      /**  * @brief Prehash initialization, with contexts if supported.  *  * @param [out] hash The hash object to be initialized.  */-void cryptonite_decaf_ed448_prehash_init (-    cryptonite_decaf_ed448_prehash_ctx_t hash-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1))) CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_ed448_prehash_init (+    crypton_decaf_ed448_prehash_ctx_t hash+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1))) CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA signature verification.@@ -132,15 +132,15 @@  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives  * you no seat belt.  */-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify (-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],+crypton_decaf_error_t crypton_decaf_ed448_verify (+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],     const uint8_t *message,     size_t message_len,     uint8_t prehashed,     const uint8_t *context,     uint8_t context_len-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTONITE_DECAF_NOINLINE;+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA signature verification.@@ -158,13 +158,13 @@  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives  * you no seat belt.  */-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify_prehash (-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const cryptonite_decaf_ed448_prehash_ctx_t hash,+crypton_decaf_error_t crypton_decaf_ed448_verify_prehash (+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const crypton_decaf_ed448_prehash_ctx_t hash,     const uint8_t *context,     uint8_t context_len-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTONITE_DECAF_NOINLINE;+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA point encoding.  Used internally, exposed externally.@@ -173,10 +173,10 @@  * @param [out] enc The encoded point.  * @param [in] p The point.  */       -void cryptonite_decaf_448_point_mul_by_cofactor_and_encode_like_eddsa (-    uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],-    const cryptonite_decaf_448_point_t p-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_mul_by_cofactor_and_encode_like_eddsa (+    uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],+    const crypton_decaf_448_point_t p+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA point decoding.  Remember that while points on the@@ -186,10 +186,10 @@  * @param [out] enc The encoded point.  * @param [in] p The point.  */       -cryptonite_decaf_error_t cryptonite_decaf_448_point_decode_like_eddsa_and_ignore_cofactor (-    cryptonite_decaf_448_point_t p,-    const uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_448_point_decode_like_eddsa_and_ignore_cofactor (+    crypton_decaf_448_point_t p,+    const uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA to ECDH public key conversion@@ -202,10 +202,10 @@  * @param[out] x The ECDH public key as in RFC7748(point on Montgomery curve)  * @param[in] ed The EdDSA public key(point on Edwards curve)  */-void cryptonite_decaf_ed448_convert_public_key_to_x448 (-    uint8_t x[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_ed448_convert_public_key_to_x448 (+    uint8_t x[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief EdDSA to ECDH private key conversion@@ -215,13 +215,13 @@  * @param[out] x The ECDH private key as in RFC7748  * @param[in] ed The EdDSA private key  */-void cryptonite_decaf_ed448_convert_private_key_to_x448 (-    uint8_t x[CRYPTONITE_DECAF_X448_PRIVATE_BYTES],-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_ed448_convert_private_key_to_x448 (+    uint8_t x[CRYPTON_DECAF_X448_PRIVATE_BYTES],+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  #ifdef __cplusplus } /* extern "C" */ #endif -#endif /* __CRYPTONITE_DECAF_ED448_H__ */+#endif /* __CRYPTON_DECAF_ED448_H__ */
cbits/decaf/include/decaf/point_448.h view
@@ -12,8 +12,8 @@  * Please do not edit it.  */ -#ifndef __CRYPTONITE_DECAF_POINT_448_H__-#define __CRYPTONITE_DECAF_POINT_448_H__ 1+#ifndef __CRYPTON_DECAF_POINT_448_H__+#define __CRYPTON_DECAF_POINT_448_H__ 1  #include <decaf/common.h> @@ -22,79 +22,79 @@ #endif  /** @cond internal */-#define CRYPTONITE_DECAF_448_SCALAR_LIMBS ((446-1)/CRYPTONITE_DECAF_WORD_BITS+1)+#define CRYPTON_DECAF_448_SCALAR_LIMBS ((446-1)/CRYPTON_DECAF_WORD_BITS+1) /** @endcond */  /** The number of bits in a scalar */-#define CRYPTONITE_DECAF_448_SCALAR_BITS 446+#define CRYPTON_DECAF_448_SCALAR_BITS 446  /** @cond internal */-#ifndef __CRYPTONITE_DECAF_448_GF_DEFINED__-#define __CRYPTONITE_DECAF_448_GF_DEFINED__ 1+#ifndef __CRYPTON_DECAF_448_GF_DEFINED__+#define __CRYPTON_DECAF_448_GF_DEFINED__ 1 /** @brief Galois field element internal structure */-typedef struct cryptonite_gf_448_s {-    cryptonite_decaf_word_t limb[512/CRYPTONITE_DECAF_WORD_BITS];-} __attribute__((aligned(16))) cryptonite_gf_448_s, cryptonite_gf_448_t[1];-#endif /* __CRYPTONITE_DECAF_448_GF_DEFINED__ */+typedef struct crypton_gf_448_s {+    crypton_decaf_word_t limb[512/CRYPTON_DECAF_WORD_BITS];+} __attribute__((aligned(16))) crypton_gf_448_s, crypton_gf_448_t[1];+#endif /* __CRYPTON_DECAF_448_GF_DEFINED__ */ /** @endcond */  /** Number of bytes in a serialized point. */-#define CRYPTONITE_DECAF_448_SER_BYTES 56+#define CRYPTON_DECAF_448_SER_BYTES 56  /** Number of bytes in an elligated point.  For now set the same as SER_BYTES  * but could be different for other curves.  */-#define CRYPTONITE_DECAF_448_HASH_BYTES 56+#define CRYPTON_DECAF_448_HASH_BYTES 56  /** Number of bytes in a serialized scalar. */-#define CRYPTONITE_DECAF_448_SCALAR_BYTES 56+#define CRYPTON_DECAF_448_SCALAR_BYTES 56  /** Number of bits in the "which" field of an elligator inverse */-#define CRYPTONITE_DECAF_448_INVERT_ELLIGATOR_WHICH_BITS 3+#define CRYPTON_DECAF_448_INVERT_ELLIGATOR_WHICH_BITS 3  /** Number of bytes in an x448 public key */-#define CRYPTONITE_DECAF_X448_PUBLIC_BYTES 56+#define CRYPTON_DECAF_X448_PUBLIC_BYTES 56  /** Number of bytes in an x448 private key */-#define CRYPTONITE_DECAF_X448_PRIVATE_BYTES 56+#define CRYPTON_DECAF_X448_PRIVATE_BYTES 56  /** Twisted Edwards extended homogeneous coordinates */-typedef struct cryptonite_decaf_448_point_s {+typedef struct crypton_decaf_448_point_s {     /** @cond internal */-    cryptonite_gf_448_t x,y,z,t;+    crypton_gf_448_t x,y,z,t;     /** @endcond */-} cryptonite_decaf_448_point_t[1];+} crypton_decaf_448_point_t[1];  /** Precomputed table based on a point.  Can be trivial implementation. */-struct cryptonite_decaf_448_precomputed_s;+struct crypton_decaf_448_precomputed_s;  /** Precomputed table based on a point.  Can be trivial implementation. */-typedef struct cryptonite_decaf_448_precomputed_s cryptonite_decaf_448_precomputed_s; +typedef struct crypton_decaf_448_precomputed_s crypton_decaf_448_precomputed_s;   /** Size and alignment of precomputed point tables. */-extern const size_t cryptonite_decaf_448_sizeof_precomputed_s CRYPTONITE_DECAF_API_VIS, cryptonite_decaf_448_alignof_precomputed_s CRYPTONITE_DECAF_API_VIS;+extern const size_t crypton_decaf_448_sizeof_precomputed_s CRYPTON_DECAF_API_VIS, crypton_decaf_448_alignof_precomputed_s CRYPTON_DECAF_API_VIS;  /** Scalar is stored packed, because we don't need the speed. */-typedef struct cryptonite_decaf_448_scalar_s {+typedef struct crypton_decaf_448_scalar_s {     /** @cond internal */-    cryptonite_decaf_word_t limb[CRYPTONITE_DECAF_448_SCALAR_LIMBS];+    crypton_decaf_word_t limb[CRYPTON_DECAF_448_SCALAR_LIMBS];     /** @endcond */-} cryptonite_decaf_448_scalar_t[1];+} crypton_decaf_448_scalar_t[1];  /** A scalar equal to 1. */-extern const cryptonite_decaf_448_scalar_t cryptonite_decaf_448_scalar_one CRYPTONITE_DECAF_API_VIS;+extern const crypton_decaf_448_scalar_t crypton_decaf_448_scalar_one CRYPTON_DECAF_API_VIS;  /** A scalar equal to 0. */-extern const cryptonite_decaf_448_scalar_t cryptonite_decaf_448_scalar_zero CRYPTONITE_DECAF_API_VIS;+extern const crypton_decaf_448_scalar_t crypton_decaf_448_scalar_zero CRYPTON_DECAF_API_VIS;  /** The identity point on the curve. */-extern const cryptonite_decaf_448_point_t cryptonite_decaf_448_point_identity CRYPTONITE_DECAF_API_VIS;+extern const crypton_decaf_448_point_t crypton_decaf_448_point_identity CRYPTON_DECAF_API_VIS;  /** An arbitrarily chosen base point on the curve. */-extern const cryptonite_decaf_448_point_t cryptonite_decaf_448_point_base CRYPTONITE_DECAF_API_VIS;+extern const crypton_decaf_448_point_t crypton_decaf_448_point_base CRYPTON_DECAF_API_VIS;  /** Precomputed table for the base point on the curve. */-extern const struct cryptonite_decaf_448_precomputed_s *cryptonite_decaf_448_precomputed_base CRYPTONITE_DECAF_API_VIS;+extern const struct crypton_decaf_448_precomputed_s *crypton_decaf_448_precomputed_base CRYPTON_DECAF_API_VIS;  /**  * @brief Read a scalar from wire format or from bytes.@@ -102,14 +102,14 @@  * @param [in] ser Serialized form of a scalar.  * @param [out] out Deserialized form.  *- * @retval CRYPTONITE_DECAF_SUCCESS The scalar was correctly encoded.- * @retval CRYPTONITE_DECAF_FAILURE The scalar was greater than the modulus,+ * @retval CRYPTON_DECAF_SUCCESS The scalar was correctly encoded.+ * @retval CRYPTON_DECAF_FAILURE The scalar was greater than the modulus,  * and has been reduced modulo that modulus.  */-cryptonite_decaf_error_t cryptonite_decaf_448_scalar_decode (-    cryptonite_decaf_448_scalar_t out,-    const unsigned char ser[CRYPTONITE_DECAF_448_SCALAR_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_448_scalar_decode (+    crypton_decaf_448_scalar_t out,+    const unsigned char ser[CRYPTON_DECAF_448_SCALAR_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Read a scalar from wire format or from bytes.  Reduces mod@@ -119,11 +119,11 @@  * @param [in] ser_len Length of serialized form.  * @param [out] out Deserialized form.  */-void cryptonite_decaf_448_scalar_decode_long (-    cryptonite_decaf_448_scalar_t out,+void crypton_decaf_448_scalar_decode_long (+    crypton_decaf_448_scalar_t out,     const unsigned char *ser,     size_t ser_len-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;      /**  * @brief Serialize a scalar to wire format.@@ -131,10 +131,10 @@  * @param [out] ser Serialized form of a scalar.  * @param [in] s Deserialized scalar.  */-void cryptonite_decaf_448_scalar_encode (-    unsigned char ser[CRYPTONITE_DECAF_448_SCALAR_BYTES],-    const cryptonite_decaf_448_scalar_t s-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_encode (+    unsigned char ser[CRYPTON_DECAF_448_SCALAR_BYTES],+    const crypton_decaf_448_scalar_t s+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_NOINLINE;          /**  * @brief Add two scalars.  The scalars may use the same memory.@@ -142,23 +142,23 @@  * @param [in] b Another scalar.  * @param [out] out a+b.  */-void cryptonite_decaf_448_scalar_add (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a,-    const cryptonite_decaf_448_scalar_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_add (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a,+    const crypton_decaf_448_scalar_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Compare two scalars.  * @param [in] a One scalar.  * @param [in] b Another scalar.- * @retval CRYPTONITE_DECAF_TRUE The scalars are equal.- * @retval CRYPTONITE_DECAF_FALSE The scalars are not equal.+ * @retval CRYPTON_DECAF_TRUE The scalars are equal.+ * @retval CRYPTON_DECAF_FALSE The scalars are not equal.  */    -cryptonite_decaf_bool_t cryptonite_decaf_448_scalar_eq (-    const cryptonite_decaf_448_scalar_t a,-    const cryptonite_decaf_448_scalar_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_bool_t crypton_decaf_448_scalar_eq (+    const crypton_decaf_448_scalar_t a,+    const crypton_decaf_448_scalar_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Subtract two scalars.  The scalars may use the same memory.@@ -166,11 +166,11 @@  * @param [in] b Another scalar.  * @param [out] out a-b.  */  -void cryptonite_decaf_448_scalar_sub (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a,-    const cryptonite_decaf_448_scalar_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_sub (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a,+    const crypton_decaf_448_scalar_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Multiply two scalars.  The scalars may use the same memory.@@ -178,32 +178,32 @@  * @param [in] b Another scalar.  * @param [out] out a*b.  */  -void cryptonite_decaf_448_scalar_mul (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a,-    const cryptonite_decaf_448_scalar_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_mul (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a,+    const crypton_decaf_448_scalar_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;          /** * @brief Halve a scalar.  The scalars may use the same memory. * @param [in] a A scalar. * @param [out] out a/2. */-void cryptonite_decaf_448_scalar_halve (-   cryptonite_decaf_448_scalar_t out,-   const cryptonite_decaf_448_scalar_t a-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_halve (+   crypton_decaf_448_scalar_t out,+   const crypton_decaf_448_scalar_t a+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Invert a scalar.  When passed zero, return 0.  The input and output may alias.  * @param [in] a A scalar.  * @param [out] out 1/a.- * @return CRYPTONITE_DECAF_SUCCESS The input is nonzero.+ * @return CRYPTON_DECAF_SUCCESS The input is nonzero.  */  -cryptonite_decaf_error_t cryptonite_decaf_448_scalar_invert (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_448_scalar_invert (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Copy a scalar.  The scalars may use the same memory, in which@@ -211,9 +211,9 @@  * @param [in] a A scalar.  * @param [out] out Will become a copy of a.  */-static inline void CRYPTONITE_DECAF_NONNULL cryptonite_decaf_448_scalar_copy (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a+static inline void CRYPTON_DECAF_NONNULL crypton_decaf_448_scalar_copy (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a ) {     *out = *a; }@@ -223,10 +223,10 @@  * @param [in] a An integer.  * @param [out] out Will become equal to a.  */  -void cryptonite_decaf_448_scalar_set_unsigned (-    cryptonite_decaf_448_scalar_t out,+void crypton_decaf_448_scalar_set_unsigned (+    crypton_decaf_448_scalar_t out,     uint64_t a-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;  /**  * @brief Encode a point as a sequence of bytes.@@ -234,10 +234,10 @@  * @param [out] ser The byte representation of the point.  * @param [in] pt The point to encode.  */-void cryptonite_decaf_448_point_encode (-    uint8_t ser[CRYPTONITE_DECAF_448_SER_BYTES],-    const cryptonite_decaf_448_point_t pt-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_encode (+    uint8_t ser[CRYPTON_DECAF_448_SER_BYTES],+    const crypton_decaf_448_point_t pt+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Decode a point from a sequence of bytes.@@ -248,16 +248,16 @@  *  * @param [out] pt The decoded point.  * @param [in] ser The serialized version of the point.- * @param [in] allow_identity CRYPTONITE_DECAF_TRUE if the identity is a legal input.- * @retval CRYPTONITE_DECAF_SUCCESS The decoding succeeded.- * @retval CRYPTONITE_DECAF_FAILURE The decoding didn't succeed, because+ * @param [in] allow_identity CRYPTON_DECAF_TRUE if the identity is a legal input.+ * @retval CRYPTON_DECAF_SUCCESS The decoding succeeded.+ * @retval CRYPTON_DECAF_FAILURE The decoding didn't succeed, because  * ser does not represent a point.  */-cryptonite_decaf_error_t cryptonite_decaf_448_point_decode (-    cryptonite_decaf_448_point_t pt,-    const uint8_t ser[CRYPTONITE_DECAF_448_SER_BYTES],-    cryptonite_decaf_bool_t allow_identity-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_448_point_decode (+    crypton_decaf_448_point_t pt,+    const uint8_t ser[CRYPTON_DECAF_448_SER_BYTES],+    crypton_decaf_bool_t allow_identity+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Copy a point.  The input and output may alias,@@ -266,26 +266,26 @@  * @param [out] a A copy of the point.  * @param [in] b Any point.  */-static inline void CRYPTONITE_DECAF_NONNULL cryptonite_decaf_448_point_copy (-    cryptonite_decaf_448_point_t a,-    const cryptonite_decaf_448_point_t b+static inline void CRYPTON_DECAF_NONNULL crypton_decaf_448_point_copy (+    crypton_decaf_448_point_t a,+    const crypton_decaf_448_point_t b ) {     *a=*b; }  /**  * @brief Test whether two points are equal.  If yes, return- * CRYPTONITE_DECAF_TRUE, else return CRYPTONITE_DECAF_FALSE.+ * CRYPTON_DECAF_TRUE, else return CRYPTON_DECAF_FALSE.  *  * @param [in] a A point.  * @param [in] b Another point.- * @retval CRYPTONITE_DECAF_TRUE The points are equal.- * @retval CRYPTONITE_DECAF_FALSE The points are not equal.+ * @retval CRYPTON_DECAF_TRUE The points are equal.+ * @retval CRYPTON_DECAF_FALSE The points are not equal.  */-cryptonite_decaf_bool_t cryptonite_decaf_448_point_eq (-    const cryptonite_decaf_448_point_t a,-    const cryptonite_decaf_448_point_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_bool_t crypton_decaf_448_point_eq (+    const crypton_decaf_448_point_t a,+    const crypton_decaf_448_point_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Add two points to produce a third point.  The@@ -296,23 +296,23 @@  * @param [in] a An addend.  * @param [in] b An addend.  */-void cryptonite_decaf_448_point_add (-    cryptonite_decaf_448_point_t sum,-    const cryptonite_decaf_448_point_t a,-    const cryptonite_decaf_448_point_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;+void crypton_decaf_448_point_add (+    crypton_decaf_448_point_t sum,+    const crypton_decaf_448_point_t a,+    const crypton_decaf_448_point_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;  /**  * @brief Double a point.  Equivalent to- * cryptonite_decaf_448_point_add(two_a,a,a), but potentially faster.+ * crypton_decaf_448_point_add(two_a,a,a), but potentially faster.  *  * @param [out] two_a The sum a+a.  * @param [in] a A point.  */-void cryptonite_decaf_448_point_double (-    cryptonite_decaf_448_point_t two_a,-    const cryptonite_decaf_448_point_t a-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;+void crypton_decaf_448_point_double (+    crypton_decaf_448_point_t two_a,+    const crypton_decaf_448_point_t a+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;  /**  * @brief Subtract two points to produce a third point.  The@@ -323,11 +323,11 @@  * @param [in] a The minuend.  * @param [in] b The subtrahend.  */-void cryptonite_decaf_448_point_sub (-    cryptonite_decaf_448_point_t diff,-    const cryptonite_decaf_448_point_t a,-    const cryptonite_decaf_448_point_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;+void crypton_decaf_448_point_sub (+    crypton_decaf_448_point_t diff,+    const crypton_decaf_448_point_t a,+    const crypton_decaf_448_point_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;      /**  * @brief Negate a point to produce another point.  The input@@ -336,10 +336,10 @@  * @param [out] nega The negated input point  * @param [in] a The input point.  */-void cryptonite_decaf_448_point_negate (-   cryptonite_decaf_448_point_t nega,-   const cryptonite_decaf_448_point_t a-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;+void crypton_decaf_448_point_negate (+   crypton_decaf_448_point_t nega,+   const crypton_decaf_448_point_t a+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;  /**  * @brief Multiply a base point by a scalar: scaled = scalar*base.@@ -348,11 +348,11 @@  * @param [in] base The point to be scaled.  * @param [in] scalar The scalar to multiply by.  */-void cryptonite_decaf_448_point_scalarmul (-    cryptonite_decaf_448_point_t scaled,-    const cryptonite_decaf_448_point_t base,-    const cryptonite_decaf_448_scalar_t scalar-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_scalarmul (+    crypton_decaf_448_point_t scaled,+    const crypton_decaf_448_point_t base,+    const crypton_decaf_448_scalar_t scalar+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Multiply a base point by a scalar: scaled = scalar*base.@@ -367,17 +367,17 @@  * @param [in] allow_identity Allow the input to be the identity.  * @param [in] short_circuit Allow a fast return if the input is illegal.  *- * @retval CRYPTONITE_DECAF_SUCCESS The scalarmul succeeded.- * @retval CRYPTONITE_DECAF_FAILURE The scalarmul didn't succeed, because+ * @retval CRYPTON_DECAF_SUCCESS The scalarmul succeeded.+ * @retval CRYPTON_DECAF_FAILURE The scalarmul didn't succeed, because  * base does not represent a point.  */-cryptonite_decaf_error_t cryptonite_decaf_448_direct_scalarmul (-    uint8_t scaled[CRYPTONITE_DECAF_448_SER_BYTES],-    const uint8_t base[CRYPTONITE_DECAF_448_SER_BYTES],-    const cryptonite_decaf_448_scalar_t scalar,-    cryptonite_decaf_bool_t allow_identity,-    cryptonite_decaf_bool_t short_circuit-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_448_direct_scalarmul (+    uint8_t scaled[CRYPTON_DECAF_448_SER_BYTES],+    const uint8_t base[CRYPTON_DECAF_448_SER_BYTES],+    const crypton_decaf_448_scalar_t scalar,+    crypton_decaf_bool_t allow_identity,+    crypton_decaf_bool_t short_circuit+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NOINLINE;  /**  * @brief RFC 7748 Diffie-Hellman scalarmul.  This function uses a different@@ -387,50 +387,50 @@  * @param [in] base The point to be scaled.  * @param [in] scalar The scalar to multiply by.  *- * @retval CRYPTONITE_DECAF_SUCCESS The scalarmul succeeded.- * @retval CRYPTONITE_DECAF_FAILURE The scalarmul didn't succeed, because the base+ * @retval CRYPTON_DECAF_SUCCESS The scalarmul succeeded.+ * @retval CRYPTON_DECAF_FAILURE The scalarmul didn't succeed, because the base  * point is in a small subgroup.  */-cryptonite_decaf_error_t cryptonite_decaf_x448 (-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t base[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_error_t crypton_decaf_x448 (+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t base[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NOINLINE;  /** The base point for X448 Diffie-Hellman */-extern const uint8_t cryptonite_decaf_x448_base_point[CRYPTONITE_DECAF_X448_PUBLIC_BYTES] CRYPTONITE_DECAF_API_VIS;+extern const uint8_t crypton_decaf_x448_base_point[CRYPTON_DECAF_X448_PUBLIC_BYTES] CRYPTON_DECAF_API_VIS;  /**  * @brief RFC 7748 Diffie-Hellman base point scalarmul.  This function uses  * a different (non-Decaf) encoding.  *- * @deprecated Renamed to cryptonite_decaf_x448_derive_public_key.+ * @deprecated Renamed to crypton_decaf_x448_derive_public_key.  * I have no particular timeline for removing this name.  *  * @param [out] scaled The scaled point base*scalar  * @param [in] scalar The scalar to multiply by.  */-void cryptonite_decaf_x448_generate_key (-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_DEPRECATED("Renamed to cryptonite_decaf_x448_derive_public_key");+void crypton_decaf_x448_generate_key (+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_DEPRECATED("Renamed to crypton_decaf_x448_derive_public_key");      /**  * @brief RFC 7748 Diffie-Hellman base point scalarmul.  This function uses  * a different (non-Decaf) encoding.  *- * Does exactly the same thing as cryptonite_decaf_x448_generate_key,+ * Does exactly the same thing as crypton_decaf_x448_generate_key,  * but has a better name.  *  * @param [out] scaled The scaled point base*scalar  * @param [in] scalar The scalar to multiply by.  */-void cryptonite_decaf_x448_derive_public_key (-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_x448_derive_public_key (+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE; -/* FUTURE: uint8_t cryptonite_decaf_448_encode_like_curve448) */+/* FUTURE: uint8_t crypton_decaf_448_encode_like_curve448) */  /**  * @brief Precompute a table for fast scalar multiplication.@@ -441,33 +441,33 @@  * @param [out] a A precomputed table of multiples of the point.  * @param [in] b Any point.  */-void cryptonite_decaf_448_precompute (-    cryptonite_decaf_448_precomputed_s *a,-    const cryptonite_decaf_448_point_t b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_precompute (+    crypton_decaf_448_precomputed_s *a,+    const crypton_decaf_448_point_t b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Multiply a precomputed base point by a scalar:  * scaled = scalar*base.  * Some implementations do not include precomputed points; for  * those implementations, this function is the same as- * cryptonite_decaf_448_point_scalarmul+ * crypton_decaf_448_point_scalarmul  *  * @param [out] scaled The scaled point base*scalar  * @param [in] base The point to be scaled.  * @param [in] scalar The scalar to multiply by.  */-void cryptonite_decaf_448_precomputed_scalarmul (-    cryptonite_decaf_448_point_t scaled,-    const cryptonite_decaf_448_precomputed_s *base,-    const cryptonite_decaf_448_scalar_t scalar-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_precomputed_scalarmul (+    crypton_decaf_448_point_t scaled,+    const crypton_decaf_448_precomputed_s *base,+    const crypton_decaf_448_scalar_t scalar+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Multiply two base points by two scalars:  * scaled = scalar1*base1 + scalar2*base2.  *- * Equivalent to two calls to cryptonite_decaf_448_point_scalarmul, but may be+ * Equivalent to two calls to crypton_decaf_448_point_scalarmul, but may be  * faster.  *  * @param [out] combo The linear combination scalar1*base1 + scalar2*base2.@@ -476,13 +476,13 @@  * @param [in] base2 A second point to be scaled.  * @param [in] scalar2 A second scalar to multiply by.  */-void cryptonite_decaf_448_point_double_scalarmul (-    cryptonite_decaf_448_point_t combo,-    const cryptonite_decaf_448_point_t base1,-    const cryptonite_decaf_448_scalar_t scalar1,-    const cryptonite_decaf_448_point_t base2,-    const cryptonite_decaf_448_scalar_t scalar2-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_double_scalarmul (+    crypton_decaf_448_point_t combo,+    const crypton_decaf_448_point_t base1,+    const crypton_decaf_448_scalar_t scalar1,+    const crypton_decaf_448_point_t base2,+    const crypton_decaf_448_scalar_t scalar2+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;      /**  * Multiply one base point by two scalars:@@ -490,7 +490,7 @@  * a1 = scalar1 * base  * a2 = scalar2 * base  *- * Equivalent to two calls to cryptonite_decaf_448_point_scalarmul, but may be+ * Equivalent to two calls to crypton_decaf_448_point_scalarmul, but may be  * faster.  *  * @param [out] a1 The first multiple.  It may be the same as the input point.@@ -499,19 +499,19 @@  * @param [in] scalar1 A first scalar to multiply by.  * @param [in] scalar2 A second scalar to multiply by.  */-void cryptonite_decaf_448_point_dual_scalarmul (-    cryptonite_decaf_448_point_t a1,-    cryptonite_decaf_448_point_t a2,-    const cryptonite_decaf_448_point_t base1,-    const cryptonite_decaf_448_scalar_t scalar1,-    const cryptonite_decaf_448_scalar_t scalar2-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_dual_scalarmul (+    crypton_decaf_448_point_t a1,+    crypton_decaf_448_point_t a2,+    const crypton_decaf_448_point_t base1,+    const crypton_decaf_448_scalar_t scalar1,+    const crypton_decaf_448_scalar_t scalar2+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Multiply two base points by two scalars:- * scaled = scalar1*cryptonite_decaf_448_point_base + scalar2*base2.+ * scaled = scalar1*crypton_decaf_448_point_base + scalar2*base2.  *- * Otherwise equivalent to cryptonite_decaf_448_point_double_scalarmul, but may be+ * Otherwise equivalent to crypton_decaf_448_point_double_scalarmul, but may be  * faster at the expense of being variable time.  *  * @param [out] combo The linear combination scalar1*base + scalar2*base2.@@ -522,12 +522,12 @@  * @warning: This function takes variable time, and may leak the scalars  * used.  It is designed for signature verification.  */-void cryptonite_decaf_448_base_double_scalarmul_non_secret (-    cryptonite_decaf_448_point_t combo,-    const cryptonite_decaf_448_scalar_t scalar1,-    const cryptonite_decaf_448_point_t base2,-    const cryptonite_decaf_448_scalar_t scalar2-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_base_double_scalarmul_non_secret (+    crypton_decaf_448_point_t combo,+    const crypton_decaf_448_scalar_t scalar1,+    const crypton_decaf_448_point_t base2,+    const crypton_decaf_448_scalar_t scalar2+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Constant-time decision between two points.  If pick_b@@ -538,12 +538,12 @@  * @param [in] b Any point.  * @param [in] pick_b If nonzero, choose point b.  */-void cryptonite_decaf_448_point_cond_sel (-    cryptonite_decaf_448_point_t out,-    const cryptonite_decaf_448_point_t a,-    const cryptonite_decaf_448_point_t b,-    cryptonite_decaf_word_t pick_b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_cond_sel (+    crypton_decaf_448_point_t out,+    const crypton_decaf_448_point_t a,+    const crypton_decaf_448_point_t b,+    crypton_decaf_word_t pick_b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Constant-time decision between two scalars.  If pick_b@@ -554,23 +554,23 @@  * @param [in] b Any scalar.  * @param [in] pick_b If nonzero, choose scalar b.  */-void cryptonite_decaf_448_scalar_cond_sel (-    cryptonite_decaf_448_scalar_t out,-    const cryptonite_decaf_448_scalar_t a,-    const cryptonite_decaf_448_scalar_t b,-    cryptonite_decaf_word_t pick_b-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_scalar_cond_sel (+    crypton_decaf_448_scalar_t out,+    const crypton_decaf_448_scalar_t a,+    const crypton_decaf_448_scalar_t b,+    crypton_decaf_word_t pick_b+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Test that a point is valid, for debugging purposes.  *  * @param [in] to_test The point to test.- * @retval CRYPTONITE_DECAF_TRUE The point is valid.- * @retval CRYPTONITE_DECAF_FALSE The point is invalid.+ * @retval CRYPTON_DECAF_TRUE The point is valid.+ * @retval CRYPTON_DECAF_FALSE The point is invalid.  */-cryptonite_decaf_bool_t cryptonite_decaf_448_point_valid (-    const cryptonite_decaf_448_point_t to_test-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_bool_t crypton_decaf_448_point_valid (+    const crypton_decaf_448_point_t to_test+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Torque a point, for debugging purposes.  The output@@ -579,10 +579,10 @@  * @param [out] q The point to torque.  * @param [in] p The point to torque.  */-void cryptonite_decaf_448_point_debugging_torque (-    cryptonite_decaf_448_point_t q,-    const cryptonite_decaf_448_point_t p-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_debugging_torque (+    crypton_decaf_448_point_t q,+    const crypton_decaf_448_point_t p+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Projectively scale a point, for debugging purposes.@@ -593,18 +593,18 @@  * @param [in] p The point to scale.  * @param [in] factor Serialized GF factor to scale.  */-void cryptonite_decaf_448_point_debugging_pscale (-    cryptonite_decaf_448_point_t q,-    const cryptonite_decaf_448_point_t p,-    const unsigned char factor[CRYPTONITE_DECAF_448_SER_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_debugging_pscale (+    crypton_decaf_448_point_t q,+    const crypton_decaf_448_point_t p,+    const unsigned char factor[CRYPTON_DECAF_448_SER_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Almost-Elligator-like hash to curve.  *  * Call this function with the output of a hash to make a hash to the curve.  *- * This function runs Elligator2 on the cryptonite_decaf_448 Jacobi quartic model.  It then+ * This function runs Elligator2 on the crypton_decaf_448 Jacobi quartic model.  It then  * uses the isogeny to put the result in twisted Edwards form.  As a result,  * it is safe (cannot produce points of order 4), and would be compatible with  * hypothetical other implementations of Decaf using a Montgomery or untwisted@@ -628,29 +628,29 @@  * @param [out] pt The data hashed to the curve.  */ void-cryptonite_decaf_448_point_from_hash_nonuniform (-    cryptonite_decaf_448_point_t pt,-    const unsigned char hashed_data[CRYPTONITE_DECAF_448_HASH_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+crypton_decaf_448_point_from_hash_nonuniform (+    crypton_decaf_448_point_t pt,+    const unsigned char hashed_data[CRYPTON_DECAF_448_HASH_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Indifferentiable hash function encoding to curve.  *- * Equivalent to calling cryptonite_decaf_448_point_from_hash_nonuniform twice and adding.+ * Equivalent to calling crypton_decaf_448_point_from_hash_nonuniform twice and adding.  *  * @param [in] hashed_data Output of some hash function.  * @param [out] pt The data hashed to the curve.  */ -void cryptonite_decaf_448_point_from_hash_uniform (-    cryptonite_decaf_448_point_t pt,-    const unsigned char hashed_data[2*CRYPTONITE_DECAF_448_HASH_BYTES]-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;+void crypton_decaf_448_point_from_hash_uniform (+    crypton_decaf_448_point_t pt,+    const unsigned char hashed_data[2*CRYPTON_DECAF_448_HASH_BYTES]+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;  /**  * @brief Inverse of elligator-like hash to curve.  *  * This function writes to the buffer, to make it so that- * cryptonite_decaf_448_point_from_hash_nonuniform(buffer) = pt if+ * crypton_decaf_448_point_from_hash_nonuniform(buffer) = pt if  * possible.  Since there may be multiple preimages, the  * "which" parameter chooses between them.  To ensure uniform  * inverse sampling, this function succeeds or fails@@ -661,21 +661,21 @@  * @param [in] which A value determining which inverse point  * to return.  *- * @retval CRYPTONITE_DECAF_SUCCESS The inverse succeeded.- * @retval CRYPTONITE_DECAF_FAILURE The inverse failed.+ * @retval CRYPTON_DECAF_SUCCESS The inverse succeeded.+ * @retval CRYPTON_DECAF_FAILURE The inverse failed.  */-cryptonite_decaf_error_t-cryptonite_decaf_448_invert_elligator_nonuniform (-    unsigned char recovered_hash[CRYPTONITE_DECAF_448_HASH_BYTES],-    const cryptonite_decaf_448_point_t pt,+crypton_decaf_error_t+crypton_decaf_448_invert_elligator_nonuniform (+    unsigned char recovered_hash[CRYPTON_DECAF_448_HASH_BYTES],+    const crypton_decaf_448_point_t pt,     uint32_t which-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_WARN_UNUSED;+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_WARN_UNUSED;  /**  * @brief Inverse of elligator-like hash to curve.  *  * This function writes to the buffer, to make it so that- * cryptonite_decaf_448_point_from_hash_uniform(buffer) = pt if+ * crypton_decaf_448_point_from_hash_uniform(buffer) = pt if  * possible.  Since there may be multiple preimages, the  * "which" parameter chooses between them.  To ensure uniform  * inverse sampling, this function succeeds or fails@@ -686,39 +686,39 @@  * @param [in] which A value determining which inverse point  * to return.  *- * @retval CRYPTONITE_DECAF_SUCCESS The inverse succeeded.- * @retval CRYPTONITE_DECAF_FAILURE The inverse failed.+ * @retval CRYPTON_DECAF_SUCCESS The inverse succeeded.+ * @retval CRYPTON_DECAF_FAILURE The inverse failed.  */-cryptonite_decaf_error_t-cryptonite_decaf_448_invert_elligator_uniform (-    unsigned char recovered_hash[2*CRYPTONITE_DECAF_448_HASH_BYTES],-    const cryptonite_decaf_448_point_t pt,+crypton_decaf_error_t+crypton_decaf_448_invert_elligator_uniform (+    unsigned char recovered_hash[2*CRYPTON_DECAF_448_HASH_BYTES],+    const crypton_decaf_448_point_t pt,     uint32_t which-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_WARN_UNUSED;+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_WARN_UNUSED;  /**  * @brief Overwrite scalar with zeros.  */-void cryptonite_decaf_448_scalar_destroy (-    cryptonite_decaf_448_scalar_t scalar-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;+void crypton_decaf_448_scalar_destroy (+    crypton_decaf_448_scalar_t scalar+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;  /**  * @brief Overwrite point with zeros.  */-void cryptonite_decaf_448_point_destroy (-    cryptonite_decaf_448_point_t point-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;+void crypton_decaf_448_point_destroy (+    crypton_decaf_448_point_t point+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;  /**  * @brief Overwrite precomputed table with zeros.  */-void cryptonite_decaf_448_precomputed_destroy (-    cryptonite_decaf_448_precomputed_s *pre-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;+void crypton_decaf_448_precomputed_destroy (+    crypton_decaf_448_precomputed_s *pre+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;  #ifdef __cplusplus } /* extern "C" */ #endif -#endif /* __CRYPTONITE_DECAF_POINT_448_H__ */+#endif /* __CRYPTON_DECAF_POINT_448_H__ */
cbits/decaf/include/decaf/shake.h view
@@ -21,10 +21,10 @@  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.  */-#ifndef CRYPTONITE_DECAF_SHAKE_H-#define CRYPTONITE_DECAF_SHAKE_H+#ifndef CRYPTON_DECAF_SHAKE_H+#define CRYPTON_DECAF_SHAKE_H -#include "cryptonite_sha3.h"+#include "crypton_sha3.h"  #include <decaf/common.h> @@ -35,62 +35,62 @@         struct sha3_ctx    sc[1];         uint8_t            filler[136];    // 200 - 2*(256/8) }-cryptonite_decaf_shake256_ctx_t[1];+crypton_decaf_shake256_ctx_t[1]; -static inline void cryptonite_decaf_shake256_init(cryptonite_decaf_shake256_ctx_t ctx)+static inline void crypton_decaf_shake256_init(crypton_decaf_shake256_ctx_t ctx) {-        cryptonite_sha3_init(ctx -> sc, 256);+        crypton_sha3_init(ctx -> sc, 256); } -static inline void cryptonite_decaf_shake256_update(cryptonite_decaf_shake256_ctx_t ctx, const uint8_t *in, size_t inlen)+static inline void crypton_decaf_shake256_update(crypton_decaf_shake256_ctx_t ctx, const uint8_t *in, size_t inlen) { #if __SIZE_MAX__ > UINT32_MAX         // split data over 4 GB in 2-GB chunks         while (inlen > UINT32_MAX) {-                cryptonite_sha3_update(ctx -> sc, in, CHUNK_SIZE_32);+                crypton_sha3_update(ctx -> sc, in, CHUNK_SIZE_32);                 inlen -= CHUNK_SIZE_32;                 in += CHUNK_SIZE_32;         } #endif-        cryptonite_sha3_update(ctx -> sc, in, (uint32_t) inlen);+        crypton_sha3_update(ctx -> sc, in, (uint32_t) inlen); } -static inline void cryptonite_decaf_shake256_output(cryptonite_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen) {+static inline void crypton_decaf_shake256_output(crypton_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen) { #if __SIZE_MAX__ > UINT32_MAX         // split data over 4 GB in 2-GB chunks         while (outlen > UINT32_MAX) {-                cryptonite_sha3_output(ctx -> sc, out, CHUNK_SIZE_32);+                crypton_sha3_output(ctx -> sc, out, CHUNK_SIZE_32);                 outlen -= CHUNK_SIZE_32;                 out += CHUNK_SIZE_32;         } #endif-        cryptonite_sha3_output(ctx -> sc, out, (uint32_t) outlen);+        crypton_sha3_output(ctx -> sc, out, (uint32_t) outlen); } -static inline void cryptonite_decaf_shake256_final(cryptonite_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen)+static inline void crypton_decaf_shake256_final(crypton_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen) {-        cryptonite_sha3_finalize_shake(ctx -> sc);-        cryptonite_decaf_shake256_output(ctx, out, outlen);+        crypton_sha3_finalize_shake(ctx -> sc);+        crypton_decaf_shake256_output(ctx, out, outlen); -        cryptonite_decaf_shake256_init(ctx);+        crypton_decaf_shake256_init(ctx); } -static inline void cryptonite_decaf_shake256_destroy(cryptonite_decaf_shake256_ctx_t ctx)+static inline void crypton_decaf_shake256_destroy(crypton_decaf_shake256_ctx_t ctx) {-        cryptonite_decaf_bzero(ctx, sizeof(*ctx));+        crypton_decaf_bzero(ctx, sizeof(*ctx)); } -static inline void cryptonite_decaf_shake256_hash(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen)+static inline void crypton_decaf_shake256_hash(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen) {-        cryptonite_decaf_shake256_ctx_t ctx;+        crypton_decaf_shake256_ctx_t ctx; -        cryptonite_decaf_shake256_init(ctx);-        cryptonite_decaf_shake256_update(ctx, in, inlen);+        crypton_decaf_shake256_init(ctx);+        crypton_decaf_shake256_update(ctx, in, inlen); -        cryptonite_sha3_finalize_shake(ctx -> sc);-        cryptonite_decaf_shake256_output(ctx, out, outlen);+        crypton_sha3_finalize_shake(ctx -> sc);+        crypton_decaf_shake256_output(ctx, out, outlen); -        cryptonite_decaf_shake256_destroy(ctx);+        crypton_decaf_shake256_destroy(ctx); }  #endif
cbits/decaf/include/field.h view
@@ -15,89 +15,89 @@ #include <string.h>      /** Square x, n times. */-static CRYPTONITE_DECAF_INLINE void cryptonite_gf_sqrn (-    cryptonite_gf_s *__restrict__ y,+static CRYPTON_DECAF_INLINE void crypton_gf_sqrn (+    crypton_gf_s *__restrict__ y,     const gf x,     int n ) {     gf tmp;     assert(n>0);     if (n&1) {-        cryptonite_gf_sqr(y,x);+        crypton_gf_sqr(y,x);         n--;     } else {-        cryptonite_gf_sqr(tmp,x);-        cryptonite_gf_sqr(y,tmp);+        crypton_gf_sqr(tmp,x);+        crypton_gf_sqr(y,tmp);         n-=2;     }     for (; n; n-=2) {-        cryptonite_gf_sqr(tmp,y);-        cryptonite_gf_sqr(y,tmp);+        crypton_gf_sqr(tmp,y);+        crypton_gf_sqr(y,tmp);     } } -#define cryptonite_gf_add_nr cryptonite_gf_add_RAW+#define crypton_gf_add_nr crypton_gf_add_RAW  /** Subtract mod p.  Bias by 2 and don't reduce  */-static inline void cryptonite_gf_sub_nr ( gf c, const gf a, const gf b ) {-    cryptonite_gf_sub_RAW(c,a,b);-    cryptonite_gf_bias(c, 2);-    if (GF_HEADROOM < 3) cryptonite_gf_weak_reduce(c);+static inline void crypton_gf_sub_nr ( gf c, const gf a, const gf b ) {+    crypton_gf_sub_RAW(c,a,b);+    crypton_gf_bias(c, 2);+    if (GF_HEADROOM < 3) crypton_gf_weak_reduce(c); }  /** Subtract mod p. Bias by amt but don't reduce.  */-static inline void cryptonite_gf_subx_nr ( gf c, const gf a, const gf b, int amt ) {-    cryptonite_gf_sub_RAW(c,a,b);-    cryptonite_gf_bias(c, amt);-    if (GF_HEADROOM < amt+1) cryptonite_gf_weak_reduce(c);+static inline void crypton_gf_subx_nr ( gf c, const gf a, const gf b, int amt ) {+    crypton_gf_sub_RAW(c,a,b);+    crypton_gf_bias(c, amt);+    if (GF_HEADROOM < amt+1) crypton_gf_weak_reduce(c); }  /** Mul by signed int.  Not constant-time WRT the sign of that int. */-static inline void cryptonite_gf_mulw(gf c, const gf a, int32_t w) {+static inline void crypton_gf_mulw(gf c, const gf a, int32_t w) {     if (w>0) {-        cryptonite_gf_mulw_unsigned(c, a, w);+        crypton_gf_mulw_unsigned(c, a, w);     } else {-        cryptonite_gf_mulw_unsigned(c, a, -w);-        cryptonite_gf_sub(c,ZERO,c);+        crypton_gf_mulw_unsigned(c, a, -w);+        crypton_gf_sub(c,ZERO,c);     } }  /** Constant time, x = is_z ? z : y */-static inline void cryptonite_gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) {+static inline void crypton_gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) {     constant_time_select(x,y,z,sizeof(gf),is_z,0); }  /** Constant time, if (neg) x=-x; */-static inline void cryptonite_gf_cond_neg(gf x, mask_t neg) {+static inline void crypton_gf_cond_neg(gf x, mask_t neg) {     gf y;-    cryptonite_gf_sub(y,ZERO,x);-    cryptonite_gf_cond_sel(x,x,y,neg);+    crypton_gf_sub(y,ZERO,x);+    crypton_gf_cond_sel(x,x,y,neg); }  /** Constant time, if (swap) (x,y) = (y,x); */ static inline void-cryptonite_gf_cond_swap(gf x, cryptonite_gf_s *__restrict__ y, mask_t swap) {-    constant_time_cond_swap(x,y,sizeof(cryptonite_gf_s),swap);+crypton_gf_cond_swap(gf x, crypton_gf_s *__restrict__ y, mask_t swap) {+    constant_time_cond_swap(x,y,sizeof(crypton_gf_s),swap); } -static CRYPTONITE_DECAF_INLINE void cryptonite_gf_mul_qnr(cryptonite_gf_s *__restrict__ out, const gf x) {+static CRYPTON_DECAF_INLINE void crypton_gf_mul_qnr(crypton_gf_s *__restrict__ out, const gf x) { #if P_MOD_8 == 5     /* r = QNR * r0^2 */-    cryptonite_gf_mul(out,x,SQRT_MINUS_ONE);+    crypton_gf_mul(out,x,SQRT_MINUS_ONE); #elif P_MOD_8 == 3 || P_MOD_8 == 7-    cryptonite_gf_sub(out,ZERO,x);+    crypton_gf_sub(out,ZERO,x); #else     #error "Only supporting p=3,5,7 mod 8" #endif } -static CRYPTONITE_DECAF_INLINE void cryptonite_gf_div_qnr(cryptonite_gf_s *__restrict__ out, const gf x) {+static CRYPTON_DECAF_INLINE void crypton_gf_div_qnr(crypton_gf_s *__restrict__ out, const gf x) { #if P_MOD_8 == 5     /* r = QNR * r0^2 */-    cryptonite_gf_mul(out,x,SQRT_MINUS_ONE);-    cryptonite_gf_sub(out,ZERO,out);+    crypton_gf_mul(out,x,SQRT_MINUS_ONE);+    crypton_gf_sub(out,ZERO,out); #elif P_MOD_8 == 3 || P_MOD_8 == 7-    cryptonite_gf_sub(out,ZERO,x);+    crypton_gf_sub(out,ZERO,x); #else     #error "Only supporting p=3,5,7 mod 8" #endif
cbits/decaf/include/word.h view
@@ -60,9 +60,9 @@ #endif      /* Scalar limbs are keyed off of the API word size instead of the arch word size. */-#if CRYPTONITE_DECAF_WORD_BITS == 64+#if CRYPTON_DECAF_WORD_BITS == 64     #define SC_LIMB(x) (x##ull)-#elif CRYPTONITE_DECAF_WORD_BITS == 32+#elif CRYPTON_DECAF_WORD_BITS == 32     #define SC_LIMB(x) ((uint32_t)x##ull),(x##ull>>32) #else     #error "For now, libdecaf only supports 32- and 64-bit architectures."@@ -102,7 +102,7 @@     typedef uint64x4_t uint64xn_t;     typedef uint32x8_t uint32xn_t; -    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_set_to_mask(mask_t x) {         uint32_t y = (uint32_t)x;         big_register_t ret = {y,y,y,y,y,y,y,y};@@ -114,7 +114,7 @@     typedef uint64x2_t uint64xn_t;     typedef uint32x4_t uint32xn_t; -    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_set_to_mask(mask_t x) {         uint32_t y = x;         big_register_t ret = {y,y,y,y};@@ -126,7 +126,7 @@     typedef uint64x2_t uint64xn_t;     typedef uint32x4_t uint32xn_t;     -    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_set_to_mask(mask_t x) {         return vdupq_n_u32(x);     }@@ -135,7 +135,7 @@     typedef uint64_t big_register_t, uint64xn_t;      typedef uint32_t uint32xn_t;-    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_set_to_mask(mask_t x) {         return (big_register_t)x;     }@@ -145,7 +145,7 @@     typedef uint32_t uint32xn_t;     typedef uint32_t big_register_t; -    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_set_to_mask(mask_t x) {         return (big_register_t)x;     }@@ -160,18 +160,18 @@ } __attribute__((packed)) unaligned_uint32xn_t;  #if __AVX2__-    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_is_zero(big_register_t x) {         return (big_register_t)(x == br_set_to_mask(0));     } #elif __SSE2__-    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_is_zero(big_register_t x) {         return (big_register_t)_mm_cmpeq_epi32((__m128i)x, _mm_setzero_si128());         //return (big_register_t)(x == br_set_to_mask(0));     } #elif __ARM_NEON__-    static CRYPTONITE_DECAF_INLINE big_register_t+    static CRYPTON_DECAF_INLINE big_register_t     br_is_zero(big_register_t x) {         return vceqq_u32(x,x^x);     }@@ -197,13 +197,13 @@     #ifdef NEED_MEMSET_S_EXTERN         extern int memset_s(void *, size_t, int, size_t);     #endif-    static CRYPTONITE_DECAF_INLINE void+    static CRYPTON_DECAF_INLINE void     really_memset(void *p, char c, size_t s) {         memset_s(p, s, c, s);     } #else     /* PERF: use words? */-    static CRYPTONITE_DECAF_INLINE void+    static CRYPTON_DECAF_INLINE void     really_memset(void *p, char c, size_t s) {         volatile char *pv = (volatile char *)p;         size_t i;@@ -222,7 +222,7 @@  * @return A suitable pointer, which can be free'd with free(),  * or NULL if no memory can be allocated.  */-static CRYPTONITE_DECAF_INLINE void *+static CRYPTON_DECAF_INLINE void * malloc_vector(size_t size) {     void *out = NULL;     @@ -248,25 +248,25 @@  /* The plan on booleans:  *- * The external interface uses cryptonite_decaf_bool_t, but this might be a different+ * The external interface uses crypton_decaf_bool_t, but this might be a different  * size than our particular arch's word_t (and thus mask_t).  Also, the caller  * isn't guaranteed to pass it as nonzero.  So bool_to_mask converts word sizes  * and checks nonzero.  *  * On the flip side, mask_t is always -1 or 0, but it might be a different size- * than cryptonite_decaf_bool_t.+ * than crypton_decaf_bool_t.  *  * On the third hand, we have success vs boolean types, but that's handled in- * common.h: it converts between cryptonite_decaf_bool_t and cryptonite_decaf_error_t.+ * common.h: it converts between crypton_decaf_bool_t and crypton_decaf_error_t.  */-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_bool_t mask_to_bool (mask_t m) {-    return (cryptonite_decaf_sword_t)(sword_t)m;+static CRYPTON_DECAF_INLINE crypton_decaf_bool_t mask_to_bool (mask_t m) {+    return (crypton_decaf_sword_t)(sword_t)m; } -static CRYPTONITE_DECAF_INLINE mask_t bool_to_mask (cryptonite_decaf_bool_t m) {+static CRYPTON_DECAF_INLINE mask_t bool_to_mask (crypton_decaf_bool_t m) {     /* On most arches this will be optimized to a simple cast. */     mask_t ret = 0;-    unsigned int limit = sizeof(cryptonite_decaf_bool_t)/sizeof(mask_t);+    unsigned int limit = sizeof(crypton_decaf_bool_t)/sizeof(mask_t);     if (limit < 1) limit = 1;     for (unsigned int i=0; i<limit; i++) {         ret |= ~ word_is_zero(m >> (i*8*sizeof(word_t)));@@ -274,7 +274,7 @@     return ret; } -static CRYPTONITE_DECAF_INLINE void ignore_result ( cryptonite_decaf_bool_t boo ) {+static CRYPTON_DECAF_INLINE void ignore_result ( crypton_decaf_bool_t boo ) {     (void)boo; }
cbits/decaf/p448/arch_32/f_impl.c view
@@ -5,14 +5,14 @@ #include "f_field.h"  #if (defined(__OPTIMIZE__) && !defined(__OPTIMIZE_SIZE__) && !I_HATE_UNROLLED_LOOPS) \-     || defined(CRYPTONITE_DECAF_FORCE_UNROLL)+     || defined(CRYPTON_DECAF_FORCE_UNROLL) #define REPEAT8(_x) _x _x _x _x _x _x _x _x #define FOR_LIMB(_i,_start,_end,_x) do { _i=_start; REPEAT8( if (_i<_end) { _x; } _i++;) } while (0) #else #define FOR_LIMB(_i,_start,_end,_x) do { for (_i=_start; _i<_end; _i++) _x; } while (0) #endif -void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ cs, const gf as, const gf bs) { +void crypton_gf_mul (crypton_gf_s *__restrict__ cs, const gf as, const gf bs) {      const uint32_t *a = as->limb, *b = bs->limb;     uint32_t *c = cs->limb; @@ -68,7 +68,7 @@     c[1] += ((uint32_t)(accum1)); } -void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ cs, const gf as, uint32_t b) {+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ cs, const gf as, uint32_t b) {     assert(b<1<<28);          const uint32_t *a = as->limb;@@ -95,7 +95,7 @@     c[1] += accum8 >> 28; } -void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ cs, const gf as) {-    cryptonite_gf_mul(cs,as,as); /* Performs better with a dedicated square */+void crypton_gf_sqr (crypton_gf_s *__restrict__ cs, const gf as) {+    crypton_gf_mul(cs,as,as); /* Performs better with a dedicated square */ }
cbits/decaf/p448/arch_32/f_impl.h view
@@ -9,26 +9,26 @@      #define LIMB_PLACE_VALUE(i) 28 -void cryptonite_gf_add_RAW (gf out, const gf a, const gf b) {+void crypton_gf_add_RAW (gf out, const gf a, const gf b) {     for (unsigned int i=0; i<sizeof(*out)/sizeof(out->limb[0]); i++) {         out->limb[i] = a->limb[i] + b->limb[i];     } } -void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b) {+void crypton_gf_sub_RAW (gf out, const gf a, const gf b) {     for (unsigned int i=0; i<sizeof(*out)/sizeof(out->limb[0]); i++) {         out->limb[i] = a->limb[i] - b->limb[i];     } } -void cryptonite_gf_bias (gf a, int amt) {    +void crypton_gf_bias (gf a, int amt) {         uint32_t co1 = ((1ull<<28)-1)*amt, co2 = co1-amt;     for (unsigned int i=0; i<sizeof(*a)/sizeof(a->limb[0]); i++) {         a->limb[i] += (i==sizeof(*a)/sizeof(a->limb[0])/2) ? co2 : co1;     } } -void cryptonite_gf_weak_reduce (gf a) {+void crypton_gf_weak_reduce (gf a) {     uint32_t mask = (1ull<<28) - 1;     uint32_t tmp = a->limb[15] >> 28;     a->limb[8] += tmp;
cbits/decaf/p448/arch_ref64/f_impl.c view
@@ -4,7 +4,7 @@  #include "f_field.h" -void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ cs, const gf as, const gf bs) {+void crypton_gf_mul (crypton_gf_s *__restrict__ cs, const gf as, const gf bs) {     const uint64_t *a = as->limb, *b = bs->limb;     uint64_t *c = cs->limb; @@ -165,7 +165,7 @@     c[1] += ((uint64_t)(accum1)); } -void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ cs, const gf as, uint32_t b) {+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ cs, const gf as, uint32_t b) {     const uint64_t *a = as->limb;     uint64_t *c = cs->limb; @@ -189,7 +189,7 @@     c[1] += accum4 >> 56; } -void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ cs, const gf as) {+void crypton_gf_sqr (crypton_gf_s *__restrict__ cs, const gf as) {     const uint64_t *a = as->limb;     uint64_t *c = cs->limb;
cbits/decaf/p448/arch_ref64/f_impl.h view
@@ -7,27 +7,27 @@      #define LIMB_PLACE_VALUE(i) 56 -void cryptonite_gf_add_RAW (gf out, const gf a, const gf b) {+void crypton_gf_add_RAW (gf out, const gf a, const gf b) {     for (unsigned int i=0; i<8; i++) {         out->limb[i] = a->limb[i] + b->limb[i];     }-    cryptonite_gf_weak_reduce(out);+    crypton_gf_weak_reduce(out); } -void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b) {+void crypton_gf_sub_RAW (gf out, const gf a, const gf b) {     uint64_t co1 = ((1ull<<56)-1)*2, co2 = co1-2;     for (unsigned int i=0; i<8; i++) {         out->limb[i] = a->limb[i] - b->limb[i] + ((i==4) ? co2 : co1);     }-    cryptonite_gf_weak_reduce(out);+    crypton_gf_weak_reduce(out); } -void cryptonite_gf_bias (gf a, int amt) {+void crypton_gf_bias (gf a, int amt) {     (void) a;     (void) amt; } -void cryptonite_gf_weak_reduce (gf a) {+void crypton_gf_weak_reduce (gf a) {     uint64_t mask = (1ull<<56) - 1;     uint64_t tmp = a->limb[7] >> 56;     a->limb[4] += tmp;
cbits/decaf/p448/f_arithmetic.c view
@@ -10,37 +10,37 @@  #include "field.h" -mask_t cryptonite_gf_isr (+mask_t crypton_gf_isr (     gf a,     const gf x ) {     gf L0, L1, L2;-    cryptonite_gf_sqr  (L1,     x );-    cryptonite_gf_mul  (L2,     x,   L1 );-    cryptonite_gf_sqr  (L1,   L2 );-    cryptonite_gf_mul  (L2,     x,   L1 );-    cryptonite_gf_sqrn (L1,   L2,     3 );-    cryptonite_gf_mul  (L0,   L2,   L1 );-    cryptonite_gf_sqrn (L1,   L0,     3 );-    cryptonite_gf_mul  (L0,   L2,   L1 );-    cryptonite_gf_sqrn (L2,   L0,     9 );-    cryptonite_gf_mul  (L1,   L0,   L2 );-    cryptonite_gf_sqr  (L0,   L1 );-    cryptonite_gf_mul  (L2,     x,   L0 );-    cryptonite_gf_sqrn (L0,   L2,    18 );-    cryptonite_gf_mul  (L2,   L1,   L0 );-    cryptonite_gf_sqrn (L0,   L2,    37 );-    cryptonite_gf_mul  (L1,   L2,   L0 );-    cryptonite_gf_sqrn (L0,   L1,    37 );-    cryptonite_gf_mul  (L1,   L2,   L0 );-    cryptonite_gf_sqrn (L0,   L1,   111 );-    cryptonite_gf_mul  (L2,   L1,   L0 );-    cryptonite_gf_sqr  (L0,   L2 );-    cryptonite_gf_mul  (L1,     x,   L0 );-    cryptonite_gf_sqrn (L0,   L1,   223 );-    cryptonite_gf_mul  (L1,   L2,   L0 );-    cryptonite_gf_sqr  (L2, L1);-    cryptonite_gf_mul  (L0, L2, x);-    cryptonite_gf_copy(a,L1);-    return cryptonite_gf_eq(L0,ONE);+    crypton_gf_sqr  (L1,     x );+    crypton_gf_mul  (L2,     x,   L1 );+    crypton_gf_sqr  (L1,   L2 );+    crypton_gf_mul  (L2,     x,   L1 );+    crypton_gf_sqrn (L1,   L2,     3 );+    crypton_gf_mul  (L0,   L2,   L1 );+    crypton_gf_sqrn (L1,   L0,     3 );+    crypton_gf_mul  (L0,   L2,   L1 );+    crypton_gf_sqrn (L2,   L0,     9 );+    crypton_gf_mul  (L1,   L0,   L2 );+    crypton_gf_sqr  (L0,   L1 );+    crypton_gf_mul  (L2,     x,   L0 );+    crypton_gf_sqrn (L0,   L2,    18 );+    crypton_gf_mul  (L2,   L1,   L0 );+    crypton_gf_sqrn (L0,   L2,    37 );+    crypton_gf_mul  (L1,   L2,   L0 );+    crypton_gf_sqrn (L0,   L1,    37 );+    crypton_gf_mul  (L1,   L2,   L0 );+    crypton_gf_sqrn (L0,   L1,   111 );+    crypton_gf_mul  (L2,   L1,   L0 );+    crypton_gf_sqr  (L0,   L2 );+    crypton_gf_mul  (L1,     x,   L0 );+    crypton_gf_sqrn (L0,   L1,   223 );+    crypton_gf_mul  (L1,   L2,   L0 );+    crypton_gf_sqr  (L2, L1);+    crypton_gf_mul  (L0, L2, x);+    crypton_gf_copy(a,L1);+    return crypton_gf_eq(L0,ONE); }
cbits/decaf/p448/f_field.h view
@@ -21,37 +21,37 @@  #include "word.h" -#define __CRYPTONITE_DECAF_448_GF_DEFINED__ 1+#define __CRYPTON_DECAF_448_GF_DEFINED__ 1 #define NLIMBS (64/sizeof(word_t)) #define X_SER_BYTES 56 #define SER_BYTES 56-typedef struct cryptonite_gf_448_s {+typedef struct crypton_gf_448_s {     word_t limb[NLIMBS];-} __attribute__((aligned(16))) cryptonite_gf_448_s, cryptonite_gf_448_t[1];+} __attribute__((aligned(16))) crypton_gf_448_s, crypton_gf_448_t[1];  #define GF_LIT_LIMB_BITS  56 #define GF_BITS           448-#define ZERO              cryptonite_gf_448_ZERO-#define ONE               cryptonite_gf_448_ONE-#define MODULUS           cryptonite_gf_448_MODULUS-#define gf                cryptonite_gf_448_t-#define cryptonite_gf_s              cryptonite_gf_448_s-#define cryptonite_gf_eq             cryptonite_gf_448_eq-#define cryptonite_gf_hibit          cryptonite_gf_448_hibit-#define cryptonite_gf_copy           cryptonite_gf_448_copy-#define cryptonite_gf_add            cryptonite_gf_448_add-#define cryptonite_gf_sub            cryptonite_gf_448_sub-#define cryptonite_gf_add_RAW        cryptonite_gf_448_add_RAW-#define cryptonite_gf_sub_RAW        cryptonite_gf_448_sub_RAW-#define cryptonite_gf_bias           cryptonite_gf_448_bias-#define cryptonite_gf_weak_reduce    cryptonite_gf_448_weak_reduce-#define cryptonite_gf_strong_reduce  cryptonite_gf_448_strong_reduce-#define cryptonite_gf_mul            cryptonite_gf_448_mul-#define cryptonite_gf_sqr            cryptonite_gf_448_sqr-#define cryptonite_gf_mulw_unsigned  cryptonite_gf_448_mulw_unsigned-#define cryptonite_gf_isr            cryptonite_gf_448_isr-#define cryptonite_gf_serialize      cryptonite_gf_448_serialize-#define cryptonite_gf_deserialize    cryptonite_gf_448_deserialize+#define ZERO              crypton_gf_448_ZERO+#define ONE               crypton_gf_448_ONE+#define MODULUS           crypton_gf_448_MODULUS+#define gf                crypton_gf_448_t+#define crypton_gf_s              crypton_gf_448_s+#define crypton_gf_eq             crypton_gf_448_eq+#define crypton_gf_hibit          crypton_gf_448_hibit+#define crypton_gf_copy           crypton_gf_448_copy+#define crypton_gf_add            crypton_gf_448_add+#define crypton_gf_sub            crypton_gf_448_sub+#define crypton_gf_add_RAW        crypton_gf_448_add_RAW+#define crypton_gf_sub_RAW        crypton_gf_448_sub_RAW+#define crypton_gf_bias           crypton_gf_448_bias+#define crypton_gf_weak_reduce    crypton_gf_448_weak_reduce+#define crypton_gf_strong_reduce  crypton_gf_448_strong_reduce+#define crypton_gf_mul            crypton_gf_448_mul+#define crypton_gf_sqr            crypton_gf_448_sqr+#define crypton_gf_mulw_unsigned  crypton_gf_448_mulw_unsigned+#define crypton_gf_isr            crypton_gf_448_isr+#define crypton_gf_serialize      crypton_gf_448_serialize+#define crypton_gf_deserialize    crypton_gf_448_deserialize  /* RFC 7748 support */ #define X_PUBLIC_BYTES  X_SER_BYTES@@ -67,24 +67,24 @@ #endif  /* Defined below in f_impl.h */-static INLINE_UNUSED void cryptonite_gf_copy (gf out, const gf a) { *out = *a; }-static INLINE_UNUSED void cryptonite_gf_add_RAW (gf out, const gf a, const gf b);-static INLINE_UNUSED void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b);-static INLINE_UNUSED void cryptonite_gf_bias (gf inout, int amount);-static INLINE_UNUSED void cryptonite_gf_weak_reduce (gf inout);+static INLINE_UNUSED void crypton_gf_copy (gf out, const gf a) { *out = *a; }+static INLINE_UNUSED void crypton_gf_add_RAW (gf out, const gf a, const gf b);+static INLINE_UNUSED void crypton_gf_sub_RAW (gf out, const gf a, const gf b);+static INLINE_UNUSED void crypton_gf_bias (gf inout, int amount);+static INLINE_UNUSED void crypton_gf_weak_reduce (gf inout); -void cryptonite_gf_strong_reduce (gf inout);   -void cryptonite_gf_add (gf out, const gf a, const gf b);-void cryptonite_gf_sub (gf out, const gf a, const gf b);-void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ out, const gf a, const gf b);-void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ out, const gf a, uint32_t b);-void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ out, const gf a);-mask_t cryptonite_gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */-mask_t cryptonite_gf_eq (const gf x, const gf y);-mask_t cryptonite_gf_hibit (const gf x);+void crypton_gf_strong_reduce (gf inout);   +void crypton_gf_add (gf out, const gf a, const gf b);+void crypton_gf_sub (gf out, const gf a, const gf b);+void crypton_gf_mul (crypton_gf_s *__restrict__ out, const gf a, const gf b);+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ out, const gf a, uint32_t b);+void crypton_gf_sqr (crypton_gf_s *__restrict__ out, const gf a);+mask_t crypton_gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */+mask_t crypton_gf_eq (const gf x, const gf y);+mask_t crypton_gf_hibit (const gf x); -void cryptonite_gf_serialize (uint8_t *serial, const gf x,int with_highbit);-mask_t cryptonite_gf_deserialize (gf x, const uint8_t serial[SER_BYTES],int with_highbit);+void crypton_gf_serialize (uint8_t *serial, const gf x,int with_highbit);+mask_t crypton_gf_deserialize (gf x, const uint8_t serial[SER_BYTES],int with_highbit);   #ifdef __cplusplus
cbits/decaf/p448/f_generic.c view
@@ -24,11 +24,11 @@ #endif  /** Serialize to wire format. */-void cryptonite_gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {+void crypton_gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {     gf red;-    cryptonite_gf_copy(red, x);-    cryptonite_gf_strong_reduce(red);-    if (!with_hibit) { assert(cryptonite_gf_hibit(red) == 0); }+    crypton_gf_copy(red, x);+    crypton_gf_strong_reduce(red);+    if (!with_hibit) { assert(crypton_gf_hibit(red) == 0); }          unsigned int j=0, fill=0;     dword_t buffer = 0;@@ -45,15 +45,15 @@ }  /** Return high bit of x = low bit of 2x mod p */-mask_t cryptonite_gf_hibit(const gf x) {+mask_t crypton_gf_hibit(const gf x) {     gf y;-    cryptonite_gf_add(y,x,x);-    cryptonite_gf_strong_reduce(y);+    crypton_gf_add(y,x,x);+    crypton_gf_strong_reduce(y);     return -(y->limb[0]&1); }  /** Deserialize from wire format; return -1 on success and 0 on failure. */-mask_t cryptonite_gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit) {+mask_t crypton_gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit) {     unsigned int j=0, fill=0;     dword_t buffer = 0;     dsword_t scarry = 0;@@ -68,14 +68,14 @@         buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i));         scarry = (scarry + x->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)]) >> (8*sizeof(word_t));     }-    mask_t succ = with_hibit ? -(mask_t)1 : ~cryptonite_gf_hibit(x);+    mask_t succ = with_hibit ? -(mask_t)1 : ~crypton_gf_hibit(x);     return succ & word_is_zero(buffer) & ~word_is_zero(scarry); }  /** Reduce to canonical form. */-void cryptonite_gf_strong_reduce (gf a) {+void crypton_gf_strong_reduce (gf a) {     /* first, clear high */-    cryptonite_gf_weak_reduce(a); /* Determined to have negligible perf impact. */+    crypton_gf_weak_reduce(a); /* Determined to have negligible perf impact. */      /* now the total is less than 2p */ @@ -107,23 +107,23 @@ }  /** Subtract two gf elements d=a-b */-void cryptonite_gf_sub (gf d, const gf a, const gf b) {-    cryptonite_gf_sub_RAW ( d, a, b );-    cryptonite_gf_bias( d, 2 );-    cryptonite_gf_weak_reduce ( d );+void crypton_gf_sub (gf d, const gf a, const gf b) {+    crypton_gf_sub_RAW ( d, a, b );+    crypton_gf_bias( d, 2 );+    crypton_gf_weak_reduce ( d ); }  /** Add two field elements d = a+b */-void cryptonite_gf_add (gf d, const gf a, const gf b) {-    cryptonite_gf_add_RAW ( d, a, b );-    cryptonite_gf_weak_reduce ( d );+void crypton_gf_add (gf d, const gf a, const gf b) {+    crypton_gf_add_RAW ( d, a, b );+    crypton_gf_weak_reduce ( d ); }  /** Compare a==b */-mask_t cryptonite_gf_eq(const gf a, const gf b) {+mask_t crypton_gf_eq(const gf a, const gf b) {     gf c;-    cryptonite_gf_sub(c,a,b);-    cryptonite_gf_strong_reduce(c);+    crypton_gf_sub(c,a,b);+    crypton_gf_strong_reduce(c);     mask_t ret=0;     for (unsigned int i=0; i<NLIMBS; i++) {         ret |= c->limb[LIMBPERM(i)];
cbits/decaf/utils.c view
@@ -10,25 +10,25 @@  #include <decaf/common.h> -void cryptonite_decaf_bzero (+void crypton_decaf_bzero (     void *s,     size_t size ) { #ifdef __STDC_LIB_EXT1__     memset_s(s, size, 0, size); #else-    const size_t sw = sizeof(cryptonite_decaf_word_t);+    const size_t sw = sizeof(crypton_decaf_word_t);     volatile uint8_t *destroy = (volatile uint8_t *)s;     for (; size && ((uintptr_t)destroy)%sw; size--, destroy++)         *destroy = 0;     for (; size >= sw; size -= sw, destroy += sw)-        *(volatile cryptonite_decaf_word_t *)destroy = 0;+        *(volatile crypton_decaf_word_t *)destroy = 0;     for (; size; size--, destroy++)         *destroy = 0; #endif } -cryptonite_decaf_bool_t cryptonite_decaf_memeq (+crypton_decaf_bool_t crypton_decaf_memeq (    const void *data1_,    const void *data2_,    size_t size@@ -39,5 +39,5 @@     for (; size; size--, data1++, data2++) {         ret |= *data1 ^ *data2;     }-    return (((cryptonite_decaf_dword_t)ret) - 1) >> 8;+    return (((crypton_decaf_dword_t)ret) - 1) >> 8; }
+ cbits/ed25519/ed25519-crypton-exts.h view
@@ -0,0 +1,246 @@+/*+    Public domain by Olivier Chéron <olivier.cheron@gmail.com>++    Arithmetic extensions to Ed25519-donna+*/+++/*+    Scalar functions+*/++void+ED25519_FN(ed25519_scalar_encode) (unsigned char out[32], const bignum256modm in) {+    contract256_modm(out, in);+}++void+ED25519_FN(ed25519_scalar_decode_long) (bignum256modm out, const unsigned char *in, size_t len) {+    expand256_modm(out, in, len);+}++int+ED25519_FN(ed25519_scalar_eq) (const bignum256modm a, const bignum256modm b) {+    bignum256modm_element_t e = 0;++    for (int i = 0; i < bignum256modm_limb_size; i++) {+        e |= a[i] ^ b[i];+    }++    return (int) (1 & ((e - 1) >> bignum256modm_bits_per_limb));+}++void+ED25519_FN(ed25519_scalar_add) (bignum256modm r, const bignum256modm x, const bignum256modm y) {+    add256_modm(r, x, y);+}++void+ED25519_FN(ed25519_scalar_mul) (bignum256modm r, const bignum256modm x, const bignum256modm y) {+    mul256_modm(r, x, y);+}+++/*+    Point functions+*/++void+ED25519_FN(ed25519_point_encode) (unsigned char r[32], const ge25519 *p) {+    ge25519_pack(r, p);+}++int+ED25519_FN(ed25519_point_decode_vartime) (ge25519 *r, const unsigned char p[32]) {+    unsigned char p_neg[32];++    // invert parity bit of X coordinate so the point is negated twice+    // (once here, once in ge25519_unpack_negative_vartime)+    for (int i = 0; i < 31; i++) {+        p_neg[i] = p[i];+    }+    p_neg[31] = p[31] ^ 0x80;++    return ge25519_unpack_negative_vartime(r, p_neg);+}++int+ED25519_FN(ed25519_point_eq) (const ge25519 *p, const ge25519 *q) {+    bignum25519 a, b;+    unsigned char contract_a[32], contract_b[32];+    int eq;++    // pX * qZ = qX * pZ+    curve25519_mul(a, p->x, q->z);+    curve25519_contract(contract_a, a);+    curve25519_mul(b, q->x, p->z);+    curve25519_contract(contract_b, b);+    eq = ed25519_verify(contract_a, contract_b, 32);++    // pY * qZ = qY * pZ+    curve25519_mul(a, p->y, q->z);+    curve25519_contract(contract_a, a);+    curve25519_mul(b, q->y, p->z);+    curve25519_contract(contract_b, b);+    eq &= ed25519_verify(contract_a, contract_b, 32);++    return eq;+}++static int+ED25519_FN(ed25519_point_is_identity) (const ge25519 *p) {+    static const unsigned char zero[32] = {0};+    unsigned char check[32];+    bignum25519 d;+    int eq;++    // pX = 0+    curve25519_contract(check, p->x);+    eq = ed25519_verify(check, zero, 32);++    // pY - pZ = 0+    curve25519_sub_reduce(d, p->y, p->z);+    curve25519_contract(check, d);+    eq &= ed25519_verify(check, zero, 32);++    return eq;+}++void+ED25519_FN(ed25519_point_negate) (ge25519 *r, const ge25519 *p) {+    curve25519_neg(r->x, p->x);+    curve25519_copy(r->y, p->y);+    curve25519_copy(r->z, p->z);+    curve25519_neg(r->t, p->t);+}++void+ED25519_FN(ed25519_point_add) (ge25519 *r, const ge25519 *p, const ge25519 *q) {+    ge25519_add(r, p, q);+}++void+ED25519_FN(ed25519_point_double) (ge25519 *r, const ge25519 *p) {+    ge25519_double(r, p);+}++void+ED25519_FN(ed25519_point_mul_by_cofactor) (ge25519 *r, const ge25519 *p) {+    ge25519_double_partial(r, p);+    ge25519_double_partial(r, r);+    ge25519_double(r, r);+}++void+ED25519_FN(ed25519_point_base_scalarmul) (ge25519 *r, const bignum256modm s) {+    ge25519_scalarmult_base_niels(r, ge25519_niels_base_multiples, s);+}++#if defined(ED25519_64BIT)+typedef uint64_t ed25519_move_cond_word;+#else+typedef uint32_t ed25519_move_cond_word;+#endif++/* out = (flag) ? in : out */+DONNA_INLINE static void+ed25519_move_cond_pniels(ge25519_pniels *out, const ge25519_pniels *in, uint32_t flag) {+    const int word_count = sizeof(ge25519_pniels) / sizeof(ed25519_move_cond_word);+    const ed25519_move_cond_word nb = (ed25519_move_cond_word) flag - 1, b = ~nb;++    ed25519_move_cond_word *outw = (ed25519_move_cond_word *) out;+    const ed25519_move_cond_word *inw  = (const ed25519_move_cond_word *) in;++    // ge25519_pniels has 4 coordinates, so word_count is divisible by 4+    for (int i = 0; i < word_count; i += 4) {+        outw[i + 0] = (outw[i + 0] & nb) | (inw[i + 0] & b);+        outw[i + 1] = (outw[i + 1] & nb) | (inw[i + 1] & b);+        outw[i + 2] = (outw[i + 2] & nb) | (inw[i + 2] & b);+        outw[i + 3] = (outw[i + 3] & nb) | (inw[i + 3] & b);+    }+}++static void+ed25519_point_scalarmul_w_choose_pniels(ge25519_pniels *t, const ge25519_pniels table[15], uint32_t pos) {+    // initialize t to identity, i.e. (1, 1, 1, 0)+    memset(t, 0, sizeof(ge25519_pniels));+    t->ysubx[0] = 1;+    t->xaddy[0] = 1;+    t->z[0] = 1;++    // move one entry from table matching requested position,+    // scanning all table to avoid cache-timing attack+    //+    // when pos == 0, no entry matches and this returns+    // identity as expected+    for (uint32_t i = 1; i < 16; i++) {+        uint32_t flag = ((i ^ pos) - 1) >> 31;+        ed25519_move_cond_pniels(t, table + i - 1, flag);+    }+}++void+ED25519_FN(ed25519_point_scalarmul) (ge25519 *r, const ge25519 *p, const bignum256modm s) {+    ge25519_pniels mult[15];+    ge25519_pniels pn;+    ge25519_p1p1 t;+    unsigned char ss[32];++    // transform scalar as little-endian number+    contract256_modm(ss, s);++    // initialize r to identity, i.e. ge25519 (0, 1, 1, 0)+    memset(r, 0, sizeof(ge25519));+    r->y[0] = 1;+    r->z[0] = 1;++    // precompute multiples of P: 1.P, 2.P, ..., 15.P+    ge25519_full_to_pniels(&mult[0], p);+    for (int i = 1; i < 15; i++) {+        ge25519_pnielsadd(&mult[i], p, &mult[i-1]);+    }++    // 4-bit fixed window, still 256 doublings but 64 additions+    for (int i = 31; i >= 0; i--) {+        // higher bits in ss[i]+        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] >> 4);+        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);+        ge25519_p1p1_to_partial(r, &t);++        ge25519_double_partial(r, r);+        ge25519_double_partial(r, r);+        ge25519_double_partial(r, r);+        ge25519_double(r, r);++        // lower bits in ss[i]+        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] & 0x0F);+        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);+        if (i > 0) {+            ge25519_p1p1_to_partial(r, &t);++            ge25519_double_partial(r, r);+            ge25519_double_partial(r, r);+            ge25519_double_partial(r, r);+            ge25519_double(r, r);+        } else {+            ge25519_p1p1_to_full(r, &t);+        }+    }+}++void+ED25519_FN(ed25519_base_double_scalarmul_vartime) (ge25519 *r, const bignum256modm s1, const ge25519 *p2, const bignum256modm s2) {+    // computes [s1]basepoint + [s2]p2+    ge25519_double_scalarmult_vartime(r, p2, s2, s1);+}++int+ED25519_FN(ed25519_point_has_prime_order) (const ge25519 *p) {+    static const bignum256modm sc_zero = {0};+    ge25519 q;++    // computes Q = m.P, vartime allowed because m is not secret+    ED25519_FN(ed25519_base_double_scalarmul_vartime) (&q, sc_zero, p, modm_m);++    return ED25519_FN(ed25519_point_is_identity) (&q);+}
− cbits/ed25519/ed25519-cryptonite-exts.h 
@@ -1,246 +0,0 @@-/*-    Public domain by Olivier Chéron <olivier.cheron@gmail.com>--    Arithmetic extensions to Ed25519-donna-*/---/*-    Scalar functions-*/--void-ED25519_FN(ed25519_scalar_encode) (unsigned char out[32], const bignum256modm in) {-    contract256_modm(out, in);-}--void-ED25519_FN(ed25519_scalar_decode_long) (bignum256modm out, const unsigned char *in, size_t len) {-    expand256_modm(out, in, len);-}--int-ED25519_FN(ed25519_scalar_eq) (const bignum256modm a, const bignum256modm b) {-    bignum256modm_element_t e = 0;--    for (int i = 0; i < bignum256modm_limb_size; i++) {-        e |= a[i] ^ b[i];-    }--    return (int) (1 & ((e - 1) >> bignum256modm_bits_per_limb));-}--void-ED25519_FN(ed25519_scalar_add) (bignum256modm r, const bignum256modm x, const bignum256modm y) {-    add256_modm(r, x, y);-}--void-ED25519_FN(ed25519_scalar_mul) (bignum256modm r, const bignum256modm x, const bignum256modm y) {-    mul256_modm(r, x, y);-}---/*-    Point functions-*/--void-ED25519_FN(ed25519_point_encode) (unsigned char r[32], const ge25519 *p) {-    ge25519_pack(r, p);-}--int-ED25519_FN(ed25519_point_decode_vartime) (ge25519 *r, const unsigned char p[32]) {-    unsigned char p_neg[32];--    // invert parity bit of X coordinate so the point is negated twice-    // (once here, once in ge25519_unpack_negative_vartime)-    for (int i = 0; i < 31; i++) {-        p_neg[i] = p[i];-    }-    p_neg[31] = p[31] ^ 0x80;--    return ge25519_unpack_negative_vartime(r, p_neg);-}--int-ED25519_FN(ed25519_point_eq) (const ge25519 *p, const ge25519 *q) {-    bignum25519 a, b;-    unsigned char contract_a[32], contract_b[32];-    int eq;--    // pX * qZ = qX * pZ-    curve25519_mul(a, p->x, q->z);-    curve25519_contract(contract_a, a);-    curve25519_mul(b, q->x, p->z);-    curve25519_contract(contract_b, b);-    eq = ed25519_verify(contract_a, contract_b, 32);--    // pY * qZ = qY * pZ-    curve25519_mul(a, p->y, q->z);-    curve25519_contract(contract_a, a);-    curve25519_mul(b, q->y, p->z);-    curve25519_contract(contract_b, b);-    eq &= ed25519_verify(contract_a, contract_b, 32);--    return eq;-}--static int-ED25519_FN(ed25519_point_is_identity) (const ge25519 *p) {-    static const unsigned char zero[32] = {0};-    unsigned char check[32];-    bignum25519 d;-    int eq;--    // pX = 0-    curve25519_contract(check, p->x);-    eq = ed25519_verify(check, zero, 32);--    // pY - pZ = 0-    curve25519_sub_reduce(d, p->y, p->z);-    curve25519_contract(check, d);-    eq &= ed25519_verify(check, zero, 32);--    return eq;-}--void-ED25519_FN(ed25519_point_negate) (ge25519 *r, const ge25519 *p) {-    curve25519_neg(r->x, p->x);-    curve25519_copy(r->y, p->y);-    curve25519_copy(r->z, p->z);-    curve25519_neg(r->t, p->t);-}--void-ED25519_FN(ed25519_point_add) (ge25519 *r, const ge25519 *p, const ge25519 *q) {-    ge25519_add(r, p, q);-}--void-ED25519_FN(ed25519_point_double) (ge25519 *r, const ge25519 *p) {-    ge25519_double(r, p);-}--void-ED25519_FN(ed25519_point_mul_by_cofactor) (ge25519 *r, const ge25519 *p) {-    ge25519_double_partial(r, p);-    ge25519_double_partial(r, r);-    ge25519_double(r, r);-}--void-ED25519_FN(ed25519_point_base_scalarmul) (ge25519 *r, const bignum256modm s) {-    ge25519_scalarmult_base_niels(r, ge25519_niels_base_multiples, s);-}--#if defined(ED25519_64BIT)-typedef uint64_t ed25519_move_cond_word;-#else-typedef uint32_t ed25519_move_cond_word;-#endif--/* out = (flag) ? in : out */-DONNA_INLINE static void-ed25519_move_cond_pniels(ge25519_pniels *out, const ge25519_pniels *in, uint32_t flag) {-    const int word_count = sizeof(ge25519_pniels) / sizeof(ed25519_move_cond_word);-    const ed25519_move_cond_word nb = (ed25519_move_cond_word) flag - 1, b = ~nb;--    ed25519_move_cond_word *outw = (ed25519_move_cond_word *) out;-    const ed25519_move_cond_word *inw  = (const ed25519_move_cond_word *) in;--    // ge25519_pniels has 4 coordinates, so word_count is divisible by 4-    for (int i = 0; i < word_count; i += 4) {-        outw[i + 0] = (outw[i + 0] & nb) | (inw[i + 0] & b);-        outw[i + 1] = (outw[i + 1] & nb) | (inw[i + 1] & b);-        outw[i + 2] = (outw[i + 2] & nb) | (inw[i + 2] & b);-        outw[i + 3] = (outw[i + 3] & nb) | (inw[i + 3] & b);-    }-}--static void-ed25519_point_scalarmul_w_choose_pniels(ge25519_pniels *t, const ge25519_pniels table[15], uint32_t pos) {-    // initialize t to identity, i.e. (1, 1, 1, 0)-    memset(t, 0, sizeof(ge25519_pniels));-    t->ysubx[0] = 1;-    t->xaddy[0] = 1;-    t->z[0] = 1;--    // move one entry from table matching requested position,-    // scanning all table to avoid cache-timing attack-    //-    // when pos == 0, no entry matches and this returns-    // identity as expected-    for (uint32_t i = 1; i < 16; i++) {-        uint32_t flag = ((i ^ pos) - 1) >> 31;-        ed25519_move_cond_pniels(t, table + i - 1, flag);-    }-}--void-ED25519_FN(ed25519_point_scalarmul) (ge25519 *r, const ge25519 *p, const bignum256modm s) {-    ge25519_pniels mult[15];-    ge25519_pniels pn;-    ge25519_p1p1 t;-    unsigned char ss[32];--    // transform scalar as little-endian number-    contract256_modm(ss, s);--    // initialize r to identity, i.e. ge25519 (0, 1, 1, 0)-    memset(r, 0, sizeof(ge25519));-    r->y[0] = 1;-    r->z[0] = 1;--    // precompute multiples of P: 1.P, 2.P, ..., 15.P-    ge25519_full_to_pniels(&mult[0], p);-    for (int i = 1; i < 15; i++) {-        ge25519_pnielsadd(&mult[i], p, &mult[i-1]);-    }--    // 4-bit fixed window, still 256 doublings but 64 additions-    for (int i = 31; i >= 0; i--) {-        // higher bits in ss[i]-        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] >> 4);-        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);-        ge25519_p1p1_to_partial(r, &t);--        ge25519_double_partial(r, r);-        ge25519_double_partial(r, r);-        ge25519_double_partial(r, r);-        ge25519_double(r, r);--        // lower bits in ss[i]-        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] & 0x0F);-        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);-        if (i > 0) {-            ge25519_p1p1_to_partial(r, &t);--            ge25519_double_partial(r, r);-            ge25519_double_partial(r, r);-            ge25519_double_partial(r, r);-            ge25519_double(r, r);-        } else {-            ge25519_p1p1_to_full(r, &t);-        }-    }-}--void-ED25519_FN(ed25519_base_double_scalarmul_vartime) (ge25519 *r, const bignum256modm s1, const ge25519 *p2, const bignum256modm s2) {-    // computes [s1]basepoint + [s2]p2-    ge25519_double_scalarmult_vartime(r, p2, s2, s1);-}--int-ED25519_FN(ed25519_point_has_prime_order) (const ge25519 *p) {-    static const bignum256modm sc_zero = {0};-    ge25519 q;--    // computes Q = m.P, vartime allowed because m is not secret-    ED25519_FN(ed25519_base_double_scalarmul_vartime) (&q, sc_zero, p, modm_m);--    return ED25519_FN(ed25519_point_is_identity) (&q);-}
cbits/ed25519/ed25519-donna-batchverify.h view
@@ -188,7 +188,7 @@ }  /* not actually used for anything other than testing */-unsigned char batch_point_buffer[3][32];+unsigned char crypton_batch_point_buffer[3][32];  static int ge25519_is_neutral_vartime(const ge25519 *p) {@@ -197,7 +197,7 @@ 	curve25519_contract(point_buffer[0], p->x); 	curve25519_contract(point_buffer[1], p->y); 	curve25519_contract(point_buffer[2], p->z);-	memcpy(batch_point_buffer[1], point_buffer[1], 32);+	memcpy(crypton_batch_point_buffer[1], point_buffer[1], 32); 	return (memcmp(point_buffer[0], zero, 32) == 0) && (memcmp(point_buffer[1], point_buffer[2], 32) == 0); }
cbits/ed25519/ed25519-hash.h view
@@ -1,26 +1,26 @@-#include <cryptonite_sha512.h>+#include <crypton_sha512.h> typedef struct sha512_ctx ed25519_hash_context;  static void ed25519_hash_init(ed25519_hash_context *ctx) {-	cryptonite_sha512_init(ctx);+	crypton_sha512_init(ctx); }  static void ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen) {-	cryptonite_sha512_update(ctx, in, inlen);+	crypton_sha512_update(ctx, in, inlen); }  static void ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash) {-	cryptonite_sha512_finalize(ctx, hash);+	crypton_sha512_finalize(ctx, hash); }  static void ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) { 	ed25519_hash_context ctx;-	cryptonite_sha512_init(&ctx);-	cryptonite_sha512_update(&ctx, in, inlen);-	cryptonite_sha512_finalize(&ctx, hash);+	crypton_sha512_init(&ctx);+	crypton_sha512_update(&ctx, in, inlen);+	crypton_sha512_finalize(&ctx, hash); 	memset(&ctx, 0, sizeof(ctx)); }
cbits/ed25519/ed25519.c view
@@ -5,13 +5,13 @@ */  -#define ED25519_FN(fn)         cryptonite_##fn+#define ED25519_FN(fn)         crypton_##fn  #include "ed25519-donna.h" #include "ed25519.h" #include "ed25519-randombytes.h" #include "ed25519-hash.h"-#include "ed25519-cryptonite-exts.h"+#include "ed25519-crypton-exts.h"  /* 	Generates a (extsk[0..31]) and aExt (extsk[32..63])
cbits/ed25519/ed25519.h view
@@ -13,11 +13,11 @@  typedef unsigned char curved25519_key[32]; -void cryptonite_ed25519_publickey(const ed25519_secret_key sk, ed25519_public_key pk);-int cryptonite_ed25519_sign_open(const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS);-void cryptonite_ed25519_sign(const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS);+void crypton_ed25519_publickey(const ed25519_secret_key sk, ed25519_public_key pk);+int crypton_ed25519_sign_open(const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS);+void crypton_ed25519_sign(const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS); -//int cryptonite_ed25519_sign_open_batch(const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid);+//int crypton_ed25519_sign_open_batch(const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid);  //void ed25519_randombytes_unsafe(void *out, size_t count);
cbits/include32/p256/p256.h view
@@ -45,114 +45,114 @@  #define P256_LITERAL(lo,hi) (lo), (hi) -typedef int cryptonite_p256_err;-typedef uint32_t cryptonite_p256_digit;-typedef int32_t cryptonite_p256_sdigit;-typedef uint64_t cryptonite_p256_ddigit;-typedef int64_t cryptonite_p256_sddigit;+typedef int crypton_p256_err;+typedef uint32_t crypton_p256_digit;+typedef int32_t crypton_p256_sdigit;+typedef uint64_t crypton_p256_ddigit;+typedef int64_t crypton_p256_sddigit; -// Defining cryptonite_p256_int as struct to leverage struct assigment.+// Defining crypton_p256_int as struct to leverage struct assigment. typedef struct {-  cryptonite_p256_digit a[P256_NDIGITS];-} cryptonite_p256_int;+  crypton_p256_digit a[P256_NDIGITS];+} crypton_p256_int; -extern const cryptonite_p256_int cryptonite_SECP256r1_n;  // Curve order-extern const cryptonite_p256_int cryptonite_SECP256r1_p;  // Curve prime-extern const cryptonite_p256_int cryptonite_SECP256r1_b;  // Curve param+extern const crypton_p256_int crypton_SECP256r1_n;  // Curve order+extern const crypton_p256_int crypton_SECP256r1_p;  // Curve prime+extern const crypton_p256_int crypton_SECP256r1_b;  // Curve param -// Initialize a cryptonite_p256_int to zero.-void cryptonite_p256_init(cryptonite_p256_int* a);+// Initialize a crypton_p256_int to zero.+void crypton_p256_init(crypton_p256_int* a); -// Clear a cryptonite_p256_int to zero.-void cryptonite_p256_clear(cryptonite_p256_int* a);+// Clear a crypton_p256_int to zero.+void crypton_p256_clear(crypton_p256_int* a);  // Return bit. Index 0 is least significant.-int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);+int crypton_p256_get_bit(const crypton_p256_int* a, int index);  // b := a % MOD-void cryptonite_p256_mod(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+void crypton_p256_mod(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // c := a * (top_b | b) % MOD-void cryptonite_p256_modmul(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    const cryptonite_p256_digit top_b,-    const cryptonite_p256_int* b,-    cryptonite_p256_int* c);+void crypton_p256_modmul(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    const crypton_p256_digit top_b,+    const crypton_p256_int* b,+    crypton_p256_int* c);  // b := 1 / a % MOD // MOD best be SECP256r1_n-void cryptonite_p256_modinv(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+void crypton_p256_modinv(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // b := 1 / a % MOD // MOD best be SECP256r1_n-// Faster than cryptonite_p256_modinv()-void cryptonite_p256_modinv_vartime(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+// Faster than crypton_p256_modinv()+void crypton_p256_modinv_vartime(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // b := a << (n % P256_BITSPERDIGIT) // Returns the bits shifted out of most significant digit.-cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b);  // b := a >> (n % P256_BITSPERDIGIT)-void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b); -int cryptonite_p256_is_zero(const cryptonite_p256_int* a);-int cryptonite_p256_is_odd(const cryptonite_p256_int* a);-int cryptonite_p256_is_even(const cryptonite_p256_int* a);+int crypton_p256_is_zero(const crypton_p256_int* a);+int crypton_p256_is_odd(const crypton_p256_int* a);+int crypton_p256_is_even(const crypton_p256_int* a);  // Returns -1, 0 or 1.-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int *b);  // c: = a - b // Returns -1 on borrow.-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);  // c := a + b // Returns 1 on carry.-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);  // c := a + (single digit)b // Returns carry 1 on carry.-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit b, crypton_p256_int* c);  // ec routines.  // {out_x,out_y} := nG-void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,-                         cryptonite_p256_int *out_x,-                         cryptonite_p256_int *out_y);+void crypton_p256_base_point_mul(const crypton_p256_int *n,+                         crypton_p256_int *out_x,+                         crypton_p256_int *out_y);  // {out_x,out_y} := n{in_x,in_y}-void cryptonite_p256_point_mul(const cryptonite_p256_int *n,-                    const cryptonite_p256_int *in_x,-                    const cryptonite_p256_int *in_y,-                    cryptonite_p256_int *out_x,-                    cryptonite_p256_int *out_y);+void crypton_p256_point_mul(const crypton_p256_int *n,+                    const crypton_p256_int *in_x,+                    const crypton_p256_int *in_y,+                    crypton_p256_int *out_x,+                    crypton_p256_int *out_y);  // {out_x,out_y} := n1G + n2{in_x,in_y}-void cryptonite_p256_points_mul_vartime(-    const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);+void crypton_p256_points_mul_vartime(+    const crypton_p256_int *n1, const crypton_p256_int *n2,+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,+    crypton_p256_int *out_x, crypton_p256_int *out_y);  // Return whether point {x,y} is on curve.-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y);  // Outputs big-endian binary form. No leading zero skips.-void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES]);  // Reads from big-endian binary form, // thus pre-pad with leading zeros if short.-void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst);  #define P256_DIGITS(x) ((x)->a) #define P256_DIGIT(x,y) ((x)->a[y])
cbits/include32/p256/p256_gf.h view
@@ -730,50 +730,50 @@  #define kRInvDigits {0x80000000, 1, 0xffffffff, 0, 0x80000001, 0xfffffffe, 1, 0x7fffffff}  // 1 / 2^257 mod p256.p -static const cryptonite_p256_int kR = { kRDigits };-static const cryptonite_p256_int kRInv = { kRInvDigits };+static const crypton_p256_int kR = { kRDigits };+static const crypton_p256_int kRInv = { kRInvDigits };  /* to_montgomery sets out = R*in. */-static void to_montgomery(felem out, const cryptonite_p256_int* in) {-  cryptonite_p256_int in_shifted;+static void to_montgomery(felem out, const crypton_p256_int* in) {+  crypton_p256_int in_shifted;   int i; -  cryptonite_p256_init(&in_shifted);-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);+  crypton_p256_init(&in_shifted);+  crypton_p256_modmul(&crypton_SECP256r1_p, in, 0, &kR, &in_shifted);    for (i = 0; i < NLIMBS; i++) {     if ((i & 1) == 0) {       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom29Bits;-      cryptonite_p256_shr(&in_shifted, 29, &in_shifted);+      crypton_p256_shr(&in_shifted, 29, &in_shifted);     } else {       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom28Bits;-      cryptonite_p256_shr(&in_shifted, 28, &in_shifted);+      crypton_p256_shr(&in_shifted, 28, &in_shifted);     }   } -  cryptonite_p256_clear(&in_shifted);+  crypton_p256_clear(&in_shifted); }  /* from_montgomery sets out=in/R. */-static void from_montgomery(cryptonite_p256_int* out, const felem in) {-  cryptonite_p256_int result, tmp;+static void from_montgomery(crypton_p256_int* out, const felem in) {+  crypton_p256_int result, tmp;   int i, top; -  cryptonite_p256_init(&result);-  cryptonite_p256_init(&tmp);+  crypton_p256_init(&result);+  crypton_p256_init(&tmp); -  cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);+  crypton_p256_add_d(&tmp, in[NLIMBS - 1], &result);   for (i = NLIMBS - 2; i >= 0; i--) {     if ((i & 1) == 0) {-      top = cryptonite_p256_shl(&result, 29, &tmp);+      top = crypton_p256_shl(&result, 29, &tmp);     } else {-      top = cryptonite_p256_shl(&result, 28, &tmp);+      top = crypton_p256_shl(&result, 28, &tmp);     }-    top |= cryptonite_p256_add_d(&tmp, in[i], &result);+    top |= crypton_p256_add_d(&tmp, in[i], &result);   } -  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);+  crypton_p256_modmul(&crypton_SECP256r1_p, &kRInv, top, &result, out); -  cryptonite_p256_clear(&result);-  cryptonite_p256_clear(&tmp);+  crypton_p256_clear(&result);+  crypton_p256_clear(&tmp); }
cbits/include64/p256/p256.h view
@@ -45,114 +45,114 @@  #define P256_LITERAL(lo,hi) (((uint32_t) (lo)) + (((uint64_t) (hi)) << 32)) -typedef int cryptonite_p256_err;-typedef uint64_t cryptonite_p256_digit;-typedef int64_t cryptonite_p256_sdigit;-typedef __uint128_t cryptonite_p256_ddigit;-typedef __int128_t cryptonite_p256_sddigit;+typedef int crypton_p256_err;+typedef uint64_t crypton_p256_digit;+typedef int64_t crypton_p256_sdigit;+typedef __uint128_t crypton_p256_ddigit;+typedef __int128_t crypton_p256_sddigit; -// Defining cryptonite_p256_int as struct to leverage struct assigment.+// Defining crypton_p256_int as struct to leverage struct assigment. typedef struct {-  cryptonite_p256_digit a[P256_NDIGITS];-} cryptonite_p256_int;+  crypton_p256_digit a[P256_NDIGITS];+} crypton_p256_int; -extern const cryptonite_p256_int cryptonite_SECP256r1_n;  // Curve order-extern const cryptonite_p256_int cryptonite_SECP256r1_p;  // Curve prime-extern const cryptonite_p256_int cryptonite_SECP256r1_b;  // Curve param+extern const crypton_p256_int crypton_SECP256r1_n;  // Curve order+extern const crypton_p256_int crypton_SECP256r1_p;  // Curve prime+extern const crypton_p256_int crypton_SECP256r1_b;  // Curve param -// Initialize a cryptonite_p256_int to zero.-void cryptonite_p256_init(cryptonite_p256_int* a);+// Initialize a crypton_p256_int to zero.+void crypton_p256_init(crypton_p256_int* a); -// Clear a cryptonite_p256_int to zero.-void cryptonite_p256_clear(cryptonite_p256_int* a);+// Clear a crypton_p256_int to zero.+void crypton_p256_clear(crypton_p256_int* a);  // Return bit. Index 0 is least significant.-int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);+int crypton_p256_get_bit(const crypton_p256_int* a, int index);  // b := a % MOD-void cryptonite_p256_mod(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+void crypton_p256_mod(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // c := a * (top_b | b) % MOD-void cryptonite_p256_modmul(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    const cryptonite_p256_digit top_b,-    const cryptonite_p256_int* b,-    cryptonite_p256_int* c);+void crypton_p256_modmul(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    const crypton_p256_digit top_b,+    const crypton_p256_int* b,+    crypton_p256_int* c);  // b := 1 / a % MOD // MOD best be SECP256r1_n-void cryptonite_p256_modinv(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+void crypton_p256_modinv(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // b := 1 / a % MOD // MOD best be SECP256r1_n-// Faster than cryptonite_p256_modinv()-void cryptonite_p256_modinv_vartime(-    const cryptonite_p256_int* MOD,-    const cryptonite_p256_int* a,-    cryptonite_p256_int* b);+// Faster than crypton_p256_modinv()+void crypton_p256_modinv_vartime(+    const crypton_p256_int* MOD,+    const crypton_p256_int* a,+    crypton_p256_int* b);  // b := a << (n % P256_BITSPERDIGIT) // Returns the bits shifted out of most significant digit.-cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b);  // b := a >> (n % P256_BITSPERDIGIT)-void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b); -int cryptonite_p256_is_zero(const cryptonite_p256_int* a);-int cryptonite_p256_is_odd(const cryptonite_p256_int* a);-int cryptonite_p256_is_even(const cryptonite_p256_int* a);+int crypton_p256_is_zero(const crypton_p256_int* a);+int crypton_p256_is_odd(const crypton_p256_int* a);+int crypton_p256_is_even(const crypton_p256_int* a);  // Returns -1, 0 or 1.-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int *b);  // c: = a - b // Returns -1 on borrow.-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);  // c := a + b // Returns 1 on carry.-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);  // c := a + (single digit)b // Returns carry 1 on carry.-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit b, crypton_p256_int* c);  // ec routines.  // {out_x,out_y} := nG-void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,-                         cryptonite_p256_int *out_x,-                         cryptonite_p256_int *out_y);+void crypton_p256_base_point_mul(const crypton_p256_int *n,+                         crypton_p256_int *out_x,+                         crypton_p256_int *out_y);  // {out_x,out_y} := n{in_x,in_y}-void cryptonite_p256_point_mul(const cryptonite_p256_int *n,-                    const cryptonite_p256_int *in_x,-                    const cryptonite_p256_int *in_y,-                    cryptonite_p256_int *out_x,-                    cryptonite_p256_int *out_y);+void crypton_p256_point_mul(const crypton_p256_int *n,+                    const crypton_p256_int *in_x,+                    const crypton_p256_int *in_y,+                    crypton_p256_int *out_x,+                    crypton_p256_int *out_y);  // {out_x,out_y} := n1G + n2{in_x,in_y}-void cryptonite_p256_points_mul_vartime(-    const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);+void crypton_p256_points_mul_vartime(+    const crypton_p256_int *n1, const crypton_p256_int *n2,+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,+    crypton_p256_int *out_x, crypton_p256_int *out_y);  // Return whether point {x,y} is on curve.-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y);  // Outputs big-endian binary form. No leading zero skips.-void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES]);  // Reads from big-endian binary form, // thus pre-pad with leading zeros if short.-void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst);  #define P256_DIGITS(x) ((x)->a) #define P256_DIGIT(x,y) ((x)->a[y])
cbits/include64/p256/p256_gf.h view
@@ -664,50 +664,50 @@  #define kRInvDigits {0x180000000, 0xffffffff, 0xfffffffe80000001, 0x7fffffff00000001}  // 1 / 2^257 mod p256.p -static const cryptonite_p256_int kR = { kRDigits };-static const cryptonite_p256_int kRInv = { kRInvDigits };+static const crypton_p256_int kR = { kRDigits };+static const crypton_p256_int kRInv = { kRInvDigits };  /* to_montgomery sets out = R*in. */-static void to_montgomery(felem out, const cryptonite_p256_int* in) {-  cryptonite_p256_int in_shifted;+static void to_montgomery(felem out, const crypton_p256_int* in) {+  crypton_p256_int in_shifted;   int i; -  cryptonite_p256_init(&in_shifted);-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);+  crypton_p256_init(&in_shifted);+  crypton_p256_modmul(&crypton_SECP256r1_p, in, 0, &kR, &in_shifted);    for (i = 0; i < NLIMBS; i++) {     if ((i & 1) == 0) {       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom51Bits;-      cryptonite_p256_shr(&in_shifted, 51, &in_shifted);+      crypton_p256_shr(&in_shifted, 51, &in_shifted);     } else {       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom52Bits;-      cryptonite_p256_shr(&in_shifted, 52, &in_shifted);+      crypton_p256_shr(&in_shifted, 52, &in_shifted);     }   } -  cryptonite_p256_clear(&in_shifted);+  crypton_p256_clear(&in_shifted); }  /* from_montgomery sets out=in/R. */-static void from_montgomery(cryptonite_p256_int* out, const felem in) {-  cryptonite_p256_int result, tmp;+static void from_montgomery(crypton_p256_int* out, const felem in) {+  crypton_p256_int result, tmp;   int i, top; -  cryptonite_p256_init(&result);-  cryptonite_p256_init(&tmp);+  crypton_p256_init(&result);+  crypton_p256_init(&tmp); -  cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);+  crypton_p256_add_d(&tmp, in[NLIMBS - 1], &result);   for (i = NLIMBS - 2; i >= 0; i--) {     if ((i & 1) == 0) {-      top = cryptonite_p256_shl(&result, 51, &tmp);+      top = crypton_p256_shl(&result, 51, &tmp);     } else {-      top = cryptonite_p256_shl(&result, 52, &tmp);+      top = crypton_p256_shl(&result, 52, &tmp);     }-    top += cryptonite_p256_add_d(&tmp, in[i], &result);+    top += crypton_p256_add_d(&tmp, in[i], &result);   } -  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);+  crypton_p256_modmul(&crypton_SECP256r1_p, &kRInv, top, &result, out); -  cryptonite_p256_clear(&result);-  cryptonite_p256_clear(&tmp);+  crypton_p256_clear(&result);+  crypton_p256_clear(&tmp); }
cbits/p256/p256.c view
@@ -39,31 +39,31 @@  #include "p256/p256.h" -const cryptonite_p256_int cryptonite_SECP256r1_n =  // curve order+const crypton_p256_int crypton_SECP256r1_n =  // curve order   {{P256_LITERAL(0xfc632551, 0xf3b9cac2), P256_LITERAL(0xa7179e84, 0xbce6faad),     P256_LITERAL(-1, -1), P256_LITERAL(0, -1)}}; -const cryptonite_p256_int cryptonite_SECP256r1_p =  // curve field size+const crypton_p256_int crypton_SECP256r1_p =  // curve field size   {{P256_LITERAL(-1, -1), P256_LITERAL(-1, 0),     P256_LITERAL(0, 0), P256_LITERAL(1, -1) }}; -const cryptonite_p256_int cryptonite_SECP256r1_b =  // curve b+const crypton_p256_int crypton_SECP256r1_b =  // curve b   {{P256_LITERAL(0x27d2604b, 0x3bce3c3e), P256_LITERAL(0xcc53b0f6, 0x651d06b0),     P256_LITERAL(0x769886bc, 0xb3ebbd55), P256_LITERAL(0xaa3a93e7, 0x5ac635d8)}}; -void cryptonite_p256_init(cryptonite_p256_int* a) {+void crypton_p256_init(crypton_p256_int* a) {   memset(a, 0, sizeof(*a)); } -void cryptonite_p256_clear(cryptonite_p256_int* a) { cryptonite_p256_init(a); }+void crypton_p256_clear(crypton_p256_int* a) { crypton_p256_init(a); } -int cryptonite_p256_get_bit(const cryptonite_p256_int* scalar, int bit) {+int crypton_p256_get_bit(const crypton_p256_int* scalar, int bit) {   return (P256_DIGIT(scalar, bit / P256_BITSPERDIGIT)               >> (bit & (P256_BITSPERDIGIT - 1))) & 1; } -int cryptonite_p256_is_zero(const cryptonite_p256_int* a) {-  cryptonite_p256_digit result = 0;+int crypton_p256_is_zero(const crypton_p256_int* a) {+  crypton_p256_digit result = 0;   int i = 0;   for (i = 0; i < P256_NDIGITS; ++i) result |= P256_DIGIT(a, i);   return result == 0;@@ -71,85 +71,85 @@  // top, c[] += a[] * b // Returns new top-static cryptonite_p256_digit mulAdd(const cryptonite_p256_int* a,-                         cryptonite_p256_digit b,-                         cryptonite_p256_digit top,-                         cryptonite_p256_digit* c) {+static crypton_p256_digit mulAdd(const crypton_p256_int* a,+                         crypton_p256_digit b,+                         crypton_p256_digit top,+                         crypton_p256_digit* c) {   int i;-  cryptonite_p256_ddigit carry = 0;+  crypton_p256_ddigit carry = 0;    for (i = 0; i < P256_NDIGITS; ++i) {     carry += *c;-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) * b;-    *c++ = (cryptonite_p256_digit)carry;+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i) * b;+    *c++ = (crypton_p256_digit)carry;     carry >>= P256_BITSPERDIGIT;   }-  return top + (cryptonite_p256_digit)carry;+  return top + (crypton_p256_digit)carry; }  // top, c[] -= top_a, a[]-static cryptonite_p256_digit subTop(cryptonite_p256_digit top_a,-                         const cryptonite_p256_digit* a,-                         cryptonite_p256_digit top_c,-                         cryptonite_p256_digit* c) {+static crypton_p256_digit subTop(crypton_p256_digit top_a,+                         const crypton_p256_digit* a,+                         crypton_p256_digit top_c,+                         crypton_p256_digit* c) {   int i;-  cryptonite_p256_sddigit borrow = 0;+  crypton_p256_sddigit borrow = 0;    for (i = 0; i < P256_NDIGITS; ++i) {     borrow += *c;     borrow -= *a++;-    *c++ = (cryptonite_p256_digit)borrow;+    *c++ = (crypton_p256_digit)borrow;     borrow >>= P256_BITSPERDIGIT;   }   borrow += top_c;   borrow -= top_a;-  top_c = (cryptonite_p256_digit)borrow;+  top_c = (crypton_p256_digit)borrow;   assert((borrow >> P256_BITSPERDIGIT) == 0);   return top_c; }  // top, c[] -= MOD[] & mask (0 or -1) // returns new top.-static cryptonite_p256_digit subM(const cryptonite_p256_int* MOD,-                       cryptonite_p256_digit top,-                       cryptonite_p256_digit* c,-                       cryptonite_p256_digit mask) {+static crypton_p256_digit subM(const crypton_p256_int* MOD,+                       crypton_p256_digit top,+                       crypton_p256_digit* c,+                       crypton_p256_digit mask) {   int i;-  cryptonite_p256_sddigit borrow = 0;+  crypton_p256_sddigit borrow = 0;   for (i = 0; i < P256_NDIGITS; ++i) {     borrow += *c;     borrow -= P256_DIGIT(MOD, i) & mask;-    *c++ = (cryptonite_p256_digit)borrow;+    *c++ = (crypton_p256_digit)borrow;     borrow >>= P256_BITSPERDIGIT;   }-  return top + (cryptonite_p256_digit)borrow;+  return top + (crypton_p256_digit)borrow; }  // top, c[] += MOD[] & mask (0 or -1) // returns new top.-static cryptonite_p256_digit addM(const cryptonite_p256_int* MOD,-                       cryptonite_p256_digit top,-                       cryptonite_p256_digit* c,-                       cryptonite_p256_digit mask) {+static crypton_p256_digit addM(const crypton_p256_int* MOD,+                       crypton_p256_digit top,+                       crypton_p256_digit* c,+                       crypton_p256_digit mask) {   int i;-  cryptonite_p256_ddigit carry = 0;+  crypton_p256_ddigit carry = 0;   for (i = 0; i < P256_NDIGITS; ++i) {     carry += *c;     carry += P256_DIGIT(MOD, i) & mask;-    *c++ = (cryptonite_p256_digit)carry;+    *c++ = (crypton_p256_digit)carry;     carry >>= P256_BITSPERDIGIT;   }-  return top + (cryptonite_p256_digit)carry;+  return top + (crypton_p256_digit)carry; }  // c = a * b mod MOD. c can be a and/or b.-void cryptonite_p256_modmul(const cryptonite_p256_int* MOD,-                 const cryptonite_p256_int* a,-                 const cryptonite_p256_digit top_b,-                 const cryptonite_p256_int* b,-                 cryptonite_p256_int* c) {-  cryptonite_p256_digit tmp[P256_NDIGITS * 2 + 1] = { 0 };-  cryptonite_p256_digit top = 0;+void crypton_p256_modmul(const crypton_p256_int* MOD,+                 const crypton_p256_int* a,+                 const crypton_p256_digit top_b,+                 const crypton_p256_int* b,+                 crypton_p256_int* c) {+  crypton_p256_digit tmp[P256_NDIGITS * 2 + 1] = { 0 };+  crypton_p256_digit top = 0;   int i;    // Multiply/add into tmp.@@ -164,8 +164,8 @@    // Reduce tmp, digit by digit.   for (; i >= 0; --i) {-    cryptonite_p256_digit reducer[P256_NDIGITS] = { 0 };-    cryptonite_p256_digit top_reducer;+    crypton_p256_digit reducer[P256_NDIGITS] = { 0 };+    crypton_p256_digit top_reducer;      // top can be any value at this point.     // Guestimate reducer as top * MOD, since msw of MOD is -1.@@ -195,198 +195,198 @@    memcpy(c, tmp, P256_NBYTES); }-int cryptonite_p256_is_odd(const cryptonite_p256_int* a) { return P256_DIGIT(a, 0) & 1; }-int cryptonite_p256_is_even(const cryptonite_p256_int* a) { return !(P256_DIGIT(a, 0) & 1); }+int crypton_p256_is_odd(const crypton_p256_int* a) { return P256_DIGIT(a, 0) & 1; }+int crypton_p256_is_even(const crypton_p256_int* a) { return !(P256_DIGIT(a, 0) & 1); } -cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b) {   int i;-  cryptonite_p256_digit top = P256_DIGIT(a, P256_NDIGITS - 1);+  crypton_p256_digit top = P256_DIGIT(a, P256_NDIGITS - 1);    n %= P256_BITSPERDIGIT;   for (i = P256_NDIGITS - 1; i > 0; --i) {-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) << n);+    crypton_p256_digit accu = (P256_DIGIT(a, i) << n);     accu |= (P256_DIGIT(a, i - 1) >> (P256_BITSPERDIGIT - n));     P256_DIGIT(b, i) = accu;   }   P256_DIGIT(b, i) = (P256_DIGIT(a, i) << n); -  top = (cryptonite_p256_digit)((((cryptonite_p256_ddigit)top) << n) >> P256_BITSPERDIGIT);+  top = (crypton_p256_digit)((((crypton_p256_ddigit)top) << n) >> P256_BITSPERDIGIT);    return top; } -void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b) {   int i;    n %= P256_BITSPERDIGIT;   for (i = 0; i < P256_NDIGITS - 1; ++i) {-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> n);+    crypton_p256_digit accu = (P256_DIGIT(a, i) >> n);     accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - n));     P256_DIGIT(b, i) = accu;   }   P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> n); } -static void cryptonite_p256_shr1(const cryptonite_p256_int* a, int highbit, cryptonite_p256_int* b) {+static void crypton_p256_shr1(const crypton_p256_int* a, int highbit, crypton_p256_int* b) {   int i;    for (i = 0; i < P256_NDIGITS - 1; ++i) {-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> 1);+    crypton_p256_digit accu = (P256_DIGIT(a, i) >> 1);     accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - 1));     P256_DIGIT(b, i) = accu;   }   P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> 1) |-      (((cryptonite_p256_sdigit) highbit) << (P256_BITSPERDIGIT - 1));+      (((crypton_p256_sdigit) highbit) << (P256_BITSPERDIGIT - 1)); }  // Return -1, 0, 1 for a < b, a == b or a > b respectively.-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int* b) {+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int* b) {   int i;-  cryptonite_p256_sddigit borrow = 0;-  cryptonite_p256_digit notzero = 0;+  crypton_p256_sddigit borrow = 0;+  crypton_p256_digit notzero = 0;    for (i = 0; i < P256_NDIGITS; ++i) {-    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);+    borrow += (crypton_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);     // Track whether any result digit is ever not zero.     // Relies on !!(non-zero) evaluating to 1, e.g., !!(-1) evaluating to 1.-    notzero |= !!((cryptonite_p256_digit)borrow);+    notzero |= !!((crypton_p256_digit)borrow);     borrow >>= P256_BITSPERDIGIT;   }   return (int)borrow | notzero; }  // c = a - b. Returns borrow: 0 or -1.-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {   int i;-  cryptonite_p256_sddigit borrow = 0;+  crypton_p256_sddigit borrow = 0;    for (i = 0; i < P256_NDIGITS; ++i) {-    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);-    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)borrow;+    borrow += (crypton_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);+    if (c) P256_DIGIT(c, i) = (crypton_p256_digit)borrow;     borrow >>= P256_BITSPERDIGIT;   }   return (int)borrow; }  // c = a + b. Returns carry: 0 or 1.-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {   int i;-  cryptonite_p256_ddigit carry = 0;+  crypton_p256_ddigit carry = 0;    for (i = 0; i < P256_NDIGITS; ++i) {-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) + P256_DIGIT(b, i);-    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)carry;+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i) + P256_DIGIT(b, i);+    if (c) P256_DIGIT(c, i) = (crypton_p256_digit)carry;     carry >>= P256_BITSPERDIGIT;   }   return (int)carry; }  // b = a + d. Returns carry, 0 or 1.-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit d, cryptonite_p256_int* b) {+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit d, crypton_p256_int* b) {   int i;-  cryptonite_p256_ddigit carry = d;+  crypton_p256_ddigit carry = d;    for (i = 0; i < P256_NDIGITS; ++i) {-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i);-    if (b) P256_DIGIT(b, i) = (cryptonite_p256_digit)carry;+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i);+    if (b) P256_DIGIT(b, i) = (crypton_p256_digit)carry;     carry >>= P256_BITSPERDIGIT;   }   return (int)carry; }  // b = 1/a mod MOD, binary euclid.-void cryptonite_p256_modinv_vartime(const cryptonite_p256_int* MOD,-                         const cryptonite_p256_int* a,-                         cryptonite_p256_int* b) {-  cryptonite_p256_int R = P256_ZERO;-  cryptonite_p256_int S = P256_ONE;-  cryptonite_p256_int U = *MOD;-  cryptonite_p256_int V = *a;+void crypton_p256_modinv_vartime(const crypton_p256_int* MOD,+                         const crypton_p256_int* a,+                         crypton_p256_int* b) {+  crypton_p256_int R = P256_ZERO;+  crypton_p256_int S = P256_ONE;+  crypton_p256_int U = *MOD;+  crypton_p256_int V = *a;    for (;;) {-    if (cryptonite_p256_is_even(&U)) {-      cryptonite_p256_shr1(&U, 0, &U);-      if (cryptonite_p256_is_even(&R)) {-        cryptonite_p256_shr1(&R, 0, &R);+    if (crypton_p256_is_even(&U)) {+      crypton_p256_shr1(&U, 0, &U);+      if (crypton_p256_is_even(&R)) {+        crypton_p256_shr1(&R, 0, &R);       } else {         // R = (R+MOD)/2-        cryptonite_p256_shr1(&R, cryptonite_p256_add(&R, MOD, &R), &R);+        crypton_p256_shr1(&R, crypton_p256_add(&R, MOD, &R), &R);       }-    } else if (cryptonite_p256_is_even(&V)) {-      cryptonite_p256_shr1(&V, 0, &V);-      if (cryptonite_p256_is_even(&S)) {-        cryptonite_p256_shr1(&S, 0, &S);+    } else if (crypton_p256_is_even(&V)) {+      crypton_p256_shr1(&V, 0, &V);+      if (crypton_p256_is_even(&S)) {+        crypton_p256_shr1(&S, 0, &S);       } else {         // S = (S+MOD)/2-        cryptonite_p256_shr1(&S, cryptonite_p256_add(&S, MOD, &S) , &S);+        crypton_p256_shr1(&S, crypton_p256_add(&S, MOD, &S) , &S);       }     } else {  // U,V both odd.-      if (!cryptonite_p256_sub(&V, &U, NULL)) {-        cryptonite_p256_sub(&V, &U, &V);-        if (cryptonite_p256_sub(&S, &R, &S)) cryptonite_p256_add(&S, MOD, &S);-        if (cryptonite_p256_is_zero(&V)) break;  // done.+      if (!crypton_p256_sub(&V, &U, NULL)) {+        crypton_p256_sub(&V, &U, &V);+        if (crypton_p256_sub(&S, &R, &S)) crypton_p256_add(&S, MOD, &S);+        if (crypton_p256_is_zero(&V)) break;  // done.       } else {-        cryptonite_p256_sub(&U, &V, &U);-        if (cryptonite_p256_sub(&R, &S, &R)) cryptonite_p256_add(&R, MOD, &R);+        crypton_p256_sub(&U, &V, &U);+        if (crypton_p256_sub(&R, &S, &R)) crypton_p256_add(&R, MOD, &R);       }     }   } -  cryptonite_p256_mod(MOD, &R, b);+  crypton_p256_mod(MOD, &R, b); } -void cryptonite_p256_mod(const cryptonite_p256_int* MOD,-              const cryptonite_p256_int* in,-              cryptonite_p256_int* out) {+void crypton_p256_mod(const crypton_p256_int* MOD,+              const crypton_p256_int* in,+              crypton_p256_int* out) {   if (out != in) *out = *in;   addM(MOD, 0, P256_DIGITS(out), subM(MOD, 0, P256_DIGITS(out), -1)); }  // Verify y^2 == x^3 - 3x + b mod p // and 0 < x < p and 0 < y < p-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y) {-  cryptonite_p256_int y2, x3;+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y) {+  crypton_p256_int y2, x3; -  if (cryptonite_p256_cmp(&cryptonite_SECP256r1_p, x) <= 0 ||-      cryptonite_p256_cmp(&cryptonite_SECP256r1_p, y) <= 0 ||-      cryptonite_p256_is_zero(x) ||-      cryptonite_p256_is_zero(y)) return 0;+  if (crypton_p256_cmp(&crypton_SECP256r1_p, x) <= 0 ||+      crypton_p256_cmp(&crypton_SECP256r1_p, y) <= 0 ||+      crypton_p256_is_zero(x) ||+      crypton_p256_is_zero(y)) return 0; -  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, y, 0, y, &y2);  // y^2+  crypton_p256_modmul(&crypton_SECP256r1_p, y, 0, y, &y2);  // y^2 -  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, x, &x3);  // x^2-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, &x3, &x3);  // x^3-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - x-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 2x-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 3x-  if (cryptonite_p256_add(&x3, &cryptonite_SECP256r1_b, &x3))  // x^3 - 3x + b-    cryptonite_p256_sub(&x3, &cryptonite_SECP256r1_p, &x3);+  crypton_p256_modmul(&crypton_SECP256r1_p, x, 0, x, &x3);  // x^2+  crypton_p256_modmul(&crypton_SECP256r1_p, x, 0, &x3, &x3);  // x^3+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - x+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - 2x+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - 3x+  if (crypton_p256_add(&x3, &crypton_SECP256r1_b, &x3))  // x^3 - 3x + b+    crypton_p256_sub(&x3, &crypton_SECP256r1_p, &x3); -  return cryptonite_p256_cmp(&y2, &x3) == 0;+  return crypton_p256_cmp(&y2, &x3) == 0; } -void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst) {+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst) {   int i, n;   const uint8_t* p = &src[0];    for (i = P256_NDIGITS - 1; i >= 0; --i) {-    cryptonite_p256_digit dig = 0;+    crypton_p256_digit dig = 0;     n = P256_BITSPERDIGIT;     while (n > 0) {       n -= 8;-      dig |= ((cryptonite_p256_digit) *(p++)) << n;+      dig |= ((crypton_p256_digit) *(p++)) << n;     }     P256_DIGIT(dst, i) = dig;   } } -void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES])+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES]) { 	int i, n; 	uint8_t* p = &dst[0];  	for (i = P256_NDIGITS -1; i >= 0; --i) {-		const cryptonite_p256_digit dig = P256_DIGIT(src, i);+		const crypton_p256_digit dig = P256_DIGIT(src, i); 		n = P256_BITSPERDIGIT; 		while (n > 0) { 			n -= 8;@@ -402,49 +402,49 @@ #define MSB_COMPLEMENT(x) (((x) >> (P256_BITSPERDIGIT - 1)) - 1)  // c = a + b mod MOD-void cryptonite_p256e_modadd(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {-  assert(c);  /* avoid repeated checks inside inlined cryptonite_p256_add */-  cryptonite_p256_digit top = cryptonite_p256_add(a, b, c);+void crypton_p256e_modadd(const crypton_p256_int* MOD, const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {+  assert(c);  /* avoid repeated checks inside inlined crypton_p256_add */+  crypton_p256_digit top = crypton_p256_add(a, b, c);   top = subM(MOD, top, P256_DIGITS(c), -1);   top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));   addM(MOD, 0, P256_DIGITS(c), top); }  // c = a - b mod MOD-void cryptonite_p256e_modsub(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {-  assert(c); /* avoid repeated checks inside inlined cryptonite_p256_sub */-  cryptonite_p256_digit top = cryptonite_p256_sub(a, b, c);+void crypton_p256e_modsub(const crypton_p256_int* MOD, const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {+  assert(c); /* avoid repeated checks inside inlined crypton_p256_sub */+  crypton_p256_digit top = crypton_p256_sub(a, b, c);   top = addM(MOD, top, P256_DIGITS(c), ~MSB_COMPLEMENT(top));   top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));   addM(MOD, 0, P256_DIGITS(c), top); }  #define NTH_DOUBLE_THEN_ADD(i, a, nth, b, out)   \-    cryptonite_p256e_montmul(a, a, out);         \+    crypton_p256e_montmul(a, a, out);         \     for (i = 1; i < nth; i++)                    \-        cryptonite_p256e_montmul(out, out, out); \-    cryptonite_p256e_montmul(out, b, out);+        crypton_p256e_montmul(out, out, out); \+    crypton_p256e_montmul(out, b, out); -const cryptonite_p256_int cryptonite_SECP256r1_r2 = // r^2 mod n+const crypton_p256_int crypton_SECP256r1_r2 = // r^2 mod n   {{P256_LITERAL(0xBE79EEA2, 0x83244C95), P256_LITERAL(0x49BD6FA6, 0x4699799C),     P256_LITERAL(0x2B6BEC59, 0x2845B239), P256_LITERAL(0xF3D95620, 0x66E12D94)}}; -const cryptonite_p256_int cryptonite_SECP256r1_one = {{1}};+const crypton_p256_int crypton_SECP256r1_one = {{1}};  // Montgomery multiplication, i.e. c = ab/r mod n with r = 2^256. // Implementation is adapted from 'sc_montmul' in libdecaf.-static void cryptonite_p256e_montmul(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {+static void crypton_p256e_montmul(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {   int i, j, borrow;-  cryptonite_p256_digit accum[P256_NDIGITS+1] = {0};-  cryptonite_p256_digit hi_carry = 0;+  crypton_p256_digit accum[P256_NDIGITS+1] = {0};+  crypton_p256_digit hi_carry = 0;    for (i=0; i<P256_NDIGITS; i++) {-    cryptonite_p256_digit mand = P256_DIGIT(a, i);-    const cryptonite_p256_digit *mier = P256_DIGITS(b);+    crypton_p256_digit mand = P256_DIGIT(a, i);+    const crypton_p256_digit *mier = P256_DIGITS(b); -    cryptonite_p256_ddigit chain = 0;+    crypton_p256_ddigit chain = 0;     for (j=0; j<P256_NDIGITS; j++) {-      chain += ((cryptonite_p256_ddigit)mand)*mier[j] + accum[j];+      chain += ((crypton_p256_ddigit)mand)*mier[j] + accum[j];       accum[j] = chain;       chain >>= P256_BITSPERDIGIT;     }@@ -452,9 +452,9 @@      mand = accum[0] * P256_MONTGOMERY_FACTOR;     chain = 0;-    mier = P256_DIGITS(&cryptonite_SECP256r1_n);+    mier = P256_DIGITS(&crypton_SECP256r1_n);     for (j=0; j<P256_NDIGITS; j++) {-      chain += (cryptonite_p256_ddigit)mand*mier[j] + accum[j];+      chain += (crypton_p256_ddigit)mand*mier[j] + accum[j];       if (j) accum[j-1] = chain;       chain >>= P256_BITSPERDIGIT;     }@@ -465,31 +465,31 @@   }    memcpy(P256_DIGITS(c), accum, sizeof(*c));-  borrow = cryptonite_p256_sub(c, &cryptonite_SECP256r1_n, c);-  addM(&cryptonite_SECP256r1_n, 0, P256_DIGITS(c), borrow + hi_carry);+  borrow = crypton_p256_sub(c, &crypton_SECP256r1_n, c);+  addM(&crypton_SECP256r1_n, 0, P256_DIGITS(c), borrow + hi_carry); }  // b = 1/a mod n, using Fermat's little theorem.-void cryptonite_p256e_scalar_invert(const cryptonite_p256_int* a, cryptonite_p256_int* b) {-  cryptonite_p256_int _1, _10, _11, _101, _111, _1010, _1111;-  cryptonite_p256_int _10101, _101010, _101111, x6, x8, x16, x32;+void crypton_p256e_scalar_invert(const crypton_p256_int* a, crypton_p256_int* b) {+  crypton_p256_int _1, _10, _11, _101, _111, _1010, _1111;+  crypton_p256_int _10101, _101010, _101111, x6, x8, x16, x32;   int i;    // Montgomerize-  cryptonite_p256e_montmul(a, &cryptonite_SECP256r1_r2, &_1);+  crypton_p256e_montmul(a, &crypton_SECP256r1_r2, &_1);    // P-256 (secp256r1) Scalar Inversion   // <https://briansmith.org/ecc-inversion-addition-chains-01>-  cryptonite_p256e_montmul(&_1     , &_1     , &_10);-  cryptonite_p256e_montmul(&_10    , &_1     , &_11);-  cryptonite_p256e_montmul(&_10    , &_11    , &_101);-  cryptonite_p256e_montmul(&_10    , &_101   , &_111);-  cryptonite_p256e_montmul(&_101   , &_101   , &_1010);-  cryptonite_p256e_montmul(&_101   , &_1010  , &_1111);+  crypton_p256e_montmul(&_1     , &_1     , &_10);+  crypton_p256e_montmul(&_10    , &_1     , &_11);+  crypton_p256e_montmul(&_10    , &_11    , &_101);+  crypton_p256e_montmul(&_10    , &_101   , &_111);+  crypton_p256e_montmul(&_101   , &_101   , &_1010);+  crypton_p256e_montmul(&_101   , &_1010  , &_1111);   NTH_DOUBLE_THEN_ADD(i, &_1010,  1   , &_1     , &_10101);-  cryptonite_p256e_montmul(&_10101 , &_10101 , &_101010);-  cryptonite_p256e_montmul(&_101   , &_101010, &_101111);-  cryptonite_p256e_montmul(&_10101 , &_101010, &x6);+  crypton_p256e_montmul(&_10101 , &_10101 , &_101010);+  crypton_p256e_montmul(&_101   , &_101010, &_101111);+  crypton_p256e_montmul(&_10101 , &_101010, &x6);   NTH_DOUBLE_THEN_ADD(i, &x6   ,  2   , &_11    , &x8);   NTH_DOUBLE_THEN_ADD(i, &x8   ,  8   , &x8     , &x16);   NTH_DOUBLE_THEN_ADD(i, &x16  , 16   , &x16    , &x32);@@ -524,5 +524,5 @@   NTH_DOUBLE_THEN_ADD(i, b     , 2 + 4, &_1111  , b);    // Demontgomerize-  cryptonite_p256e_montmul(b, &cryptonite_SECP256r1_one, b);+  crypton_p256e_montmul(b, &crypton_SECP256r1_one, b); }
cbits/p256/p256_ec.c view
@@ -358,7 +358,7 @@  * number. Note that the value of scalar must be less than the order of the  * group. */ static void scalar_base_mult(felem nx, felem ny, felem nz,-                             const cryptonite_p256_int* scalar) {+                             const crypton_p256_int* scalar) {   int i, j;   limb n_is_infinity_mask = -1, p_is_noninfinite_mask, mask;   u32 table_offset;@@ -378,10 +378,10 @@     }     table_offset = 0;     for (j = 0; j <= 32; j += 32) {-      char bit0 = cryptonite_p256_get_bit(scalar, 31 - i + j);-      char bit1 = cryptonite_p256_get_bit(scalar, 95 - i + j);-      char bit2 = cryptonite_p256_get_bit(scalar, 159 - i + j);-      char bit3 = cryptonite_p256_get_bit(scalar, 223 - i + j);+      char bit0 = crypton_p256_get_bit(scalar, 31 - i + j);+      char bit1 = crypton_p256_get_bit(scalar, 95 - i + j);+      char bit2 = crypton_p256_get_bit(scalar, 159 - i + j);+      char bit3 = crypton_p256_get_bit(scalar, 223 - i + j);       limb index = bit0 | (bit1 << 1) | (bit2 << 2) | (bit3 << 3);        select_affine_point(px, py, kPrecomputed + table_offset, index);@@ -426,7 +426,7 @@  /* scalar_base_mult sets {nx,ny,nz} = scalar*{x,y}. */ static void scalar_mult(felem nx, felem ny, felem nz, const felem x,-                        const felem y, const cryptonite_p256_int* scalar) {+                        const felem y, const crypton_p256_int* scalar) {   int i;   felem px, py, pz, tx, ty, tz;   felem precomp[16][3];@@ -460,10 +460,10 @@       point_double(nx, ny, nz, nx, ny, nz);     } -    index = (cryptonite_p256_get_bit(scalar, 255 - i - 0) << 3) |-            (cryptonite_p256_get_bit(scalar, 255 - i - 1) << 2) |-            (cryptonite_p256_get_bit(scalar, 255 - i - 2) << 1) |-            cryptonite_p256_get_bit(scalar, 255 - i - 3);+    index = (crypton_p256_get_bit(scalar, 255 - i - 0) << 3) |+            (crypton_p256_get_bit(scalar, 255 - i - 1) << 2) |+            (crypton_p256_get_bit(scalar, 255 - i - 2) << 1) |+            crypton_p256_get_bit(scalar, 255 - i - 3);      /* See the comments in scalar_base_mult about handling infinities. */     select_jacobian_point(px, py, pz, precomp[0][0], index);@@ -482,9 +482,9 @@   } } -/* cryptonite_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the+/* crypton_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the  * order of the group. */-void cryptonite_p256_base_point_mul(const cryptonite_p256_int* n, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {+void crypton_p256_base_point_mul(const crypton_p256_int* n, crypton_p256_int* out_x, crypton_p256_int* out_y) {   felem x, y, z;    scalar_base_mult(x, y, z, n);@@ -498,21 +498,21 @@   } } -/* cryptonite_p256_points_mul_vartime sets {out_x,out_y} = n1*G + n2*{in_x,in_y}, where+/* crypton_p256_points_mul_vartime sets {out_x,out_y} = n1*G + n2*{in_x,in_y}, where  * n1 and n2 are < the order of the group.  *  * As indicated by the name, this function operates in variable time. This  * is safe because it's used for signature validation which doesn't deal  * with secrets. */-void cryptonite_p256_points_mul_vartime(-    const cryptonite_p256_int* n1, const cryptonite_p256_int* n2, const cryptonite_p256_int* in_x,-    const cryptonite_p256_int* in_y, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {+void crypton_p256_points_mul_vartime(+    const crypton_p256_int* n1, const crypton_p256_int* n2, const crypton_p256_int* in_x,+    const crypton_p256_int* in_y, crypton_p256_int* out_x, crypton_p256_int* out_y) {   felem x1, y1, z1, x2, y2, z2, px, py;    /* If both scalars are zero, then the result is the point at infinity. */-  if (cryptonite_p256_is_zero(n1) != 0 && cryptonite_p256_is_zero(n2) != 0) {-    cryptonite_p256_clear(out_x);-    cryptonite_p256_clear(out_y);+  if (crypton_p256_is_zero(n1) != 0 && crypton_p256_is_zero(n2) != 0) {+    crypton_p256_clear(out_x);+    crypton_p256_clear(out_y);     return;   } @@ -521,10 +521,10 @@   scalar_base_mult(x1, y1, z1, n1);   scalar_mult(x2, y2, z2, px, py, n2); -  if (cryptonite_p256_is_zero(n2) != 0) {+  if (crypton_p256_is_zero(n2) != 0) {     /* If n2 == 0, then {x2,y2,z2} is zero and the result is just          * {x1,y1,z1}. */-  } else if (cryptonite_p256_is_zero(n1) != 0) {+  } else if (crypton_p256_is_zero(n1) != 0) {     /* If n1 == 0, then {x1,y1,z1} is zero and the result is just          * {x2,y2,z2}. */     memcpy(x1, x2, sizeof(x2));@@ -544,10 +544,10 @@    add 2 points together. so far untested.    probably vartime, as it use point_add_or_double_vartime  */-void cryptonite_p256e_point_add(-    const cryptonite_p256_int *in_x1, const cryptonite_p256_int *in_y1,-    const cryptonite_p256_int *in_x2, const cryptonite_p256_int *in_y2,-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y)+void crypton_p256e_point_add(+    const crypton_p256_int *in_x1, const crypton_p256_int *in_y1,+    const crypton_p256_int *in_x2, const crypton_p256_int *in_y2,+    crypton_p256_int *out_x, crypton_p256_int *out_y) {     felem x, y, z, px1, py1, px2, py2; @@ -566,21 +566,21 @@ /* this function is not part of the original source    negate a point, i.e. (out_x, out_y) = (in_x, -in_y)  */-void cryptonite_p256e_point_negate(-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y)+void crypton_p256e_point_negate(+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,+    crypton_p256_int *out_x, crypton_p256_int *out_y) {     memcpy(out_x, in_x, P256_NBYTES);-    cryptonite_p256_sub(&cryptonite_SECP256r1_p, in_y, out_y);+    crypton_p256_sub(&crypton_SECP256r1_p, in_y, out_y); }  /* this function is not part of the original source-   cryptonite_p256e_point_mul sets {out_x,out_y} = n*{in_x,in_y}, where+   crypton_p256e_point_mul sets {out_x,out_y} = n*{in_x,in_y}, where    n is < the order of the group.  */-void cryptonite_p256e_point_mul(const cryptonite_p256_int* n,-    const cryptonite_p256_int* in_x, const cryptonite_p256_int* in_y,-    cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {+void crypton_p256e_point_mul(const crypton_p256_int* n,+    const crypton_p256_int* in_x, const crypton_p256_int* in_y,+    crypton_p256_int* out_x, crypton_p256_int* out_y) {   felem x, y, z, px, py;    to_montgomery(px, in_x);
crypton.cabal view
@@ -1,5 +1,5 @@ Name:                crypton-version:             0.31+version:             0.32 Synopsis:            Cryptography Primitives sink Description:     A repository of cryptographic primitives.@@ -57,7 +57,7 @@                      cbits/argon2/*.h                      cbits/argon2/*.c                      cbits/aes/x86ni_impl.c-                     cbits/cryptonite_hash_prefix.c+                     cbits/crypton_hash_prefix.c                      tests/*.hs  source-repository head@@ -261,32 +261,32 @@   cc-options:        -std=gnu99   if flag(old_toolchain_inliner)     cc-options:      -fgnu89-inline-  C-sources:         cbits/cryptonite_chacha.c-                   , cbits/cryptonite_salsa.c-                   , cbits/cryptonite_xsalsa.c-                   , cbits/cryptonite_rc4.c-                   , cbits/cryptonite_cpu.c+  C-sources:         cbits/crypton_chacha.c+                   , cbits/crypton_salsa.c+                   , cbits/crypton_xsalsa.c+                   , cbits/crypton_rc4.c+                   , cbits/crypton_cpu.c                    , cbits/p256/p256.c                    , cbits/p256/p256_ec.c-                   , cbits/cryptonite_blake2s.c-                   , cbits/cryptonite_blake2sp.c-                   , cbits/cryptonite_blake2b.c-                   , cbits/cryptonite_blake2bp.c-                   , cbits/cryptonite_poly1305.c-                   , cbits/cryptonite_sha1.c-                   , cbits/cryptonite_sha256.c-                   , cbits/cryptonite_sha512.c-                   , cbits/cryptonite_sha3.c-                   , cbits/cryptonite_md2.c-                   , cbits/cryptonite_md4.c-                   , cbits/cryptonite_md5.c-                   , cbits/cryptonite_ripemd.c-                   , cbits/cryptonite_skein256.c-                   , cbits/cryptonite_skein512.c-                   , cbits/cryptonite_tiger.c-                   , cbits/cryptonite_whirlpool.c-                   , cbits/cryptonite_scrypt.c-                   , cbits/cryptonite_pbkdf2.c+                   , cbits/crypton_blake2s.c+                   , cbits/crypton_blake2sp.c+                   , cbits/crypton_blake2b.c+                   , cbits/crypton_blake2bp.c+                   , cbits/crypton_poly1305.c+                   , cbits/crypton_sha1.c+                   , cbits/crypton_sha256.c+                   , cbits/crypton_sha512.c+                   , cbits/crypton_sha3.c+                   , cbits/crypton_md2.c+                   , cbits/crypton_md4.c+                   , cbits/crypton_md5.c+                   , cbits/crypton_ripemd.c+                   , cbits/crypton_skein256.c+                   , cbits/crypton_skein512.c+                   , cbits/crypton_tiger.c+                   , cbits/crypton_whirlpool.c+                   , cbits/crypton_scrypt.c+                   , cbits/crypton_pbkdf2.c                    , cbits/ed25519/ed25519.c   include-dirs:      cbits                    , cbits/ed25519@@ -341,7 +341,7 @@   if flag(support_rdrand) && (arch(i386) || arch(x86_64)) && !os(windows)     CPP-options:    -DSUPPORT_RDRAND     Other-modules:  Crypto.Random.Entropy.RDRand-    c-sources:      cbits/cryptonite_rdrand.c+    c-sources:      cbits/crypton_rdrand.c    if flag(support_aesni) && (os(linux) || os(freebsd) || os(osx)) && (arch(i386) || arch(x86_64))     CC-options:     -DWITH_AESNI@@ -354,11 +354,11 @@     C-sources:       cbits/aes/x86ni.c                    , cbits/aes/generic.c                    , cbits/aes/gf.c-                   , cbits/cryptonite_aes.c+                   , cbits/crypton_aes.c   else     C-sources:       cbits/aes/generic.c                    , cbits/aes/gf.c-                   , cbits/cryptonite_aes.c+                   , cbits/crypton_aes.c    if arch(x86_64) || flag(support_sse)     C-sources:      cbits/blake2/sse/blake2s.c