packages feed

cryptonite (empty) → 0.1

raw patch · 200 files changed

+25678/−0 lines, 200 filesdep +Win32dep +basedep +byteablesetup-changed

Dependencies added: Win32, base, byteable, bytestring, cryptonite, deepseq, ghc-prim, integer-gmp, memory, tasty, tasty-hunit, tasty-kat, tasty-quickcheck

Files

+ CHANGELOG.md view
@@ -0,0 +1,3 @@+## 0.1++* Initial release
+ Crypto/Cipher/AES.hs view
@@ -0,0 +1,67 @@+    -- |+-- Module      : Crypto.Cipher.AES+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+{-# LANGUAGE CPP #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.AES+    ( AES128+    , AES192+    , AES256+    ) where++import Crypto.Error+import Crypto.Cipher.Types+import Crypto.Cipher.Types.Block+import Crypto.Cipher.AES.Primitive+import Crypto.Internal.Imports++-- | AES with 128 bit key+newtype AES128 = AES128 AES+    deriving (NFData)++-- | AES with 192 bit key+newtype AES192 = AES192 AES+    deriving (NFData)++-- | AES with 256 bit key+newtype AES256 = AES256 AES+    deriving (NFData)++instance Cipher AES128 where+    cipherName    _ = "AES128"+    cipherKeySize _ = KeySizeFixed 16+    cipherInit k    = AES128 `fmap` initAES k++instance Cipher AES192 where+    cipherName    _ = "AES192"+    cipherKeySize _ = KeySizeFixed 24+    cipherInit k    = AES192 `fmap` initAES k++instance Cipher AES256 where+    cipherName    _ = "AES256"+    cipherKeySize _ = KeySizeFixed 32+    cipherInit k    = AES256 `fmap` initAES k++#define INSTANCE_BLOCKCIPHER(CSTR) \+instance BlockCipher CSTR where \+    { blockSize _ = 16 \+    ; ecbEncrypt (CSTR aes) = encryptECB aes \+    ; ecbDecrypt (CSTR aes) = decryptECB aes \+    ; cbcEncrypt (CSTR aes) (IV iv) = encryptCBC aes (IV iv) \+    ; cbcDecrypt (CSTR aes) (IV iv) = decryptCBC aes (IV iv) \+    ; ctrCombine (CSTR aes) (IV iv) = encryptCTR aes (IV iv) \+    ; aeadInit AEAD_GCM (CSTR aes) iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv) \+    ; aeadInit AEAD_OCB (CSTR aes) iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv) \+    ; aeadInit _        _          _  = CryptoFailed CryptoError_AEADModeNotSupported \+    }; \+instance BlockCipher128 CSTR where \+    { xtsEncrypt (CSTR aes1, CSTR aes2) (IV iv) = encryptXTS (aes1,aes2) (IV iv) \+    ; xtsDecrypt (CSTR aes1, CSTR aes2) (IV iv) = decryptXTS (aes1,aes2) (IV iv) \+    };++INSTANCE_BLOCKCIPHER(AES128)+INSTANCE_BLOCKCIPHER(AES192)+INSTANCE_BLOCKCIPHER(AES256)
+ Crypto/Cipher/AES/Primitive.hs view
@@ -0,0 +1,593 @@+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE ViewPatterns #-}+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+-- |+-- Module      : Crypto.Cipher.AES.Primitive+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+module Crypto.Cipher.AES.Primitive+    (+    -- * block cipher data types+      AES++    -- * Authenticated encryption block cipher types+    , AESGCM+    , AESOCB++    -- * creation+    , initAES++    -- * misc+    , genCTR+    , genCounter++    -- * encryption+    , encryptECB+    , encryptCBC+    , encryptCTR+    , encryptXTS+    , encryptGCM+    , encryptOCB++    -- * decryption+    , decryptECB+    , decryptCBC+    , decryptCTR+    , decryptXTS+    , decryptGCM+    , decryptOCB++    -- * incremental GCM+    , gcmMode+    , gcmInit+    , gcmAppendAAD+    , gcmAppendEncrypt+    , gcmAppendDecrypt+    , gcmFinish++    -- * incremental OCB+    , ocbMode+    , ocbInit+    , ocbAppendAAD+    , ocbAppendEncrypt+    , ocbAppendDecrypt+    , ocbFinish+    ) where++import           Data.Word+import           Foreign.Ptr+import           Foreign.C.Types+import           Foreign.C.String++import           Crypto.Error+import           Crypto.Cipher.Types+import           Crypto.Cipher.Types.Block (IV(..))+import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess, ScrubbedBytes, withByteArray)+import qualified Crypto.Internal.ByteArray as B++instance Cipher AES where+    cipherName    _ = "AES"+    cipherKeySize _ = KeySizeEnum [16,24,32]+    cipherInit k    = initAES k++instance BlockCipher AES where+    blockSize _ = 16+    ecbEncrypt = encryptECB+    ecbDecrypt = decryptECB+    cbcEncrypt = encryptCBC+    cbcDecrypt = decryptCBC+    ctrCombine = encryptCTR+    aeadInit AEAD_GCM aes iv = CryptoPassed $ AEAD (gcmMode aes) (gcmInit aes iv)+    aeadInit AEAD_OCB aes iv = CryptoPassed $ AEAD (ocbMode aes) (ocbInit aes iv)+    aeadInit _        _   _  = CryptoFailed CryptoError_AEADModeNotSupported+instance BlockCipher128 AES where +    xtsEncrypt = encryptXTS+    xtsDecrypt = decryptXTS++-- | Create an AES AEAD implementation for GCM+gcmMode :: AES -> AEADModeImpl AESGCM+gcmMode aes = AEADModeImpl+    { aeadImplAppendHeader = gcmAppendAAD+    , aeadImplEncrypt      = gcmAppendEncrypt aes+    , aeadImplDecrypt      = gcmAppendDecrypt aes+    , aeadImplFinalize     = gcmFinish aes+    }++-- | Create an AES AEAD implementation for OCB+ocbMode :: AES -> AEADModeImpl AESOCB+ocbMode aes = AEADModeImpl+    { aeadImplAppendHeader = ocbAppendAAD aes+    , aeadImplEncrypt      = ocbAppendEncrypt aes+    , aeadImplDecrypt      = ocbAppendDecrypt aes+    , aeadImplFinalize     = ocbFinish aes+    }+++-- | AES Context (pre-processed key)+newtype AES = AES ScrubbedBytes+    deriving (NFData)++-- | AESGCM State+newtype AESGCM = AESGCM ScrubbedBytes+    deriving (NFData)++-- | AESOCB State+newtype AESOCB = AESOCB ScrubbedBytes+    deriving (NFData)++sizeGCM :: Int+sizeGCM = 80++sizeOCB :: Int+sizeOCB = 160++keyToPtr :: AES -> (Ptr AES -> IO a) -> IO a+keyToPtr (AES b) f = withByteArray b (f . castPtr)++ivToPtr :: ByteArrayAccess iv => iv -> (Ptr Word8 -> IO a) -> IO a+ivToPtr iv f = withByteArray iv (f . castPtr)+++ivCopyPtr :: IV AES -> (Ptr Word8 -> IO a) -> IO (a, IV AES)+ivCopyPtr (IV iv) f = (\(x,y) -> (x, IV y)) `fmap` copyAndModify iv f+  where+    copyAndModify :: ByteArray ba => ba -> (Ptr Word8 -> IO a) -> IO (a, ba)+    copyAndModify ba f' = B.copyRet ba f'++withKeyAndIV :: ByteArrayAccess iv => AES -> iv -> (Ptr AES -> Ptr Word8 -> IO a) -> IO a+withKeyAndIV ctx iv f = keyToPtr ctx $ \kptr -> ivToPtr iv $ \ivp -> f kptr ivp++withKey2AndIV :: ByteArrayAccess iv => AES -> AES -> iv -> (Ptr AES -> Ptr AES -> Ptr Word8 -> IO a) -> IO a+withKey2AndIV key1 key2 iv f =+    keyToPtr key1 $ \kptr1 -> keyToPtr key2 $ \kptr2 -> ivToPtr iv $ \ivp -> f kptr1 kptr2 ivp++withGCMKeyAndCopySt :: AES -> AESGCM -> (Ptr AESGCM -> Ptr AES -> IO a) -> IO (a, AESGCM)+withGCMKeyAndCopySt aes (AESGCM gcmSt) f =+    keyToPtr aes $ \aesPtr -> do+        newSt <- B.copy gcmSt (\_ -> return ())+        a     <- withByteArray newSt $ \gcmStPtr -> f (castPtr gcmStPtr) aesPtr+        return (a, AESGCM newSt)++withNewGCMSt :: AESGCM -> (Ptr AESGCM -> IO ()) -> IO AESGCM+withNewGCMSt (AESGCM gcmSt) f = B.copy gcmSt (f . castPtr) >>= \sm2 -> return (AESGCM sm2)++withOCBKeyAndCopySt :: AES -> AESOCB -> (Ptr AESOCB -> Ptr AES -> IO a) -> IO (a, AESOCB)+withOCBKeyAndCopySt aes (AESOCB gcmSt) f =+    keyToPtr aes $ \aesPtr -> do+        newSt <- B.copy gcmSt (\_ -> return ())+        a     <- withByteArray newSt $ \gcmStPtr -> f (castPtr gcmStPtr) aesPtr+        return (a, AESOCB newSt)++-- | Initialize a new context with a key+--+-- Key need to be of length 16, 24 or 32 bytes. any other values will cause undefined behavior+initAES :: ByteArrayAccess key => key -> CryptoFailable AES+initAES k+    | len == 16 = CryptoPassed $ initWithRounds 10+    | len == 24 = CryptoPassed $ initWithRounds 12+    | len == 32 = CryptoPassed $ initWithRounds 14+    | otherwise = CryptoFailed CryptoError_KeySizeInvalid+  where len = B.length k+        initWithRounds nbR = AES $ B.allocAndFreeze (16+2*2*16*nbR) aesInit+        aesInit ptr = withByteArray k $ \ikey ->+            c_aes_init (castPtr ptr) (castPtr ikey) (fromIntegral len)++-- | encrypt using Electronic Code Book (ECB)+{-# NOINLINE encryptECB #-}+encryptECB :: ByteArray ba => AES -> ba -> ba+encryptECB = doECB c_aes_encrypt_ecb++-- | encrypt using Cipher Block Chaining (CBC)+{-# NOINLINE encryptCBC #-}+encryptCBC :: ByteArray ba+           => AES        -- ^ AES Context+           -> IV AES     -- ^ Initial vector of AES block size+           -> ba         -- ^ plaintext+           -> ba         -- ^ ciphertext+encryptCBC = doCBC c_aes_encrypt_cbc++-- | generate a counter mode pad. this is generally xor-ed to an input+-- to make the standard counter mode block operations.+--+-- if the length requested is not a multiple of the block cipher size,+-- more data will be returned, so that the returned bytestring is+-- a multiple of the block cipher size.+{-# NOINLINE genCTR #-}+genCTR :: ByteArray ba+       => AES    -- ^ Cipher Key.+       -> IV AES -- ^ usually a 128 bit integer.+       -> Int    -- ^ length of bytes required.+       -> ba+genCTR ctx (IV iv) len+    | len <= 0  = B.empty+    | otherwise = B.allocAndFreeze (nbBlocks * 16) generate+  where generate o = withKeyAndIV ctx iv $ \k i -> c_aes_gen_ctr (castPtr o) k i (fromIntegral nbBlocks)+        (nbBlocks',r) = len `quotRem` 16+        nbBlocks = if r == 0 then nbBlocks' else nbBlocks' + 1++-- | generate a counter mode pad. this is generally xor-ed to an input+-- to make the standard counter mode block operations.+--+-- if the length requested is not a multiple of the block cipher size,+-- more data will be returned, so that the returned bytestring is+-- a multiple of the block cipher size.+--+-- Similiar to 'genCTR' but also return the next IV for continuation+{-# NOINLINE genCounter #-}+genCounter :: ByteArray ba+           => AES+           -> IV AES+           -> Int+           -> (ba, IV AES)+genCounter ctx iv len+    | len <= 0  = (B.empty, iv)+    | otherwise = unsafeDoIO $+        keyToPtr ctx $ \k ->+        ivCopyPtr iv $ \i ->+        B.alloc outputLength $ \o -> do+            c_aes_gen_ctr_cont (castPtr o) k i (fromIntegral nbBlocks)+  where+        (nbBlocks',r) = len `quotRem` 16+        nbBlocks = if r == 0 then nbBlocks' else nbBlocks' + 1+        outputLength = nbBlocks * 16++{- TODO: when genCTR has same AESIV requirements for IV, add the following rules:+ - RULES "snd . genCounter" forall ctx iv len .  snd (genCounter ctx iv len) = genCTR ctx iv len+ -}++-- | encrypt using Counter mode (CTR)+--+-- in CTR mode encryption and decryption is the same operation.+{-# NOINLINE encryptCTR #-}+encryptCTR :: ByteArray ba+           => AES        -- ^ AES Context+           -> IV AES     -- ^ initial vector of AES block size (usually representing a 128 bit integer)+           -> ba         -- ^ plaintext input+           -> ba         -- ^ ciphertext output+encryptCTR ctx iv input+    | len <= 0          = B.empty+    | B.length iv /= 16 = error $ "AES error: IV length must be block size (16). Its length is: " ++ (show $ B.length iv)+    | otherwise = B.allocAndFreeze len doEncrypt+  where doEncrypt o = withKeyAndIV ctx iv $ \k v -> withByteArray input $ \i ->+                      c_aes_encrypt_ctr (castPtr o) k v i (fromIntegral len)+        len = B.length input++-- | encrypt using Galois counter mode (GCM)+-- return the encrypted bytestring and the tag associated+--+-- note: encrypted data is identical to CTR mode in GCM, however+-- a tag is also computed.+{-# NOINLINE encryptGCM #-}+encryptGCM :: (ByteArrayAccess iv, ByteArrayAccess aad, ByteArray ba)+           => AES        -- ^ AES Context+           -> iv         -- ^ IV initial vector of any size+           -> aad        -- ^ data to authenticate (AAD)+           -> ba         -- ^ data to encrypt+           -> (ba, AuthTag) -- ^ ciphertext and tag+encryptGCM = doGCM gcmAppendEncrypt++-- | encrypt using OCB v3+-- return the encrypted bytestring and the tag associated+{-# NOINLINE encryptOCB #-}+encryptOCB :: (ByteArrayAccess iv, ByteArrayAccess aad, ByteArray ba)+           => AES        -- ^ AES Context+           -> iv         -- ^ IV initial vector of any size+           -> aad        -- ^ data to authenticate (AAD)+           -> ba         -- ^ data to encrypt+           -> (ba, AuthTag) -- ^ ciphertext and tag+encryptOCB = doOCB ocbAppendEncrypt++-- | encrypt using XTS+--+-- the first key is the normal block encryption key+-- the second key is used for the initial block tweak+{-# NOINLINE encryptXTS #-}+encryptXTS :: ByteArray ba+           => (AES,AES)  -- ^ AES cipher and tweak context+           -> IV AES     -- ^ a 128 bits IV, typically a sector or a block offset in XTS+           -> Word32     -- ^ number of rounds to skip, also seen a 16 byte offset in the sector or block.+           -> ba         -- ^ input to encrypt+           -> ba         -- ^ output encrypted+encryptXTS = doXTS c_aes_encrypt_xts++-- | decrypt using Electronic Code Book (ECB)+{-# NOINLINE decryptECB #-}+decryptECB :: ByteArray ba => AES -> ba -> ba+decryptECB = doECB c_aes_decrypt_ecb++-- | decrypt using Cipher block chaining (CBC)+{-# NOINLINE decryptCBC #-}+decryptCBC :: ByteArray ba => AES -> IV AES -> ba -> ba+decryptCBC = doCBC c_aes_decrypt_cbc++-- | decrypt using Counter mode (CTR).+--+-- in CTR mode encryption and decryption is the same operation.+decryptCTR :: ByteArray ba+           => AES        -- ^ AES Context+           -> IV AES     -- ^ initial vector, usually representing a 128 bit integer+           -> ba         -- ^ ciphertext input+           -> ba         -- ^ plaintext output+decryptCTR = encryptCTR++-- | decrypt using XTS+{-# NOINLINE decryptXTS #-}+decryptXTS :: ByteArray ba+           => (AES,AES)  -- ^ AES cipher and tweak context+           -> IV AES     -- ^ a 128 bits IV, typically a sector or a block offset in XTS+           -> Word32     -- ^ number of rounds to skip, also seen a 16 byte offset in the sector or block.+           -> ba         -- ^ input to decrypt+           -> ba         -- ^ output decrypted+decryptXTS = doXTS c_aes_decrypt_xts++-- | decrypt using Galois Counter Mode (GCM)+{-# NOINLINE decryptGCM #-}+decryptGCM :: (ByteArrayAccess aad, ByteArrayAccess iv, ByteArray ba)+           => AES        -- ^ Key+           -> iv         -- ^ IV initial vector of any size+           -> aad        -- ^ data to authenticate (AAD)+           -> ba         -- ^ data to decrypt+           -> (ba, AuthTag) -- ^ plaintext and tag+decryptGCM = doGCM gcmAppendDecrypt++-- | decrypt using Offset Codebook Mode (OCB)+{-# NOINLINE decryptOCB #-}+decryptOCB :: (ByteArrayAccess aad, ByteArrayAccess iv, ByteArray ba)+           => AES        -- ^ Key+           -> iv         -- ^ IV initial vector of any size+           -> aad        -- ^ data to authenticate (AAD)+           -> ba         -- ^ data to decrypt+           -> (ba, AuthTag) -- ^ plaintext and tag+decryptOCB = doOCB ocbAppendDecrypt++{-# INLINE doECB #-}+doECB :: ByteArray ba+      => (Ptr b -> Ptr AES -> CString -> CUInt -> IO ())+      -> AES -> ba -> ba+doECB f ctx input+    | r /= 0    = error $ "Encryption error: input length must be a multiple of block size (16). Its length is: " ++ (show len)+    | otherwise = B.allocAndFreeze len $ \o ->+                  keyToPtr ctx $ \k ->+                  withByteArray input $ \i ->+                  f (castPtr o) k i (fromIntegral nbBlocks)+  where (nbBlocks, r) = len `quotRem` 16+        len           = B.length input++{-# INLINE doCBC #-}+doCBC :: ByteArray ba+      => (Ptr b -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ())+      -> AES -> IV AES -> ba -> ba+doCBC f ctx (IV iv) input+    | len == 0  = B.empty+    | r /= 0    = error $ "Encryption error: input length must be a multiple of block size (16). Its length is: " ++ (show len)+    | otherwise = B.allocAndFreeze len $ \o ->+                  withKeyAndIV ctx iv $ \k v ->+                  withByteArray input $ \i ->+                  f (castPtr o) k v i (fromIntegral nbBlocks)+  where (nbBlocks, r) = len `quotRem` 16+        len           = B.length input++{-# INLINE doXTS #-}+doXTS :: ByteArray ba+      => (Ptr b -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO ())+      -> (AES, AES)+      -> IV AES+      -> Word32+      -> ba+      -> ba+doXTS f (key1,key2) iv spoint input+    | len == 0  = B.empty+    | r /= 0    = error $ "Encryption error: input length must be a multiple of block size (16) for now. Its length is: " ++ (show len)+    | otherwise = B.allocAndFreeze len $ \o -> withKey2AndIV key1 key2 iv $ \k1 k2 v -> withByteArray input $ \i ->+            f (castPtr o) k1 k2 v (fromIntegral spoint) i (fromIntegral nbBlocks)+  where (nbBlocks, r) = len `quotRem` 16+        len           = B.length input++------------------------------------------------------------------------+-- GCM+------------------------------------------------------------------------++{-# INLINE doGCM #-}+doGCM :: (ByteArrayAccess iv, ByteArrayAccess aad, ByteArray ba)+      => (AES -> AESGCM -> ba -> (ba, AESGCM))+      -> AES+      -> iv+      -> aad+      -> ba+      -> (ba, AuthTag)+doGCM f ctx iv aad input = (output, tag)+  where tag             = gcmFinish ctx after 16+        (output, after) = f ctx afterAAD input+        afterAAD        = gcmAppendAAD ini aad+        ini             = gcmInit ctx iv++-- | initialize a gcm context+{-# NOINLINE gcmInit #-}+gcmInit :: ByteArrayAccess iv => AES -> iv -> AESGCM+gcmInit ctx iv = unsafeDoIO $ do+    sm <- B.alloc sizeGCM $ \gcmStPtr ->+            withKeyAndIV ctx iv $ \k v ->+            c_aes_gcm_init (castPtr gcmStPtr) k v (fromIntegral $ B.length iv)+    return $ AESGCM sm++-- | append data which is going to just be authentified to the GCM context.+--+-- need to happen after initialization and before appending encryption/decryption data.+{-# NOINLINE gcmAppendAAD #-}+gcmAppendAAD :: ByteArrayAccess aad => AESGCM -> aad -> AESGCM+gcmAppendAAD gcmSt input = unsafeDoIO doAppend+  where doAppend =+            withNewGCMSt gcmSt $ \gcmStPtr ->+            withByteArray input $ \i ->+            c_aes_gcm_aad gcmStPtr i (fromIntegral $ B.length input)++-- | append data to encrypt and append to the GCM context+--+-- bytestring need to be multiple of AES block size, unless it's the last call to this function.+-- need to happen after AAD appending, or after initialization if no AAD data.+{-# NOINLINE gcmAppendEncrypt #-}+gcmAppendEncrypt :: ByteArray ba => AES -> AESGCM -> ba -> (ba, AESGCM)+gcmAppendEncrypt ctx gcm input = unsafeDoIO $ withGCMKeyAndCopySt ctx gcm doEnc+  where len = B.length input+        doEnc gcmStPtr aesPtr =+            B.alloc len $ \o ->+            withByteArray input $ \i ->+            c_aes_gcm_encrypt (castPtr o) gcmStPtr aesPtr i (fromIntegral len)++-- | append data to decrypt and append to the GCM context+--+-- bytestring need to be multiple of AES block size, unless it's the last call to this function.+-- need to happen after AAD appending, or after initialization if no AAD data.+{-# NOINLINE gcmAppendDecrypt #-}+gcmAppendDecrypt :: ByteArray ba => AES -> AESGCM -> ba -> (ba, AESGCM)+gcmAppendDecrypt ctx gcm input = unsafeDoIO $ withGCMKeyAndCopySt ctx gcm doDec+  where len = B.length input+        doDec gcmStPtr aesPtr =+            B.alloc len $ \o ->+            withByteArray input $ \i ->+            c_aes_gcm_decrypt (castPtr o) gcmStPtr aesPtr i (fromIntegral len)++-- | Generate the Tag from GCM context+{-# NOINLINE gcmFinish #-}+gcmFinish :: AES -> AESGCM -> Int -> AuthTag+gcmFinish ctx gcm taglen = AuthTag $ B.take taglen computeTag+  where computeTag = B.allocAndFreeze 16 $ \t ->+                        withGCMKeyAndCopySt ctx gcm (c_aes_gcm_finish (castPtr t)) >> return ()++------------------------------------------------------------------------+-- OCB v3+------------------------------------------------------------------------++{-# INLINE doOCB #-}+doOCB :: (ByteArrayAccess iv, ByteArrayAccess aad, ByteArray ba)+      => (AES -> AESOCB -> ba -> (ba, AESOCB))+      -> AES+      -> iv+      -> aad+      -> ba+      -> (ba, AuthTag)+doOCB f ctx iv aad input = (output, tag)+  where tag             = ocbFinish ctx after 16+        (output, after) = f ctx afterAAD input+        afterAAD        = ocbAppendAAD ctx ini aad+        ini             = ocbInit ctx iv++-- | initialize an ocb context+{-# NOINLINE ocbInit #-}+ocbInit :: ByteArrayAccess iv => AES -> iv -> AESOCB+ocbInit ctx iv = unsafeDoIO $ do+    sm <- B.alloc sizeOCB $ \ocbStPtr ->+            withKeyAndIV ctx iv $ \k v ->+            c_aes_ocb_init (castPtr ocbStPtr) k v (fromIntegral $ B.length iv)+    return $ AESOCB sm++-- | append data which is going to just be authentified to the OCB context.+--+-- need to happen after initialization and before appending encryption/decryption data.+{-# NOINLINE ocbAppendAAD #-}+ocbAppendAAD :: ByteArrayAccess aad => AES -> AESOCB -> aad -> AESOCB+ocbAppendAAD ctx ocb input = unsafeDoIO (snd `fmap` withOCBKeyAndCopySt ctx ocb doAppend)+  where doAppend ocbStPtr aesPtr =+            withByteArray input $ \i ->+            c_aes_ocb_aad ocbStPtr aesPtr i (fromIntegral $ B.length input)++-- | append data to encrypt and append to the OCB context+--+-- bytestring need to be multiple of AES block size, unless it's the last call to this function.+-- need to happen after AAD appending, or after initialization if no AAD data.+{-# NOINLINE ocbAppendEncrypt #-}+ocbAppendEncrypt :: ByteArray ba => AES -> AESOCB -> ba -> (ba, AESOCB)+ocbAppendEncrypt ctx ocb input = unsafeDoIO $ withOCBKeyAndCopySt ctx ocb doEnc+  where len = B.length input+        doEnc ocbStPtr aesPtr =+            B.alloc len $ \o ->+            withByteArray input $ \i ->+            c_aes_ocb_encrypt (castPtr o) ocbStPtr aesPtr i (fromIntegral len)++-- | append data to decrypt and append to the OCB context+--+-- bytestring need to be multiple of AES block size, unless it's the last call to this function.+-- need to happen after AAD appending, or after initialization if no AAD data.+{-# NOINLINE ocbAppendDecrypt #-}+ocbAppendDecrypt :: ByteArray ba => AES -> AESOCB -> ba -> (ba, AESOCB)+ocbAppendDecrypt ctx ocb input = unsafeDoIO $ withOCBKeyAndCopySt ctx ocb doDec+  where len = B.length input+        doDec ocbStPtr aesPtr =+            B.alloc len $ \o ->+            withByteArray input $ \i ->+            c_aes_ocb_decrypt (castPtr o) ocbStPtr aesPtr i (fromIntegral len)++-- | Generate the Tag from OCB context+{-# NOINLINE ocbFinish #-}+ocbFinish :: AES -> AESOCB -> Int -> AuthTag+ocbFinish ctx ocb taglen = AuthTag $ B.take taglen computeTag+  where computeTag = B.allocAndFreeze 16 $ \t ->+                        withOCBKeyAndCopySt ctx ocb (c_aes_ocb_finish (castPtr t)) >> return ()++------------------------------------------------------------------------+foreign import ccall "cryptonite_aes.h cryptonite_aes_initkey"+    c_aes_init :: Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ecb"+    c_aes_encrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_ecb"+    c_aes_decrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_cbc"+    c_aes_encrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_cbc"+    c_aes_decrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_xts"+    c_aes_encrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_xts"+    c_aes_decrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gen_ctr"+    c_aes_gen_ctr :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_gen_ctr_cont"+    c_aes_gen_ctr_cont :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ctr"+    c_aes_encrypt_ctr :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_init"+    c_aes_gcm_init :: Ptr AESGCM -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_aad"+    c_aes_gcm_aad :: Ptr AESGCM -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_encrypt"+    c_aes_gcm_encrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_decrypt"+    c_aes_gcm_decrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_finish"+    c_aes_gcm_finish :: CString -> Ptr AESGCM -> Ptr AES -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_init"+    c_aes_ocb_init :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_aad"+    c_aes_ocb_aad :: Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_encrypt"+    c_aes_ocb_encrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_decrypt"+    c_aes_ocb_decrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()++foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_finish"+    c_aes_ocb_finish :: CString -> Ptr AESOCB -> Ptr AES -> IO ()+
+ Crypto/Cipher/Blowfish.hs view
@@ -0,0 +1,67 @@+-- |+-- Module      : Crypto.Cipher.Blowfish+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+{-# LANGUAGE CPP #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.Blowfish+    ( Blowfish+    , Blowfish64+    , Blowfish128+    , Blowfish256+    , Blowfish448+    ) where++import Crypto.Internal.Imports+import Crypto.Cipher.Types+import Crypto.Cipher.Blowfish.Primitive++-- | variable keyed blowfish state+newtype Blowfish = Blowfish Context+    deriving (NFData)++-- | 64 bit keyed blowfish state+newtype Blowfish64 = Blowfish64 Context+    deriving (NFData)++-- | 128 bit keyed blowfish state+newtype Blowfish128 = Blowfish128 Context+    deriving (NFData)++-- | 256 bit keyed blowfish state+newtype Blowfish256 = Blowfish256 Context+    deriving (NFData)++-- | 448 bit keyed blowfish state+newtype Blowfish448 = Blowfish448 Context+    deriving (NFData)++instance Cipher Blowfish where+    cipherName _    = "blowfish"+    cipherKeySize _ = KeySizeRange 6 56+    cipherInit k    = Blowfish `fmap` initBlowfish k++instance BlockCipher Blowfish where+    blockSize _ = 8+    ecbEncrypt (Blowfish bf) = encrypt bf+    ecbDecrypt (Blowfish bf) = decrypt bf++#define INSTANCE_CIPHER(CSTR, NAME, KEYSIZE) \+instance Cipher CSTR where \+    { cipherName _ = NAME \+    ; cipherKeySize _ = KeySizeFixed KEYSIZE \+    ; cipherInit k = CSTR `fmap` initBlowfish k \+    }; \+instance BlockCipher CSTR where \+    { blockSize _ = 8 \+    ; ecbEncrypt (CSTR bf) = encrypt bf \+    ; ecbDecrypt (CSTR bf) = decrypt bf \+    };++INSTANCE_CIPHER(Blowfish64, "blowfish64", 8)+INSTANCE_CIPHER(Blowfish128, "blowfish128", 16)+INSTANCE_CIPHER(Blowfish256, "blowfish256", 32)+INSTANCE_CIPHER(Blowfish448, "blowfish448", 56)
+ Crypto/Cipher/Blowfish/Box.hs view
@@ -0,0 +1,278 @@+-- |+-- Module      : Crypto.Cipher.Blowfish.Box+-- License     : BSD-style+-- Stability   : experimental+-- Portability : Good+{-# LANGUAGE MagicHash #-}+module Crypto.Cipher.Blowfish.Box+    ( createKeySchedule+    ) where++import Crypto.Internal.WordArray (mutableArray32FromAddrBE, MutableArray32)++-- | Create a key schedule mutable array of the pbox followed by+-- all the sboxes.+createKeySchedule :: IO MutableArray32+createKeySchedule = mutableArray32FromAddrBE 1042 "\+    \\x24\x3f\x6a\x88\x85\xa3\x08\xd3\x13\x19\x8a\x2e\x03\x70\x73\x44\+    \\xa4\x09\x38\x22\x29\x9f\x31\xd0\x08\x2e\xfa\x98\xec\x4e\x6c\x89\+    \\x45\x28\x21\xe6\x38\xd0\x13\x77\xbe\x54\x66\xcf\x34\xe9\x0c\x6c\+    \\xc0\xac\x29\xb7\xc9\x7c\x50\xdd\x3f\x84\xd5\xb5\xb5\x47\x09\x17\+    \\x92\x16\xd5\xd9\x89\x79\xfb\x1b\+    \\xd1\x31\x0b\xa6\x98\xdf\xb5\xac\x2f\xfd\x72\xdb\xd0\x1a\xdf\xb7\+    \\xb8\xe1\xaf\xed\x6a\x26\x7e\x96\xba\x7c\x90\x45\xf1\x2c\x7f\x99\+    \\x24\xa1\x99\x47\xb3\x91\x6c\xf7\x08\x01\xf2\xe2\x85\x8e\xfc\x16\+    \\x63\x69\x20\xd8\x71\x57\x4e\x69\xa4\x58\xfe\xa3\xf4\x93\x3d\x7e\+    \\x0d\x95\x74\x8f\x72\x8e\xb6\x58\x71\x8b\xcd\x58\x82\x15\x4a\xee\+    \\x7b\x54\xa4\x1d\xc2\x5a\x59\xb5\x9c\x30\xd5\x39\x2a\xf2\x60\x13\+    \\xc5\xd1\xb0\x23\x28\x60\x85\xf0\xca\x41\x79\x18\xb8\xdb\x38\xef\+    \\x8e\x79\xdc\xb0\x60\x3a\x18\x0e\x6c\x9e\x0e\x8b\xb0\x1e\x8a\x3e\+    \\xd7\x15\x77\xc1\xbd\x31\x4b\x27\x78\xaf\x2f\xda\x55\x60\x5c\x60\+    \\xe6\x55\x25\xf3\xaa\x55\xab\x94\x57\x48\x98\x62\x63\xe8\x14\x40\+    \\x55\xca\x39\x6a\x2a\xab\x10\xb6\xb4\xcc\x5c\x34\x11\x41\xe8\xce\+    \\xa1\x54\x86\xaf\x7c\x72\xe9\x93\xb3\xee\x14\x11\x63\x6f\xbc\x2a\+    \\x2b\xa9\xc5\x5d\x74\x18\x31\xf6\xce\x5c\x3e\x16\x9b\x87\x93\x1e\+    \\xaf\xd6\xba\x33\x6c\x24\xcf\x5c\x7a\x32\x53\x81\x28\x95\x86\x77\+    \\x3b\x8f\x48\x98\x6b\x4b\xb9\xaf\xc4\xbf\xe8\x1b\x66\x28\x21\x93\+    \\x61\xd8\x09\xcc\xfb\x21\xa9\x91\x48\x7c\xac\x60\x5d\xec\x80\x32\+    \\xef\x84\x5d\x5d\xe9\x85\x75\xb1\xdc\x26\x23\x02\xeb\x65\x1b\x88\+    \\x23\x89\x3e\x81\xd3\x96\xac\xc5\x0f\x6d\x6f\xf3\x83\xf4\x42\x39\+    \\x2e\x0b\x44\x82\xa4\x84\x20\x04\x69\xc8\xf0\x4a\x9e\x1f\x9b\x5e\+    \\x21\xc6\x68\x42\xf6\xe9\x6c\x9a\x67\x0c\x9c\x61\xab\xd3\x88\xf0\+    \\x6a\x51\xa0\xd2\xd8\x54\x2f\x68\x96\x0f\xa7\x28\xab\x51\x33\xa3\+    \\x6e\xef\x0b\x6c\x13\x7a\x3b\xe4\xba\x3b\xf0\x50\x7e\xfb\x2a\x98\+    \\xa1\xf1\x65\x1d\x39\xaf\x01\x76\x66\xca\x59\x3e\x82\x43\x0e\x88\+    \\x8c\xee\x86\x19\x45\x6f\x9f\xb4\x7d\x84\xa5\xc3\x3b\x8b\x5e\xbe\+    \\xe0\x6f\x75\xd8\x85\xc1\x20\x73\x40\x1a\x44\x9f\x56\xc1\x6a\xa6\+    \\x4e\xd3\xaa\x62\x36\x3f\x77\x06\x1b\xfe\xdf\x72\x42\x9b\x02\x3d\+    \\x37\xd0\xd7\x24\xd0\x0a\x12\x48\xdb\x0f\xea\xd3\x49\xf1\xc0\x9b\+    \\x07\x53\x72\xc9\x80\x99\x1b\x7b\x25\xd4\x79\xd8\xf6\xe8\xde\xf7\+    \\xe3\xfe\x50\x1a\xb6\x79\x4c\x3b\x97\x6c\xe0\xbd\x04\xc0\x06\xba\+    \\xc1\xa9\x4f\xb6\x40\x9f\x60\xc4\x5e\x5c\x9e\xc2\x19\x6a\x24\x63\+    \\x68\xfb\x6f\xaf\x3e\x6c\x53\xb5\x13\x39\xb2\xeb\x3b\x52\xec\x6f\+    \\x6d\xfc\x51\x1f\x9b\x30\x95\x2c\xcc\x81\x45\x44\xaf\x5e\xbd\x09\+    \\xbe\xe3\xd0\x04\xde\x33\x4a\xfd\x66\x0f\x28\x07\x19\x2e\x4b\xb3\+    \\xc0\xcb\xa8\x57\x45\xc8\x74\x0f\xd2\x0b\x5f\x39\xb9\xd3\xfb\xdb\+    \\x55\x79\xc0\xbd\x1a\x60\x32\x0a\xd6\xa1\x00\xc6\x40\x2c\x72\x79\+    \\x67\x9f\x25\xfe\xfb\x1f\xa3\xcc\x8e\xa5\xe9\xf8\xdb\x32\x22\xf8\+    \\x3c\x75\x16\xdf\xfd\x61\x6b\x15\x2f\x50\x1e\xc8\xad\x05\x52\xab\+    \\x32\x3d\xb5\xfa\xfd\x23\x87\x60\x53\x31\x7b\x48\x3e\x00\xdf\x82\+    \\x9e\x5c\x57\xbb\xca\x6f\x8c\xa0\x1a\x87\x56\x2e\xdf\x17\x69\xdb\+    \\xd5\x42\xa8\xf6\x28\x7e\xff\xc3\xac\x67\x32\xc6\x8c\x4f\x55\x73\+    \\x69\x5b\x27\xb0\xbb\xca\x58\xc8\xe1\xff\xa3\x5d\xb8\xf0\x11\xa0\+    \\x10\xfa\x3d\x98\xfd\x21\x83\xb8\x4a\xfc\xb5\x6c\x2d\xd1\xd3\x5b\+    \\x9a\x53\xe4\x79\xb6\xf8\x45\x65\xd2\x8e\x49\xbc\x4b\xfb\x97\x90\+    \\xe1\xdd\xf2\xda\xa4\xcb\x7e\x33\x62\xfb\x13\x41\xce\xe4\xc6\xe8\+    \\xef\x20\xca\xda\x36\x77\x4c\x01\xd0\x7e\x9e\xfe\x2b\xf1\x1f\xb4\+    \\x95\xdb\xda\x4d\xae\x90\x91\x98\xea\xad\x8e\x71\x6b\x93\xd5\xa0\+    \\xd0\x8e\xd1\xd0\xaf\xc7\x25\xe0\x8e\x3c\x5b\x2f\x8e\x75\x94\xb7\+    \\x8f\xf6\xe2\xfb\xf2\x12\x2b\x64\x88\x88\xb8\x12\x90\x0d\xf0\x1c\+    \\x4f\xad\x5e\xa0\x68\x8f\xc3\x1c\xd1\xcf\xf1\x91\xb3\xa8\xc1\xad\+    \\x2f\x2f\x22\x18\xbe\x0e\x17\x77\xea\x75\x2d\xfe\x8b\x02\x1f\xa1\+    \\xe5\xa0\xcc\x0f\xb5\x6f\x74\xe8\x18\xac\xf3\xd6\xce\x89\xe2\x99\+    \\xb4\xa8\x4f\xe0\xfd\x13\xe0\xb7\x7c\xc4\x3b\x81\xd2\xad\xa8\xd9\+    \\x16\x5f\xa2\x66\x80\x95\x77\x05\x93\xcc\x73\x14\x21\x1a\x14\x77\+    \\xe6\xad\x20\x65\x77\xb5\xfa\x86\xc7\x54\x42\xf5\xfb\x9d\x35\xcf\+    \\xeb\xcd\xaf\x0c\x7b\x3e\x89\xa0\xd6\x41\x1b\xd3\xae\x1e\x7e\x49\+    \\x00\x25\x0e\x2d\x20\x71\xb3\x5e\x22\x68\x00\xbb\x57\xb8\xe0\xaf\+    \\x24\x64\x36\x9b\xf0\x09\xb9\x1e\x55\x63\x91\x1d\x59\xdf\xa6\xaa\+    \\x78\xc1\x43\x89\xd9\x5a\x53\x7f\x20\x7d\x5b\xa2\x02\xe5\xb9\xc5\+    \\x83\x26\x03\x76\x62\x95\xcf\xa9\x11\xc8\x19\x68\x4e\x73\x4a\x41\+    \\xb3\x47\x2d\xca\x7b\x14\xa9\x4a\x1b\x51\x00\x52\x9a\x53\x29\x15\+    \\xd6\x0f\x57\x3f\xbc\x9b\xc6\xe4\x2b\x60\xa4\x76\x81\xe6\x74\x00\+    \\x08\xba\x6f\xb5\x57\x1b\xe9\x1f\xf2\x96\xec\x6b\x2a\x0d\xd9\x15\+    \\xb6\x63\x65\x21\xe7\xb9\xf9\xb6\xff\x34\x05\x2e\xc5\x85\x56\x64\+    \\x53\xb0\x2d\x5d\xa9\x9f\x8f\xa1\x08\xba\x47\x99\x6e\x85\x07\x6a\+    \\x4b\x7a\x70\xe9\xb5\xb3\x29\x44\xdb\x75\x09\x2e\xc4\x19\x26\x23\+    \\xad\x6e\xa6\xb0\x49\xa7\xdf\x7d\x9c\xee\x60\xb8\x8f\xed\xb2\x66\+    \\xec\xaa\x8c\x71\x69\x9a\x17\xff\x56\x64\x52\x6c\xc2\xb1\x9e\xe1\+    \\x19\x36\x02\xa5\x75\x09\x4c\x29\xa0\x59\x13\x40\xe4\x18\x3a\x3e\+    \\x3f\x54\x98\x9a\x5b\x42\x9d\x65\x6b\x8f\xe4\xd6\x99\xf7\x3f\xd6\+    \\xa1\xd2\x9c\x07\xef\xe8\x30\xf5\x4d\x2d\x38\xe6\xf0\x25\x5d\xc1\+    \\x4c\xdd\x20\x86\x84\x70\xeb\x26\x63\x82\xe9\xc6\x02\x1e\xcc\x5e\+    \\x09\x68\x6b\x3f\x3e\xba\xef\xc9\x3c\x97\x18\x14\x6b\x6a\x70\xa1\+    \\x68\x7f\x35\x84\x52\xa0\xe2\x86\xb7\x9c\x53\x05\xaa\x50\x07\x37\+    \\x3e\x07\x84\x1c\x7f\xde\xae\x5c\x8e\x7d\x44\xec\x57\x16\xf2\xb8\+    \\xb0\x3a\xda\x37\xf0\x50\x0c\x0d\xf0\x1c\x1f\x04\x02\x00\xb3\xff\+    \\xae\x0c\xf5\x1a\x3c\xb5\x74\xb2\x25\x83\x7a\x58\xdc\x09\x21\xbd\+    \\xd1\x91\x13\xf9\x7c\xa9\x2f\xf6\x94\x32\x47\x73\x22\xf5\x47\x01\+    \\x3a\xe5\xe5\x81\x37\xc2\xda\xdc\xc8\xb5\x76\x34\x9a\xf3\xdd\xa7\+    \\xa9\x44\x61\x46\x0f\xd0\x03\x0e\xec\xc8\xc7\x3e\xa4\x75\x1e\x41\+    \\xe2\x38\xcd\x99\x3b\xea\x0e\x2f\x32\x80\xbb\xa1\x18\x3e\xb3\x31\+    \\x4e\x54\x8b\x38\x4f\x6d\xb9\x08\x6f\x42\x0d\x03\xf6\x0a\x04\xbf\+    \\x2c\xb8\x12\x90\x24\x97\x7c\x79\x56\x79\xb0\x72\xbc\xaf\x89\xaf\+    \\xde\x9a\x77\x1f\xd9\x93\x08\x10\xb3\x8b\xae\x12\xdc\xcf\x3f\x2e\+    \\x55\x12\x72\x1f\x2e\x6b\x71\x24\x50\x1a\xdd\xe6\x9f\x84\xcd\x87\+    \\x7a\x58\x47\x18\x74\x08\xda\x17\xbc\x9f\x9a\xbc\xe9\x4b\x7d\x8c\+    \\xec\x7a\xec\x3a\xdb\x85\x1d\xfa\x63\x09\x43\x66\xc4\x64\xc3\xd2\+    \\xef\x1c\x18\x47\x32\x15\xd9\x08\xdd\x43\x3b\x37\x24\xc2\xba\x16\+    \\x12\xa1\x4d\x43\x2a\x65\xc4\x51\x50\x94\x00\x02\x13\x3a\xe4\xdd\+    \\x71\xdf\xf8\x9e\x10\x31\x4e\x55\x81\xac\x77\xd6\x5f\x11\x19\x9b\+    \\x04\x35\x56\xf1\xd7\xa3\xc7\x6b\x3c\x11\x18\x3b\x59\x24\xa5\x09\+    \\xf2\x8f\xe6\xed\x97\xf1\xfb\xfa\x9e\xba\xbf\x2c\x1e\x15\x3c\x6e\+    \\x86\xe3\x45\x70\xea\xe9\x6f\xb1\x86\x0e\x5e\x0a\x5a\x3e\x2a\xb3\+    \\x77\x1f\xe7\x1c\x4e\x3d\x06\xfa\x29\x65\xdc\xb9\x99\xe7\x1d\x0f\+    \\x80\x3e\x89\xd6\x52\x66\xc8\x25\x2e\x4c\xc9\x78\x9c\x10\xb3\x6a\+    \\xc6\x15\x0e\xba\x94\xe2\xea\x78\xa5\xfc\x3c\x53\x1e\x0a\x2d\xf4\+    \\xf2\xf7\x4e\xa7\x36\x1d\x2b\x3d\x19\x39\x26\x0f\x19\xc2\x79\x60\+    \\x52\x23\xa7\x08\xf7\x13\x12\xb6\xeb\xad\xfe\x6e\xea\xc3\x1f\x66\+    \\xe3\xbc\x45\x95\xa6\x7b\xc8\x83\xb1\x7f\x37\xd1\x01\x8c\xff\x28\+    \\xc3\x32\xdd\xef\xbe\x6c\x5a\xa5\x65\x58\x21\x85\x68\xab\x98\x02\+    \\xee\xce\xa5\x0f\xdb\x2f\x95\x3b\x2a\xef\x7d\xad\x5b\x6e\x2f\x84\+    \\x15\x21\xb6\x28\x29\x07\x61\x70\xec\xdd\x47\x75\x61\x9f\x15\x10\+    \\x13\xcc\xa8\x30\xeb\x61\xbd\x96\x03\x34\xfe\x1e\xaa\x03\x63\xcf\+    \\xb5\x73\x5c\x90\x4c\x70\xa2\x39\xd5\x9e\x9e\x0b\xcb\xaa\xde\x14\+    \\xee\xcc\x86\xbc\x60\x62\x2c\xa7\x9c\xab\x5c\xab\xb2\xf3\x84\x6e\+    \\x64\x8b\x1e\xaf\x19\xbd\xf0\xca\xa0\x23\x69\xb9\x65\x5a\xbb\x50\+    \\x40\x68\x5a\x32\x3c\x2a\xb4\xb3\x31\x9e\xe9\xd5\xc0\x21\xb8\xf7\+    \\x9b\x54\x0b\x19\x87\x5f\xa0\x99\x95\xf7\x99\x7e\x62\x3d\x7d\xa8\+    \\xf8\x37\x88\x9a\x97\xe3\x2d\x77\x11\xed\x93\x5f\x16\x68\x12\x81\+    \\x0e\x35\x88\x29\xc7\xe6\x1f\xd6\x96\xde\xdf\xa1\x78\x58\xba\x99\+    \\x57\xf5\x84\xa5\x1b\x22\x72\x63\x9b\x83\xc3\xff\x1a\xc2\x46\x96\+    \\xcd\xb3\x0a\xeb\x53\x2e\x30\x54\x8f\xd9\x48\xe4\x6d\xbc\x31\x28\+    \\x58\xeb\xf2\xef\x34\xc6\xff\xea\xfe\x28\xed\x61\xee\x7c\x3c\x73\+    \\x5d\x4a\x14\xd9\xe8\x64\xb7\xe3\x42\x10\x5d\x14\x20\x3e\x13\xe0\+    \\x45\xee\xe2\xb6\xa3\xaa\xab\xea\xdb\x6c\x4f\x15\xfa\xcb\x4f\xd0\+    \\xc7\x42\xf4\x42\xef\x6a\xbb\xb5\x65\x4f\x3b\x1d\x41\xcd\x21\x05\+    \\xd8\x1e\x79\x9e\x86\x85\x4d\xc7\xe4\x4b\x47\x6a\x3d\x81\x62\x50\+    \\xcf\x62\xa1\xf2\x5b\x8d\x26\x46\xfc\x88\x83\xa0\xc1\xc7\xb6\xa3\+    \\x7f\x15\x24\xc3\x69\xcb\x74\x92\x47\x84\x8a\x0b\x56\x92\xb2\x85\+    \\x09\x5b\xbf\x00\xad\x19\x48\x9d\x14\x62\xb1\x74\x23\x82\x0e\x00\+    \\x58\x42\x8d\x2a\x0c\x55\xf5\xea\x1d\xad\xf4\x3e\x23\x3f\x70\x61\+    \\x33\x72\xf0\x92\x8d\x93\x7e\x41\xd6\x5f\xec\xf1\x6c\x22\x3b\xdb\+    \\x7c\xde\x37\x59\xcb\xee\x74\x60\x40\x85\xf2\xa7\xce\x77\x32\x6e\+    \\xa6\x07\x80\x84\x19\xf8\x50\x9e\xe8\xef\xd8\x55\x61\xd9\x97\x35\+    \\xa9\x69\xa7\xaa\xc5\x0c\x06\xc2\x5a\x04\xab\xfc\x80\x0b\xca\xdc\+    \\x9e\x44\x7a\x2e\xc3\x45\x34\x84\xfd\xd5\x67\x05\x0e\x1e\x9e\xc9\+    \\xdb\x73\xdb\xd3\x10\x55\x88\xcd\x67\x5f\xda\x79\xe3\x67\x43\x40\+    \\xc5\xc4\x34\x65\x71\x3e\x38\xd8\x3d\x28\xf8\x9e\xf1\x6d\xff\x20\+    \\x15\x3e\x21\xe7\x8f\xb0\x3d\x4a\xe6\xe3\x9f\x2b\xdb\x83\xad\xf7\+    \\xe9\x3d\x5a\x68\x94\x81\x40\xf7\xf6\x4c\x26\x1c\x94\x69\x29\x34\+    \\x41\x15\x20\xf7\x76\x02\xd4\xf7\xbc\xf4\x6b\x2e\xd4\xa2\x00\x68\+    \\xd4\x08\x24\x71\x33\x20\xf4\x6a\x43\xb7\xd4\xb7\x50\x00\x61\xaf\+    \\x1e\x39\xf6\x2e\x97\x24\x45\x46\x14\x21\x4f\x74\xbf\x8b\x88\x40\+    \\x4d\x95\xfc\x1d\x96\xb5\x91\xaf\x70\xf4\xdd\xd3\x66\xa0\x2f\x45\+    \\xbf\xbc\x09\xec\x03\xbd\x97\x85\x7f\xac\x6d\xd0\x31\xcb\x85\x04\+    \\x96\xeb\x27\xb3\x55\xfd\x39\x41\xda\x25\x47\xe6\xab\xca\x0a\x9a\+    \\x28\x50\x78\x25\x53\x04\x29\xf4\x0a\x2c\x86\xda\xe9\xb6\x6d\xfb\+    \\x68\xdc\x14\x62\xd7\x48\x69\x00\x68\x0e\xc0\xa4\x27\xa1\x8d\xee\+    \\x4f\x3f\xfe\xa2\xe8\x87\xad\x8c\xb5\x8c\xe0\x06\x7a\xf4\xd6\xb6\+    \\xaa\xce\x1e\x7c\xd3\x37\x5f\xec\xce\x78\xa3\x99\x40\x6b\x2a\x42\+    \\x20\xfe\x9e\x35\xd9\xf3\x85\xb9\xee\x39\xd7\xab\x3b\x12\x4e\x8b\+    \\x1d\xc9\xfa\xf7\x4b\x6d\x18\x56\x26\xa3\x66\x31\xea\xe3\x97\xb2\+    \\x3a\x6e\xfa\x74\xdd\x5b\x43\x32\x68\x41\xe7\xf7\xca\x78\x20\xfb\+    \\xfb\x0a\xf5\x4e\xd8\xfe\xb3\x97\x45\x40\x56\xac\xba\x48\x95\x27\+    \\x55\x53\x3a\x3a\x20\x83\x8d\x87\xfe\x6b\xa9\xb7\xd0\x96\x95\x4b\+    \\x55\xa8\x67\xbc\xa1\x15\x9a\x58\xcc\xa9\x29\x63\x99\xe1\xdb\x33\+    \\xa6\x2a\x4a\x56\x3f\x31\x25\xf9\x5e\xf4\x7e\x1c\x90\x29\x31\x7c\+    \\xfd\xf8\xe8\x02\x04\x27\x2f\x70\x80\xbb\x15\x5c\x05\x28\x2c\xe3\+    \\x95\xc1\x15\x48\xe4\xc6\x6d\x22\x48\xc1\x13\x3f\xc7\x0f\x86\xdc\+    \\x07\xf9\xc9\xee\x41\x04\x1f\x0f\x40\x47\x79\xa4\x5d\x88\x6e\x17\+    \\x32\x5f\x51\xeb\xd5\x9b\xc0\xd1\xf2\xbc\xc1\x8f\x41\x11\x35\x64\+    \\x25\x7b\x78\x34\x60\x2a\x9c\x60\xdf\xf8\xe8\xa3\x1f\x63\x6c\x1b\+    \\x0e\x12\xb4\xc2\x02\xe1\x32\x9e\xaf\x66\x4f\xd1\xca\xd1\x81\x15\+    \\x6b\x23\x95\xe0\x33\x3e\x92\xe1\x3b\x24\x0b\x62\xee\xbe\xb9\x22\+    \\x85\xb2\xa2\x0e\xe6\xba\x0d\x99\xde\x72\x0c\x8c\x2d\xa2\xf7\x28\+    \\xd0\x12\x78\x45\x95\xb7\x94\xfd\x64\x7d\x08\x62\xe7\xcc\xf5\xf0\+    \\x54\x49\xa3\x6f\x87\x7d\x48\xfa\xc3\x9d\xfd\x27\xf3\x3e\x8d\x1e\+    \\x0a\x47\x63\x41\x99\x2e\xff\x74\x3a\x6f\x6e\xab\xf4\xf8\xfd\x37\+    \\xa8\x12\xdc\x60\xa1\xeb\xdd\xf8\x99\x1b\xe1\x4c\xdb\x6e\x6b\x0d\+    \\xc6\x7b\x55\x10\x6d\x67\x2c\x37\x27\x65\xd4\x3b\xdc\xd0\xe8\x04\+    \\xf1\x29\x0d\xc7\xcc\x00\xff\xa3\xb5\x39\x0f\x92\x69\x0f\xed\x0b\+    \\x66\x7b\x9f\xfb\xce\xdb\x7d\x9c\xa0\x91\xcf\x0b\xd9\x15\x5e\xa3\+    \\xbb\x13\x2f\x88\x51\x5b\xad\x24\x7b\x94\x79\xbf\x76\x3b\xd6\xeb\+    \\x37\x39\x2e\xb3\xcc\x11\x59\x79\x80\x26\xe2\x97\xf4\x2e\x31\x2d\+    \\x68\x42\xad\xa7\xc6\x6a\x2b\x3b\x12\x75\x4c\xcc\x78\x2e\xf1\x1c\+    \\x6a\x12\x42\x37\xb7\x92\x51\xe7\x06\xa1\xbb\xe6\x4b\xfb\x63\x50\+    \\x1a\x6b\x10\x18\x11\xca\xed\xfa\x3d\x25\xbd\xd8\xe2\xe1\xc3\xc9\+    \\x44\x42\x16\x59\x0a\x12\x13\x86\xd9\x0c\xec\x6e\xd5\xab\xea\x2a\+    \\x64\xaf\x67\x4e\xda\x86\xa8\x5f\xbe\xbf\xe9\x88\x64\xe4\xc3\xfe\+    \\x9d\xbc\x80\x57\xf0\xf7\xc0\x86\x60\x78\x7b\xf8\x60\x03\x60\x4d\+    \\xd1\xfd\x83\x46\xf6\x38\x1f\xb0\x77\x45\xae\x04\xd7\x36\xfc\xcc\+    \\x83\x42\x6b\x33\xf0\x1e\xab\x71\xb0\x80\x41\x87\x3c\x00\x5e\x5f\+    \\x77\xa0\x57\xbe\xbd\xe8\xae\x24\x55\x46\x42\x99\xbf\x58\x2e\x61\+    \\x4e\x58\xf4\x8f\xf2\xdd\xfd\xa2\xf4\x74\xef\x38\x87\x89\xbd\xc2\+    \\x53\x66\xf9\xc3\xc8\xb3\x8e\x74\xb4\x75\xf2\x55\x46\xfc\xd9\xb9\+    \\x7a\xeb\x26\x61\x8b\x1d\xdf\x84\x84\x6a\x0e\x79\x91\x5f\x95\xe2\+    \\x46\x6e\x59\x8e\x20\xb4\x57\x70\x8c\xd5\x55\x91\xc9\x02\xde\x4c\+    \\xb9\x0b\xac\xe1\xbb\x82\x05\xd0\x11\xa8\x62\x48\x75\x74\xa9\x9e\+    \\xb7\x7f\x19\xb6\xe0\xa9\xdc\x09\x66\x2d\x09\xa1\xc4\x32\x46\x33\+    \\xe8\x5a\x1f\x02\x09\xf0\xbe\x8c\x4a\x99\xa0\x25\x1d\x6e\xfe\x10\+    \\x1a\xb9\x3d\x1d\x0b\xa5\xa4\xdf\xa1\x86\xf2\x0f\x28\x68\xf1\x69\+    \\xdc\xb7\xda\x83\x57\x39\x06\xfe\xa1\xe2\xce\x9b\x4f\xcd\x7f\x52\+    \\x50\x11\x5e\x01\xa7\x06\x83\xfa\xa0\x02\xb5\xc4\x0d\xe6\xd0\x27\+    \\x9a\xf8\x8c\x27\x77\x3f\x86\x41\xc3\x60\x4c\x06\x61\xa8\x06\xb5\+    \\xf0\x17\x7a\x28\xc0\xf5\x86\xe0\x00\x60\x58\xaa\x30\xdc\x7d\x62\+    \\x11\xe6\x9e\xd7\x23\x38\xea\x63\x53\xc2\xdd\x94\xc2\xc2\x16\x34\+    \\xbb\xcb\xee\x56\x90\xbc\xb6\xde\xeb\xfc\x7d\xa1\xce\x59\x1d\x76\+    \\x6f\x05\xe4\x09\x4b\x7c\x01\x88\x39\x72\x0a\x3d\x7c\x92\x7c\x24\+    \\x86\xe3\x72\x5f\x72\x4d\x9d\xb9\x1a\xc1\x5b\xb4\xd3\x9e\xb8\xfc\+    \\xed\x54\x55\x78\x08\xfc\xa5\xb5\xd8\x3d\x7c\xd3\x4d\xad\x0f\xc4\+    \\x1e\x50\xef\x5e\xb1\x61\xe6\xf8\xa2\x85\x14\xd9\x6c\x51\x13\x3c\+    \\x6f\xd5\xc7\xe7\x56\xe1\x4e\xc4\x36\x2a\xbf\xce\xdd\xc6\xc8\x37\+    \\xd7\x9a\x32\x34\x92\x63\x82\x12\x67\x0e\xfa\x8e\x40\x60\x00\xe0\+    \\x3a\x39\xce\x37\xd3\xfa\xf5\xcf\xab\xc2\x77\x37\x5a\xc5\x2d\x1b\+    \\x5c\xb0\x67\x9e\x4f\xa3\x37\x42\xd3\x82\x27\x40\x99\xbc\x9b\xbe\+    \\xd5\x11\x8e\x9d\xbf\x0f\x73\x15\xd6\x2d\x1c\x7e\xc7\x00\xc4\x7b\+    \\xb7\x8c\x1b\x6b\x21\xa1\x90\x45\xb2\x6e\xb1\xbe\x6a\x36\x6e\xb4\+    \\x57\x48\xab\x2f\xbc\x94\x6e\x79\xc6\xa3\x76\xd2\x65\x49\xc2\xc8\+    \\x53\x0f\xf8\xee\x46\x8d\xde\x7d\xd5\x73\x0a\x1d\x4c\xd0\x4d\xc6\+    \\x29\x39\xbb\xdb\xa9\xba\x46\x50\xac\x95\x26\xe8\xbe\x5e\xe3\x04\+    \\xa1\xfa\xd5\xf0\x6a\x2d\x51\x9a\x63\xef\x8c\xe2\x9a\x86\xee\x22\+    \\xc0\x89\xc2\xb8\x43\x24\x2e\xf6\xa5\x1e\x03\xaa\x9c\xf2\xd0\xa4\+    \\x83\xc0\x61\xba\x9b\xe9\x6a\x4d\x8f\xe5\x15\x50\xba\x64\x5b\xd6\+    \\x28\x26\xa2\xf9\xa7\x3a\x3a\xe1\x4b\xa9\x95\x86\xef\x55\x62\xe9\+    \\xc7\x2f\xef\xd3\xf7\x52\xf7\xda\x3f\x04\x6f\x69\x77\xfa\x0a\x59\+    \\x80\xe4\xa9\x15\x87\xb0\x86\x01\x9b\x09\xe6\xad\x3b\x3e\xe5\x93\+    \\xe9\x90\xfd\x5a\x9e\x34\xd7\x97\x2c\xf0\xb7\xd9\x02\x2b\x8b\x51\+    \\x96\xd5\xac\x3a\x01\x7d\xa6\x7d\xd1\xcf\x3e\xd6\x7c\x7d\x2d\x28\+    \\x1f\x9f\x25\xcf\xad\xf2\xb8\x9b\x5a\xd6\xb4\x72\x5a\x88\xf5\x4c\+    \\xe0\x29\xac\x71\xe0\x19\xa5\xe6\x47\xb0\xac\xfd\xed\x93\xfa\x9b\+    \\xe8\xd3\xc4\x8d\x28\x3b\x57\xcc\xf8\xd5\x66\x29\x79\x13\x2e\x28\+    \\x78\x5f\x01\x91\xed\x75\x60\x55\xf7\x96\x0e\x44\xe3\xd3\x5e\x8c\+    \\x15\x05\x6d\xd4\x88\xf4\x6d\xba\x03\xa1\x61\x25\x05\x64\xf0\xbd\+    \\xc3\xeb\x9e\x15\x3c\x90\x57\xa2\x97\x27\x1a\xec\xa9\x3a\x07\x2a\+    \\x1b\x3f\x6d\x9b\x1e\x63\x21\xf5\xf5\x9c\x66\xfb\x26\xdc\xf3\x19\+    \\x75\x33\xd9\x28\xb1\x55\xfd\xf5\x03\x56\x34\x82\x8a\xba\x3c\xbb\+    \\x28\x51\x77\x11\xc2\x0a\xd9\xf8\xab\xcc\x51\x67\xcc\xad\x92\x5f\+    \\x4d\xe8\x17\x51\x38\x30\xdc\x8e\x37\x9d\x58\x62\x93\x20\xf9\x91\+    \\xea\x7a\x90\xc2\xfb\x3e\x7b\xce\x51\x21\xce\x64\x77\x4f\xbe\x32\+    \\xa8\xb6\xe3\x7e\xc3\x29\x3d\x46\x48\xde\x53\x69\x64\x13\xe6\x80\+    \\xa2\xae\x08\x10\xdd\x6d\xb2\x24\x69\x85\x2d\xfd\x09\x07\x21\x66\+    \\xb3\x9a\x46\x0a\x64\x45\xc0\xdd\x58\x6c\xde\xcf\x1c\x20\xc8\xae\+    \\x5b\xbe\xf7\xdd\x1b\x58\x8d\x40\xcc\xd2\x01\x7f\x6b\xb4\xe3\xbb\+    \\xdd\xa2\x6a\x7e\x3a\x59\xff\x45\x3e\x35\x0a\x44\xbc\xb4\xcd\xd5\+    \\x72\xea\xce\xa8\xfa\x64\x84\xbb\x8d\x66\x12\xae\xbf\x3c\x6f\x47\+    \\xd2\x9b\xe4\x63\x54\x2f\x5d\x9e\xae\xc2\x77\x1b\xf6\x4e\x63\x70\+    \\x74\x0e\x0d\x8d\xe7\x5b\x13\x57\xf8\x72\x16\x71\xaf\x53\x7d\x5d\+    \\x40\x40\xcb\x08\x4e\xb4\xe2\xcc\x34\xd2\x46\x6a\x01\x15\xaf\x84\+    \\xe1\xb0\x04\x28\x95\x98\x3a\x1d\x06\xb8\x9f\xb4\xce\x6e\xa0\x48\+    \\x6f\x3f\x3b\x82\x35\x20\xab\x82\x01\x1a\x1d\x4b\x27\x72\x27\xf8\+    \\x61\x15\x60\xb1\xe7\x93\x3f\xdc\xbb\x3a\x79\x2b\x34\x45\x25\xbd\+    \\xa0\x88\x39\xe1\x51\xce\x79\x4b\x2f\x32\xc9\xb7\xa0\x1f\xba\xc9\+    \\xe0\x1c\xc8\x7e\xbc\xc7\xd1\xf6\xcf\x01\x11\xc3\xa1\xe8\xaa\xc7\+    \\x1a\x90\x87\x49\xd4\x4f\xbd\x9a\xd0\xda\xde\xcb\xd5\x0a\xda\x38\+    \\x03\x39\xc3\x2a\xc6\x91\x36\x67\x8d\xf9\x31\x7c\xe0\xb1\x2b\x4f\+    \\xf7\x9e\x59\xb7\x43\xf5\xbb\x3a\xf2\xd5\x19\xff\x27\xd9\x45\x9c\+    \\xbf\x97\x22\x2c\x15\xe6\xfc\x2a\x0f\x91\xfc\x71\x9b\x94\x15\x25\+    \\xfa\xe5\x93\x61\xce\xb6\x9c\xeb\xc2\xa8\x64\x59\x12\xba\xa8\xd1\+    \\xb6\xc1\x07\x5e\xe3\x05\x6a\x0c\x10\xd2\x50\x65\xcb\x03\xa4\x42\+    \\xe0\xec\x6e\x0e\x16\x98\xdb\x3b\x4c\x98\xa0\xbe\x32\x78\xe9\x64\+    \\x9f\x1f\x95\x32\xe0\xd3\x92\xdf\xd3\xa0\x34\x2b\x89\x71\xf2\x1e\+    \\x1b\x0a\x74\x41\x4b\xa3\x34\x8c\xc5\xbe\x71\x20\xc3\x76\x32\xd8\+    \\xdf\x35\x9f\x8d\x9b\x99\x2f\x2e\xe6\x0b\x6f\x47\x0f\xe3\xf1\x1d\+    \\xe5\x4c\xda\x54\x1e\xda\xd8\x91\xce\x62\x79\xcf\xcd\x3e\x7e\x6f\+    \\x16\x18\xb1\x66\xfd\x2c\x1d\x05\x84\x8f\xd2\xc5\xf6\xfb\x22\x99\+    \\xf5\x23\xf3\x57\xa6\x32\x76\x23\x93\xa8\x35\x31\x56\xcc\xcd\x02\+    \\xac\xf0\x81\x62\x5a\x75\xeb\xb5\x6e\x16\x36\x97\x88\xd2\x73\xcc\+    \\xde\x96\x62\x92\x81\xb9\x49\xd0\x4c\x50\x90\x1b\x71\xc6\x56\x14\+    \\xe6\xc6\xc7\xbd\x32\x7a\x14\x0a\x45\xe1\xd0\x06\xc3\xf2\x7b\x9a\+    \\xc9\xaa\x53\xfd\x62\xa8\x0f\x00\xbb\x25\xbf\xe2\x35\xbd\xd2\xf6\+    \\x71\x12\x69\x05\xb2\x04\x02\x22\xb6\xcb\xcf\x7c\xcd\x76\x9c\x2b\+    \\x53\x11\x3e\xc0\x16\x40\xe3\xd3\x38\xab\xbd\x60\x25\x47\xad\xf0\+    \\xba\x38\x20\x9c\xf7\x46\xce\x76\x77\xaf\xa1\xc5\x20\x75\x60\x60\+    \\x85\xcb\xfe\x4e\x8a\xe8\x8d\xd8\x7a\xaa\xf9\xb0\x4c\xf9\xaa\x7e\+    \\x19\x48\xc2\x5c\x02\xfb\x8a\x8c\x01\xc3\x6a\xe4\xd6\xeb\xe1\xf9\+    \\x90\xd4\xf8\x69\xa6\x5c\xde\xa0\x3f\x09\x25\x2d\xc2\x08\xe6\x9f\+    \\xb7\x4e\x61\x32\xce\x77\xe2\x5b\x57\x8f\xdf\xe3\x3a\xc3\x72\xe6\+    \"#
+ Crypto/Cipher/Blowfish/Primitive.hs view
@@ -0,0 +1,154 @@+-- |+-- Module      : Crypto.Cipher.Blowfish.Primitive+-- License     : BSD-style+-- Stability   : experimental+-- Portability : Good++-- Rewritten by Vincent Hanquez (c) 2015+--+-- Original code:+--      Crypto.Cipher.Blowfish.Primitive, copyright (c) 2012 Stijn van Drongelen+--      based on: BlowfishAux.hs (C) 2002 HardCore SoftWare, Doug Hoyte+--           (as found in Crypto-4.2.4)++module Crypto.Cipher.Blowfish.Primitive+    ( Context+    , initBlowfish+    , encrypt+    , decrypt+    ) where++import           Control.Monad (when)+import           Data.Bits+import           Data.Word++import           Crypto.Error+import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.Words+import           Crypto.Internal.WordArray+import           Crypto.Cipher.Blowfish.Box++-- | variable keyed blowfish state+data Context = BF (Int -> Word32) -- p+                  (Int -> Word32) -- sbox0+                  (Int -> Word32) -- sbox1+                  (Int -> Word32) -- sbox2+                  (Int -> Word32) -- sbox2++instance NFData Context where+    rnf (BF p a b c d) = p `seq` a `seq` b `seq` c `seq` d `seq` ()++-- | Encrypt blocks+--+-- Input need to be a multiple of 8 bytes+encrypt :: ByteArray ba => Context -> ba -> ba+encrypt = cipher++-- | Decrypt blocks+--+-- Input need to be a multiple of 8 bytes+decrypt :: ByteArray ba => Context -> ba -> ba+decrypt = cipher . decryptContext++decryptContext :: Context -> Context+decryptContext (BF p s0 s1 s2 s3) = BF (\i -> p (17-i)) s0 s1 s2 s3++cipher :: ByteArray ba => Context -> ba -> ba+cipher ctx b+    | B.length b == 0         = B.empty+    | B.length b `mod` 8 /= 0 = error "invalid data length"+    | otherwise               = B.mapAsWord64 (coreCrypto ctx) b++-- | Initialize a new Blowfish context from a key.+--+-- key need to be between 0 to 448 bits.+initBlowfish :: ByteArrayAccess key => key -> CryptoFailable Context+initBlowfish key+    | len > (448 `div` 8) = CryptoFailed $ CryptoError_KeySizeInvalid+    | otherwise           = CryptoPassed $ makeKeySchedule key+  where len = B.length key++coreCrypto :: Context -> Word64 -> Word64+coreCrypto (BF p s0 s1 s2 s3) input = doRound input 0+  where+    -- transform the input @i over 16 rounds+    doRound :: Word64 -> Int -> Word64+    doRound i roundIndex+        | roundIndex == 16 =+            let final = (fromIntegral (p 16) `shiftL` 32) .|. fromIntegral (p 17)+             in rotateL (i `xor` final) 32+        | otherwise     =+            let newr = fromIntegral (i `shiftR` 32) `xor` (p roundIndex)+                newi = ((i `shiftL` 32) `xor` (f newr)) .|. (fromIntegral newr)+             in doRound newi (roundIndex+1)++    f   :: Word32 -> Word64+    f t = let a = s0 (fromIntegral $ (t `shiftR` 24) .&. 0xff)+              b = s1 (fromIntegral $ (t `shiftR` 16) .&. 0xff)+              c = s2 (fromIntegral $ (t `shiftR` 8) .&. 0xff)+              d = s3 (fromIntegral $ t .&. 0xff)+           in fromIntegral (((a + b) `xor` c) + d) `shiftL` 32++makeKeySchedule :: ByteArrayAccess key => key -> Context+makeKeySchedule key =+    let v = unsafeDoIO $ do+              let len = B.length key+              mv <- createKeySchedule+              when (len > 0) $ forM_ [0..17] $ \i -> do+                    let a = B.index key ((i * 4 + 0) `mod` len)+                        b = B.index key ((i * 4 + 1) `mod` len)+                        c = B.index key ((i * 4 + 2) `mod` len)+                        d = B.index key ((i * 4 + 3) `mod` len)+                        k = (fromIntegral a `shiftL` 24) .|.+                            (fromIntegral b `shiftL` 16) .|.+                            (fromIntegral c `shiftL`  8) .|.+                            (fromIntegral d)+                    mutableArrayWriteXor32 mv i k+              prepare mv+              mutableArray32Freeze mv+     in BF (\i -> arrayRead32 v i)+           (\i -> arrayRead32 v (s0+i))+           (\i -> arrayRead32 v (s1+i))+           (\i -> arrayRead32 v (s2+i))+           (\i -> arrayRead32 v (s3+i))+  where+        s0 = 18+        s1 = 274+        s2 = 530+        s3 = 786++        prepare mctx = loop 0 0+          where loop i input+                  | i == 1042   = return ()+                  | otherwise = do+                      ninput <- coreCryptoMutable input+                      let (nl, nr) = w64to32 ninput+                      mutableArrayWrite32 mctx i     nl+                      mutableArrayWrite32 mctx (i+1) nr+                      loop (i+2) ninput++                coreCryptoMutable :: Word64 -> IO Word64+                coreCryptoMutable input = doRound input 0+                  where doRound i roundIndex+                          | roundIndex == 16 = do+                              pVal1 <- mutableArrayRead32 mctx 16+                              pVal2 <- mutableArrayRead32 mctx 17+                              let final = (fromIntegral pVal1 `shiftL` 32) .|. fromIntegral pVal2+                              return $ rotateL (i `xor` final) 32+                          | otherwise     = do+                              pVal <- mutableArrayRead32 mctx roundIndex+                              let newr = fromIntegral (i `shiftR` 32) `xor` pVal+                              newr' <- f newr+                              let newi = ((i `shiftL` 32) `xor` newr') .|. (fromIntegral newr)+                              doRound newi (roundIndex+1)+++                f   :: Word32 -> IO Word64+                f t = do a <- mutableArrayRead32 mctx (s0 + fromIntegral ((t `shiftR` 24) .&. 0xff))+                         b <- mutableArrayRead32 mctx (s1 + fromIntegral ((t `shiftR` 16) .&. 0xff))+                         c <- mutableArrayRead32 mctx (s2 + fromIntegral ((t `shiftR` 8) .&. 0xff))+                         d <- mutableArrayRead32 mctx (s3 + fromIntegral (t .&. 0xff))+                         return (fromIntegral (((a + b) `xor` c) + d) `shiftL` 32)
+ Crypto/Cipher/Camellia.hs view
@@ -0,0 +1,28 @@+-- |+-- Module      : Crypto.Cipher.Camellia+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- Camellia support. only 128 bit variant available for now.++module Crypto.Cipher.Camellia+    ( Camellia128+    ) where++import Crypto.Cipher.Camellia.Primitive+import Crypto.Cipher.Types++-- | Camellia block cipher with 128 bit key+newtype Camellia128 = Camellia128 Camellia++instance Cipher Camellia128 where+    cipherName    _ = "Camellia128"+    cipherKeySize _ = KeySizeFixed 16+    cipherInit k    = Camellia128 `fmap` initCamellia k++instance BlockCipher Camellia128 where+    blockSize _ = 16+    ecbEncrypt (Camellia128 key) = encrypt key+    ecbDecrypt (Camellia128 key) = decrypt key
+ Crypto/Cipher/Camellia/Primitive.hs view
@@ -0,0 +1,283 @@++-- |+-- Module      : Crypto.Cipher.Camellia.Primitive+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- this only cover Camellia 128 bits for now, API will change once+-- 192 and 256 mode are implemented too+{-# LANGUAGE MagicHash #-}+module Crypto.Cipher.Camellia.Primitive+    ( Camellia+    , initCamellia+    , encrypt+    , decrypt+    ) where++import           Data.Word+import           Data.Bits++import           Crypto.Error+import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.Words+import           Crypto.Internal.WordArray+import           Data.Memory.Endian++data Mode = Decrypt | Encrypt++w64tow128 :: (Word64, Word64) -> Word128+w64tow128 (x1, x2) = Word128 x1 x2++w64tow8 :: Word64 -> (Word8, Word8, Word8, Word8, Word8, Word8, Word8, Word8)+w64tow8 x = (t1, t2, t3, t4, t5, t6, t7, t8)+    where+        t1 = fromIntegral (x `shiftR` 56)+        t2 = fromIntegral (x `shiftR` 48)+        t3 = fromIntegral (x `shiftR` 40)+        t4 = fromIntegral (x `shiftR` 32)+        t5 = fromIntegral (x `shiftR` 24)+        t6 = fromIntegral (x `shiftR` 16)+        t7 = fromIntegral (x `shiftR` 8)+        t8 = fromIntegral (x)++w8tow64 :: (Word8, Word8, Word8, Word8, Word8, Word8, Word8, Word8) -> Word64+w8tow64 (t1,t2,t3,t4,t5,t6,t7,t8) =+    (fromIntegral t1 `shiftL` 56) .|.+    (fromIntegral t2 `shiftL` 48) .|.+    (fromIntegral t3 `shiftL` 40) .|.+    (fromIntegral t4 `shiftL` 32) .|.+    (fromIntegral t5 `shiftL` 24) .|.+    (fromIntegral t6 `shiftL` 16) .|.+    (fromIntegral t7 `shiftL` 8)  .|.+    (fromIntegral t8)++sbox :: Int -> Word8+sbox = arrayRead8 t+  where t = array8+            "\x70\x82\x2c\xec\xb3\x27\xc0\xe5\xe4\x85\x57\x35\xea\x0c\xae\x41\+            \\x23\xef\x6b\x93\x45\x19\xa5\x21\xed\x0e\x4f\x4e\x1d\x65\x92\xbd\+            \\x86\xb8\xaf\x8f\x7c\xeb\x1f\xce\x3e\x30\xdc\x5f\x5e\xc5\x0b\x1a\+            \\xa6\xe1\x39\xca\xd5\x47\x5d\x3d\xd9\x01\x5a\xd6\x51\x56\x6c\x4d\+            \\x8b\x0d\x9a\x66\xfb\xcc\xb0\x2d\x74\x12\x2b\x20\xf0\xb1\x84\x99\+            \\xdf\x4c\xcb\xc2\x34\x7e\x76\x05\x6d\xb7\xa9\x31\xd1\x17\x04\xd7\+            \\x14\x58\x3a\x61\xde\x1b\x11\x1c\x32\x0f\x9c\x16\x53\x18\xf2\x22\+            \\xfe\x44\xcf\xb2\xc3\xb5\x7a\x91\x24\x08\xe8\xa8\x60\xfc\x69\x50\+            \\xaa\xd0\xa0\x7d\xa1\x89\x62\x97\x54\x5b\x1e\x95\xe0\xff\x64\xd2\+            \\x10\xc4\x00\x48\xa3\xf7\x75\xdb\x8a\x03\xe6\xda\x09\x3f\xdd\x94\+            \\x87\x5c\x83\x02\xcd\x4a\x90\x33\x73\x67\xf6\xf3\x9d\x7f\xbf\xe2\+            \\x52\x9b\xd8\x26\xc8\x37\xc6\x3b\x81\x96\x6f\x4b\x13\xbe\x63\x2e\+            \\xe9\x79\xa7\x8c\x9f\x6e\xbc\x8e\x29\xf5\xf9\xb6\x2f\xfd\xb4\x59\+            \\x78\x98\x06\x6a\xe7\x46\x71\xba\xd4\x25\xab\x42\x88\xa2\x8d\xfa\+            \\x72\x07\xb9\x55\xf8\xee\xac\x0a\x36\x49\x2a\x68\x3c\x38\xf1\xa4\+            \\x40\x28\xd3\x7b\xbb\xc9\x43\xc1\x15\xe3\xad\xf4\x77\xc7\x80\x9e"#++sbox1 :: Word8 -> Word8+sbox1 x = sbox (fromIntegral x)++sbox2 :: Word8 -> Word8+sbox2 x = sbox1 x `rotateL` 1++sbox3 :: Word8 -> Word8+sbox3 x = sbox1 x `rotateL` 7++sbox4 :: Word8 -> Word8+sbox4 x = sbox1 (x `rotateL` 1)++sigma1, sigma2, sigma3, sigma4, sigma5, sigma6 :: Word64+sigma1 = 0xA09E667F3BCC908B+sigma2 = 0xB67AE8584CAA73B2+sigma3 = 0xC6EF372FE94F82BE+sigma4 = 0x54FF53A5F1D36F1C+sigma5 = 0x10E527FADE682D1D+sigma6 = 0xB05688C2B3E6C1FD++rotl128 :: Word128 -> Int -> Word128+rotl128 v               0  = v+rotl128 (Word128 x1 x2) 64 = Word128 x2 x1++rotl128 v@(Word128 x1 x2) w+    | w > 64    = (v `rotl128` 64) `rotl128` (w - 64)+    | otherwise = Word128 (x1high .|. x2low) (x2high .|. x1low)+        where+            splitBits i = (i .&. complement x, i .&. x)+                where x = 2 ^ w - 1+            (x1high, x1low) = splitBits (x1 `rotateL` w)+            (x2high, x2low) = splitBits (x2 `rotateL` w)++-- | Camellia context+data Camellia = Camellia+    { k  :: Array64+    , kw :: Array64+    , ke :: Array64+    }++setKeyInterim :: ByteArrayAccess key => key -> (Word128, Word128, Word128, Word128)+setKeyInterim keyseed = (w64tow128 kL, w64tow128 kR, w64tow128 kA, w64tow128 kB)+  where kL = (fromBE $ B.toW64BE keyseed 0, fromBE $ B.toW64BE keyseed 8)+        kR = (0, 0)++        kA = let d1 = (fst kL `xor` fst kR)+                 d2 = (snd kL `xor` snd kR)+                 d3 = d2 `xor` feistel d1 sigma1+                 d4 = d1 `xor` feistel d3 sigma2+                 d5 = d4 `xor` (fst kL)+                 d6 = d3 `xor` (snd kL)+                 d7 = d6 `xor` feistel d5 sigma3+                 d8 = d5 `xor` feistel d7 sigma4+              in (d8, d7)++        kB = let d1 = (fst kA `xor` fst kR)+                 d2 = (snd kA `xor` snd kR)+                 d3 = d2 `xor` feistel d1 sigma5+                 d4 = d1 `xor` feistel d3 sigma6+              in (d4, d3)++-- | Initialize a 128-bit key+--+-- Return the initialized key or a error message if the given +-- keyseed was not 16-bytes in length.+initCamellia :: ByteArray key+             => key -- ^ The key to create the camellia context+             -> CryptoFailable Camellia+initCamellia key+    | B.length key /= 16 = CryptoFailed $ CryptoError_KeySizeInvalid+    | otherwise          =+        let (kL, _, kA, _) = setKeyInterim key in++        let (Word128 kw1 kw2) = (kL `rotl128` 0) in+        let (Word128 k1 k2)   = (kA `rotl128` 0) in+        let (Word128 k3 k4)   = (kL `rotl128` 15) in+        let (Word128 k5 k6)   = (kA `rotl128` 15) in+        let (Word128 ke1 ke2) = (kA `rotl128` 30) in --ke1 = (KA <<<  30) >> 64; ke2 = (KA <<<  30) & MASK64;+        let (Word128 k7 k8)   = (kL `rotl128` 45) in --k7  = (KL <<<  45) >> 64; k8  = (KL <<<  45) & MASK64;+        let (Word128 k9 _)    = (kA `rotl128` 45) in --k9  = (KA <<<  45) >> 64;+        let (Word128 _ k10)   = (kL `rotl128` 60) in+        let (Word128 k11 k12) = (kA `rotl128` 60) in+        let (Word128 ke3 ke4) = (kL `rotl128` 77) in+        let (Word128 k13 k14) = (kL `rotl128` 94) in+        let (Word128 k15 k16) = (kA `rotl128` 94) in+        let (Word128 k17 k18) = (kL `rotl128` 111) in+        let (Word128 kw3 kw4) = (kA `rotl128` 111) in++        CryptoPassed $ Camellia+            { kw = array64 4 [ kw1, kw2, kw3, kw4 ]+            , ke = array64 4 [ ke1, ke2, ke3, ke4 ]+            , k  = array64 18 [ k1, k2, k3, k4, k5, k6, k7, k8, k9, k10, k11, k12, k13, k14, k15, k16, k17, k18 ]+            }++feistel :: Word64 -> Word64 -> Word64+feistel fin sk = +    let x = fin `xor` sk in+    let (t1, t2, t3, t4, t5, t6, t7, t8) = w64tow8 x in+    let t1' = sbox1 t1 in+    let t2' = sbox2 t2 in+    let t3' = sbox3 t3 in+    let t4' = sbox4 t4 in+    let t5' = sbox2 t5 in+    let t6' = sbox3 t6 in+    let t7' = sbox4 t7 in+    let t8' = sbox1 t8 in+    let y1 = t1' `xor` t3' `xor` t4' `xor` t6' `xor` t7' `xor` t8' in+    let y2 = t1' `xor` t2' `xor` t4' `xor` t5' `xor` t7' `xor` t8' in+    let y3 = t1' `xor` t2' `xor` t3' `xor` t5' `xor` t6' `xor` t8' in+    let y4 = t2' `xor` t3' `xor` t4' `xor` t5' `xor` t6' `xor` t7' in+    let y5 = t1' `xor` t2' `xor` t6' `xor` t7' `xor` t8' in+    let y6 = t2' `xor` t3' `xor` t5' `xor` t7' `xor` t8' in+    let y7 = t3' `xor` t4' `xor` t5' `xor` t6' `xor` t8' in+    let y8 = t1' `xor` t4' `xor` t5' `xor` t6' `xor` t7' in+    w8tow64 (y1, y2, y3, y4, y5, y6, y7, y8)++fl :: Word64 -> Word64 -> Word64+fl fin sk =+    let (x1, x2) = w64to32 fin in+    let (k1, k2) = w64to32 sk in+    let y2 = x2 `xor` ((x1 .&. k1) `rotateL` 1) in+    let y1 = x1 `xor` (y2 .|. k2) in+    w32to64 (y1, y2)++flinv :: Word64 -> Word64 -> Word64+flinv fin sk =+    let (y1, y2) = w64to32 fin in+    let (k1, k2) = w64to32 sk in+    let x1 = y1 `xor` (y2 .|. k2) in+    let x2 = y2 `xor` ((x1 .&. k1) `rotateL` 1) in+    w32to64 (x1, x2)++{- in decrypt mode 0->17 1->16 ... -}+getKeyK :: Mode -> Camellia -> Int -> Word64+getKeyK Encrypt key i = k key `arrayRead64` i+getKeyK Decrypt key i = k key `arrayRead64` (17 - i)++{- in decrypt mode 0->3 1->2 2->1 3->0 -}+getKeyKe :: Mode -> Camellia -> Int -> Word64+getKeyKe Encrypt key i = ke key `arrayRead64` i+getKeyKe Decrypt key i = ke key `arrayRead64` (3 - i)++{- in decrypt mode 0->2 1->3 2->0 3->1 -}+getKeyKw :: Mode -> Camellia -> Int -> Word64+getKeyKw Encrypt key i = (kw key) `arrayRead64` i+getKeyKw Decrypt key i = (kw key) `arrayRead64` ((i + 2) `mod` 4)++{- perform the following+    D2 = D2 ^ F(D1, k1);     // Round 1+    D1 = D1 ^ F(D2, k2);     // Round 2+    D2 = D2 ^ F(D1, k3);     // Round 3+    D1 = D1 ^ F(D2, k4);     // Round 4+    D2 = D2 ^ F(D1, k5);     // Round 5+    D1 = D1 ^ F(D2, k6);     // Round 6+ -}+doBlockRound :: Mode -> Camellia -> Word64 -> Word64 -> Int -> (Word64, Word64)+doBlockRound mode key d1 d2 i =+    let r1 = d2 `xor` feistel d1 (getKeyK mode key (0+i)) in     {- Round 1+i -}+    let r2 = d1 `xor` feistel r1 (getKeyK mode key (1+i)) in     {- Round 2+i -}+    let r3 = r1 `xor` feistel r2 (getKeyK mode key (2+i)) in     {- Round 3+i -}+    let r4 = r2 `xor` feistel r3 (getKeyK mode key (3+i)) in     {- Round 4+i -}+    let r5 = r3 `xor` feistel r4 (getKeyK mode key (4+i)) in     {- Round 5+i -}+    let r6 = r4 `xor` feistel r5 (getKeyK mode key (5+i)) in     {- Round 6+i -}+    (r6, r5)++doBlock :: Mode -> Camellia -> Word128 -> Word128+doBlock mode key (Word128 d1 d2) =+    let d1a = d1 `xor` (getKeyKw mode key 0) in {- Prewhitening -}+    let d2a = d2 `xor` (getKeyKw mode key 1) in++    let (d1b, d2b) = doBlockRound mode key d1a d2a 0 in++    let d1c = fl    d1b (getKeyKe mode key 0) in {- FL -}+    let d2c = flinv d2b (getKeyKe mode key 1) in {- FLINV -}++    let (d1d, d2d) = doBlockRound mode key d1c d2c 6 in++    let d1e = fl    d1d (getKeyKe mode key 2) in {- FL -}+    let d2e = flinv d2d (getKeyKe mode key 3) in {- FLINV -}++    let (d1f, d2f) = doBlockRound mode key d1e d2e 12 in++    let d2g = d2f `xor` (getKeyKw mode key 2) in {- Postwhitening -}+    let d1g = d1f `xor` (getKeyKw mode key 3) in+    w64tow128 (d2g, d1g)++{- encryption for 128 bits blocks -}+encryptBlock :: Camellia -> Word128 -> Word128+encryptBlock = doBlock Encrypt++{- decryption for 128 bits blocks -}+decryptBlock :: Camellia -> Word128 -> Word128+decryptBlock = doBlock Decrypt++-- | Encrypts the given ByteString using the given Key+encrypt :: ByteArray ba+        => Camellia     -- ^ The key to use+        -> ba           -- ^ The data to encrypt+        -> ba+encrypt key = B.mapAsWord128 (encryptBlock key)++-- | Decrypts the given ByteString using the given Key+decrypt :: ByteArray ba+        => Camellia     -- ^ The key to use+        -> ba           -- ^ The data to decrypt+        -> ba+decrypt key = B.mapAsWord128 (decryptBlock key)
+ Crypto/Cipher/ChaCha.hs view
@@ -0,0 +1,124 @@+-- |+-- Module      : Crypto.Cipher.ChaCha+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.ChaCha+    ( initialize+    , combine+    , generate+    , State+    -- * simple interface for DRG purpose+    , initializeSimple+    , generateSimple+    , StateSimple+    ) where++import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray, ScrubbedBytes)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Foreign.Ptr+import           Foreign.C.Types++-- | ChaCha context+newtype State = State ScrubbedBytes+    deriving (NFData)++-- | ChaCha context for DRG purpose (see Crypto.Random.ChaChaDRG)+newtype StateSimple = StateSimple ScrubbedBytes -- just ChaCha's state+    deriving (NFData)++-- | Initialize a new ChaCha context with the number of rounds,+-- the key and the nonce associated.+initialize :: (ByteArrayAccess key, ByteArrayAccess nonce)+           => Int   -- ^ number of rounds (8,12,20)+           -> key   -- ^ the key (128 or 256 bits)+           -> nonce -- ^ the nonce (64 or 96 bits)+           -> State -- ^ the initial ChaCha state+initialize nbRounds key nonce+    | not (kLen `elem` [16,32])       = error "ChaCha: key length should be 128 or 256 bits"+    | not (nonceLen `elem` [8,12])    = error "ChaCha: nonce length should be 64 or 96 bits"+    | not (nbRounds `elem` [8,12,20]) = error "ChaCha: rounds should be 8, 12 or 20"+    | otherwise                       = unsafeDoIO $ do+        stPtr <- B.alloc 132 $ \stPtr ->+            B.withByteArray nonce $ \noncePtr  ->+            B.withByteArray key   $ \keyPtr ->+                ccryptonite_chacha_init stPtr (fromIntegral nbRounds) kLen keyPtr nonceLen noncePtr+        return $ State stPtr+  where kLen     = B.length key+        nonceLen = B.length nonce++-- | Initialize simple ChaCha State+initializeSimple :: ByteArray seed+                 => seed -- ^ a 40 bytes long seed+                 -> StateSimple+initializeSimple seed+    | sLen /= 40 = error "ChaCha Random: seed length should be 40 bytes"+    | otherwise = unsafeDoIO $ do+        stPtr <- B.alloc 64 $ \stPtr ->+                    B.withByteArray seed $ \seedPtr ->+                        ccryptonite_chacha_init_core stPtr 32 seedPtr 8 (seedPtr `plusPtr` 32)+        return $ StateSimple stPtr+  where+    sLen = B.length seed++-- | Combine the chacha output and an arbitrary message with a xor,+-- and return the combined output and the new state.+combine :: ByteArray ba+        => State       -- ^ the current ChaCha state+        -> ba          -- ^ the source to xor with the generator+        -> (ba, State)+combine prevSt@(State prevStMem) src+    | B.null src = (B.empty, prevSt)+    | otherwise  = unsafeDoIO $ do+        (out, st) <- B.copyRet prevStMem $ \ctx ->+            B.alloc (B.length src) $ \dstPtr ->+            B.withByteArray src    $ \srcPtr ->+                ccryptonite_chacha_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)+        return (out, State st)++-- | Generate a number of bytes from the ChaCha output directly+generate :: ByteArray ba+         => State -- ^ the current ChaCha state+         -> Int   -- ^ the length of data to generate+         -> (ba, State)+generate prevSt@(State prevStMem) len+    | len <= 0  = (B.empty, prevSt)+    | otherwise = unsafeDoIO $ do+        (out, st) <- B.copyRet prevStMem $ \ctx ->+            B.alloc len $ \dstPtr ->+                ccryptonite_chacha_generate dstPtr ctx (fromIntegral len)+        return (out, State st)++-- | similar to 'generate' but assume certains values+generateSimple :: ByteArray ba+               => StateSimple+               -> Int+               -> (ba, StateSimple)+generateSimple (StateSimple prevSt) nbBytes = unsafeDoIO $ do+    newSt  <- B.copy prevSt (\_ -> return ())+    output <- B.alloc nbBytes $ \dstPtr ->+        B.withByteArray newSt $ \stPtr ->+            ccryptonite_chacha_random 8 dstPtr stPtr (fromIntegral nbBytes)+    return (output, StateSimple newSt)++foreign import ccall "cryptonite_chacha_init_core"+    ccryptonite_chacha_init_core :: Ptr StateSimple -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()++foreign import ccall "cryptonite_chacha_init"+    ccryptonite_chacha_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()++foreign import ccall "cryptonite_chacha_combine"+    ccryptonite_chacha_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall "cryptonite_chacha_generate"+    ccryptonite_chacha_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()++foreign import ccall "cryptonite_chacha_random"+    ccryptonite_chacha_random :: Int -> Ptr Word8 -> Ptr StateSimple -> CUInt -> IO ()+
+ Crypto/Cipher/DES.hs view
@@ -0,0 +1,39 @@+-- |+-- Module      : Crypto.Cipher.DES+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+module Crypto.Cipher.DES+    ( DES+    ) where++import           Data.Word+import           Crypto.Error+import           Crypto.Cipher.Types+import           Crypto.Cipher.DES.Primitive+import           Crypto.Internal.ByteArray (ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B+import           Data.Memory.Endian++-- | DES Context+data DES = DES Word64+    deriving (Eq)++instance Cipher DES where+    cipherName    _ = "DES"+    cipherKeySize _ = KeySizeFixed 8+    cipherInit k    = initDES k++instance BlockCipher DES where+    blockSize _ = 8+    ecbEncrypt (DES key) = B.mapAsWord64 (unBlock . encrypt key . Block)+    ecbDecrypt (DES key) = B.mapAsWord64 (unBlock . decrypt key . Block)++initDES :: ByteArrayAccess key => key -> CryptoFailable DES+initDES k+    | len == 8  = CryptoPassed $ DES key+    | otherwise = CryptoFailed $ CryptoError_KeySizeInvalid+  where len = B.length k+        key = fromBE $ B.toW64BE k 0
+ Crypto/Cipher/DES/Primitive.hs view
@@ -0,0 +1,223 @@+{-# LANGUAGE FlexibleInstances #-}++-----------------------------------------------------------------------------+-- |+-- Module      :  Crypto.Cipher.DES.Primitive+-- License     :  BSD-style+--+-- This module is copy of DES module from Crypto package.+-- http://hackage.haskell.org/package/Crypto+--+-----------------------------------------------------------------------------+++module Crypto.Cipher.DES.Primitive+    ( encrypt+    , decrypt+    , Block(..)+    ) where++import Data.Word+import Data.Bits++-- | a DES block (64 bits)+newtype Block = Block { unBlock :: Word64 }++type Rotation = Int+type Key     = Word64++type Bits4  = [Bool]+type Bits6  = [Bool]+type Bits32 = [Bool]+type Bits48 = [Bool]+type Bits56 = [Bool]+type Bits64 = [Bool]++desXor :: [Bool] -> [Bool] -> [Bool]+desXor a b = zipWith (/=) a b++desRotate :: [Bool] -> Int -> [Bool]+desRotate bits rot = drop rot' bits ++ take rot' bits+  where rot' = rot `mod` length bits++bitify :: Word64 -> Bits64+bitify w = map (\b -> w .&. (shiftL 1 b) /= 0) [63,62..0]++unbitify :: Bits64 -> Word64+unbitify bs = foldl (\i b -> if b then 1 + shiftL i 1 else shiftL i 1) 0 bs++initial_permutation :: Bits64 -> Bits64+initial_permutation mb = map ((!!) mb) i+ where i = [57, 49, 41, 33, 25, 17,  9, 1, 59, 51, 43, 35, 27, 19, 11, 3,+            61, 53, 45, 37, 29, 21, 13, 5, 63, 55, 47, 39, 31, 23, 15, 7,+            56, 48, 40, 32, 24, 16,  8, 0, 58, 50, 42, 34, 26, 18, 10, 2,+            60, 52, 44, 36, 28, 20, 12, 4, 62, 54, 46, 38, 30, 22, 14, 6]++{-+"\x39\x31\x29\x21\x19\x11\x09\x01\x3b\x33\x2b\x23\x1b\x13\+\\x0b\x03\x3d\x35\x2d\x25\x1d\x15\x0d\x05\x3f\x37\x2f\x27\+\\x1f\x17\x0f\x07\x38\x30\x28\x20\x18\x10\x08\x00\x3a\x32\+\\x2a\x22\x1a\x12\x0a\x02\x3c\x34\x2c\x24\x1c\x14\x0c\x04\+\\x3e\x36\x2e\x26\x1e\x16\x0e\x06"+-}++key_transformation :: Bits64 -> Bits56+key_transformation kb = map ((!!) kb) i+ where i = [56, 48, 40, 32, 24, 16,  8,  0, 57, 49, 41, 33, 25, 17,+             9,  1, 58, 50, 42, 34, 26, 18, 10,  2, 59, 51, 43, 35,+            62, 54, 46, 38, 30, 22, 14,  6, 61, 53, 45, 37, 29, 21,+            13,  5, 60, 52, 44, 36, 28, 20, 12,  4, 27, 19, 11,  3]+{-+"\x38\x30\x28\x20\x18\x10\x08\x00\x39\x31\x29\x21\x19\x11\+\\x09\x01\x3a\x32\x2a\x22\x1a\x12\x0a\x02\x3b\x33\x2b\x23\+\\x3e\x36\x2e\x26\x1e\x16\x0e\x06\x3d\x35\x2d\x25\x1d\x15\+\\x0d\x05\x3c\x34\x2c\x24\x1c\x14\x0c\x04\x1b\x13\x0b\x03"+-}+++des_enc :: Block -> Key -> Block+des_enc = do_des [1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28]++des_dec :: Block -> Key -> Block+des_dec = do_des [28,27,25,23,21,19,17,15,14,12,10,8,6,4,2,1]++do_des :: [Rotation] -> Block -> Key -> Block+do_des rots (Block m) k = Block $ des_work rots (takeDrop 32 mb) kb+ where kb = key_transformation $ bitify k+       mb = initial_permutation $ bitify m++des_work :: [Rotation] -> (Bits32, Bits32) -> Bits56 -> Word64+des_work [] (ml, mr) _ = unbitify $ final_perm $ (mr ++ ml)+des_work (r:rs) mb kb = des_work rs mb' kb+ where mb' = do_round r mb kb++do_round :: Rotation -> (Bits32, Bits32) -> Bits56 -> (Bits32, Bits32)+do_round r (ml, mr) kb = (mr, m')+ where kb' = get_key kb r+       comp_kb = compression_permutation kb'+       expa_mr = expansion_permutation mr+       res = comp_kb `desXor` expa_mr+       res' = tail $ iterate (trans 6) ([], res)+       trans n (_, b) = (take n b, drop n b)+       res_s = concat $ zipWith (\f (x,_) -> f x) [s_box_1, s_box_2,+                                                   s_box_3, s_box_4,+                                                   s_box_5, s_box_6,+                                                   s_box_7, s_box_8] res'+       res_p = p_box res_s+       m' = res_p `desXor` ml++get_key :: Bits56 -> Rotation -> Bits56+get_key kb r = kb'+ where (kl, kr) = takeDrop 28 kb+       kb' = desRotate kl r ++ desRotate kr r++compression_permutation :: Bits56 -> Bits48+compression_permutation kb = map ((!!) kb) i+ where i = [13, 16, 10, 23,  0,  4,  2, 27, 14,  5, 20,  9,+            22, 18, 11,  3, 25,  7, 15,  6, 26, 19, 12,  1,+            40, 51, 30, 36, 46, 54, 29, 39, 50, 44, 32, 47,+            43, 48, 38, 55, 33, 52, 45, 41, 49, 35, 28, 31]++expansion_permutation :: Bits32 -> Bits48+expansion_permutation mb = map ((!!) mb) i+ where i = [31,  0,  1,  2,  3,  4,  3,  4,  5,  6,  7,  8,+             7,  8,  9, 10, 11, 12, 11, 12, 13, 14, 15, 16,+            15, 16, 17, 18, 19, 20, 19, 20, 21, 22, 23, 24,+            23, 24, 25, 26, 27, 28, 27, 28, 29, 30, 31,  0]++s_box :: [[Word8]] -> Bits6 -> Bits4+s_box s [a,b,c,d,e,f] = to_bool 4 $ (s !! row) !! col+ where row = sum $ zipWith numericise [a,f]     [1, 0]+       col = sum $ zipWith numericise [b,c,d,e] [3, 2, 1, 0]+       numericise :: Bool -> Int -> Int+       numericise = (\x y -> if x then 2^y else 0)++       to_bool :: Int -> Word8 -> [Bool]+       to_bool 0 _ = []+       to_bool n i = ((i .&. 8) == 8):to_bool (n-1) (shiftL i 1)+s_box _ _             = error "DES: internal error bits6 more than 6 elements"++s_box_1 :: Bits6 -> Bits4+s_box_1 = s_box i+ where i = [[14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7],+            [ 0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8],+            [ 4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0],+            [15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13]]++s_box_2 :: Bits6 -> Bits4+s_box_2 = s_box i+ where i = [[15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10],+            [3,  13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9,  11, 5],+            [0,  14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15],+            [13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5,  14, 9]]++s_box_3 :: Bits6 -> Bits4+s_box_3 = s_box i+ where i = [[10,  0,  9, 14 , 6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8],+            [13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1],+            [13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7],+            [1,  10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12]]++s_box_4 :: Bits6 -> Bits4+s_box_4 = s_box i+ where i = [[7,  13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15],+            [13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9],+            [10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4],+            [3,  15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14]]++s_box_5 :: Bits6 -> Bits4+s_box_5 = s_box i+ where i = [[2,  12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9],+            [14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6],+            [4,   2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14],+            [11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3]]++s_box_6 :: Bits6 -> Bits4+s_box_6 = s_box i+ where i = [[12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11],+            [10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8],+            [9,  14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6],+            [4,  3,   2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13]]++s_box_7 :: Bits6 -> Bits4+s_box_7 = s_box i+ where i = [[4,  11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1],+            [13, 0,  11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6],+            [1,  4,  11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2],+            [6,  11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12]]++s_box_8 :: Bits6 -> Bits4+s_box_8 = s_box i+ where i = [[13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7],+            [1,  15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2],+            [7,  11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8],+            [2,   1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11]]++p_box :: Bits32 -> Bits32+p_box kb = map ((!!) kb) i+ where i = [15, 6, 19, 20, 28, 11, 27, 16,  0, 14, 22, 25,  4, 17, 30,  9,+             1, 7, 23, 13, 31, 26,  2,  8, 18, 12, 29,  5, 21, 10,  3, 24]++final_perm :: Bits64 -> Bits64+final_perm kb = map ((!!) kb) i+ where i = [39, 7, 47, 15, 55, 23, 63, 31, 38, 6, 46, 14, 54, 22, 62, 30,+            37, 5, 45, 13, 53, 21, 61, 29, 36, 4, 44, 12, 52, 20, 60, 28,+            35, 3, 43, 11, 51, 19, 59, 27, 34, 2, 42, 10, 50, 18, 58, 26,+            33, 1, 41,  9, 49, 17, 57, 25, 32, 0, 40 , 8, 48, 16, 56, 24]++takeDrop :: Int -> [a] -> ([a], [a])+takeDrop _ [] = ([], [])+takeDrop 0 xs = ([], xs)+takeDrop n (x:xs) = (x:ys, zs)+ where (ys, zs) = takeDrop (n-1) xs+++-- | Basic DES encryption which takes a key and a block of plaintext+-- and returns the encrypted block of ciphertext according to the standard.+encrypt :: Word64 -> Block -> Block+encrypt = flip des_enc++-- | Basic DES decryption which takes a key and a block of ciphertext and+-- returns the decrypted block of plaintext according to the standard.+decrypt :: Word64 -> Block -> Block+decrypt = flip des_dec
+ Crypto/Cipher/RC4.hs view
@@ -0,0 +1,79 @@+-- |+-- Module      : Crypto.Cipher.RC4+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Good+--+-- Simple implementation of the RC4 stream cipher.+-- http://en.wikipedia.org/wiki/RC4+--+-- Initial FFI implementation by Peter White <peter@janrain.com>+--+-- Reorganized and simplified to have an opaque context.+--+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.RC4+    ( initialize+    , combine+    , generate+    , State+    ) where++import           Data.Word+import           Foreign.Ptr+import           Crypto.Internal.ByteArray (ScrubbedBytes, ByteArray, ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B++import           Crypto.Internal.Compat+import           Crypto.Internal.Imports++-- | The encryption state for RC4+newtype State = State ScrubbedBytes+    deriving (ByteArrayAccess,NFData)++-- | C Call for initializing the encryptor+foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_init"+    c_rc4_init :: Ptr Word8 -- ^ The rc4 key+               -> Word32    -- ^ The key length+               -> Ptr State -- ^ The context+               -> IO ()++foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_combine"+    c_rc4_combine :: Ptr State        -- ^ Pointer to the permutation+                  -> Ptr Word8      -- ^ Pointer to the clear text+                  -> Word32         -- ^ Length of the clear text+                  -> Ptr Word8      -- ^ Output buffer+                  -> IO ()++-- | RC4 context initialization.+--+-- seed the context with an initial key. the key size need to be+-- adequate otherwise security takes a hit.+initialize :: ByteArrayAccess key+           => key   -- ^ The key+           -> State -- ^ The RC4 context with the key mixed in+initialize key = unsafeDoIO $ do+    st <- B.alloc 264 $ \stPtr ->+        B.withByteArray key $ \keyPtr -> c_rc4_init keyPtr (fromIntegral $ B.length key) (castPtr stPtr)+    return $ State st++-- | generate the next len bytes of the rc4 stream without combining+-- it to anything.+generate :: ByteArray ba => State -> Int -> (State, ba)+generate ctx len = combine ctx (B.zero len)++-- | RC4 xor combination of the rc4 stream with an input+combine :: ByteArray ba+        => State               -- ^ rc4 context+        -> ba                  -- ^ input+        -> (State, ba)         -- ^ new rc4 context, and the output+combine (State prevSt) clearText = unsafeDoIO $+    B.allocRet len            $ \outptr ->+    B.withByteArray clearText $ \clearPtr -> do+        st <- B.copy prevSt $ \stPtr ->+                c_rc4_combine (castPtr stPtr) clearPtr (fromIntegral len) outptr+        return $! State st+    --return $! (State st, B.PS outfptr 0 len)+  where len = B.length clearText
+ Crypto/Cipher/Salsa.hs view
@@ -0,0 +1,83 @@+-- |+-- Module      : Crypto.Cipher.Salsa+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.Salsa+    ( initialize+    , combine+    , generate+    , State+    ) where++import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray, ScrubbedBytes)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Foreign.Ptr+import           Foreign.C.Types++-- | Salsa context+newtype State = State ScrubbedBytes+    deriving (NFData)++-- | Initialize a new Salsa context with the number of rounds,+-- the key and the nonce associated.+initialize :: (ByteArrayAccess key, ByteArrayAccess nonce)+           => Int    -- ^ number of rounds (8,12,20)+           -> key    -- ^ the key (128 or 256 bits)+           -> nonce  -- ^ the nonce (64 or 96 bits)+           -> State  -- ^ the initial Salsa state+initialize nbRounds key nonce+    | not (kLen `elem` [16,32])       = error "Salsa: key length should be 128 or 256 bits"+    | not (nonceLen `elem` [8,12])    = error "Salsa: nonce length should be 64 or 96 bits"+    | not (nbRounds `elem` [8,12,20]) = error "Salsa: rounds should be 8, 12 or 20"+    | otherwise = unsafeDoIO $ do+        stPtr <- B.alloc 132 $ \stPtr ->+            B.withByteArray nonce $ \noncePtr  ->+            B.withByteArray key   $ \keyPtr ->+                ccryptonite_salsa_init stPtr (fromIntegral nbRounds) kLen keyPtr nonceLen noncePtr+        return $ State stPtr+  where kLen     = B.length key+        nonceLen = B.length nonce++-- | Combine the salsa output and an arbitrary message with a xor,+-- and return the combined output and the new state.+combine :: ByteArray ba+        => State      -- ^ the current Salsa state+        -> ba         -- ^ the source to xor with the generator+        -> (ba, State)+combine prevSt@(State prevStMem) src+    | B.null src = (B.empty, prevSt)+    | otherwise  = unsafeDoIO $ do+        (out, st) <- B.copyRet prevStMem $ \ctx ->+            B.alloc (B.length src) $ \dstPtr ->+            B.withByteArray src    $ \srcPtr -> do+                ccryptonite_salsa_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)+        return (out, State st)++-- | Generate a number of bytes from the Salsa output directly+generate :: ByteArray ba+         => State -- ^ the current Salsa state+         -> Int   -- ^ the length of data to generate+         -> (ba, State)+generate prevSt@(State prevStMem) len+    | len <= 0  = (B.empty, prevSt)+    | otherwise = unsafeDoIO $ do+        (out, st) <- B.copyRet prevStMem $ \ctx ->+            B.alloc len $ \dstPtr ->+                ccryptonite_salsa_generate dstPtr ctx (fromIntegral len)+        return (out, State st)++foreign import ccall "cryptonite_salsa_init"+    ccryptonite_salsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()++foreign import ccall "cryptonite_salsa_combine"+    ccryptonite_salsa_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall "cryptonite_salsa_generate"+    ccryptonite_salsa_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
+ Crypto/Cipher/TripleDES.hs view
@@ -0,0 +1,90 @@+-- |+-- Module      : Crypto.Cipher.TripleDES+-- License     : BSD-style+-- Stability   : experimental+-- Portability : ???++module Crypto.Cipher.TripleDES+    ( DES_EEE3+    , DES_EDE3+    , DES_EEE2+    , DES_EDE2+    ) where++import           Data.Word+import           Crypto.Error+import           Crypto.Cipher.Types+import           Crypto.Cipher.DES.Primitive+import           Crypto.Internal.ByteArray (ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B+import           Data.Memory.Endian++-- | 3DES with 3 different keys used all in the same direction+data DES_EEE3 = DES_EEE3 Word64 Word64 Word64+    deriving (Eq)++-- | 3DES with 3 different keys used in alternative direction+data DES_EDE3 = DES_EDE3 Word64 Word64 Word64 +    deriving (Eq)++-- | 3DES where the first and third keys are equal, used in the same direction+data DES_EEE2 = DES_EEE2 Word64 Word64 -- key1 and key3 are equal+    deriving (Eq)++-- | 3DES where the first and third keys are equal, used in alternative direction+data DES_EDE2 = DES_EDE2 Word64 Word64 -- key1 and key3 are equal+    deriving (Eq)++instance Cipher DES_EEE3 where+    cipherName    _ = "3DES_EEE"+    cipherKeySize _ = KeySizeFixed 24+    cipherInit k    = init3DES DES_EEE3 k++instance Cipher DES_EDE3 where+    cipherName    _ = "3DES_EDE"+    cipherKeySize _ = KeySizeFixed 24+    cipherInit k    = init3DES DES_EDE3 k++instance Cipher DES_EDE2 where+    cipherName    _ = "2DES_EDE"+    cipherKeySize _ = KeySizeFixed 16+    cipherInit k    = init2DES DES_EDE2 k++instance Cipher DES_EEE2 where+    cipherName    _ = "2DES_EEE"+    cipherKeySize _ = KeySizeFixed 16+    cipherInit k    = init2DES DES_EEE2 k++instance BlockCipher DES_EEE3 where+    blockSize _ = 8+    ecbEncrypt (DES_EEE3 k1 k2 k3) = B.mapAsWord64 (unBlock . (encrypt k3 . encrypt k2 . encrypt k1) . Block)+    ecbDecrypt (DES_EEE3 k1 k2 k3) = B.mapAsWord64 (unBlock . (decrypt k1 . decrypt k2 . decrypt k3) . Block)++instance BlockCipher DES_EDE3 where+    blockSize _ = 8+    ecbEncrypt (DES_EDE3 k1 k2 k3) = B.mapAsWord64 (unBlock . (encrypt k3 . decrypt k2 . encrypt k1) . Block)+    ecbDecrypt (DES_EDE3 k1 k2 k3) = B.mapAsWord64 (unBlock . (decrypt k1 . encrypt k2 . decrypt k3) . Block)++instance BlockCipher DES_EEE2 where+    blockSize _ = 8+    ecbEncrypt (DES_EEE2 k1 k2) = B.mapAsWord64 (unBlock . (encrypt k1 . encrypt k2 . encrypt k1) . Block)+    ecbDecrypt (DES_EEE2 k1 k2) = B.mapAsWord64 (unBlock . (decrypt k1 . decrypt k2 . decrypt k1) . Block)++instance BlockCipher DES_EDE2 where+    blockSize _ = 8+    ecbEncrypt (DES_EDE2 k1 k2) = B.mapAsWord64 (unBlock . (encrypt k1 . decrypt k2 . encrypt k1) . Block)+    ecbDecrypt (DES_EDE2 k1 k2) = B.mapAsWord64 (unBlock . (decrypt k1 . encrypt k2 . decrypt k1) . Block)++init3DES :: ByteArrayAccess key => (Word64 -> Word64 -> Word64 -> a) -> key -> CryptoFailable a+init3DES constr k+    | len == 24 = CryptoPassed $ constr k1 k2 k3+    | otherwise = CryptoFailed CryptoError_KeySizeInvalid+  where len = B.length k+        (k1, k2, k3) = (fromBE $ B.toW64BE k 0, fromBE $ B.toW64BE k 8, fromBE $ B.toW64BE k 16)++init2DES :: ByteArrayAccess key => (Word64 -> Word64 -> a) -> key -> CryptoFailable a+init2DES constr k+    | len == 16 = CryptoPassed $ constr k1 k2+    | otherwise = CryptoFailed CryptoError_KeySizeInvalid+  where len = B.length k+        (k1, k2) = (fromBE $ B.toW64BE k 0, fromBE $ B.toW64BE k 8)
+ Crypto/Cipher/Types.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Cipher.Types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- symmetric cipher basic types+--+{-# LANGUAGE DeriveDataTypeable #-}+module Crypto.Cipher.Types+    (+    -- * Cipher classes+      Cipher(..)+    , BlockCipher(..)+    , BlockCipher128(..)+    , StreamCipher(..)+    , DataUnitOffset+    , KeySizeSpecifier(..)+    -- , cfb8Encrypt+    -- , cfb8Decrypt+    -- * AEAD functions+    , AEADMode(..)+    , module Crypto.Cipher.Types.AEAD+    -- * Initial Vector type and constructor+    , IV+    , makeIV+    , nullIV+    , ivAdd+    -- * Authentification Tag+    , AuthTag(..)+    ) where++import Crypto.Cipher.Types.Base+import Crypto.Cipher.Types.Block+import Crypto.Cipher.Types.Stream+import Crypto.Cipher.Types.AEAD
+ Crypto/Cipher/Types/AEAD.hs view
@@ -0,0 +1,74 @@+-- |+-- Module      : Crypto.Cipher.Types.AEAD+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- AEAD cipher basic types+--+{-# LANGUAGE ExistentialQuantification #-}+{-# LANGUAGE Rank2Types #-}+module Crypto.Cipher.Types.AEAD where++import           Crypto.Cipher.Types.Base+import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.Imports++-- | AEAD Implementation+data AEADModeImpl st = AEADModeImpl+    { aeadImplAppendHeader :: forall ba . ByteArrayAccess ba => st -> ba -> st+    , aeadImplEncrypt      :: forall ba . ByteArray ba => st -> ba -> (ba, st)+    , aeadImplDecrypt      :: forall ba . ByteArray ba => st -> ba -> (ba, st)+    , aeadImplFinalize     :: st -> Int -> AuthTag+    }++-- | Authenticated Encryption with Associated Data algorithms+data AEAD cipher = forall st . AEAD+    { aeadModeImpl :: AEADModeImpl st+    , aeadState    :: st+    }++-- | Append some header information to an AEAD context+aeadAppendHeader :: ByteArrayAccess aad => AEAD cipher -> aad -> AEAD cipher+aeadAppendHeader (AEAD impl st) aad = AEAD impl $ (aeadImplAppendHeader impl) st aad++-- | Encrypt some data and update the AEAD context+aeadEncrypt :: ByteArray ba => AEAD cipher -> ba -> (ba, AEAD cipher)+aeadEncrypt (AEAD impl st) ba = second (AEAD impl) $ (aeadImplEncrypt impl) st ba++-- | Decrypt some data and update the AEAD context+aeadDecrypt :: ByteArray ba => AEAD cipher -> ba -> (ba, AEAD cipher)+aeadDecrypt (AEAD impl st) ba = second (AEAD impl) $ (aeadImplDecrypt impl) st ba++-- | Finalize the AEAD context and return the authentication tag+aeadFinalize :: AEAD cipher -> Int -> AuthTag+aeadFinalize (AEAD impl st) n = (aeadImplFinalize impl) st n++-- | Simple AEAD encryption+aeadSimpleEncrypt :: (ByteArrayAccess aad, ByteArray ba)+                  => AEAD a        -- ^ A new AEAD Context+                  -> aad           -- ^ Optional Authentified Header+                  -> ba            -- ^ Optional Plaintext+                  -> Int           -- ^ Tag length+                  -> (AuthTag, ba) -- ^ Authentification tag and ciphertext+aeadSimpleEncrypt aeadIni header input taglen = (tag, output)+  where aead                = aeadAppendHeader aeadIni header+        (output, aeadFinal) = aeadEncrypt aead input+        tag                 = aeadFinalize aeadFinal taglen++-- | Simple AEAD decryption+aeadSimpleDecrypt :: (ByteArrayAccess aad, ByteArray ba)+                  => AEAD a        -- ^ A new AEAD Context+                  -> aad           -- ^ Optional Authentified Header+                  -> ba            -- ^ Optional Plaintext+                  -> AuthTag       -- ^ Tag length+                  -> Maybe ba      -- ^ Plaintext+aeadSimpleDecrypt aeadIni header input authTag+    | tag == authTag = Just output+    | otherwise      = Nothing+  where aead                = aeadAppendHeader aeadIni header+        (output, aeadFinal) = aeadDecrypt aead input+        tag                 = aeadFinalize aeadFinal (B.length authTag)+
+ Crypto/Cipher/Types/Base.hs view
@@ -0,0 +1,59 @@+-- |+-- Module      : Crypto.Cipher.Types.Base+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- symmetric cipher basic types+--+{-# LANGUAGE ExistentialQuantification #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Cipher.Types.Base+    ( KeySizeSpecifier(..)+    , Cipher(..)+    , AuthTag(..)+    , AEADMode(..)+    , DataUnitOffset+    ) where++import           Data.Word+import           Crypto.Internal.ByteArray (Bytes, ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Error++-- | Different specifier for key size in bytes+data KeySizeSpecifier =+      KeySizeRange Int Int -- ^ in the range [min,max]+    | KeySizeEnum  [Int]   -- ^ one of the specified values+    | KeySizeFixed Int     -- ^ a specific size+    deriving (Show,Eq)++-- | Offset inside an XTS data unit, measured in block size.+type DataUnitOffset = Word32++-- | Authentification Tag for AE cipher mode+newtype AuthTag = AuthTag { unAuthTag :: Bytes }+    deriving (Show, ByteArrayAccess)++instance Eq AuthTag where+    (AuthTag a) == (AuthTag b) = B.constEq a b++-- | AEAD Mode+data AEADMode =+      AEAD_OCB -- OCB3+    | AEAD_CCM+    | AEAD_EAX+    | AEAD_CWC+    | AEAD_GCM+    deriving (Show,Eq)++-- | Symmetric cipher class.+class Cipher cipher where+    -- | Initialize a cipher context from a key+    cipherInit    :: ByteArray key => key -> CryptoFailable cipher+    -- | Cipher name+    cipherName    :: cipher -> String+    -- | return the size of the key required for this cipher.+    -- Some cipher accept any size for key+    cipherKeySize :: cipher -> KeySizeSpecifier
+ Crypto/Cipher/Types/Block.hs view
@@ -0,0 +1,279 @@+-- |+-- Module      : Crypto.Cipher.Types.Block+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- block cipher basic types+--+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE ExistentialQuantification #-}+{-# LANGUAGE ViewPatterns #-}+{-# LANGUAGE Rank2Types #-}+module Crypto.Cipher.Types.Block+    (+    -- * BlockCipher+      BlockCipher(..)+    , BlockCipher128(..)+    -- * initialization vector (IV)+    , IV(..)+    , makeIV+    , nullIV+    , ivAdd+    -- * XTS+    , XTS+    -- * AEAD+    , AEAD(..)+    -- , AEADState(..)+    , AEADModeImpl(..)+    , aeadAppendHeader+    , aeadEncrypt+    , aeadDecrypt+    , aeadFinalize+    -- * CFB 8 bits+    --, cfb8Encrypt+    --, cfb8Decrypt+    ) where++import           Data.Word+import           Data.Monoid+import           Crypto.Error+import           Crypto.Cipher.Types.Base+import           Crypto.Cipher.Types.GF+import           Crypto.Cipher.Types.AEAD+import           Crypto.Cipher.Types.Utils++import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray, withByteArray, Bytes)+import qualified Crypto.Internal.ByteArray as B++import           Foreign.Ptr+import           Foreign.Storable++-- | an IV parametrized by the cipher+data IV c = forall byteArray . ByteArray byteArray => IV byteArray++instance BlockCipher c => ByteArrayAccess (IV c) where+    withByteArray (IV z) f = withByteArray z f+    length (IV z) = B.length z+instance Eq (IV c) where+    (IV a) == (IV b) = B.eq a b++-- | XTS callback+type XTS ba cipher = (cipher, cipher)+                  -> IV cipher        -- ^ Usually represent the Data Unit (e.g. disk sector)+                  -> DataUnitOffset   -- ^ Offset in the data unit in number of blocks+                  -> ba               -- ^ Data+                  -> ba               -- ^ Processed Data++-- | Symmetric block cipher class+class Cipher cipher => BlockCipher cipher where+    -- | Return the size of block required for this block cipher+    blockSize    :: cipher -> Int++    -- | Encrypt blocks+    --+    -- the input string need to be multiple of the block size+    ecbEncrypt :: ByteArray ba => cipher -> ba -> ba++    -- | Decrypt blocks+    --+    -- the input string need to be multiple of the block size+    ecbDecrypt :: ByteArray ba => cipher -> ba -> ba++    -- | encrypt using the CBC mode.+    --+    -- input need to be a multiple of the blocksize+    cbcEncrypt :: ByteArray ba => cipher -> IV cipher -> ba -> ba+    cbcEncrypt = cbcEncryptGeneric+    -- | decrypt using the CBC mode.+    --+    -- input need to be a multiple of the blocksize+    cbcDecrypt :: ByteArray ba => cipher -> IV cipher -> ba -> ba+    cbcDecrypt = cbcDecryptGeneric++    -- | encrypt using the CFB mode.+    --+    -- input need to be a multiple of the blocksize+    cfbEncrypt :: ByteArray ba => cipher -> IV cipher -> ba -> ba+    cfbEncrypt = cfbEncryptGeneric+    -- | decrypt using the CFB mode.+    --+    -- input need to be a multiple of the blocksize+    cfbDecrypt :: ByteArray ba => cipher -> IV cipher -> ba -> ba+    cfbDecrypt = cfbDecryptGeneric++    -- | combine using the CTR mode.+    --+    -- CTR mode produce a stream of randomized data that is combined+    -- (by XOR operation) with the input stream.+    --+    -- encryption and decryption are the same operation.+    --+    -- input can be of any size+    ctrCombine :: ByteArray ba => cipher -> IV cipher -> ba -> ba+    ctrCombine = ctrCombineGeneric++    -- | Initialize a new AEAD State+    --+    -- When Nothing is returns, it means the mode is not handled.+    aeadInit :: ByteArrayAccess iv => AEADMode -> cipher -> iv -> CryptoFailable (AEAD cipher)+    aeadInit _ _ _ = CryptoFailed CryptoError_AEADModeNotSupported++-- | class of block cipher with a 128 bits block size+class BlockCipher cipher => BlockCipher128 cipher where+    -- | encrypt using the XTS mode.+    --+    -- input need to be a multiple of the blocksize, and the cipher+    -- need to process 128 bits block only+    xtsEncrypt :: ByteArray ba+               => (cipher, cipher)+               -> IV cipher        -- ^ Usually represent the Data Unit (e.g. disk sector)+               -> DataUnitOffset   -- ^ Offset in the data unit in number of blocks+               -> ba               -- ^ Plaintext+               -> ba               -- ^ Ciphertext+    xtsEncrypt = xtsEncryptGeneric++    -- | decrypt using the XTS mode.+    --+    -- input need to be a multiple of the blocksize, and the cipher+    -- need to process 128 bits block only+    xtsDecrypt :: ByteArray ba+               => (cipher, cipher)+               -> IV cipher        -- ^ Usually represent the Data Unit (e.g. disk sector)+               -> DataUnitOffset   -- ^ Offset in the data unit in number of blocks+               -> ba               -- ^ Ciphertext+               -> ba               -- ^ Plaintext+    xtsDecrypt = xtsDecryptGeneric++-- | Create an IV for a specified block cipher+makeIV :: (ByteArrayAccess b, BlockCipher c) => b -> Maybe (IV c)+makeIV b = toIV undefined+  where toIV :: BlockCipher c => c -> Maybe (IV c)+        toIV cipher+          | B.length b == sz = Just $ IV (B.convert b :: Bytes)+          | otherwise        = Nothing+          where sz = blockSize cipher++-- | Create an IV that is effectively representing the number 0+nullIV :: BlockCipher c => IV c+nullIV = toIV undefined+  where toIV :: BlockCipher c => c -> IV c+        toIV cipher = IV (B.zero (blockSize cipher) :: Bytes)++-- | Increment an IV by a number.+--+-- Assume the IV is in Big Endian format.+ivAdd :: BlockCipher c => IV c -> Int -> IV c+ivAdd (IV b) i = IV $ copy b+  where copy :: ByteArray bs => bs -> bs+        copy bs = B.copyAndFreeze bs $ \p -> do+            let until0 accu = do+                  r <- loop accu (B.length bs - 1) p+                  case r of+                      0 -> return ()+                      _ -> until0 r+            until0 i++        loop :: Int -> Int -> Ptr Word8 -> IO Int+        loop 0   _   _ = return 0+        loop acc ofs p = do+            v <- peek (p `plusPtr` ofs) :: IO Word8+            let accv    = acc + fromIntegral v+                (hi,lo) = accv `divMod` 256+            poke (p `plusPtr` ofs) (fromIntegral lo :: Word8)+            if ofs == 0+                then return hi+                else loop hi (ofs - 1) p++cbcEncryptGeneric :: (ByteArray ba, BlockCipher cipher) => cipher -> IV cipher -> ba -> ba+cbcEncryptGeneric cipher ivini input = mconcat $ doEnc ivini $ chunk (blockSize cipher) input+  where doEnc _  []     = []+        doEnc iv (i:is) =+            let o = ecbEncrypt cipher $ B.xor iv i+             in o : doEnc (IV o) is++cbcDecryptGeneric :: (ByteArray ba, BlockCipher cipher) => cipher -> IV cipher -> ba -> ba+cbcDecryptGeneric cipher ivini input = mconcat $ doDec ivini $ chunk (blockSize cipher) input+  where+        doDec _  []     = []+        doDec iv (i:is) =+            let o = B.xor iv $ ecbDecrypt cipher i+             in o : doDec (IV i) is++cfbEncryptGeneric :: (ByteArray ba, BlockCipher cipher) => cipher -> IV cipher -> ba -> ba+cfbEncryptGeneric cipher ivini input = mconcat $ doEnc ivini $ chunk (blockSize cipher) input+  where+        doEnc _  []     = []+        doEnc (IV iv) (i:is) =+            let o = B.xor i $ ecbEncrypt cipher iv+             in o : doEnc (IV o) is++cfbDecryptGeneric :: (ByteArray ba, BlockCipher cipher) => cipher -> IV cipher -> ba -> ba+cfbDecryptGeneric cipher ivini input = mconcat $ doDec ivini $ chunk (blockSize cipher) input+  where+        doDec _  []     = []+        doDec (IV iv) (i:is) =+            let o = B.xor i $ ecbEncrypt cipher iv+             in o : doDec (IV i) is++ctrCombineGeneric :: (ByteArray ba, BlockCipher cipher) => cipher -> IV cipher -> ba -> ba+ctrCombineGeneric cipher ivini input = mconcat $ doCnt ivini $ chunk (blockSize cipher) input+  where doCnt _  [] = []+        doCnt iv@(IV ivd) (i:is) =+            let ivEnc = ecbEncrypt cipher ivd+             in B.xor i ivEnc : doCnt (ivAdd iv 1) is++xtsEncryptGeneric :: (ByteArray ba, BlockCipher128 cipher) => XTS ba cipher+xtsEncryptGeneric = xtsGeneric ecbEncrypt++xtsDecryptGeneric :: (ByteArray ba, BlockCipher128 cipher) => XTS ba cipher+xtsDecryptGeneric = xtsGeneric ecbDecrypt++xtsGeneric :: (ByteArray ba, BlockCipher128 cipher)+           => (cipher -> ba -> ba)+           -> (cipher, cipher)+           -> IV cipher+           -> DataUnitOffset+           -> ba+           -> ba+xtsGeneric f (cipher, tweakCipher) (IV iv) sPoint input =+    mconcat $ doXts iniTweak $ chunk (blockSize cipher) input+  where encTweak = ecbEncrypt tweakCipher iv+        iniTweak = iterate xtsGFMul encTweak !! fromIntegral sPoint+        doXts _     []     = []+        doXts tweak (i:is) =+            let o = B.xor (f cipher $ B.xor i tweak) tweak+             in o : doXts (xtsGFMul tweak) is++{-+-- | Encrypt using CFB mode in 8 bit output+--+-- Effectively turn a Block cipher in CFB mode into a Stream cipher+cfb8Encrypt :: BlockCipher a => a -> IV a -> B.byteString -> B.byteString+cfb8Encrypt ctx origIv msg = B.unsafeCreate (B.length msg) $ \dst -> loop dst origIv msg+  where loop d iv@(IV i) m+            | B.null m  = return ()+            | otherwise = poke d out >> loop (d `plusPtr` 1) ni (B.drop 1 m)+          where m'  = if B.length m < blockSize ctx+                            then m `B.append` B.replicate (blockSize ctx - B.length m) 0+                            else B.take (blockSize ctx) m+                r   = cfbEncrypt ctx iv m'+                out = B.head r+                ni  = IV (B.drop 1 i `B.snoc` out)++-- | Decrypt using CFB mode in 8 bit output+--+-- Effectively turn a Block cipher in CFB mode into a Stream cipher+cfb8Decrypt :: BlockCipher a => a -> IV a -> B.byteString -> B.byteString+cfb8Decrypt ctx origIv msg = B.unsafeCreate (B.length msg) $ \dst -> loop dst origIv msg+  where loop d iv@(IV i) m+            | B.null m  = return ()+            | otherwise = poke d out >> loop (d `plusPtr` 1) ni (B.drop 1 m)+          where m'  = if B.length m < blockSize ctx+                            then m `B.append` B.replicate (blockSize ctx - B.length m) 0+                            else B.take (blockSize ctx) m+                r   = cfbDecrypt ctx iv m'+                out = B.head r+                ni  = IV (B.drop 1 i `B.snoc` B.head m')+-}
+ Crypto/Cipher/Types/GF.hs view
@@ -0,0 +1,50 @@+-- |+-- Module      : Crypto.Cipher.Types.GF+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- Slow Galois Field arithmetic for generic XTS and GCM implementation+--+module Crypto.Cipher.Types.GF+    (+    -- * XTS support+      xtsGFMul+    ) where++import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArray, withByteArray)+import qualified Crypto.Internal.ByteArray as B+import           Foreign.Storable+import           Foreign.Ptr+import           Data.Bits++-- | Compute the gfmul with the XTS polynomial+--+-- block size need to be 128 bits.+--+-- FIXME: add support for big endian.+xtsGFMul :: ByteArray ba => ba -> ba+xtsGFMul b+    | len == 16 =+        B.allocAndFreeze len $ \dst ->+        withByteArray b      $ \src -> do+            (hi,lo) <- gf <$> peek (castPtr src) <*> peek (castPtr src `plusPtr` 8)+            poke (castPtr dst) lo+            poke (castPtr dst `plusPtr` 8) hi+    | otherwise = error "unsupported block size in GF"+  where gf :: Word64 -> Word64 -> (Word64, Word64)+        gf srcLo srcHi =+            ((if carryLo then (.|. 1) else id) (srcHi `shiftL` 1)+            ,(if carryHi then xor 0x87 else id) $ (srcLo `shiftL` 1)+            )+          where carryHi = srcHi `testBit` 63 +                carryLo = srcLo `testBit` 63+        len = B.length b+{-+	const uint64_t gf_mask = cpu_to_le64(0x8000000000000000ULL);+	uint64_t r = ((a->q[1] & gf_mask) ? cpu_to_le64(0x87) : 0);+	a->q[1] = cpu_to_le64((le64_to_cpu(a->q[1]) << 1) | (a->q[0] & gf_mask ? 1 : 0));+	a->q[0] = cpu_to_le64(le64_to_cpu(a->q[0]) << 1) ^ r;+-}
+ Crypto/Cipher/Types/Stream.hs view
@@ -0,0 +1,20 @@+-- |+-- Module      : Crypto.Cipher.Types.Stream+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- stream cipher basic types+--+module Crypto.Cipher.Types.Stream+    ( StreamCipher(..)+    ) where++import Crypto.Cipher.Types.Base+import Crypto.Internal.ByteArray (ByteArray)++-- | Symmetric stream cipher class+class Cipher cipher => StreamCipher cipher where+    -- | Combine using the stream cipher+    streamCombine :: ByteArray ba => cipher -> ba -> (ba, cipher)
+ Crypto/Cipher/Types/Utils.hs view
@@ -0,0 +1,21 @@+-- |+-- Module      : Crypto.Cipher.Types.Utils+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+-- basic utility for cipher related stuff+--+module Crypto.Cipher.Types.Utils where++import           Crypto.Internal.ByteArray (ByteArray)+import qualified Crypto.Internal.ByteArray as B++-- | Chunk some input byte array into @sz byte list of byte array.+chunk :: ByteArray b => Int -> b -> [b]+chunk sz bs = split bs+  where split b | B.length b <= sz = [b]+                | otherwise        =+                        let (b1, b2) = B.splitAt sz b+                         in b1 : split b2
+ Crypto/Data/AFIS.hs view
@@ -0,0 +1,148 @@+-- |+-- Module      : Crypto.Data.AFIS+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- haskell implementation of the Anti-forensic information splitter+-- available in LUKS. <http://clemens.endorphin.org/AFsplitter>+--+-- The algorithm bloats an arbitrary secret with many bits that are necessary for+-- the recovery of the key (merge), and allow greater way to permanently+-- destroy a key stored on disk.+--+{-# LANGUAGE ScopedTypeVariables #-}+module Crypto.Data.AFIS+    ( split+    , merge+    ) where++import           Crypto.Hash+import           Crypto.Random.Types+import           Crypto.Internal.Compat+import           Control.Monad (forM_, foldM)+import           Data.Word+import           Data.Bits+import           Foreign.Storable+import           Foreign.Ptr++import           Crypto.Internal.ByteArray (ByteArray, Bytes, MemView(..))+import qualified Crypto.Internal.ByteArray as B++import           Data.Memory.PtrMethods (memSet, memCopy)++-- | Split data to diffused data, using a random generator and+-- an hash algorithm.+--+-- the diffused data will consist of random data for (expandTimes-1)+-- then the last block will be xor of the accumulated random data diffused by+-- the hash algorithm.+--+-- ----------+-- -  orig  -+-- ----------+--+-- ---------- ---------- --------------+-- - rand1  - - rand2  - - orig ^ acc -+-- ---------- ---------- --------------+--+-- where acc is :+--   acc(n+1) = hash (n ++ rand(n)) ^ acc(n)+--+split :: (ByteArray ba, HashAlgorithm hash, DRG rng)+      => hash  -- ^ Hash algorithm to use as diffuser+      -> rng   -- ^ Random generator to use+      -> Int   -- ^ Number of times to diffuse the data.+      -> ba    -- ^ original data to diffuse.+      -> (ba, rng)         -- ^ The diffused data+{-# NOINLINE split #-}+split hashAlg rng expandTimes src+    | expandTimes <= 1 = error "invalid expandTimes value"+    | otherwise        = unsafeDoIO $ do+        (rng', bs) <- B.allocRet diffusedLen runOp+        return (bs, rng')+  where diffusedLen = blockSize * expandTimes+        blockSize   = B.length src+        runOp dstPtr = do+            let lastBlock = dstPtr `plusPtr` (blockSize * (expandTimes-1))+            memSet lastBlock 0 blockSize+            let randomBlockPtrs = map (plusPtr dstPtr . (*) blockSize) [0..(expandTimes-2)]+            rng' <- foldM fillRandomBlock rng randomBlockPtrs+            mapM_ (addRandomBlock lastBlock) randomBlockPtrs+            B.withByteArray src $ \srcPtr -> xorMem srcPtr lastBlock blockSize+            return rng'+        addRandomBlock lastBlock blockPtr = do+            xorMem blockPtr lastBlock blockSize+            diffuse hashAlg lastBlock blockSize+        fillRandomBlock g blockPtr = do+            let (rand :: Bytes, g') = randomBytesGenerate blockSize g+            B.withByteArray rand $ \randPtr -> memCopy blockPtr randPtr (fromIntegral blockSize)+            return g'++-- | Merge previously diffused data back to the original data.+merge :: (ByteArray ba, HashAlgorithm hash)+      => hash  -- ^ Hash algorithm used as diffuser+      -> Int   -- ^ Number of times to un-diffuse the data+      -> ba    -- ^ Diffused data+      -> ba    -- ^ Original data+{-# NOINLINE merge #-}+merge hashAlg expandTimes bs+    | r /= 0            = error "diffused data not a multiple of expandTimes"+    | originalSize <= 0 = error "diffused data null"+    | otherwise         = B.allocAndFreeze originalSize $ \dstPtr ->+        B.withByteArray bs $ \srcPtr -> do+            memSet dstPtr 0 originalSize+            forM_ [0..(expandTimes-2)] $ \i -> do+                xorMem (srcPtr `plusPtr` (i * originalSize)) dstPtr originalSize+                diffuse hashAlg dstPtr originalSize+            xorMem (srcPtr `plusPtr` ((expandTimes-1) * originalSize)) dstPtr originalSize+            return ()+  where (originalSize,r) = len `quotRem` expandTimes+        len              = B.length bs++-- | inplace Xor with an input+-- dst = src `xor` dst+xorMem :: Ptr Word8 -> Ptr Word8 -> Int -> IO ()+xorMem src dst sz+    | sz `mod` 64 == 0 = loop 8 (castPtr src :: Ptr Word64) (castPtr dst) sz+    | sz `mod` 32 == 0 = loop 4 (castPtr src :: Ptr Word32) (castPtr dst) sz+    | otherwise        = loop 1 (src :: Ptr Word8) dst sz+  where loop _    _ _ 0 = return ()+        loop incr s d n = do a <- peek s+                             b <- peek d+                             poke d (a `xor` b)+                             loop incr (s `plusPtr` incr) (d `plusPtr` incr) (n-incr)++diffuse :: HashAlgorithm hash+        => hash      -- ^ Hash function to use as diffuser+        -> Ptr Word8 -- ^ buffer to diffuse, modify in place+        -> Int       -- ^ length of buffer to diffuse+        -> IO ()+diffuse hashAlg src sz = loop src 0+  where (full,pad) = sz `quotRem` digestSize +        loop s i+            | i < full = do h <- hashBlock i s digestSize+                            B.withByteArray h $ \hPtr -> memCopy s hPtr digestSize+                            loop (s `plusPtr` digestSize) (i+1)+            | pad /= 0 = do h <- hashBlock i s pad+                            B.withByteArray h $ \hPtr -> memCopy s hPtr pad+                            return ()+            | otherwise = return ()++        digestSize = hashDigestSize hashAlg++        -- Hash [ BE32(n), (p .. p+hashSz) ]+        hashBlock n p hashSz = do+            let ctx = hashInitWith hashAlg+            return $! hashFinalize $ hashUpdate (hashUpdate ctx (be32 n)) (MemView p hashSz)++        be32 :: Int -> Bytes+        be32 n = B.allocAndFreeze 4 $ \ptr -> do+            poke ptr               (f8 (n `shiftR` 24))+            poke (ptr `plusPtr` 1) (f8 (n `shiftR` 16))+            poke (ptr `plusPtr` 2) (f8 (n `shiftR` 8))+            poke (ptr `plusPtr` 3) (f8 n)+          where+                f8 :: Int -> Word8+                f8 = fromIntegral
+ Crypto/Error.hs view
@@ -0,0 +1,12 @@+-- |+-- Module      : Crypto.Error+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Stable+-- Portability : Excellent+--+module Crypto.Error+    ( module Crypto.Error.Types+    ) where++import Crypto.Error.Types
+ Crypto/Error/Types.hs view
@@ -0,0 +1,90 @@+-- |+-- Module      : Crypto.Error.Types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Good+--+-- Cryptographic Error enumeration and handling+--+{-# LANGUAGE DeriveDataTypeable #-}+module Crypto.Error.Types+    ( CryptoError(..)+    , CryptoFailable(..)+    , throwCryptoErrorIO+    , throwCryptoError+    , onCryptoFailure+    , eitherCryptoError+    , maybeCryptoError+    ) where++import qualified Control.Exception as E+import           Data.Data++import           Crypto.Internal.Imports++-- | Enumeration of all possible errors that can be found in this library+data CryptoError =+    -- symmetric cipher errors+      CryptoError_KeySizeInvalid+    | CryptoError_IvSizeInvalid+    | CryptoError_AEADModeNotSupported+    -- public key cryptography error+    | CryptoError_SecretKeySizeInvalid+    | CryptoError_SecretKeyStructureInvalid+    | CryptoError_PublicKeySizeInvalid+    deriving (Show,Eq,Enum,Data,Typeable)++instance E.Exception CryptoError++-- | A simple Either like type to represent a computation that can fail+--+-- 2 possibles values are:+--+-- * 'CryptoPassed' : The computation succeeded, and contains the result of the computation+--+-- * 'CryptoFailed' : The computation failed, and contains the cryptographic error associated+--+data CryptoFailable a =+      CryptoPassed a+    | CryptoFailed CryptoError++instance Functor CryptoFailable where+    fmap f (CryptoPassed a) = CryptoPassed (f a)+    fmap _ (CryptoFailed r) = CryptoFailed r++instance Applicative CryptoFailable where+    pure a     = CryptoPassed a+    (<*>) fm m = fm >>= \p -> m >>= \r2 -> return (p r2)+instance Monad CryptoFailable where+    return a = CryptoPassed a+    (>>=) m1 m2 = do+        case m1 of+            CryptoPassed a -> m2 a+            CryptoFailed e -> CryptoFailed e++-- | Throw an CryptoError as exception on CryptoFailed result,+-- otherwise return the computed value+throwCryptoErrorIO :: CryptoFailable a -> IO a+throwCryptoErrorIO (CryptoFailed e) = E.throwIO e+throwCryptoErrorIO (CryptoPassed r) = return r++-- | Same as 'throwCryptoErrorIO' but throw the error asynchronously.+throwCryptoError :: CryptoFailable a -> a+throwCryptoError (CryptoFailed e) = E.throw e+throwCryptoError (CryptoPassed r) = r++-- | Simple 'either' like combinator for CryptoFailable type+onCryptoFailure :: (CryptoError -> r) -> (a -> r) -> CryptoFailable a -> r+onCryptoFailure onError _         (CryptoFailed e) = onError e+onCryptoFailure _       onSuccess (CryptoPassed r) = onSuccess r++-- | Transform a CryptoFailable to an Either+eitherCryptoError :: CryptoFailable a -> Either CryptoError a+eitherCryptoError (CryptoFailed e) = Left e+eitherCryptoError (CryptoPassed a) = Right a++-- | Transform a CryptoFailable to a Maybe+maybeCryptoError :: CryptoFailable a -> Maybe a+maybeCryptoError (CryptoFailed _) = Nothing+maybeCryptoError (CryptoPassed r) = Just r
+ Crypto/Hash.hs view
@@ -0,0 +1,116 @@+-- |+-- Module      : Crypto.Hash+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Generalized cryptographic hash interface, that you can use with cryptographic hash+-- algorithm that belong to the HashAlgorithm type class.+--+-- > import Crypto.Hash+-- >+-- > sha1 :: ByteString -> Digest SHA1+-- > sha1 = hash+-- >+-- > hexSha3_512 :: ByteString -> String+-- > hexSha3_512 bs = show (hash bs :: Digest SHA3_512)+--+module Crypto.Hash+    (+    -- * Types+      Context+    , Digest+    -- * Functions+    , digestFromByteString+    -- * hash methods parametrized by algorithm+    , hashInitWith+    , hashWith+    -- * hash methods+    , hashInit+    , hashUpdates+    , hashUpdate+    , hashFinalize+    , hashBlockSize+    , hashDigestSize+    , hash+    , hashlazy+    -- * Hash algorithms+    , module Crypto.Hash.Algorithms+    ) where++import           Control.Monad+import           Crypto.Hash.Types+import           Crypto.Hash.Algorithms+import           Foreign.Ptr (Ptr)+import           Crypto.Internal.ByteArray (ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B+import qualified Data.ByteString.Lazy as L++-- | Hash a strict bytestring into a digest.+hash :: (ByteArrayAccess ba, HashAlgorithm a) => ba -> Digest a+hash bs = hashFinalize $ hashUpdate hashInit bs++-- | Hash a lazy bytestring into a digest.+hashlazy :: HashAlgorithm a => L.ByteString -> Digest a+hashlazy lbs = hashFinalize $ hashUpdates hashInit (L.toChunks lbs)++-- | Initialize a new context for this hash algorithm+hashInit :: HashAlgorithm a+         => Context a+hashInit = doInit undefined B.allocAndFreeze+  where+        doInit :: HashAlgorithm a => a -> (Int -> (Ptr (Context a) -> IO ()) -> B.Bytes) -> Context a+        doInit alg alloc = Context $ alloc (hashInternalContextSize alg) hashInternalInit+{-# NOINLINE hashInit #-}++-- | run hashUpdates on one single bytestring and return the updated context.+hashUpdate :: (ByteArrayAccess ba, HashAlgorithm a) => Context a -> ba -> Context a+hashUpdate ctx b = hashUpdates ctx [b]++-- | Update the context with a list of strict bytestring,+-- and return a new context with the updates.+hashUpdates :: (HashAlgorithm a, ByteArrayAccess ba)+            => Context a+            -> [ba]+            -> Context a+hashUpdates c l = doUpdates (B.copyAndFreeze c)+  where doUpdates :: HashAlgorithm a => ((Ptr (Context a) -> IO ()) -> B.Bytes) -> Context a+        doUpdates copy = Context $ copy $ \ctx ->+            mapM_ (\b -> B.withByteArray b $ \d -> hashInternalUpdate ctx d (fromIntegral $ B.length b)) l+{-# NOINLINE hashUpdates #-}++-- | Finalize a context and return a digest.+hashFinalize :: HashAlgorithm a+             => Context a+             -> Digest a+hashFinalize c = doFinalize undefined (B.copy c) (B.allocAndFreeze)+  where doFinalize :: HashAlgorithm alg+                   => alg+                   -> ((Ptr (Context alg) -> IO ()) -> IO B.Bytes)+                   -> (Int -> (Ptr (Digest alg)  -> IO ()) -> B.Bytes)+                   -> Digest alg+        doFinalize alg copy allocDigest =+            Digest $ allocDigest (hashDigestSize alg) $ \dig ->+                (void $ copy $ \ctx -> hashInternalFinalize ctx dig)+{-# NOINLINE hashFinalize #-}++-- | Initialize a new context for a specified hash algorithm+hashInitWith :: HashAlgorithm alg => alg -> Context alg+hashInitWith _ = hashInit++-- | Run the 'hash' function but takes an explicit hash algorithm parameter+hashWith :: (ByteArrayAccess ba, HashAlgorithm alg) => alg -> ba -> Digest alg+hashWith _ = hash++-- | Try to transform a bytearray into a Digest of specific algorithm.+--+-- If the digest is not the right size for the algorithm specified, then+-- Nothing is returned.+digestFromByteString :: (HashAlgorithm a, ByteArrayAccess ba) => ba -> Maybe (Digest a)+digestFromByteString = from undefined+  where+        from :: (HashAlgorithm a, ByteArrayAccess ba) => a -> ba -> Maybe (Digest a)+        from alg bs+            | B.length bs == (hashDigestSize alg) = (Just $ Digest $ B.convert bs)+            | otherwise                           = Nothing
+ Crypto/Hash/Algorithms.hs view
@@ -0,0 +1,58 @@+-- |+-- Module      : Crypto.Hash.Algorithms+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Definitions of known hash algorithms+--+module Crypto.Hash.Algorithms+    ( HashAlgorithm+    -- * hash algorithms+    , MD2(..)+    , MD4(..)+    , MD5(..)+    , SHA1(..)+    , SHA224(..)+    , SHA256(..)+    , SHA384(..)+    , SHA512(..)+    , SHA512t_224(..)+    , SHA512t_256(..)+    , RIPEMD160(..)+    , Tiger(..)+    , Kekkak_224(..)+    , Kekkak_256(..)+    , Kekkak_384(..)+    , Kekkak_512(..)+    , SHA3_224(..)+    , SHA3_256(..)+    , SHA3_384(..)+    , SHA3_512(..)+    , Skein256_224(..)+    , Skein256_256(..)+    , Skein512_224(..)+    , Skein512_256(..)+    , Skein512_384(..)+    , Skein512_512(..)+    , Whirlpool(..)+    ) where++import           Crypto.Hash.Types (HashAlgorithm)+import           Crypto.Hash.MD2+import           Crypto.Hash.MD4+import           Crypto.Hash.MD5+import           Crypto.Hash.SHA1+import           Crypto.Hash.SHA224+import           Crypto.Hash.SHA256+import           Crypto.Hash.SHA384+import           Crypto.Hash.SHA512+import           Crypto.Hash.SHA512t+import           Crypto.Hash.SHA3+import           Crypto.Hash.Kekkak+import           Crypto.Hash.RIPEMD160+import           Crypto.Hash.Tiger+import           Crypto.Hash.Skein256+import           Crypto.Hash.Skein512+import           Crypto.Hash.Whirlpool
+ Crypto/Hash/IO.hs view
@@ -0,0 +1,72 @@+-- |+-- Module      : Crypto.Hash.IO+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Generalized impure cryptographic hash interface+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Hash.IO+    ( HashAlgorithm(..)+    , MutableContext+    , hashMutableInit+    , hashMutableInitWith+    , hashMutableUpdate+    , hashMutableFinalize+    , hashMutableReset+    ) where++import           Crypto.Hash.Types+import qualified Crypto.Internal.ByteArray as B+import           Foreign.Ptr++-- | A Mutable hash context+newtype MutableContext a = MutableContext B.Bytes+    deriving (B.ByteArrayAccess)++-- | Create a new mutable hash context.+--+-- the algorithm used is automatically determined from the return constraint.+hashMutableInit :: HashAlgorithm alg => IO (MutableContext alg)+hashMutableInit = doInit undefined B.alloc+  where+        doInit :: HashAlgorithm a => a -> (Int -> (Ptr (Context a) -> IO ()) -> IO B.Bytes) -> IO (MutableContext a)+        doInit alg alloc = MutableContext `fmap` alloc (hashInternalContextSize alg) hashInternalInit++-- | Create a new mutable hash context.+--+-- The algorithm is explicitely passed as parameter+hashMutableInitWith :: HashAlgorithm alg => alg -> IO (MutableContext alg)+hashMutableInitWith _ = hashMutableInit++-- | Update a mutable hash context in place+hashMutableUpdate :: (B.ByteArrayAccess ba, HashAlgorithm a) => MutableContext a -> ba -> IO ()+hashMutableUpdate mc dat = doUpdate mc (B.withByteArray mc)+  where doUpdate :: HashAlgorithm a => MutableContext a -> ((Ptr (Context a) -> IO ()) -> IO ()) -> IO ()+        doUpdate _ withCtx =+            withCtx             $ \ctx ->+            B.withByteArray dat $ \d   ->+                hashInternalUpdate ctx d (fromIntegral $ B.length dat)++-- | Finalize a mutable hash context and compute a digest+hashMutableFinalize :: HashAlgorithm a => MutableContext a -> IO (Digest a)+hashMutableFinalize mc = doFinalize undefined (B.withByteArray mc) B.alloc+  where doFinalize :: HashAlgorithm alg+                   => alg+                   -> ((Ptr (Context alg) -> IO ()) -> IO ())+                   -> (Int -> (Ptr (Digest alg)  -> IO ()) -> IO B.Bytes)+                   -> IO (Digest alg)+        doFinalize alg withCtx allocDigest = do+            b <- allocDigest (hashDigestSize alg) $ \dig ->+                    withCtx $ \ctx ->+                        hashInternalFinalize ctx dig+            return $ Digest b++-- | Reset the mutable context to the initial state of the hash+hashMutableReset :: HashAlgorithm a => MutableContext a -> IO ()+hashMutableReset mc = doReset mc (B.withByteArray mc)+  where+    doReset :: HashAlgorithm a => MutableContext a -> ((Ptr (Context a) -> IO ()) -> IO ()) -> IO ()+    doReset _ withCtx = withCtx hashInternalInit
+ Crypto/Hash/Kekkak.hs view
@@ -0,0 +1,77 @@+-- |+-- Module      : Crypto.Hash.Kekkak+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- Kekkak cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.Kekkak+    (  Kekkak_224 (..), Kekkak_256 (..), Kekkak_384 (..), Kekkak_512 (..)+    ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)+++-- | Kekkak (224 bits) cryptographic hash algorithm+data Kekkak_224 = Kekkak_224+    deriving (Show)++instance HashAlgorithm Kekkak_224 where+    hashBlockSize  _          = 144+    hashDigestSize _          = 28+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_kekkak_init p 224+    hashInternalUpdate        = c_kekkak_update+    hashInternalFinalize      = c_kekkak_finalize++-- | Kekkak (256 bits) cryptographic hash algorithm+data Kekkak_256 = Kekkak_256+    deriving (Show)++instance HashAlgorithm Kekkak_256 where+    hashBlockSize  _          = 136+    hashDigestSize _          = 32+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_kekkak_init p 256+    hashInternalUpdate        = c_kekkak_update+    hashInternalFinalize      = c_kekkak_finalize++-- | Kekkak (384 bits) cryptographic hash algorithm+data Kekkak_384 = Kekkak_384+    deriving (Show)++instance HashAlgorithm Kekkak_384 where+    hashBlockSize  _          = 104+    hashDigestSize _          = 48+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_kekkak_init p 384+    hashInternalUpdate        = c_kekkak_update+    hashInternalFinalize      = c_kekkak_finalize++-- | Kekkak (512 bits) cryptographic hash algorithm+data Kekkak_512 = Kekkak_512+    deriving (Show)++instance HashAlgorithm Kekkak_512 where+    hashBlockSize  _          = 72+    hashDigestSize _          = 64+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_kekkak_init p 512+    hashInternalUpdate        = c_kekkak_update+    hashInternalFinalize      = c_kekkak_finalize+++foreign import ccall unsafe "cryptonite_kekkak_init"+    c_kekkak_init :: Ptr (Context a) -> Word32 -> IO ()++foreign import ccall "cryptonite_kekkak_update"+    c_kekkak_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_kekkak_finalize"+    c_kekkak_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/MD2.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.MD2+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- MD2 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.MD2 ( MD2 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | MD2 cryptographic hash algorithm+data MD2 = MD2+    deriving (Show)++instance HashAlgorithm MD2 where+    hashBlockSize  _          = 16+    hashDigestSize _          = 16+    hashInternalContextSize _ = 96+    hashInternalInit          = c_md2_init+    hashInternalUpdate        = c_md2_update+    hashInternalFinalize      = c_md2_finalize++foreign import ccall unsafe "cryptonite_md2_init"+    c_md2_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_md2_update"+    c_md2_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_md2_finalize"+    c_md2_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/MD4.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.MD4+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- MD4 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.MD4 ( MD4 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | MD4 cryptographic hash algorithm+data MD4 = MD4+    deriving (Show)++instance HashAlgorithm MD4 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 16+    hashInternalContextSize _ = 96+    hashInternalInit          = c_md4_init+    hashInternalUpdate        = c_md4_update+    hashInternalFinalize      = c_md4_finalize++foreign import ccall unsafe "cryptonite_md4_init"+    c_md4_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_md4_update"+    c_md4_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_md4_finalize"+    c_md4_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/MD5.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.MD5+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- MD5 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.MD5 ( MD5 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | MD5 cryptographic hash algorithm+data MD5 = MD5+    deriving (Show)++instance HashAlgorithm MD5 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 16+    hashInternalContextSize _ = 96+    hashInternalInit          = c_md5_init+    hashInternalUpdate        = c_md5_update+    hashInternalFinalize      = c_md5_finalize++foreign import ccall unsafe "cryptonite_md5_init"+    c_md5_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_md5_update"+    c_md5_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_md5_finalize"+    c_md5_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/RIPEMD160.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.RIPEMD160+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- RIPEMD160 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.RIPEMD160 ( RIPEMD160 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | RIPEMD160 cryptographic hash algorithm+data RIPEMD160 = RIPEMD160+    deriving (Show)++instance HashAlgorithm RIPEMD160 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 20+    hashInternalContextSize _ = 128+    hashInternalInit          = c_ripemd160_init+    hashInternalUpdate        = c_ripemd160_update+    hashInternalFinalize      = c_ripemd160_finalize++foreign import ccall unsafe "cryptonite_ripemd160_init"+    c_ripemd160_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_ripemd160_update"+    c_ripemd160_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_ripemd160_finalize"+    c_ripemd160_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA1.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.SHA1+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA1 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA1 ( SHA1 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | SHA1 cryptographic hash algorithm+data SHA1 = SHA1+    deriving (Show)++instance HashAlgorithm SHA1 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 20+    hashInternalContextSize _ = 96+    hashInternalInit          = c_sha1_init+    hashInternalUpdate        = c_sha1_update+    hashInternalFinalize      = c_sha1_finalize++foreign import ccall unsafe "cryptonite_sha1_init"+    c_sha1_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_sha1_update"+    c_sha1_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha1_finalize"+    c_sha1_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA224.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.SHA224+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA224 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA224 ( SHA224 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | SHA224 cryptographic hash algorithm+data SHA224 = SHA224+    deriving (Show)++instance HashAlgorithm SHA224 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 28+    hashInternalContextSize _ = 192+    hashInternalInit          = c_sha224_init+    hashInternalUpdate        = c_sha224_update+    hashInternalFinalize      = c_sha224_finalize++foreign import ccall unsafe "cryptonite_sha224_init"+    c_sha224_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_sha224_update"+    c_sha224_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha224_finalize"+    c_sha224_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA256.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.SHA256+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA256 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA256 ( SHA256 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | SHA256 cryptographic hash algorithm+data SHA256 = SHA256+    deriving (Show)++instance HashAlgorithm SHA256 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 32+    hashInternalContextSize _ = 192+    hashInternalInit          = c_sha256_init+    hashInternalUpdate        = c_sha256_update+    hashInternalFinalize      = c_sha256_finalize++foreign import ccall unsafe "cryptonite_sha256_init"+    c_sha256_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_sha256_update"+    c_sha256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha256_finalize"+    c_sha256_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA3.hs view
@@ -0,0 +1,77 @@+-- |+-- Module      : Crypto.Hash.SHA3+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA3 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA3+    (  SHA3_224 (..), SHA3_256 (..), SHA3_384 (..), SHA3_512 (..)+    ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)+++-- | SHA3 (224 bits) cryptographic hash algorithm+data SHA3_224 = SHA3_224+    deriving (Show)++instance HashAlgorithm SHA3_224 where+    hashBlockSize  _          = 144+    hashDigestSize _          = 28+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_sha3_init p 224+    hashInternalUpdate        = c_sha3_update+    hashInternalFinalize      = c_sha3_finalize++-- | SHA3 (256 bits) cryptographic hash algorithm+data SHA3_256 = SHA3_256+    deriving (Show)++instance HashAlgorithm SHA3_256 where+    hashBlockSize  _          = 136+    hashDigestSize _          = 32+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_sha3_init p 256+    hashInternalUpdate        = c_sha3_update+    hashInternalFinalize      = c_sha3_finalize++-- | SHA3 (384 bits) cryptographic hash algorithm+data SHA3_384 = SHA3_384+    deriving (Show)++instance HashAlgorithm SHA3_384 where+    hashBlockSize  _          = 104+    hashDigestSize _          = 48+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_sha3_init p 384+    hashInternalUpdate        = c_sha3_update+    hashInternalFinalize      = c_sha3_finalize++-- | SHA3 (512 bits) cryptographic hash algorithm+data SHA3_512 = SHA3_512+    deriving (Show)++instance HashAlgorithm SHA3_512 where+    hashBlockSize  _          = 72+    hashDigestSize _          = 64+    hashInternalContextSize _ = 360+    hashInternalInit p        = c_sha3_init p 512+    hashInternalUpdate        = c_sha3_update+    hashInternalFinalize      = c_sha3_finalize+++foreign import ccall unsafe "cryptonite_sha3_init"+    c_sha3_init :: Ptr (Context a) -> Word32 -> IO ()++foreign import ccall "cryptonite_sha3_update"+    c_sha3_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha3_finalize"+    c_sha3_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA384.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.SHA384+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA384 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA384 ( SHA384 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | SHA384 cryptographic hash algorithm+data SHA384 = SHA384+    deriving (Show)++instance HashAlgorithm SHA384 where+    hashBlockSize  _          = 128+    hashDigestSize _          = 48+    hashInternalContextSize _ = 256+    hashInternalInit          = c_sha384_init+    hashInternalUpdate        = c_sha384_update+    hashInternalFinalize      = c_sha384_finalize++foreign import ccall unsafe "cryptonite_sha384_init"+    c_sha384_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_sha384_update"+    c_sha384_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha384_finalize"+    c_sha384_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA512.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.SHA512+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA512 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA512 ( SHA512 (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | SHA512 cryptographic hash algorithm+data SHA512 = SHA512+    deriving (Show)++instance HashAlgorithm SHA512 where+    hashBlockSize  _          = 128+    hashDigestSize _          = 64+    hashInternalContextSize _ = 256+    hashInternalInit          = c_sha512_init+    hashInternalUpdate        = c_sha512_update+    hashInternalFinalize      = c_sha512_finalize++foreign import ccall unsafe "cryptonite_sha512_init"+    c_sha512_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_sha512_update"+    c_sha512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha512_finalize"+    c_sha512_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/SHA512t.hs view
@@ -0,0 +1,53 @@+-- |+-- Module      : Crypto.Hash.SHA512t+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- SHA512t cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.SHA512t+    (  SHA512t_224 (..), SHA512t_256 (..)+    ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)+++-- | SHA512t (224 bits) cryptographic hash algorithm+data SHA512t_224 = SHA512t_224+    deriving (Show)++instance HashAlgorithm SHA512t_224 where+    hashBlockSize  _          = 128+    hashDigestSize _          = 28+    hashInternalContextSize _ = 264+    hashInternalInit p        = c_sha512t_init p 224+    hashInternalUpdate        = c_sha512t_update+    hashInternalFinalize      = c_sha512t_finalize++-- | SHA512t (256 bits) cryptographic hash algorithm+data SHA512t_256 = SHA512t_256+    deriving (Show)++instance HashAlgorithm SHA512t_256 where+    hashBlockSize  _          = 128+    hashDigestSize _          = 32+    hashInternalContextSize _ = 264+    hashInternalInit p        = c_sha512t_init p 256+    hashInternalUpdate        = c_sha512t_update+    hashInternalFinalize      = c_sha512t_finalize+++foreign import ccall unsafe "cryptonite_sha512t_init"+    c_sha512t_init :: Ptr (Context a) -> Word32 -> IO ()++foreign import ccall "cryptonite_sha512t_update"+    c_sha512t_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_sha512t_finalize"+    c_sha512t_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/Skein256.hs view
@@ -0,0 +1,53 @@+-- |+-- Module      : Crypto.Hash.Skein256+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- Skein256 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.Skein256+    (  Skein256_224 (..), Skein256_256 (..)+    ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)+++-- | Skein256 (224 bits) cryptographic hash algorithm+data Skein256_224 = Skein256_224+    deriving (Show)++instance HashAlgorithm Skein256_224 where+    hashBlockSize  _          = 32+    hashDigestSize _          = 28+    hashInternalContextSize _ = 96+    hashInternalInit p        = c_skein256_init p 224+    hashInternalUpdate        = c_skein256_update+    hashInternalFinalize      = c_skein256_finalize++-- | Skein256 (256 bits) cryptographic hash algorithm+data Skein256_256 = Skein256_256+    deriving (Show)++instance HashAlgorithm Skein256_256 where+    hashBlockSize  _          = 32+    hashDigestSize _          = 32+    hashInternalContextSize _ = 96+    hashInternalInit p        = c_skein256_init p 256+    hashInternalUpdate        = c_skein256_update+    hashInternalFinalize      = c_skein256_finalize+++foreign import ccall unsafe "cryptonite_skein256_init"+    c_skein256_init :: Ptr (Context a) -> Word32 -> IO ()++foreign import ccall "cryptonite_skein256_update"+    c_skein256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_skein256_finalize"+    c_skein256_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/Skein512.hs view
@@ -0,0 +1,77 @@+-- |+-- Module      : Crypto.Hash.Skein512+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- Skein512 cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.Skein512+    (  Skein512_224 (..), Skein512_256 (..), Skein512_384 (..), Skein512_512 (..)+    ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)+++-- | Skein512 (224 bits) cryptographic hash algorithm+data Skein512_224 = Skein512_224+    deriving (Show)++instance HashAlgorithm Skein512_224 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 28+    hashInternalContextSize _ = 160+    hashInternalInit p        = c_skein512_init p 224+    hashInternalUpdate        = c_skein512_update+    hashInternalFinalize      = c_skein512_finalize++-- | Skein512 (256 bits) cryptographic hash algorithm+data Skein512_256 = Skein512_256+    deriving (Show)++instance HashAlgorithm Skein512_256 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 32+    hashInternalContextSize _ = 160+    hashInternalInit p        = c_skein512_init p 256+    hashInternalUpdate        = c_skein512_update+    hashInternalFinalize      = c_skein512_finalize++-- | Skein512 (384 bits) cryptographic hash algorithm+data Skein512_384 = Skein512_384+    deriving (Show)++instance HashAlgorithm Skein512_384 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 48+    hashInternalContextSize _ = 160+    hashInternalInit p        = c_skein512_init p 384+    hashInternalUpdate        = c_skein512_update+    hashInternalFinalize      = c_skein512_finalize++-- | Skein512 (512 bits) cryptographic hash algorithm+data Skein512_512 = Skein512_512+    deriving (Show)++instance HashAlgorithm Skein512_512 where+    hashBlockSize  _          = 64+    hashDigestSize _          = 64+    hashInternalContextSize _ = 160+    hashInternalInit p        = c_skein512_init p 512+    hashInternalUpdate        = c_skein512_update+    hashInternalFinalize      = c_skein512_finalize+++foreign import ccall unsafe "cryptonite_skein512_init"+    c_skein512_init :: Ptr (Context a) -> Word32 -> IO ()++foreign import ccall "cryptonite_skein512_update"+    c_skein512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_skein512_finalize"+    c_skein512_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/Tiger.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.Tiger+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- Tiger cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.Tiger ( Tiger (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | Tiger cryptographic hash algorithm+data Tiger = Tiger+    deriving (Show)++instance HashAlgorithm Tiger where+    hashBlockSize  _          = 64+    hashDigestSize _          = 24+    hashInternalContextSize _ = 96+    hashInternalInit          = c_tiger_init+    hashInternalUpdate        = c_tiger_update+    hashInternalFinalize      = c_tiger_finalize++foreign import ccall unsafe "cryptonite_tiger_init"+    c_tiger_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_tiger_update"+    c_tiger_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_tiger_finalize"+    c_tiger_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Hash/Types.hs view
@@ -0,0 +1,57 @@+-- |+-- Module      : Crypto.Hash.Types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Crypto hash types definitions+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Hash.Types+    ( HashAlgorithm(..)+    , Context(..)+    , Digest(..)+    ) where++import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArrayAccess, Bytes)+import qualified Crypto.Internal.ByteArray as B+import           Foreign.Ptr (Ptr)++-- | Class representing hashing algorithms.+--+-- The interface presented here is update in place+-- and lowlevel. the Hash module takes care of+-- hidding the mutable interface properly.+class HashAlgorithm a where+    -- | Get the block size of a hash algorithm+    hashBlockSize           :: a -> Int+    -- | Get the digest size of a hash algorithm+    hashDigestSize          :: a -> Int+    -- | Get the size of the context used for a hash algorithm+    hashInternalContextSize :: a -> Int+    --hashAlgorithmFromProxy  :: Proxy a -> a++    -- | Initialize a context pointer to the initial state of a hash algorithm+    hashInternalInit     :: Ptr (Context a) -> IO ()+    -- | Update the context with some raw data+    hashInternalUpdate   :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()+    -- | Finalize the context and set the digest raw memory to the right value+    hashInternalFinalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()++{-+hashContextGetAlgorithm :: HashAlgorithm a => Context a -> a+hashContextGetAlgorithm = undefined+-}++-- | Represent a context for a given hash algorithm.+newtype Context a = Context Bytes+    deriving (ByteArrayAccess,NFData)++-- | Represent a digest for a given hash algorithm.+newtype Digest a = Digest Bytes+    deriving (Eq,ByteArrayAccess,NFData)++instance Show (Digest a) where+    show (Digest bs) = show (B.convertToBase B.Base16 bs :: Bytes)
+ Crypto/Hash/Whirlpool.hs view
@@ -0,0 +1,37 @@+-- |+-- Module      : Crypto.Hash.Whirlpool+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- module containing the binding functions to work with the+-- Whirlpool cryptographic hash.+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Hash.Whirlpool ( Whirlpool (..) ) where++import           Crypto.Hash.Types+import           Foreign.Ptr (Ptr)+import           Data.Word (Word8, Word32)++-- | Whirlpool cryptographic hash algorithm+data Whirlpool = Whirlpool+    deriving (Show)++instance HashAlgorithm Whirlpool where+    hashBlockSize  _          = 64+    hashDigestSize _          = 64+    hashInternalContextSize _ = 168+    hashInternalInit          = c_whirlpool_init+    hashInternalUpdate        = c_whirlpool_update+    hashInternalFinalize      = c_whirlpool_finalize++foreign import ccall unsafe "cryptonite_whirlpool_init"+    c_whirlpool_init :: Ptr (Context a)-> IO ()++foreign import ccall "cryptonite_whirlpool_update"+    c_whirlpool_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()++foreign import ccall unsafe "cryptonite_whirlpool_finalize"+    c_whirlpool_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
+ Crypto/Internal/ByteArray.hs view
@@ -0,0 +1,19 @@+-- |+-- Module      : Crypto.Internal.ByteArray+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Good+--+-- Simple and efficient byte array types+--+{-# OPTIONS_HADDOCK hide #-}+module Crypto.Internal.ByteArray+    ( module Data.ByteArray+    , module Data.ByteArray.Mapping+    , module Data.ByteArray.Encoding+    ) where++import Data.ByteArray+import Data.ByteArray.Mapping+import Data.ByteArray.Encoding
+ Crypto/Internal/Compat.hs view
@@ -0,0 +1,48 @@+-- |+-- Module      : Crypto.Internal.Compat+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Good+--+-- This module try to keep all the difference between versions of base+-- or other needed packages, so that modules don't need to use CPP+--+{-# LANGUAGE CPP #-}+module Crypto.Internal.Compat+    ( unsafeDoIO+    , popCount+    , byteSwap64+    ) where++import System.IO.Unsafe+import Data.Word+import Data.Bits++-- | perform io for hashes that do allocation and ffi.+-- unsafeDupablePerformIO is used when possible as the+-- computation is pure and the output is directly linked+-- to the input. we also do not modify anything after it has+-- been returned to the user.+unsafeDoIO :: IO a -> a+#if __GLASGOW_HASKELL__ > 704+unsafeDoIO = unsafeDupablePerformIO+#else+unsafeDoIO = unsafePerformIO+#endif++#if !(MIN_VERSION_base(4,5,0))+popCount :: Word64 -> Int+popCount n = loop 0 n+  where loop c 0 = c+        loop c i = loop (c + if testBit c 0 then 1 else 0) (i `shiftR` 1)+#endif++#if !(MIN_VERSION_base(4,7,0))+byteSwap64 :: Word64 -> Word64+byteSwap64 w =+        (w `shiftR` 56)                  .|. (w `shiftL` 56)+    .|. ((w `shiftR` 40) .&. 0xff00)     .|. ((w .&. 0xff00) `shiftL` 40)+    .|. ((w `shiftR` 24) .&. 0xff0000)   .|. ((w .&. 0xff0000) `shiftL` 24)+    .|. ((w `shiftR` 8)  .&. 0xff000000) .|. ((w .&. 0xff000000) `shiftL` 8)+#endif
+ Crypto/Internal/CompatPrim.hs view
@@ -0,0 +1,88 @@+-- |+-- Module      : Crypto.Internal.CompatPrim+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Compat+--+-- This module try to keep all the difference between versions of ghc primitive+-- or other needed packages, so that modules don't need to use CPP.+--+-- Note that MagicHash and CPP conflicts in places, making it "more interesting"+-- to write compat code for primitives+--+{-# LANGUAGE CPP #-}+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE MagicHash #-}+{-# LANGUAGE UnboxedTuples #-}+module Crypto.Internal.CompatPrim+    ( be32Prim+    , le32Prim+    , byteswap32Prim+    , booleanPrim+    , convert4To32+    ) where++import GHC.Prim++-- | byteswap Word# to or from Big Endian+--+-- on a big endian machine, this function is a nop.+be32Prim :: Word# -> Word#+#ifdef ARCH_IS_LITTLE_ENDIAN+be32Prim = byteswap32Prim+#else+be32Prim w = w+#endif++-- | byteswap Word# to or from Little Endian+--+-- on a little endian machine, this function is a nop.+le32Prim :: Word# -> Word#+#ifdef ARCH_IS_LITTLE_ENDIAN+le32Prim w = w+#else+le32Prim = byteswap32Prim+#endif++-- | Simple compatibility for byteswap the lower 32 bits of a Word#+-- at the primitive level+byteswap32Prim :: Word# -> Word#+#if __GLASGOW_HASKELL__ >= 708+byteswap32Prim w = byteSwap32# w+#else+byteswap32Prim w =+    let !a =       uncheckedShiftL# w 24#+        !b = and# (uncheckedShiftL# w 8#) 0x00ff0000##+        !c = and# (uncheckedShiftRL# w 8#) 0x0000ff00##+        !d = and# (uncheckedShiftRL# w 24#) 0x000000ff##+     in or# a (or# b (or# c d))+#endif++-- | combine 4 word8 [a,b,c,d] to a word32 representing [a,b,c,d]+convert4To32 :: Word# -> Word# -> Word# -> Word#+             -> Word#+convert4To32 a b c d = or# (or# c1 c2) (or# c3 c4)+  where+#ifdef ARCH_IS_LITTLE_ENDIAN+        !c1 = uncheckedShiftL# a 24#+        !c2 = uncheckedShiftL# b 16#+        !c3 = uncheckedShiftL# c 8#+        !c4 = d+#else+        !c1 = uncheckedShiftL# d 24#+        !c2 = uncheckedShiftL# c 16#+        !c3 = uncheckedShiftL# b 8#+        !c4 = a+#endif++-- | Simple wrapper to handle pre 7.8 and future, where+-- most comparaison functions don't returns a boolean+-- anymore.+#if __GLASGOW_HASKELL__ >= 708+booleanPrim :: Int# -> Bool+booleanPrim v = tagToEnum# v+#else+booleanPrim :: Bool -> Bool+booleanPrim b = b+#endif
+ Crypto/Internal/DeepSeq.hs view
@@ -0,0 +1,33 @@+-- |+-- Module      : Crypto.Internal.DeepSeq+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Simple abstraction module to allow compilation without deepseq+-- by defining our own NFData class if not compiling with deepseq+-- support.+--+{-# LANGUAGE CPP #-}+module Crypto.Internal.DeepSeq+    ( NFData(..)+    ) where++#ifdef WITH_DEEPSEQ_SUPPORT+import Control.DeepSeq+#else+import Data.Word+import Data.ByteArray++class NFData a where rnf :: a -> ()++instance NFData Word8 where rnf w = w `seq` ()+instance NFData Word16 where rnf w = w `seq` ()+instance NFData Word32 where rnf w = w `seq` ()+instance NFData Word64 where rnf w = w `seq` ()++instance NFData Bytes where rnf b = b `seq` ()+instance NFData ScrubbedBytes where rnf b = b `seq` ()++#endif
+ Crypto/Internal/Imports.hs view
@@ -0,0 +1,16 @@+-- |+-- Module      : Crypto.Internal.Imports+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+module Crypto.Internal.Imports+    ( module X+    ) where++import Data.Word               as X+import Control.Applicative     as X+import Control.Monad           as X (forM, forM_, void)+import Control.Arrow           as X (first, second)+import Crypto.Internal.DeepSeq as X
+ Crypto/Internal/WordArray.hs view
@@ -0,0 +1,155 @@+-- |+-- Module      : Crypto.Internal.Compat+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : Good+--+-- Small and self contained array representation+-- with limited safety for internal use.+--+-- the array produced should never be exposed to the user directly+--+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE MagicHash #-}+{-# LANGUAGE UnboxedTuples #-}+module Crypto.Internal.WordArray+    ( Array8+    , Array32+    , Array64+    , MutableArray32+    , array8+    , array32+    , mutableArray32+    , array64+    , arrayRead8+    , arrayRead32+    , arrayRead64+    , mutableArrayRead32+    , mutableArrayWrite32+    , mutableArrayWriteXor32+    , mutableArray32FromAddrBE+    , mutableArray32Freeze+    ) where++import Data.Word+import Data.Bits (xor)+import Crypto.Internal.Compat+import Crypto.Internal.CompatPrim+import GHC.Prim+import GHC.Types+import GHC.Word++-- | Array of Word8+data Array8 = Array8 Addr#++-- | Array of Word32+data Array32 = Array32 ByteArray#++-- | Array of Word64+data Array64 = Array64 ByteArray#++-- | Array of mutable Word32+data MutableArray32 = MutableArray32 (MutableByteArray# RealWorld)++-- | Create an array of Word8 aliasing an Addr#+array8 :: Addr# -> Array8+array8 = Array8++-- | Create an Array of Word32 of specific size from a list of Word32+array32 :: Int -> [Word32] -> Array32+array32 (I# n) l = unsafeDoIO $ IO $ \s ->+    case newAlignedPinnedByteArray# (n *# 4#) 4# s of+        (# s', mbarr #) -> loop 0# s' mbarr l+  where+        loop _ st mb [] = freezeArray mb st+        loop i st mb ((W32# x):xs)+            | booleanPrim (i ==# n) = freezeArray mb st+            | otherwise =+                let !st' = writeWord32Array# mb i x st+                 in loop (i +# 1#) st' mb xs+        freezeArray mb st =+            case unsafeFreezeByteArray# mb st of+                (# st', b #) -> (# st', Array32 b #)+{-# NOINLINE array32 #-}++-- | Create an Array of Word64 of specific size from a list of Word64+array64 :: Int -> [Word64] -> Array64+array64 (I# n) l = unsafeDoIO $ IO $ \s ->+    case newAlignedPinnedByteArray# (n *# 8#) 8# s of+        (# s', mbarr #) -> loop 0# s' mbarr l+  where+        loop _ st mb [] = freezeArray mb st+        loop i st mb ((W64# x):xs)+            | booleanPrim (i ==# n) = freezeArray mb st+            | otherwise =+                let !st' = writeWord64Array# mb i x st+                 in loop (i +# 1#) st' mb xs+        freezeArray mb st =+            case unsafeFreezeByteArray# mb st of+                (# st', b #) -> (# st', Array64 b #)+{-# NOINLINE array64 #-}++-- | Create a Mutable Array of Word32 of specific size from a list of Word32+mutableArray32 :: Int -> [Word32] -> IO MutableArray32+mutableArray32 (I# n) l = IO $ \s ->+    case newAlignedPinnedByteArray# (n *# 4#) 4# s of+        (# s', mbarr #) -> loop 0# s' mbarr l+  where+        loop _ st mb [] = (# st, MutableArray32 mb #)+        loop i st mb ((W32# x):xs)+            | booleanPrim (i ==# n) = (# st, MutableArray32 mb #)+            | otherwise =+                let !st' = writeWord32Array# mb i x st+                 in loop (i +# 1#) st' mb xs++-- | Create a Mutable Array of BE Word32 aliasing an Addr+mutableArray32FromAddrBE :: Int -> Addr# -> IO MutableArray32+mutableArray32FromAddrBE (I# n) a = IO $ \s ->+    case newAlignedPinnedByteArray# (n *# 4#) 4# s of+        (# s', mbarr #) -> loop 0# s' mbarr+  where+        loop i st mb+            | booleanPrim (i ==# n) = (# st, MutableArray32 mb #)+            | otherwise             =+                let !st' = writeWord32Array# mb i (be32Prim (indexWord32OffAddr# a i)) st+                 in loop (i +# 1#) st' mb++-- | freeze a Mutable Array of Word32 into a immutable Array of Word32+mutableArray32Freeze :: MutableArray32 -> IO Array32+mutableArray32Freeze (MutableArray32 mb) = IO $ \st ->+    case unsafeFreezeByteArray# mb st of+        (# st', b #) -> (# st', Array32 b #)++-- | Read a Word8 from an Array+arrayRead8 :: Array8 -> Int -> Word8+arrayRead8 (Array8 a) (I# o) = W8# (indexWord8OffAddr# a o)+{-# INLINE arrayRead8 #-}++-- | Read a Word32 from an Array+arrayRead32 :: Array32 -> Int -> Word32+arrayRead32 (Array32 b) (I# o) = W32# (indexWord32Array# b o)+{-# INLINE arrayRead32 #-}++-- | Read a Word64 from an Array+arrayRead64 :: Array64 -> Int -> Word64+arrayRead64 (Array64 b) (I# o) = W64# (indexWord64Array# b o)+{-# INLINE arrayRead64 #-}++-- | Read a Word32 from a Mutable Array of Word32+mutableArrayRead32 :: MutableArray32 -> Int -> IO Word32+mutableArrayRead32 (MutableArray32 m) (I# o) = IO $ \s -> case readWord32Array# m o s of (# s', e #) -> (# s', W32# e #)+{-# INLINE mutableArrayRead32 #-}++-- | Write a Word32 from a Mutable Array of Word32+mutableArrayWrite32 :: MutableArray32 -> Int -> Word32 -> IO ()+mutableArrayWrite32 (MutableArray32 m) (I# o) (W32# w) = IO $ \s -> let !s' = writeWord32Array# m o w s in (# s', () #)+{-# INLINE mutableArrayWrite32 #-}++-- | Write into the Mutable Array of Word32 by combining through xor the current value and the new value.+--+-- > x[i] = x[i] xor value+mutableArrayWriteXor32 :: MutableArray32 -> Int -> Word32 -> IO ()+mutableArrayWriteXor32 m o w =+    mutableArrayRead32 m o >>= \wOld -> mutableArrayWrite32 m o (wOld `xor` w)+{-# INLINE mutableArrayWriteXor32 #-}
+ Crypto/Internal/Words.hs view
@@ -0,0 +1,26 @@+-- |+-- Module      : Crypto.Internal.Words+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Extra Word size+--+module Crypto.Internal.Words+    ( Word128(..)+    , w64to32+    , w32to64+    ) where++import Data.Word+import Data.Bits+import Data.Memory.ExtendedWords++-- | Split a 'Word64' into the highest and lowest 'Word32'+w64to32 :: Word64 -> (Word32, Word32)+w64to32 w = (fromIntegral (w `shiftR` 32), fromIntegral w)++-- | Reconstruct a 'Word64' from two 'Word32'+w32to64 :: (Word32, Word32) -> Word64+w32to64 (x1, x2) = ((fromIntegral x1) `shiftL` 32) .|. (fromIntegral x2)
+ Crypto/KDF/PBKDF2.hs view
@@ -0,0 +1,102 @@+-- |+-- Module      : Crypto.KDF.PBKDF2+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Password Based Key Derivation Function 2+--+{-# LANGUAGE BangPatterns #-}+module Crypto.KDF.PBKDF2+    ( PRF+    , prfHMAC+    , Parameters(..)+    , generate+    ) where++import           Data.Word+import           Data.Bits+import           Foreign.Marshal.Alloc+import           Foreign.Ptr (plusPtr)++import           Crypto.Hash (HashAlgorithm)+import qualified Crypto.MAC.HMAC as HMAC++import           Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess, Bytes)+import qualified Crypto.Internal.ByteArray as B+import           Data.Memory.PtrMethods++-- | The PRF used for PBKDF2+type PRF password =+       password -- ^ the password parameters+    -> Bytes    -- ^ the content+    -> Bytes    -- ^ prf(password,content)++-- | PRF for PBKDF2 using HMAC with the hash algorithm as parameter+prfHMAC :: (HashAlgorithm a, ByteArrayAccess password)+        => a+        -> PRF password+prfHMAC alg k = hmacIncr alg (HMAC.initialize k)+  where hmacIncr :: HashAlgorithm a => a -> HMAC.Context a -> (Bytes -> Bytes)+        hmacIncr _ !ctx = \b -> B.convert $ HMAC.finalize $ HMAC.update ctx b++-- | Parameters for PBKDF2+data Parameters = Parameters+    { iterCounts   :: Int -- ^ the number of user-defined iterations for the algorithms. e.g. WPA2 uses 4000.+    , outputLength :: Int -- ^ the number of bytes to generate out of PBKDF2+    }++-- | generate the pbkdf2 key derivation function from the output+generate :: (ByteArrayAccess password, ByteArrayAccess salt, ByteArray ba)+         => PRF password+         -> Parameters+         -> password+         -> salt+         -> ba+generate prf params password salt =+    B.allocAndFreeze (outputLength params) $ \p -> do+        memSet p 0 (outputLength params)+        loop 1 (outputLength params) p+  where+    !runPRF = prf password+    !hLen   = B.length $ runPRF B.empty++    -- run the following f function on each complete chunk.+    -- when having an incomplete chunk, we call partial.+    -- partial need to be the last call.+    --+    -- f(pass,salt,c,i) = U1 xor U2 xor .. xor Uc+    -- U1 = PRF(pass,salt || BE32(i))+    -- Uc = PRF(pass,Uc-1)+    loop iterNb len p+        | len == 0   = return ()+        | len < hLen = partial iterNb len p+        | otherwise  = do+            let applyMany 0 _     = return ()+                applyMany i uprev = do+                    let uData = runPRF uprev+                    B.withByteArray uData $ \u -> memXor p p u hLen+                    applyMany (i-1) uData+            applyMany (iterCounts params) (B.convert salt `B.append` toBS iterNb)+            loop (iterNb+1) (len - hLen) (p `plusPtr` hLen)++    partial iterNb len p = allocaBytesAligned hLen 8 $ \tmp -> do+        let applyMany :: Int -> Bytes -> IO ()+            applyMany 0 _     = return ()+            applyMany i uprev = do+                let uData = runPRF uprev+                B.withByteArray uData $ \u -> memXor tmp tmp u hLen+                applyMany (i-1) uData+        memSet tmp 0 hLen+        applyMany (iterCounts params) (B.convert salt `B.append` toBS iterNb)+        memCopy p tmp len++    -- big endian encoding of Word32+    toBS :: ByteArray ba => Word32 -> ba+    toBS w = B.pack [a,b,c,d]+      where a = fromIntegral (w `shiftR` 24)+            b = fromIntegral ((w `shiftR` 16) .&. 0xff)+            c = fromIntegral ((w `shiftR` 8) .&. 0xff)+            d = fromIntegral (w .&. 0xff)+{-# NOINLINE generate #-}
+ Crypto/KDF/Scrypt.hs view
@@ -0,0 +1,62 @@+-- |+-- Module      : Crypto.KDF.Scrypt+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Scrypt key derivation function as defined in Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard Functions" <http://www.tarsnap.com/scrypt/scrypt.pdf>.+--+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.KDF.Scrypt+    ( Parameters(..)+    , generate+    ) where++import           Data.Word+import           Foreign.Marshal.Alloc+import           Foreign.Ptr (Ptr, plusPtr)+import           Control.Monad (forM_)++import           Crypto.Hash (SHA256(..))+import qualified Crypto.KDF.PBKDF2 as PBKDF2+import           Crypto.Internal.Compat (popCount, unsafeDoIO)+import           Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B++-- | Parameters for Scrypt+data Parameters = Parameters+    { n            :: Word64 -- ^ Cpu/Memory cost ratio. must be a power of 2 greater than 1. also known as N.+    , r            :: Int    -- ^ Must satisfy r * p < 2^30+    , p            :: Int    -- ^ Must satisfy r * p < 2^30+    , outputLength :: Int    -- ^ the number of bytes to generate out of Scrypt+    }++foreign import ccall "cryptonite_scrypt_smix"+    ccryptonite_scrypt_smix :: Ptr Word8 -> Word32 -> Word64 -> Ptr Word8 -> Ptr Word8 -> IO ()++-- | Generate the scrypt key derivation data+generate :: (ByteArrayAccess password, ByteArrayAccess salt, ByteArray output)+         => Parameters+         -> password+         -> salt+         -> output+generate params password salt+    | r params * p params >= 0x40000000 =+        error "Scrypt: invalid parameters: r and p constraint"+    | popCount (n params) /= 1 =+        error "Scrypt: invalid parameters: n not a power of 2"+    | otherwise = unsafeDoIO $ do+        let b = PBKDF2.generate prf (PBKDF2.Parameters 1 intLen) password salt :: B.Bytes+        newSalt <- B.copy b $ \bPtr ->+            allocaBytesAligned (128*(fromIntegral $ n params)*(r params)) 8 $ \v ->+            allocaBytesAligned (256*r params) 8 $ \xy -> do+                forM_ [0..(p params-1)] $ \i ->+                    ccryptonite_scrypt_smix (bPtr `plusPtr` (i * 128 * (r params)))+                                            (fromIntegral $ r params) (n params) v xy++        return $ PBKDF2.generate prf (PBKDF2.Parameters 1 (outputLength params)) password (newSalt :: B.Bytes)+  where prf    = PBKDF2.prfHMAC SHA256+        intLen = p params * 128 * r params+{-# NOINLINE generate #-}
+ Crypto/MAC/HMAC.hs view
@@ -0,0 +1,114 @@+-- |+-- Module      : Crypto.MAC.HMAC+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- provide the HMAC (Hash based Message Authentification Code) base algorithm.+-- <http://en.wikipedia.org/wiki/HMAC>+--+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.MAC.HMAC+    ( hmac+    , HMAC(..)+    -- * incremental+    , Context(..)+    , initialize+    , update+    , updates+    , finalize+    ) where++import           Crypto.Hash hiding (Context)+import qualified Crypto.Hash as Hash (Context)+import           Crypto.Hash.IO+import           Crypto.Internal.ByteArray (ScrubbedBytes, ByteArray, ByteArrayAccess)+import qualified Crypto.Internal.ByteArray as B+import           Data.Memory.PtrMethods+import           Crypto.Internal.Compat+import           Crypto.Internal.Imports++-- | Represent an HMAC that is a phantom type with the hash used to produce the mac.+--+-- The Eq instance is constant time.+newtype HMAC a = HMAC { hmacGetDigest :: Digest a }+    deriving (ByteArrayAccess)++instance Eq (HMAC a) where+    (HMAC b1) == (HMAC b2) = B.constEq b1 b2++-- | compute a MAC using the supplied hashing function+hmac :: (ByteArrayAccess key, ByteArray message, HashAlgorithm a)+     => key     -- ^ Secret key+     -> message -- ^ Message to MAC+     -> HMAC a+hmac secret msg = finalize $ updates (initialize secret) [msg]++-- | Represent an ongoing HMAC state, that can be appended with 'update'+-- and finalize to an HMAC with 'hmacFinalize'+data Context hashalg = Context !(Hash.Context hashalg) !(Hash.Context hashalg)++-- | Initialize a new incremental HMAC context+initialize :: (ByteArrayAccess key, HashAlgorithm a)+           => key       -- ^ Secret key+           -> Context a+initialize secret = unsafeDoIO (doHashAlg undefined)+  where+        doHashAlg :: HashAlgorithm a => a -> IO (Context a)+        doHashAlg alg = do+            !withKey <- case B.length secret `compare` blockSize of+                            EQ -> return $ B.withByteArray secret+                            LT -> do key <- B.alloc blockSize $ \k -> do+                                        memSet k 0 blockSize+                                        B.withByteArray secret $ \s -> memCopy k s (B.length secret)+                                     return $ B.withByteArray (key :: ScrubbedBytes)+                            GT -> do+                                -- hash the secret key+                                ctx <- hashMutableInitWith alg+                                hashMutableUpdate ctx secret+                                digest <- hashMutableFinalize ctx+                                hashMutableReset ctx+                                -- pad it if necessary+                                if digestSize < blockSize+                                    then do+                                        key <- B.alloc blockSize $ \k -> do+                                            memSet k 0 blockSize+                                            B.withByteArray digest $ \s -> memCopy k s (B.length digest)+                                        return $ B.withByteArray (key :: ScrubbedBytes)+                                    else+                                       return $ B.withByteArray digest+            (inner, outer) <- withKey $ \keyPtr ->+                (,) <$> B.alloc blockSize (\p -> memXorWith p 0x36 keyPtr blockSize)+                    <*> B.alloc blockSize (\p -> memXorWith p 0x5c keyPtr blockSize)+            return $ Context (hashUpdates initCtx [outer :: ScrubbedBytes])+                             (hashUpdates initCtx [inner :: ScrubbedBytes])+          where +                blockSize  = hashBlockSize alg+                digestSize = hashDigestSize alg+                initCtx    = hashInitWith alg+{-# NOINLINE initialize #-}++-- | Incrementally update a HMAC context+update :: (ByteArrayAccess message, HashAlgorithm a)+       => Context a  -- ^ Current HMAC context+       -> message    -- ^ Message to append to the MAC+       -> Context a  -- ^ Updated HMAC context+update (Context octx ictx) msg =+    Context octx (hashUpdate ictx msg)++-- | Increamentally update a HMAC context with multiple inputs+updates :: (ByteArrayAccess message, HashAlgorithm a)+        => Context a -- ^ Current HMAC context+        -> [message] -- ^ Messages to append to the MAC+        -> Context a -- ^ Updated HMAC context+updates (Context octx ictx) msgs =+    Context octx (hashUpdates ictx msgs)++-- | Finalize a HMAC context and return the HMAC.+finalize :: HashAlgorithm a+         => Context a+         -> HMAC a+finalize (Context octx ictx) =+    HMAC $ hashFinalize $ hashUpdates octx [hashFinalize ictx]
+ Crypto/MAC/Poly1305.hs view
@@ -0,0 +1,99 @@++-- |+-- Module      : Crypto.MAC.Poly1305+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Poly1305 implementation+--+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.MAC.Poly1305+    ( Ctx+    , Auth(..)++    -- * Incremental MAC Functions+    , initialize -- :: Ctx+    , update     -- :: Ctx -> ByteString -> Ctx+    , updates    -- :: Ctx -> [ByteString] -> Ctx+    , finalize   -- :: Ctx -> Auth+    -- * One-pass MAC function+    , auth+    ) where++import           Foreign.Ptr+import           Foreign.C.Types+import           Data.Word+import           Crypto.Internal.ByteArray (ByteArrayAccess, ScrubbedBytes, Bytes)+import qualified Crypto.Internal.ByteArray as B++-- | Poly1305 Context+newtype Ctx = Ctx ScrubbedBytes+    deriving (ByteArrayAccess)++-- | Poly1305 Auth+newtype Auth = Auth Bytes+    deriving (ByteArrayAccess)++instance Eq Auth where+    (Auth a1) == (Auth a2) = B.constEq a1 a2++foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_init"+    c_poly1305_init :: Ptr Ctx -> Ptr Word8 -> IO ()++foreign import ccall "cryptonite_poly1305.h cryptonite_poly1305_update"+    c_poly1305_update :: Ptr Ctx -> Ptr Word8 -> CUInt -> IO ()++foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_finalize"+    c_poly1305_finalize :: Ptr Word8 -> Ptr Ctx -> IO ()++-- | initialize a Poly1305 context+initialize :: ByteArrayAccess key+           => key+           -> Ctx+initialize key+    | B.length key /= 32 = error "Poly1305: key length expected 32 bytes"+    | otherwise          = Ctx $ B.allocAndFreeze 84 $ \ctxPtr ->+        B.withByteArray key $ \keyPtr ->+            c_poly1305_init (castPtr ctxPtr) keyPtr+{-# NOINLINE initialize #-}++-- | update a context with a bytestring+update :: ByteArrayAccess ba => Ctx -> ba -> Ctx+update (Ctx prevCtx) d = Ctx $ B.copyAndFreeze prevCtx $ \ctxPtr ->+    B.withByteArray d $ \dataPtr ->+        c_poly1305_update (castPtr ctxPtr) dataPtr (fromIntegral $ B.length d)+{-# NOINLINE update #-}++-- | updates a context with multiples bytestring+updates :: ByteArrayAccess ba => Ctx -> [ba] -> Ctx+updates (Ctx prevCtx) d = Ctx $ B.copyAndFreeze prevCtx (loop d)+  where loop []     _      = return ()+        loop (x:xs) ctxPtr = do+            B.withByteArray x $ \dataPtr -> c_poly1305_update ctxPtr dataPtr (fromIntegral $ B.length x)+            loop xs ctxPtr+{-# NOINLINE updates #-}++-- | finalize the context into a digest bytestring+finalize :: Ctx -> Auth+finalize (Ctx prevCtx) = Auth $ B.allocAndFreeze 16 $ \dst -> do+    _ <- B.copy prevCtx (\ctxPtr -> c_poly1305_finalize dst (castPtr ctxPtr)) :: IO ScrubbedBytes+    return ()+{-# NOINLINE finalize #-}++-- | One-pass authorization creation+auth :: (ByteArrayAccess key, ByteArrayAccess ba) => key -> ba -> Auth+auth key d+    | B.length key /= 32 = error "Poly1305: key length expected 32 bytes"+    | otherwise          = Auth $ B.allocAndFreeze 16 $ \dst -> do+        _ <- B.alloc 84 (onCtx dst) :: IO ScrubbedBytes+        return ()+  where+        onCtx dst ctxPtr =+            B.withByteArray key $ \keyPtr -> do+                c_poly1305_init (castPtr ctxPtr) keyPtr+                B.withByteArray d $ \dataPtr ->+                    c_poly1305_update (castPtr ctxPtr) dataPtr (fromIntegral $ B.length d)+                c_poly1305_finalize dst (castPtr ctxPtr)
+ Crypto/Number/Basic.hs view
@@ -0,0 +1,100 @@+-- |+-- Module      : Crypto.Number.Basic+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good++{-# LANGUAGE BangPatterns #-}+module Crypto.Number.Basic+    ( sqrti+    , gcde+    , areEven+    , log2+    , numBits+    , numBytes+    ) where++import Crypto.Number.Compat++-- | sqrti returns two integer (l,b) so that l <= sqrt i <= b+-- the implementation is quite naive, use an approximation for the first number+-- and use a dichotomy algorithm to compute the bound relatively efficiently.+sqrti :: Integer -> (Integer, Integer)+sqrti i+    | i < 0     = error "cannot compute negative square root"+    | i == 0    = (0,0)+    | i == 1    = (1,1)+    | i == 2    = (1,2)+    | otherwise = loop x0+        where+            nbdigits = length $ show i+            x0n = (if even nbdigits then nbdigits - 2 else nbdigits - 1) `div` 2+            x0  = if even nbdigits then 2 * 10 ^ x0n else 6 * 10 ^ x0n+            loop x = case compare (sq x) i of+                LT -> iterUp x+                EQ -> (x, x)+                GT -> iterDown x+            iterUp lb = if sq ub >= i then iter lb ub else iterUp ub+                where ub = lb * 2+            iterDown ub = if sq lb >= i then iterDown lb else iter lb ub+                where lb = ub `div` 2+            iter lb ub+                | lb == ub   = (lb, ub)+                | lb+1 == ub = (lb, ub)+                | otherwise  =+                    let d = (ub - lb) `div` 2 in+                    if sq (lb + d) >= i+                        then iter lb (ub-d)+                        else iter (lb+d) ub+            sq a = a * a++-- | get the extended GCD of two integer using integer divMod+--+-- gcde 'a' 'b' find (x,y,gcd(a,b)) where ax + by = d+--+gcde :: Integer -> Integer -> (Integer, Integer, Integer)+gcde a b = onGmpUnsupported (gmpGcde a b) $+    if d < 0 then (-x,-y,-d) else (x,y,d)+  where+    (d, x, y)                     = f (a,1,0) (b,0,1)+    f t              (0, _, _)    = t+    f (a', sa, ta) t@(b', sb, tb) =+        let (q, r) = a' `divMod` b' in+        f t (r, sa - (q * sb), ta - (q * tb))++-- | check if a list of integer are all even+areEven :: [Integer] -> Bool+areEven = and . map even++-- | Compute the binary logarithm of a integer+log2 :: Integer -> Int+log2 n = onGmpUnsupported (gmpLog2 n) $ imLog 2 n+  where+    -- http://www.haskell.org/pipermail/haskell-cafe/2008-February/039465.html+    imLog b x = if x < b then 0 else (x `div` b^l) `doDiv` l+      where+        l = 2 * imLog (b * b) x+        doDiv x' l' = if x' < b then l' else (x' `div` b) `doDiv` (l' + 1)+{-# INLINE log2 #-}++-- | Compute the number of bits for an integer+numBits :: Integer -> Int+numBits n = gmpSizeInBits n `onGmpUnsupported` (if n == 0 then 1 else computeBits 0 n)+  where computeBits !acc i+            | q == 0 =+                if r >= 0x80 then acc+8+                else if r >= 0x40 then acc+7+                else if r >= 0x20 then acc+6+                else if r >= 0x10 then acc+5+                else if r >= 0x08 then acc+4+                else if r >= 0x04 then acc+3+                else if r >= 0x02 then acc+2+                else if r >= 0x01 then acc+1+                else acc -- should be catch by previous loop+            | otherwise = computeBits (acc+8) q+          where (q,r) = i `divMod` 256++-- | Compute the number of bytes for an integer+numBytes :: Integer -> Int+numBytes n = gmpSizeInBytes n `onGmpUnsupported` ((numBits n + 7) `div` 8)
+ Crypto/Number/Compat.hs view
@@ -0,0 +1,158 @@+-- |+-- Module      : Crypto.Number.Compat+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE CPP           #-}+{-# LANGUAGE MagicHash     #-}+{-# LANGUAGE BangPatterns  #-}+{-# LANGUAGE UnboxedTuples #-}+module Crypto.Number.Compat+    ( GmpSupported(..)+    , onGmpUnsupported+    , gmpGcde+    , gmpLog2+    , gmpPowModSecInteger+    , gmpPowModInteger+    , gmpInverse+    , gmpNextPrime+    , gmpTestPrimeMillerRabin+    , gmpSizeInBytes+    , gmpSizeInBits+    , gmpExportInteger+    , gmpImportInteger+    ) where++#ifndef MIN_VERSION_integer_gmp+#define MIN_VERSION_integer_gmp(a,b,c) 0+#endif++#if MIN_VERSION_integer_gmp(0,5,1)+import GHC.Integer.GMP.Internals+import GHC.Base+import GHC.Integer.Logarithms (integerLog2#)+#endif+import Data.Word+import GHC.Ptr (Ptr(..))++-- | GMP Supported / Unsupported+data GmpSupported a = GmpSupported a+                    | GmpUnsupported+                    deriving (Show,Eq)++-- | Simple combinator in case the operation is not supported through GMP+onGmpUnsupported :: GmpSupported a -> a -> a+onGmpUnsupported (GmpSupported a) _ = a+onGmpUnsupported GmpUnsupported   f = f++-- | Compute the GCDE of a two integer through GMP+gmpGcde :: Integer -> Integer -> GmpSupported (Integer, Integer, Integer)+#if MIN_VERSION_integer_gmp(0,5,1)+gmpGcde a b =+    GmpSupported (s, t, g)+  where (# g, s #) = gcdExtInteger a b+        t = (g - s * a) `div` b+#else+gmpGcde _ _ = GmpUnsupported+#endif++-- | Compute the binary logarithm of an integer through GMP+gmpLog2 :: Integer -> GmpSupported Int+#if MIN_VERSION_integer_gmp(0,5,1)+gmpLog2 0 = GmpSupported 0+gmpLog2 x = GmpSupported (I# (integerLog2# x))+#else+gmpLog2 _ = GmpUnsupported+#endif++-- | Compute the power modulus using extra security to remain constant+-- time wise through GMP+gmpPowModSecInteger :: Integer -> Integer -> Integer -> GmpSupported Integer+#if MIN_VERSION_integer_gmp(1,0,0)+gmpPowModSecInteger b e m = GmpUnsupported+#elif MIN_VERSION_integer_gmp(0,5,1)+gmpPowModSecInteger b e m = GmpSupported (powModSecInteger b e m)+#else+gmpPowModSecInteger _ _ _ = GmpUnsupported+#endif++-- | Compute the power modulus through GMP+gmpPowModInteger :: Integer -> Integer -> Integer -> GmpSupported Integer+#if MIN_VERSION_integer_gmp(0,5,1)+gmpPowModInteger b e m = GmpSupported (powModInteger b e m)+#else+gmpPowModInteger _ _ _ = GmpUnsupported+#endif++-- | Inverse modulus of a number through GMP+gmpInverse :: Integer -> Integer -> GmpSupported (Maybe Integer)+#if MIN_VERSION_integer_gmp(0,5,1)+gmpInverse g m+    | r == 0    = GmpSupported Nothing+    | otherwise = GmpSupported (Just r)+  where r = recipModInteger g m+#else+gmpInverse _ _ = GmpUnsupported+#endif++-- | Get the next prime from a specific value through GMP+gmpNextPrime :: Integer -> GmpSupported Integer+#if MIN_VERSION_integer_gmp(0,5,1)+gmpNextPrime n = GmpSupported (nextPrimeInteger n)+#else+gmpNextPrime _ = GmpUnsupported+#endif++-- | Test if a number is prime using Miller Rabin+gmpTestPrimeMillerRabin :: Int -> Integer -> GmpSupported Bool+#if MIN_VERSION_integer_gmp(0,5,1)+gmpTestPrimeMillerRabin (I# tries) !n = GmpSupported $+    case testPrimeInteger n tries of+        0# -> False+        _  -> True+#else+gmpTestPrimeMillerRabin _ _ = GmpUnsupported+#endif++-- | Return the size in bytes of a integer+gmpSizeInBytes :: Integer -> GmpSupported Int+#if MIN_VERSION_integer_gmp(0,5,1)+gmpSizeInBytes n = GmpSupported (I# (word2Int# (sizeInBaseInteger n 256#)))+#else+gmpSizeInBytes _ = GmpUnsupported+#endif++gmpSizeInBits :: Integer -> GmpSupported Int+#if MIN_VERSION_integer_gmp(0,5,1)+gmpSizeInBits n = GmpSupported (I# (word2Int# (sizeInBaseInteger n 2#)))+#else+gmpSizeInBits _ = GmpUnsupported+#endif++-- | Export an integer to a memory+gmpExportInteger :: Integer -> Ptr Word8 -> GmpSupported (IO ())+#if MIN_VERSION_integer_gmp(1,0,0)+gmpExportInteger n (Ptr addr) = GmpSupported $ do+    _ <- exportIntegerToAddr n addr 1#+    return ()+#elif MIN_VERSION_integer_gmp(0,5,1)+gmpExportInteger n (Ptr addr) = GmpSupported $ IO $ \s ->+    case exportIntegerToAddr n addr 1# s of+        (# s2, _ #) -> (# s2, () #)+#else+gmpExportInteger _ _ = GmpUnsupported+#endif++-- | Import an integer from a memory+gmpImportInteger :: Int -> Ptr Word8 -> GmpSupported (IO Integer)+#if MIN_VERSION_integer_gmp(1,0,0)+gmpImportInteger (I# n) (Ptr addr) = GmpSupported $+    importIntegerFromAddr addr (int2Word# n) 1#+#elif MIN_VERSION_integer_gmp(0,5,1)+gmpImportInteger (I# n) (Ptr addr) = GmpSupported $ IO $ \s ->+    importIntegerFromAddr addr (int2Word# n) 1# s+#else+gmpImportInteger _ _ = GmpUnsupported+#endif
+ Crypto/Number/F2m.hs view
@@ -0,0 +1,108 @@+-- |+-- Module      : Crypto.Math.F2m+-- License     : BSD-style+-- Maintainer  : Danny Navarro <j@dannynavarro.net>+-- Stability   : experimental+-- Portability : Good+--+-- This module provides basic arithmetic operations over F₂m. Performance is+-- not optimal and it doesn't provide protection against timing+-- attacks. The 'm' parameter is implicitly derived from the irreducible+-- polynomial where applicable.+module Crypto.Number.F2m+    ( BinaryPolynomial+    , addF2m+    , mulF2m+    , squareF2m+    , modF2m+    , invF2m+    , divF2m+    ) where++import Data.Bits ((.&.),(.|.),xor,shift,testBit)+import Crypto.Number.Basic+import Crypto.Internal.Imports++-- | Binary Polynomial represented by an integer+type BinaryPolynomial = Integer++-- | Addition over F₂m. This is just a synonym of  'xor'.+addF2m :: Integer -> Integer -> Integer+addF2m = xor+{-# INLINE addF2m #-}++-- | Binary polynomial reduction modulo using long division algorithm.+modF2m :: BinaryPolynomial -- ^ Irreducible binary polynomial+       -> Integer -> Integer+modF2m fx = go+  where+    lfx = log2 fx+    go n | s == 0  = n `xor` fx+         | s < 0 = n+         | otherwise = go $ n `xor` shift fx s+      where+        s = log2 n - lfx+{-# INLINE modF2m #-}++-- | Multiplication over F₂m.+--+--     n1 * n2 (in F(2^m))+mulF2m :: BinaryPolynomial  -- ^ Irreducible binary polynomial+       -> Integer -> Integer -> Integer+mulF2m fx n1 n2 = modF2m fx+                $ go (if n2 `mod` 2 == 1 then n1 else 0) (log2 n2)+  where+    go n s | s == 0  = n+           | otherwise = if testBit n2 s+                            then go (n `xor` shift n1 s) (s - 1)+                            else go n (s - 1)+{-# INLINABLE mulF2m #-}++-- | Squaring over F₂m.+-- TODO: This is still slower than @mulF2m@.++-- Multiplication table? C?+squareF2m :: BinaryPolynomial  -- ^ Irreducible binary polynomial+          -> Integer -> Integer+squareF2m fx = modF2m fx . square+{-# INLINE squareF2m #-}++square :: Integer -> Integer+square n1 = go n1 ln1+  where+    ln1 = log2 n1+    go n s | s == 0 = n+           | otherwise = go (x .|. y) (s - 1)+      where+        x = shift (shift n (2 * (s - ln1) - 1)) (2 * (ln1 - s) + 2)+        y = n .&. (shift 1 (2 * (ln1 - s) + 1) - 1)+{-# INLINE square #-}++-- | Inversion of @n over F₂m using extended Euclidean algorithm.+--+-- If @n doesn't have an inverse, Nothing is returned.+invF2m :: BinaryPolynomial -- ^ Irreducible binary polynomial+       -> Integer -> Maybe Integer+invF2m _  0 = Nothing+invF2m fx n+    | n >= fx   = Nothing+    | otherwise = go n fx 1 0+    where+      go u v g1 g2+          | u == 1    = Just $ modF2m fx g1+          | j < 0     = go u  (v  `xor` shift  u (-j)) g1 (g2 `xor` shift g1 (-j))+          | otherwise = go (u  `xor` shift v  j) v (g1 `xor` shift g2 j) g2+        where+          j = log2 u - log2 v+{-# INLINABLE invF2m #-}++-- | Division over F₂m. If the dividend doesn't have an inverse it returns+-- 'Nothing'.+--+-- Compute n1 / n2+divF2m :: BinaryPolynomial  -- ^ Irreducible binary polynomial+       -> Integer  -- ^ Dividend+       -> Integer  -- ^ Quotient+       -> Maybe Integer+divF2m fx n1 n2 = mulF2m fx n1 <$> invF2m fx n2+{-# INLINE divF2m #-}
+ Crypto/Number/Generate.hs view
@@ -0,0 +1,125 @@+-- |+-- Module      : Crypto.Number.Generate+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good++module Crypto.Number.Generate+    ( GenTopPolicy(..)+    , generateParams+    , generateMax+    , generateBetween+    ) where++import           Crypto.Internal.Imports+import           Crypto.Number.Basic+import           Crypto.Number.Serialize+import           Crypto.Random.Types+import           Control.Monad (when)+import           Foreign.Ptr+import           Foreign.Storable+import           Data.Bits ((.|.), (.&.), shiftL, complement, testBit)+import           Crypto.Internal.ByteArray (ScrubbedBytes)+import qualified Crypto.Internal.ByteArray as B+++-- | Top bits policy when generating a number+data GenTopPolicy =+      SetHighest    -- ^ set the highest bit+    | SetTwoHighest -- ^ set the two highest bit+    deriving (Show,Eq)++-- | Generate a number for a specific size of bits,+-- and optionaly set bottom and top bits+--+-- If the top bit policy is 'Nothing', then nothing is+-- done on the highest bit (it's whatever the random generator set).+--+-- If @generateOdd is set to 'True', then the number generated+-- is guaranteed to be odd. Otherwise it will be whatever is generated+--+generateParams :: MonadRandom m+               => Int                -- ^ number of bits+               -> Maybe GenTopPolicy -- ^ top bit policy+               -> Bool               -- ^ force the number to be odd+               -> m Integer+generateParams bits genTopPolicy generateOdd+    | bits <= 0 = return 0+    | otherwise = os2ip . tweak <$> getRandomBytes bytes+  where+    tweak :: ScrubbedBytes -> ScrubbedBytes+    tweak orig = B.copyAndFreeze orig $ \p0 -> do+        let p1   = p0 `plusPtr` 1+            pEnd = p0 `plusPtr` (bytes - 1)+        case genTopPolicy of+            Nothing             -> return ()+            Just SetHighest     -> p0 |= (1 `shiftL` bit)+            Just SetTwoHighest+                | bit == 0      -> do p0 $= 0x1+                                      p1 |= 0x80+                | otherwise     -> p0 |= (0x3 `shiftL` (bit - 1))+        p0 &= (complement $ mask)+        when generateOdd (pEnd |= 0x1)++    ($=) :: Ptr Word8 -> Word8 -> IO ()+    ($=) p w = poke p w++    (|=) :: Ptr Word8 -> Word8 -> IO ()+    (|=) p w = peek p >>= \v -> poke p (v .|. w)++    (&=) :: Ptr Word8 -> Word8 -> IO ()+    (&=) p w = peek p >>= \v -> poke p (v .&. w)++    bytes = (bits + 7) `div` 8;+    bit   = (bits - 1) `mod` 8;+    mask  = 0xff `shiftL` (bit + 1);++-- | Generate a positive integer x, s.t. 0 <= x < range+generateMax :: MonadRandom m+            => Integer  -- ^ range+            -> m Integer+generateMax range+    | range <= 1      = return 0+    | range < 127     = generateSimple+    | canOverGenerate = loopGenerateOver tries+    | otherwise       = loopGenerate tries+  where+        -- this "generator" is mostly for quickcheck benefits. it'll be biased if+        -- range is not a multiple of 2, but overall, no security should be+        -- assumed for a number between 0 and 127.+        generateSimple = flip mod range `fmap` generateParams bits Nothing False++        loopGenerate count+            | count == 0 = error $ "internal: generateMax(" ++ show range ++ " bits=" ++ show bits ++ ") (normal) doesn't seems to work properly"+            | otherwise  = do+                r <- generateParams bits Nothing False+                if isValid r then return r else loopGenerate (count-1)++        loopGenerateOver count+            | count == 0 = error $ "internal: generateMax(" ++ show range ++ " bits=" ++ show bits ++ ") (over) doesn't seems to work properly"+            | otherwise  = do+                r <- generateParams (bits+1) Nothing False+                let r2 = r - range+                    r3 = r2 - range+                if isValid r+                    then return r+                    else if isValid r2+                        then return r2+                        else if isValid r3+                            then return r3+                            else loopGenerateOver (count-1)++        bits            = numBits range+        canOverGenerate = bits > 3 && not (range `testBit` (bits-2)) && not (range `testBit` (bits-3))++        isValid n = n < range++        tries :: Int+        tries = 100++-- | generate a number between the inclusive bound [low,high].+generateBetween :: MonadRandom m => Integer -> Integer -> m Integer+generateBetween low high+    | low == 1  = generateMax high >>= \r -> if r == 0 then generateBetween low high else return r+    | otherwise = (low +) <$> generateMax (high - low + 1)
+ Crypto/Number/ModArithmetic.hs view
@@ -0,0 +1,97 @@+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE DeriveDataTypeable #-}+-- |+-- Module      : Crypto.Number.ModArithmetic+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good++module Crypto.Number.ModArithmetic+    (+    -- * exponentiation+      expSafe+    , expFast+    -- * inverse computing+    , inverse+    , inverseCoprimes+    ) where++import Control.Exception (throw, Exception)+import Data.Typeable+import Crypto.Number.Basic+import Crypto.Number.Compat++-- | Raised when two numbers are supposed to be coprimes but are not.+data CoprimesAssertionError = CoprimesAssertionError+    deriving (Show,Typeable)++instance Exception CoprimesAssertionError++-- | Compute the modular exponentiation of base^exponant using+-- algorithms design to avoid side channels and timing measurement+--+-- Modulo need to be odd otherwise the normal fast modular exponentiation+-- is used.+--+-- When used with integer-simple, this function is not different+-- from expFast, and thus provide the same unstudied and dubious+-- timing and side channels claims.+--+-- with GHC 7.10, the powModSecInteger is missing from integer-gmp+-- (which is now integer-gmp2), so is has the same security as old+-- ghc version.+expSafe :: Integer -- ^ base+        -> Integer -- ^ exponant+        -> Integer -- ^ modulo+        -> Integer -- ^ result+expSafe b e m+    | odd m     = gmpPowModSecInteger b e m `onGmpUnsupported`+                  (gmpPowModInteger b e m    `onGmpUnsupported`+                  exponentiation b e m)+    | otherwise = gmpPowModInteger b e m    `onGmpUnsupported`+                  exponentiation b e m++-- | Compute the modular exponentiation of base^exponant using+-- the fastest algorithm without any consideration for+-- hiding parameters.+--+-- Use this function when all the parameters are public,+-- otherwise 'expSafe' should be prefered.+expFast :: Integer -- ^ base+        -> Integer -- ^ exponant+        -> Integer -- ^ modulo+        -> Integer -- ^ result+expFast b e m = gmpPowModInteger b e m `onGmpUnsupported` exponentiation b e m++-- | exponentiation computes modular exponentiation as b^e mod m+-- using repetitive squaring.+exponentiation :: Integer -> Integer -> Integer -> Integer+exponentiation b e m+    | b == 1    = b+    | e == 0    = 1+    | e == 1    = b `mod` m+    | even e    = let p = (exponentiation b (e `div` 2) m) `mod` m+                   in (p^(2::Integer)) `mod` m+    | otherwise = (b * exponentiation b (e-1) m) `mod` m++-- | inverse computes the modular inverse as in g^(-1) mod m+inverse :: Integer -> Integer -> Maybe Integer+inverse g m = gmpInverse g m `onGmpUnsupported` v+  where+    v+        | d > 1     = Nothing+        | otherwise = Just (x `mod` m)+    (x,_,d) = gcde g m++-- | Compute the modular inverse of 2 coprime numbers.+-- This is equivalent to inverse except that the result+-- is known to exists.+--+-- if the numbers are not defined as coprime, this function+-- will raise a CoprimesAssertionError.+inverseCoprimes :: Integer -> Integer -> Integer+inverseCoprimes g m =+    case inverse g m of+        Nothing -> throw CoprimesAssertionError+        Just i  -> i
+ Crypto/Number/Prime.hs view
@@ -0,0 +1,213 @@+-- |+-- Module      : Crypto.Number.Prime+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good++{-# LANGUAGE BangPatterns #-}+module Crypto.Number.Prime+    (+      generatePrime+    , generateSafePrime+    , isProbablyPrime+    , findPrimeFrom+    , findPrimeFromWith+    , primalityTestMillerRabin+    , primalityTestNaive+    , primalityTestFermat+    , isCoprime+    ) where++import Crypto.Internal.Imports++import Crypto.Number.Compat+import Crypto.Number.Generate+import Crypto.Number.Basic (sqrti, gcde)+import Crypto.Number.ModArithmetic (expSafe)+import Crypto.Random.Types+import Crypto.Random.Probabilistic++import Data.Bits++-- | returns if the number is probably prime.+-- first a list of small primes are implicitely tested for divisibility,+-- then a fermat primality test is used with arbitrary numbers and+-- then the Miller Rabin algorithm is used with an accuracy of 30 recursions+isProbablyPrime :: Integer -> Bool+isProbablyPrime !n+    | any (\p -> p `divides` n) (filter (< n) firstPrimes) = False+    | primalityTestFermat 50 (n`div`2) n                   = primalityTestMillerRabin 30 n+    | otherwise                                            = False++-- | generate a prime number of the required bitsize+generatePrime :: MonadRandom m => Int -> m Integer+generatePrime bits = do+    sp <- generateParams bits (Just SetTwoHighest) True+    return $ findPrimeFrom sp++-- | generate a prime number of the form 2p+1 where p is also prime.+-- it is also knowed as a Sophie Germaine prime or safe prime.+--+-- The number of safe prime is significantly smaller to the number of prime,+-- as such it shouldn't be used if this number is supposed to be kept safe.+generateSafePrime :: MonadRandom m => Int -> m Integer+generateSafePrime bits = do+    sp <- generateParams bits (Just SetTwoHighest) True+    let p = findPrimeFromWith (\i -> isProbablyPrime (2*i+1)) (sp `div` 2)+    return (2*p+1)++-- | find a prime from a starting point where the property hold.+findPrimeFromWith :: (Integer -> Bool) -> Integer -> Integer+findPrimeFromWith prop !n+    | even n        = findPrimeFromWith prop (n+1)+    | otherwise     =+        if not (isProbablyPrime n)+            then findPrimeFromWith prop (n+2)+            else+                if prop n+                    then n+                    else findPrimeFromWith prop (n+2)++-- | find a prime from a starting point with no specific property.+findPrimeFrom :: Integer -> Integer+findPrimeFrom n =+    case gmpNextPrime n of+        GmpSupported p -> p+        GmpUnsupported -> findPrimeFromWith (\_ -> True) n++-- | Miller Rabin algorithm return if the number is probably prime or composite.+-- the tries parameter is the number of recursion, that determines the accuracy of the test.+primalityTestMillerRabin :: Int -> Integer -> Bool+primalityTestMillerRabin tries !n =+    case gmpTestPrimeMillerRabin tries n of+        GmpSupported b -> b+        GmpUnsupported -> probabilistic run+  where+    run+        | n <= 3     = error "Miller-Rabin requires tested value to be > 3"+        | even n     = return False+        | tries <= 0 = error "Miller-Rabin tries need to be > 0"+        | otherwise  = loop <$> generateTries tries++    !nm1 = n-1+    !nm2 = n-2++    (!s,!d) = (factorise 0 nm1)++    generateTries 0 = return []+    generateTries t = do+        v  <- generateBetween 2 nm2+        vs <- generateTries (t-1)+        return (v:vs)++    -- factorise n-1 into the form 2^s*d+    factorise :: Integer -> Integer -> (Integer, Integer)+    factorise !si !vi+        | vi `testBit` 0 = (si, vi)+        | otherwise     = factorise (si+1) (vi `shiftR` 1) -- probably faster to not shift v continously, but just once.+    expmod = expSafe++    -- when iteration reach zero, we have a probable prime+    loop []     = True+    loop (w:ws) = let x = expmod w d n+                   in if x == (1 :: Integer) || x == nm1+                          then loop ws+                          else loop' ws ((x*x) `mod` n) 1++    -- loop from 1 to s-1. if we reach the end then it's composite+    loop' ws !x2 !r+        | r == s    = False+        | x2 == 1   = False+        | x2 /= nm1 = loop' ws ((x2*x2) `mod` n) (r+1)+        | otherwise = loop ws++{-+    n < z -> witness to test+              1373653 [2,3]+              9080191 [31,73]+              4759123141 [2,7,61]+              2152302898747 [2,3,5,7,11]+              3474749660383 [2,3,5,7,11,13]+              341550071728321 [2,3,5,7,11,13,17]+-}++-- | Probabilitic Test using Fermat primility test.+-- Beware of Carmichael numbers that are Fermat liars, i.e. this test+-- is useless for them. always combines with some other test.+primalityTestFermat :: Int -- ^ number of iterations of the algorithm+                    -> Integer -- ^ starting a+                    -> Integer -- ^ number to test for primality+                    -> Bool+primalityTestFermat n a p = and $ map expTest [a..(a+fromIntegral n)]+    where !pm1 = p-1+          expTest i = expSafe i pm1 p == 1++-- | Test naively is integer is prime.+-- while naive, we skip even number and stop iteration at i > sqrt(n)+primalityTestNaive :: Integer -> Bool+primalityTestNaive n+    | n <= 1    = False+    | n == 2    = True+    | even n    = False+    | otherwise = search 3+        where !ubound = snd $ sqrti n+              search !i+                  | i > ubound    = True+                  | i `divides` n = False+                  | otherwise     = search (i+2)++-- | Test is two integer are coprime to each other+isCoprime :: Integer -> Integer -> Bool+isCoprime m n = case gcde m n of (_,_,d) -> d == 1++-- | list of the first primes till 2903..+firstPrimes :: [Integer]+firstPrimes =+    [ 2    , 3    , 5    , 7    , 11   , 13   , 17   , 19   , 23   , 29+    , 31   , 37   , 41   , 43   , 47   , 53   , 59   , 61   , 67   , 71+    , 73   , 79   , 83   , 89   , 97   , 101  , 103  , 107  , 109  , 113+    , 127  , 131  , 137  , 139  , 149  , 151  , 157  , 163  , 167  , 173+    , 179  , 181  , 191  , 193  , 197  , 199  , 211  , 223  , 227  , 229+    , 233  , 239  , 241  , 251  , 257  , 263  , 269  , 271  , 277  , 281+    , 283  , 293  , 307  , 311  , 313  , 317  , 331  , 337  , 347  , 349+    , 353  , 359  , 367  , 373  , 379  , 383  , 389  , 397  , 401  , 409+    , 419  , 421  , 431  , 433  , 439  , 443  , 449  , 457  , 461  , 463+    , 467  , 479  , 487  , 491  , 499  , 503  , 509  , 521  , 523  , 541+    , 547  , 557  , 563  , 569  , 571  , 577  , 587  , 593  , 599  , 601+    , 607  , 613  , 617  , 619  , 631  , 641  , 643  , 647  , 653  , 659+    , 661  , 673  , 677  , 683  , 691  , 701  , 709  , 719  , 727  , 733+    , 739  , 743  , 751  , 757  , 761  , 769  , 773  , 787  , 797  , 809+    , 811  , 821  , 823  , 827  , 829  , 839  , 853  , 857  , 859  , 863+    , 877  , 881  , 883  , 887  , 907  , 911  , 919  , 929  , 937  , 941+    , 947  , 953  , 967  , 971  , 977  , 983  , 991  , 997  , 1009 , 1013+    , 1019 , 1021 , 1031 , 1033 , 1039 , 1049 , 1051 , 1061 , 1063 , 1069+    , 1087 , 1091 , 1093 , 1097 , 1103 , 1109 , 1117 , 1123 , 1129 , 1151+    , 1153 , 1163 , 1171 , 1181 , 1187 , 1193 , 1201 , 1213 , 1217 , 1223+    , 1229 , 1231 , 1237 , 1249 , 1259 , 1277 , 1279 , 1283 , 1289 , 1291+    , 1297 , 1301 , 1303 , 1307 , 1319 , 1321 , 1327 , 1361 , 1367 , 1373+    , 1381 , 1399 , 1409 , 1423 , 1427 , 1429 , 1433 , 1439 , 1447 , 1451+    , 1453 , 1459 , 1471 , 1481 , 1483 , 1487 , 1489 , 1493 , 1499 , 1511+    , 1523 , 1531 , 1543 , 1549 , 1553 , 1559 , 1567 , 1571 , 1579 , 1583+    , 1597 , 1601 , 1607 , 1609 , 1613 , 1619 , 1621 , 1627 , 1637 , 1657+    , 1663 , 1667 , 1669 , 1693 , 1697 , 1699 , 1709 , 1721 , 1723 , 1733+    , 1741 , 1747 , 1753 , 1759 , 1777 , 1783 , 1787 , 1789 , 1801 , 1811+    , 1823 , 1831 , 1847 , 1861 , 1867 , 1871 , 1873 , 1877 , 1879 , 1889+    , 1901 , 1907 , 1913 , 1931 , 1933 , 1949 , 1951 , 1973 , 1979 , 1987+    , 1993 , 1997 , 1999 , 2003 , 2011 , 2017 , 2027 , 2029 , 2039 , 2053+    , 2063 , 2069 , 2081 , 2083 , 2087 , 2089 , 2099 , 2111 , 2113 , 2129+    , 2131 , 2137 , 2141 , 2143 , 2153 , 2161 , 2179 , 2203 , 2207 , 2213+    , 2221 , 2237 , 2239 , 2243 , 2251 , 2267 , 2269 , 2273 , 2281 , 2287+    , 2293 , 2297 , 2309 , 2311 , 2333 , 2339 , 2341 , 2347 , 2351 , 2357+    , 2371 , 2377 , 2381 , 2383 , 2389 , 2393 , 2399 , 2411 , 2417 , 2423+    , 2437 , 2441 , 2447 , 2459 , 2467 , 2473 , 2477 , 2503 , 2521 , 2531+    , 2539 , 2543 , 2549 , 2551 , 2557 , 2579 , 2591 , 2593 , 2609 , 2617+    , 2621 , 2633 , 2647 , 2657 , 2659 , 2663 , 2671 , 2677 , 2683 , 2687+    , 2689 , 2693 , 2699 , 2707 , 2711 , 2713 , 2719 , 2729 , 2731 , 2741+    , 2749 , 2753 , 2767 , 2777 , 2789 , 2791 , 2797 , 2801 , 2803 , 2819+    , 2833 , 2837 , 2843 , 2851 , 2857 , 2861 , 2879 , 2887 , 2897 , 2903+    ]++{-# INLINE divides #-}+divides :: Integer -> Integer -> Bool+divides i n = n `mod` i == 0
+ Crypto/Number/Serialize.hs view
@@ -0,0 +1,97 @@+-- |+-- Module      : Crypto.Number.Serialize+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- fast serialization primitives for integer+{-# LANGUAGE BangPatterns #-}+module Crypto.Number.Serialize+    ( i2osp+    , os2ip+    , i2ospOf+    , i2ospOf_+    , lengthBytes+    ) where++import           Data.Bits+import           Data.Word+import           Foreign.Storable+import           Foreign.Ptr+import           Crypto.Number.Compat+import           Crypto.Internal.Compat (unsafeDoIO)+import qualified Crypto.Internal.ByteArray as B+import           Data.Memory.PtrMethods++divMod256 :: Integer -> (Integer, Word8)+divMod256 n = (n `shiftR` 8, fromIntegral n)++-- | os2ip converts a byte string into a positive integer+os2ip :: B.ByteArrayAccess ba => ba -> Integer+os2ip bs = unsafeDoIO $ B.withByteArray bs (loop 0 0)+  where+        len = B.length bs++        loop :: Integer -> Int -> Ptr Word8 -> IO Integer+        loop !acc i p+            | i == len  = return acc+            | otherwise = do+                w <- peekByteOff p i :: IO Word8+                loop ((acc `shiftL` 8) .|. fromIntegral w) (i+1) p++-- | i2osp converts a positive integer into a byte string+--+-- first byte is MSB (most significant byte), last byte is the LSB (least significant byte)+i2osp :: B.ByteArray ba => Integer -> ba+i2osp 0 = B.allocAndFreeze 1 $ \p -> pokeByteOff p 0 (0 :: Word8)+i2osp m = B.allocAndFreeze sz (\p -> fillPtr p >> return ())+  where+        !sz = lengthBytes m++        fillPtr p = gmpExportInteger m p `onGmpUnsupported` export p (sz-1) m+        export p ofs i+            | ofs == 0  = pokeByteOff p ofs (fromIntegral i :: Word8)+            | otherwise = do+                let (i', b) = divMod256 i+                pokeByteOff p ofs b+                export p (ofs-1) i'++-- | just like i2osp, but take an extra parameter for size.+-- if the number is too big to fit in @len bytes, nothing is returned+-- otherwise the number is padded with 0 to fit the @len required.+i2ospOf :: B.ByteArray ba => Int -> Integer -> Maybe ba+i2ospOf 0   _ = error "cannot create integer serialization in 0 bytes"+i2ospOf len 0 = Just $ B.allocAndFreeze len $ \p -> memSet p 0 len+i2ospOf len m+    | sz > len  = Nothing+    | otherwise = Just $ B.allocAndFreeze len $ \p -> memSet p 0 len >> fillPtr (p `plusPtr` (len - sz))+  where+        !sz = lengthBytes m++        fillPtr p = gmpExportInteger m p `onGmpUnsupported` export p (sz-1) m+        export p ofs i+            | ofs == 0  = pokeByteOff p ofs (fromIntegral i :: Word8)+            | otherwise = do+                let (i', b) = divMod256 i+                pokeByteOff p ofs b+                export p (ofs-1) i'++--+-- | just like i2ospOf except that it doesn't expect a failure: i.e.+-- an integer larger than the number of output bytes requested+--+-- for example if you just took a modulo of the number that represent+-- the size (example the RSA modulo n).+i2ospOf_ :: B.ByteArray ba => Int -> Integer -> ba+i2ospOf_ len = maybe (error "i2ospOf_: integer is larger than expected") id . i2ospOf len++-- | returns the number of bytes to store an integer with i2osp+--+-- with integer-simple, this function is really slow.+lengthBytes :: Integer -> Int+lengthBytes n = gmpSizeInBytes n `onGmpUnsupported` nbBytes n+  where+    nbBytes !v+        | v < 256   = 1+        | otherwise = 1 + nbBytes (v `shiftR` 8)
+ Crypto/PubKey/Curve25519.hs view
@@ -0,0 +1,111 @@+-- |+-- Module      : Crypto.PubKey.Curve25519+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Curve25519 support+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+{-# LANGUAGE MagicHash #-}+module Crypto.PubKey.Curve25519+    ( SecretKey+    , PublicKey+    , DhSecret+    -- * Smart constructors+    , dhSecret+    , publicKey+    , secretKey+    -- * methods+    , dh+    , toPublic+    ) where++import           Data.Word+import           Foreign.Ptr+import           GHC.Ptr++import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArrayAccess, ScrubbedBytes, Bytes, withByteArray)+import qualified Crypto.Internal.ByteArray as B++-- | A Curve25519 Secret key+newtype SecretKey = SecretKey ScrubbedBytes+    deriving (Show,Eq,ByteArrayAccess,NFData)++-- | A Curve25519 public key+newtype PublicKey = PublicKey Bytes+    deriving (Show,Eq,ByteArrayAccess,NFData)++-- | A Curve25519 Diffie Hellman secret related to a+-- public key and a secret key.+newtype DhSecret = DhSecret ScrubbedBytes+    deriving (Show,Eq,ByteArrayAccess,NFData)++-- | Try to build a public key from a bytearray+publicKey :: ByteArrayAccess bs => bs -> Either String PublicKey+publicKey bs+    | B.length bs == 32 = Right $ PublicKey $ B.copyAndFreeze bs (\_ -> return ())+    | otherwise               = Left "invalid public key size"++-- | Try to build a secret key from a bytearray+secretKey :: ByteArrayAccess bs => bs -> Either String SecretKey+secretKey bs+    | B.length bs == 32 = unsafeDoIO $ do+        withByteArray bs $ \inp -> do+            valid <- isValidPtr inp+            if valid+                then (Right . SecretKey) <$> B.copy bs (\_ -> return ())+                else return $ Left "invalid secret key"+    | otherwise = Left "secret key invalid size"+  where+        --  e[0] &= 0xf8;+        --  e[31] &= 0x7f;+        --  e[31] |= 40;+        isValidPtr :: Ptr Word8 -> IO Bool+        isValidPtr _ = do+            --b0  <- peekElemOff inp 0+            --b31 <- peekElemOff inp 31+            return True+{-+            return $ and [ testBit b0  0 == False+                         , testBit b0  1 == False+                         , testBit b0  2 == False+                         , testBit b31 7 == False+                         , testBit b31 6 == True+                         ]+-}+{-# NOINLINE secretKey #-}++-- | Create a DhSecret from a bytearray object+dhSecret :: ByteArrayAccess b => b -> Either String DhSecret+dhSecret bs+    | B.length bs == 32 = Right $ DhSecret $ B.copyAndFreeze bs (\_ -> return ())+    | otherwise         = Left "invalid dh secret size"++-- | Compute the Diffie Hellman secret from a public key and a secret key+dh :: PublicKey -> SecretKey -> DhSecret+dh (PublicKey pub) (SecretKey sec) = DhSecret <$>+    B.allocAndFreeze 32        $ \result ->+    withByteArray sec          $ \psec   ->+    withByteArray pub          $ \ppub   ->+        ccryptonite_curve25519 result psec ppub+{-# NOINLINE dh #-}++-- | Create a public key from a secret key+toPublic :: SecretKey -> PublicKey+toPublic (SecretKey sec) = PublicKey <$>+    B.allocAndFreeze 32     $ \result ->+    withByteArray sec       $ \psec   ->+        ccryptonite_curve25519 result psec basePoint+  where+        basePoint = Ptr "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"#+{-# NOINLINE toPublic #-}++foreign import ccall "cryptonite_curve25519_donna"+    ccryptonite_curve25519 :: Ptr Word8 -- ^ public+                           -> Ptr Word8 -- ^ secret+                           -> Ptr Word8 -- ^ basepoint+                           -> IO ()
+ Crypto/PubKey/DH.hs view
@@ -0,0 +1,73 @@+-- |+-- Module      : Crypto.PubKey.DH+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.PubKey.DH+    ( Params(..)+    , PublicNumber(..)+    , PrivateNumber(..)+    , SharedKey(..)+    , generateParams+    , generatePrivate+    , calculatePublic+    , generatePublic+    , getShared+    ) where++import Crypto.Internal.Imports+import Crypto.Number.ModArithmetic (expSafe)+import Crypto.Number.Prime (generateSafePrime)+import Crypto.Number.Generate (generateMax)+import Crypto.Random.Types+import Data.Data++-- | Represent Diffie Hellman parameters namely P (prime), and G (generator).+data Params = Params+    { params_p :: Integer+    , params_g :: Integer+    } deriving (Show,Read,Eq,Data,Typeable)++-- | Represent Diffie Hellman public number Y.+newtype PublicNumber = PublicNumber Integer+    deriving (Show,Read,Eq,Enum,Real,Num,Ord)++-- | Represent Diffie Hellman private number X.+newtype PrivateNumber = PrivateNumber Integer+    deriving (Show,Read,Eq,Enum,Real,Num,Ord)++-- | Represent Diffie Hellman shared secret.+newtype SharedKey = SharedKey Integer+    deriving (Show,Read,Eq,Enum,Real,Num,Ord)++-- | generate params from a specific generator (2 or 5 are common values)+-- we generate a safe prime (a prime number of the form 2p+1 where p is also prime)+generateParams :: MonadRandom m => Int -> Integer -> m Params+generateParams bits generator =+    (\p -> Params p generator) <$> generateSafePrime bits++-- | generate a private number with no specific property+-- this number is usually called X in DH text.+generatePrivate :: MonadRandom m => Params -> m PrivateNumber+generatePrivate (Params p _) = PrivateNumber <$> generateMax p++-- | calculate the public number from the parameters and the private key+-- this number is usually called Y in DH text.+calculatePublic :: Params -> PrivateNumber -> PublicNumber+calculatePublic (Params p g) (PrivateNumber x) = PublicNumber $ expSafe g x p++-- | calculate the public number from the parameters and the private key+-- this number is usually called Y in DH text.+--+-- DEPRECATED use calculatePublic+generatePublic :: Params -> PrivateNumber -> PublicNumber+generatePublic = calculatePublic+-- commented until 0.3 {-# DEPRECATED generatePublic "use calculatePublic" #-}++-- | generate a shared key using our private number and the other party public number+getShared :: Params -> PrivateNumber -> PublicNumber -> SharedKey+getShared (Params p _) (PrivateNumber x) (PublicNumber y) = SharedKey $ expSafe y x p
+ Crypto/PubKey/DSA.hs view
@@ -0,0 +1,153 @@+-- |+-- Module      : Crypto.PubKey.DSA+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- An implementation of the Digital Signature Algorithm (DSA)+{-# LANGUAGE DeriveDataTypeable #-}+module Crypto.PubKey.DSA+    ( Params(..)+    , Signature(..)+    , PublicKey(..)+    , PrivateKey(..)+    , PublicNumber+    , PrivateNumber+    -- * generation+    , generatePrivate+    , calculatePublic+    -- * signature primitive+    , sign+    , signWith+    -- * verification primitive+    , verify+    -- * Key pair+    , KeyPair(..)+    , toPublicKey+    , toPrivateKey+    ) where++import           Crypto.Random.Types+import           Data.Data+import           Data.Maybe+import           Crypto.Number.ModArithmetic (expFast, expSafe, inverse)+import           Crypto.Number.Serialize+import           Crypto.Number.Generate+import           Crypto.Internal.ByteArray (ByteArrayAccess)+import           Crypto.Internal.Imports+import           Crypto.Hash++-- | DSA Public Number, usually embedded in DSA Public Key+type PublicNumber = Integer++-- | DSA Private Number, usually embedded in DSA Private Key+type PrivateNumber = Integer++-- | Represent DSA parameters namely P, G, and Q.+data Params = Params+    { params_p :: Integer -- ^ DSA p+    , params_g :: Integer -- ^ DSA g+    , params_q :: Integer -- ^ DSA q+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData Params where+    rnf (Params p g q) = p `seq` g `seq` q `seq` ()++-- | Represent a DSA signature namely R and S.+data Signature = Signature+    { sign_r :: Integer -- ^ DSA r+    , sign_s :: Integer -- ^ DSA s+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData Signature where+    rnf (Signature r s) = r `seq` s `seq` ()++-- | Represent a DSA public key.+data PublicKey = PublicKey+    { public_params :: Params       -- ^ DSA parameters+    , public_y      :: PublicNumber -- ^ DSA public Y+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData PublicKey where+    rnf (PublicKey params y) = y `seq` params `seq` ()++-- | Represent a DSA private key.+--+-- Only x need to be secret.+-- the DSA parameters are publicly shared with the other side.+data PrivateKey = PrivateKey+    { private_params :: Params        -- ^ DSA parameters+    , private_x      :: PrivateNumber -- ^ DSA private X+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData PrivateKey where+    rnf (PrivateKey params x) = x `seq` params `seq` ()++-- | Represent a DSA key pair+data KeyPair = KeyPair Params PublicNumber PrivateNumber+    deriving (Show,Read,Eq,Data,Typeable)++instance NFData KeyPair where+    rnf (KeyPair params y x) = x `seq` y `seq` params `seq` ()++-- | Public key of a DSA Key pair+toPublicKey :: KeyPair -> PublicKey+toPublicKey (KeyPair params pub _) = PublicKey params pub++-- | Private key of a DSA Key pair+toPrivateKey :: KeyPair -> PrivateKey+toPrivateKey (KeyPair params _ priv) = PrivateKey params priv++-- | generate a private number with no specific property+-- this number is usually called X in DSA text.+generatePrivate :: MonadRandom m => Params -> m PrivateNumber+generatePrivate (Params _ _ q) = generateMax q++-- | Calculate the public number from the parameters and the private key+calculatePublic :: Params -> PrivateNumber -> PublicNumber+calculatePublic (Params p g _) x = expSafe g x p++-- | sign message using the private key and an explicit k number.+signWith :: (ByteArrayAccess msg, HashAlgorithm hash)+         => Integer         -- ^ k random number+         -> PrivateKey      -- ^ private key+         -> hash            -- ^ hash function+         -> msg             -- ^ message to sign+         -> Maybe Signature+signWith k pk hashAlg msg+    | r == 0 || s == 0  = Nothing+    | otherwise         = Just $ Signature r s+    where -- parameters+          (Params p g q) = private_params pk+          x              = private_x pk+          -- compute r,s+          kInv      = fromJust $ inverse k q+          hm        = os2ip $ hashWith hashAlg msg+          r         = expSafe g k p `mod` q+          s         = (kInv * (hm + x * r)) `mod` q++-- | sign message using the private key.+sign :: (ByteArrayAccess msg, HashAlgorithm hash, MonadRandom m) => PrivateKey -> hash -> msg -> m Signature+sign pk hashAlg msg = do+    k <- generateMax q+    case signWith k pk hashAlg msg of+        Nothing  -> sign pk hashAlg msg+        Just sig -> return sig+  where+    (Params _ _ q) = private_params pk++-- | verify a bytestring using the public key.+verify :: (ByteArrayAccess msg, HashAlgorithm hash) => hash -> PublicKey -> Signature -> msg -> Bool+verify hashAlg pk (Signature r s) m+    -- Reject the signature if either 0 < r < q or 0 < s < q is not satisfied.+    | r <= 0 || r >= q || s <= 0 || s >= q = False+    | otherwise                            = v == r+    where (Params p g q) = public_params pk+          y       = public_y pk+          hm      = os2ip $ hashWith hashAlg m++          w       = fromJust $ inverse s q+          u1      = (hm*w) `mod` q+          u2      = (r*w) `mod` q+          v       = ((expFast g u1 p) * (expFast y u2 p)) `mod` p `mod` q
+ Crypto/PubKey/ECC/DH.hs view
@@ -0,0 +1,46 @@+-- |+-- Module      : Crypto.PubKey.ECC.DH+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Elliptic curve Diffie Hellman+--+module Crypto.PubKey.ECC.DH+    (+      Curve+    , PublicPoint+    , PrivateNumber+    , SharedKey(..)+    , generatePrivate+    , calculatePublic+    , getShared+    ) where++import Crypto.Number.Generate (generateMax)+import Crypto.PubKey.ECC.Prim (pointMul)+import Crypto.Random.Types+import Crypto.PubKey.DH (SharedKey(..))+import Crypto.PubKey.ECC.Types (PublicPoint, PrivateNumber, Curve, Point(..))+import Crypto.PubKey.ECC.Types (ecc_n, ecc_g, common_curve)++-- | Generating a private number d.+generatePrivate :: MonadRandom m => Curve -> m PrivateNumber+generatePrivate curve = generateMax n+  where+    n = ecc_n $ common_curve curve++-- | Generating a public point Q.+calculatePublic :: Curve -> PrivateNumber -> PublicPoint+calculatePublic curve d = q+  where+    g = ecc_g $ common_curve curve+    q = pointMul curve d g++-- | Generating a shared key using our private number and+--   the other party public point.+getShared :: Curve -> PrivateNumber -> PublicPoint -> SharedKey+getShared curve db qa = SharedKey x+  where+    Point x _ = pointMul curve db qa
+ Crypto/PubKey/ECC/ECDSA.hs view
@@ -0,0 +1,121 @@+-- | /WARNING:/ Signature operations may leak the private key. Signature verification+-- should be safe.+{-# LANGUAGE DeriveDataTypeable #-}+module Crypto.PubKey.ECC.ECDSA+    ( Signature(..)+    , PublicPoint+    , PublicKey(..)+    , PrivateNumber+    , PrivateKey(..)+    , KeyPair(..)+    , toPublicKey+    , toPrivateKey+    , signWith+    , sign+    , verify+    ) where++import Control.Monad+import Crypto.Random.Types+import Data.Bits (shiftR)+import Crypto.Internal.ByteArray (ByteArrayAccess)+import Data.Data+import Crypto.Number.ModArithmetic (inverse)+import Crypto.Number.Serialize+import Crypto.Number.Generate+import Crypto.PubKey.ECC.Types+import Crypto.PubKey.ECC.Prim+import Crypto.Hash++-- | Represent a ECDSA signature namely R and S.+data Signature = Signature+    { sign_r :: Integer -- ^ ECDSA r+    , sign_s :: Integer -- ^ ECDSA s+    } deriving (Show,Read,Eq,Data,Typeable)++-- | ECDSA Private Key.+data PrivateKey = PrivateKey+    { private_curve :: Curve+    , private_d     :: PrivateNumber+    } deriving (Show,Read,Eq,Data,Typeable)++-- | ECDSA Public Key.+data PublicKey = PublicKey+    { public_curve :: Curve+    , public_q     :: PublicPoint+    } deriving (Show,Read,Eq,Data,Typeable)++-- | ECDSA Key Pair.+data KeyPair = KeyPair Curve PublicPoint PrivateNumber+    deriving (Show,Read,Eq,Data,Typeable)++-- | Public key of a ECDSA Key pair.+toPublicKey :: KeyPair -> PublicKey+toPublicKey (KeyPair curve pub _) = PublicKey curve pub++-- | Private key of a ECDSA Key pair.+toPrivateKey :: KeyPair -> PrivateKey+toPrivateKey (KeyPair curve _ priv) = PrivateKey curve priv++-- | Sign message using the private key and an explicit k number.+--+-- /WARNING:/ Vulnerable to timing attacks.+signWith :: (ByteArrayAccess msg, HashAlgorithm hash)+         => Integer    -- ^ k random number+         -> PrivateKey -- ^ private key+         -> hash       -- ^ hash function+         -> msg        -- ^ message to sign+         -> Maybe Signature+signWith k (PrivateKey curve d) hashAlg msg = do+    let z = tHash hashAlg msg n+        CurveCommon _ _ g n _ = common_curve curve+    let point = pointMul curve k g+    r <- case point of+              PointO    -> Nothing+              Point x _ -> return $ x `mod` n+    kInv <- inverse k n+    let s = kInv * (z + r * d) `mod` n+    when (r == 0 || s == 0) Nothing+    return $ Signature r s++-- | Sign message using the private key.+--+-- /WARNING:/ Vulnerable to timing attacks.+sign :: (ByteArrayAccess msg, HashAlgorithm hash, MonadRandom m)+     => PrivateKey -> hash -> msg -> m Signature+sign pk hashAlg msg = do+    k <- generateBetween 1 (n - 1)+    case signWith k pk hashAlg msg of+         Nothing  -> sign pk hashAlg msg+         Just sig -> return sig+  where n = ecc_n . common_curve $ private_curve pk++-- | Verify a bytestring using the public key.+verify :: (ByteArrayAccess msg, HashAlgorithm hash) => hash -> PublicKey -> Signature -> msg -> Bool+verify _       (PublicKey _ PointO) _ _ = False+verify hashAlg pk@(PublicKey curve q) (Signature r s) msg+    | r < 1 || r >= n || s < 1 || s >= n = False+    | otherwise = maybe False (r ==) $ do+        w <- inverse s n+        let z  = tHash hashAlg msg n+            u1 = z * w `mod` n+            u2 = r * w `mod` n+            -- TODO: Use Shamir's trick+            g' = pointMul curve u1 g+            q' = pointMul curve u2 q+            x  = pointAdd curve g' q'+        case x of+             PointO     -> Nothing+             Point x1 _ -> return $ x1 `mod` n+  where n = ecc_n cc+        g = ecc_g cc+        cc = common_curve $ public_curve pk++-- | Truncate and hash.+tHash :: (ByteArrayAccess msg, HashAlgorithm hash) => hash -> msg -> Integer -> Integer+tHash hashAlg m n+    | d > 0 = shiftR e d+    | otherwise = e+  where e = os2ip $ hashWith hashAlg m+        d = log2 e - log2 n+        log2 = ceiling . logBase (2 :: Double) . fromIntegral
+ Crypto/PubKey/ECC/Generate.hs view
@@ -0,0 +1,30 @@+-- | Signature generation.+module Crypto.PubKey.ECC.Generate where++import Crypto.Random.Types+import Crypto.PubKey.ECC.Types+import Crypto.PubKey.ECC.ECDSA+import Crypto.Number.Generate+import Crypto.PubKey.ECC.Prim++-- | Generate Q given d.+--+-- /WARNING:/ Vulnerable to timing attacks.+generateQ :: Curve+          -> Integer+          -> Point+generateQ curve d = pointMul curve d g+  where g = ecc_g $ common_curve curve++-- | Generate a pair of (private, public) key.+--+-- /WARNING:/ Vulnerable to timing attacks.+generate :: MonadRandom m+         => Curve -- ^ Elliptic Curve+         -> m (PublicKey, PrivateKey)+generate curve = do+    d <- generateBetween 1 (n - 1)+    let q = generateQ curve d+    return (PublicKey curve q, PrivateKey curve d)+  where+        n = ecc_n $ common_curve curve
+ Crypto/PubKey/ECC/P256.hs view
@@ -0,0 +1,241 @@+-- |+-- Module      : Crypto.PubKey.ECC.P256+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- P256 support+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE EmptyDataDecls #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}+module Crypto.PubKey.ECC.P256+    ( Scalar+    , Point+    -- * point arithmetic+    , pointAdd+    , pointMul+    , pointsMulVarTime+    , pointIsValid+    , toPoint+    -- * scalar arithmetic+    , scalarZero+    , scalarAdd+    , scalarSub+    , scalarInv+    , scalarInvVarTime+    , scalarCmp+    , scalarFromBinary+    , scalarToBinary+    ) where++import           Data.Word+import           Foreign.Ptr+import           Foreign.C.Types++import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+--import           Crypto.Internal.Memory+import           Crypto.Internal.ByteArray+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Error++-- | A P256 scalar+newtype Scalar = Scalar ScrubbedBytes+    deriving (Eq,ByteArrayAccess)++-- | A P256 point+data Point = Point !Bytes !Bytes+    deriving (Show,Eq)++scalarSize :: Int+scalarSize = 32++type P256Digit  = Word32++data P256Scalar+data P256Y+data P256X++------------------------------------------------------------------------+-- Point methods+------------------------------------------------------------------------+++-- | Lift to curve a scalar+--+-- Using the curve generator as base point compute:+--+-- > scalar * G+--+toPoint :: Scalar -> Point+toPoint s = withNewPoint $ \px py -> withScalar s $ \p ->+    ccryptonite_p256_basepoint_mul p px py++-- | Add a point to another point+pointAdd :: Point -> Point -> Point+pointAdd a b = withNewPoint $ \dx dy ->+    withPoint a $ \ax ay -> withPoint b $ \bx by ->+        ccryptonite_p256e_point_add ax ay bx by dx dy++-- | Multiply a point by a scalar+pointMul :: Scalar -> Point -> Point+pointMul scalar p = withNewPoint $ \dx dy ->+    withScalar scalar $ \n -> withPoint p $ \px py ->+        ccryptonite_p256_point_mul n dx dy px py++-- | multiply the point @p with @n2 and add a lifted to curve value @n1+--+-- > n1 * G + n2 * p+pointsMulVarTime :: Scalar -> Scalar -> Point -> Point+pointsMulVarTime n1 n2 p = withNewPoint $ \dx dy ->+    withScalar n1 $ \pn1 -> withScalar n2 $ \pn2 -> withPoint p $ \px py ->+        ccryptonite_p256_points_mul_vartime pn1 pn2 px py dx dy++-- | Check if a 'Point' is valid+pointIsValid :: Point -> Bool+pointIsValid p = unsafeDoIO $ withPoint p $ \px py -> do+    r <- ccryptonite_p256_is_valid_point px py+    return (r /= 0)++------------------------------------------------------------------------+-- Scalar methods+------------------------------------------------------------------------++-- | The scalar representing 0+scalarZero :: Scalar+scalarZero = withNewScalarFreeze $ \d -> ccryptonite_p256_init d++-- | Perform addition between two scalars+--+-- > a + b+scalarAdd :: Scalar -> Scalar -> Scalar+scalarAdd a b =+    withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb -> do+        void $ ccryptonite_p256_add pa pb d+        ccryptonite_p256_mod ccryptonite_SECP256r1_n d d++-- | Perform subtraction between two scalars+--+-- > a - b+scalarSub :: Scalar -> Scalar -> Scalar+scalarSub a b =+    withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb -> do+        void $ ccryptonite_p256_sub pa pb d+        ccryptonite_p256_mod ccryptonite_SECP256r1_n d d++-- | Give the inverse of the scalar+--+-- > 1 / a+scalarInv :: Scalar -> Scalar+scalarInv a =+    withNewScalarFreeze $ \b -> withScalar a $ \pa ->+        ccryptonite_p256_modinv ccryptonite_SECP256r1_n pa b++-- | similar to 'scalarInv' but instead of+-- trying to be constant time, do it as fast as possible+scalarInvVarTime :: Scalar -> Scalar+scalarInvVarTime a =+    withNewScalarFreeze $ \b -> withScalar a $ \pa ->+        ccryptonite_p256_modinv_vartime ccryptonite_SECP256r1_n pa b++-- | Compare 2 Scalar+scalarCmp :: Scalar -> Scalar -> Ordering+scalarCmp a b = unsafeDoIO $+    withScalar a $ \pa -> withScalar b $ \pb -> do+        v <- ccryptonite_p256_cmp pa pb+        return $ compare v 0++-- | convert a scalar from binary+scalarFromBinary :: ByteArrayAccess ba => ba -> CryptoFailable Scalar+scalarFromBinary ba+    | B.length ba /= scalarSize = CryptoFailed $ CryptoError_SecretKeySizeInvalid+    | otherwise                 =+        CryptoPassed $ withNewScalarFreeze $ \p -> B.withByteArray ba $ \b ->+            ccryptonite_p256_from_bin b p++-- | convert a scalar to binary+scalarToBinary :: ByteArray ba => Scalar -> ba+scalarToBinary s = B.allocAndFreeze scalarSize $ \b -> withScalar s $ \p ->+    ccryptonite_p256_to_bin p b++------------------------------------------------------------------------+-- Memory Helpers+------------------------------------------------------------------------+withNewPoint :: (Ptr P256X -> Ptr P256Y -> IO ()) -> Point+withNewPoint f = unsafeDoIO $ do+    (x,y) <- B.allocRet pointCoordSize $ \py -> B.alloc pointCoordSize $ \px -> f px py+    return $! Point x y+  where pointCoordSize = 32+{-# NOINLINE withNewPoint #-}++withPoint :: Point -> (Ptr P256X -> Ptr P256Y -> IO a) -> IO a+withPoint (Point x y) f = B.withByteArray x $ \px -> B.withByteArray y $ \py -> f px py++withNewScalarFreeze :: (Ptr P256Scalar -> IO ()) -> Scalar+withNewScalarFreeze f = Scalar $ B.allocAndFreeze scalarSize f+{-# NOINLINE withNewScalarFreeze #-}++withScalar :: Scalar -> (Ptr P256Scalar -> IO a) -> IO a+withScalar (Scalar d) f = B.withByteArray d f++------------------------------------------------------------------------+-- Foreign bindings+------------------------------------------------------------------------+foreign import ccall "&cryptonite_SECP256r1_n"+    ccryptonite_SECP256r1_n :: Ptr P256Scalar+foreign import ccall "&cryptonite_SECP256r1_p"+    ccryptonite_SECP256r1_p :: Ptr P256Scalar+foreign import ccall "&cryptonite_SECP256r1_b"+    ccryptonite_SECP256r1_b :: Ptr P256Scalar++foreign import ccall "cryptonite_p256_init"+    ccryptonite_p256_init :: Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_clear"+    ccryptonite_p256_clear :: Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_add"+    ccryptonite_p256_add :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO CInt+foreign import ccall "cryptonite_p256_sub"+    ccryptonite_p256_sub :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO CInt+foreign import ccall "cryptonite_p256_cmp"+    ccryptonite_p256_cmp :: Ptr P256Scalar -> Ptr P256Scalar -> IO CInt+foreign import ccall "cryptonite_p256_mod"+    ccryptonite_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_modmul"+    ccryptonite_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_modinv"+    ccryptonite_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_modinv_vartime"+    ccryptonite_p256_modinv_vartime :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()+foreign import ccall "cryptonite_p256_base_point_mul"+    ccryptonite_p256_basepoint_mul :: Ptr P256Scalar+                                   -> Ptr P256X -> Ptr P256Y+                                   -> IO ()++foreign import ccall "cryptonite_p256e_point_add"+    ccryptonite_p256e_point_add :: Ptr P256X -> Ptr P256Y+                                -> Ptr P256X -> Ptr P256Y+                                -> Ptr P256X -> Ptr P256Y+                                -> IO ()+foreign import ccall "cryptonite_p256_point_mul"+    ccryptonite_p256_point_mul :: Ptr P256Scalar+                               -> Ptr P256X -> Ptr P256Y+                               -> Ptr P256X -> Ptr P256Y+                               -> IO ()+foreign import ccall "cryptonite_p256_points_mul_vartime"+    ccryptonite_p256_points_mul_vartime :: Ptr P256Scalar -> Ptr P256Scalar+                                        -> Ptr P256X -> Ptr P256Y+                                        -> Ptr P256X -> Ptr P256Y+                                        -> IO ()+foreign import ccall "cryptonite_p256_is_valid_point"+    ccryptonite_p256_is_valid_point :: Ptr P256X -> Ptr P256Y -> IO CInt++foreign import ccall "cryptonite_p256_to_bin"+    ccryptonite_p256_to_bin :: Ptr P256Scalar -> Ptr Word8 -> IO ()++foreign import ccall "cryptonite_p256_from_bin"+    ccryptonite_p256_from_bin :: Ptr Word8 -> Ptr P256Scalar -> IO ()
+ Crypto/PubKey/ECC/Prim.hs view
@@ -0,0 +1,124 @@+-- | Elliptic Curve Arithmetic.+--+-- /WARNING:/ These functions are vulnerable to timing attacks.+module Crypto.PubKey.ECC.Prim+    ( pointAdd+    , pointDouble+    , pointMul+    , isPointAtInfinity+    , isPointValid+    ) where++import Data.Maybe+import Crypto.Number.ModArithmetic+import Crypto.Number.F2m+import Crypto.PubKey.ECC.Types++--TODO: Extract helper function for `fromMaybe PointO...`++-- | Elliptic Curve point addition.+--+-- /WARNING:/ Vulnerable to timing attacks.+pointAdd :: Curve -> Point -> Point -> Point+pointAdd _ PointO PointO = PointO+pointAdd _ PointO q = q+pointAdd _ p PointO = p+pointAdd c@(CurveFP (CurvePrime pr _)) p@(Point xp yp) q@(Point xq yq)+    | p == Point xq (-yq) = PointO+    | p == q = pointDouble c p+    | otherwise = fromMaybe PointO $ do+                      s <- divmod (yp - yq) (xp - xq) pr+                      let xr = (s ^ (2::Int) - xp - xq) `mod` pr+                          yr = (s * (xp - xr) - yp) `mod` pr+                      return $ Point xr yr+pointAdd c@(CurveF2m (CurveBinary fx cc)) p@(Point xp yp) q@(Point xq yq)+    | p == Point xq (xq `addF2m` yq) = PointO+    | p == q = pointDouble c p+    | otherwise = fromMaybe PointO $ do+                     s <- divF2m fx (yp `addF2m` yq) (xp `addF2m` xq)+                     let xr = mulF2m fx s s `addF2m` s `addF2m` xp `addF2m` xq `addF2m` a+                         yr = mulF2m fx s (xp `addF2m` xr) `addF2m` xr `addF2m` yp+                     return $ Point xr yr+  where a = ecc_a cc++-- | Elliptic Curve point doubling.+--+-- /WARNING:/ Vulnerable to timing attacks.+--+-- This perform the following calculation:+-- > lambda = (3 * xp ^ 2 + a) / 2 yp+-- > xr = lambda ^ 2 - 2 xp+-- > yr = lambda (xp - xr) - yp+--+-- With binary curve:+-- > xp == 0   => P = O+-- > otherwise =>+-- >    s = xp + (yp / xp)+-- >    xr = s ^ 2 + s + a+-- >    yr = xp ^ 2 + (s+1) * xr+--+pointDouble :: Curve -> Point -> Point+pointDouble _ PointO = PointO+pointDouble (CurveFP (CurvePrime pr cc)) (Point xp yp) = fromMaybe PointO $ do+    lambda <- divmod (3 * xp ^ (2::Int) + a) (2 * yp) pr+    let xr = (lambda ^ (2::Int) - 2 * xp) `mod` pr+        yr = (lambda * (xp - xr) - yp) `mod` pr+    return $ Point xr yr+  where a = ecc_a cc+pointDouble (CurveF2m (CurveBinary fx cc)) (Point xp yp)+    | xp == 0   = PointO+    | otherwise = fromMaybe PointO $ do+        s <- return . addF2m xp =<< divF2m fx yp xp+        let xr = mulF2m fx s s `addF2m` s `addF2m` a+            yr = mulF2m fx xp xp `addF2m` mulF2m fx xr (s `addF2m` 1)+        return $ Point xr yr+  where a = ecc_a cc++-- | Elliptic curve point multiplication (double and add algorithm).+--+-- /WARNING:/ Vulnerable to timing attacks.+pointMul :: Curve -> Integer -> Point -> Point+pointMul _ _ PointO = PointO+pointMul c n p@(Point xp yp)+    | n <  0 = pointMul c (-n) (Point xp (-yp))+    | n == 0 = PointO+    | n == 1 = p+    | odd n = pointAdd c p (pointMul c (n - 1) p)+    | otherwise = pointMul c (n `div` 2) (pointDouble c p)++-- | Check if a point is the point at infinity.+isPointAtInfinity :: Point -> Bool+isPointAtInfinity PointO = True+isPointAtInfinity _      = False++-- | check if a point is on specific curve+--+-- This perform three checks:+--+-- * x is not out of range+-- * y is not out of range+-- * the equation @y^2 = x^3 + a*x + b (mod p)@ holds+isPointValid :: Curve -> Point -> Bool+isPointValid _                           PointO      = True+isPointValid (CurveFP (CurvePrime p cc)) (Point x y) =+    isValid x && isValid y && (y ^ (2 :: Int)) `eqModP` (x ^ (3 :: Int) + a * x + b)+  where a  = ecc_a cc+        b  = ecc_b cc+        eqModP z1 z2 = (z1 `mod` p) == (z2 `mod` p)+        isValid e = e >= 0 && e < p+isPointValid (CurveF2m (CurveBinary fx cc)) (Point x y) =+    and [ isValid x+        , isValid y+        , ((((x `add` a) `mul` x `add` y) `mul` x) `add` b `add` (squareF2m fx y)) == 0+        ]+  where a  = ecc_a cc+        b  = ecc_b cc+        add = addF2m+        mul = mulF2m fx+        isValid e = modF2m fx e == e++-- | div and mod+divmod :: Integer -> Integer -> Integer -> Maybe Integer+divmod y x m = do+    i <- inverse (x `mod` m) m+    return $ y * i `mod` m
+ Crypto/PubKey/ECC/Types.hs view
@@ -0,0 +1,494 @@+{-# LANGUAGE DeriveDataTypeable #-}+-- |+-- Module      : Crypto.PubKey.ECC.types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : Experimental+-- Portability : Excellent+--+-- references:+--   <https://tools.ietf.org/html/rfc5915>+--+module Crypto.PubKey.ECC.Types+    ( Curve(..)+    , Point(..)+    , PublicPoint+    , PrivateNumber+    , CurveBinary(..)+    , CurvePrime(..)+    , common_curve+    , ecc_fx+    , ecc_p+    , CurveCommon(..)+    -- * recommended curves definition+    , CurveName(..)+    , getCurveByName+    ) where++import           Data.Data+import           Crypto.Internal.Imports++-- | Define either a binary curve or a prime curve.+data Curve = CurveF2m CurveBinary -- ^ 𝔽(2^m)+           | CurveFP  CurvePrime  -- ^ 𝔽p+           deriving (Show,Read,Eq,Data,Typeable)++-- | ECC Public Point+type PublicPoint = Point++-- | ECC Private Number+type PrivateNumber = Integer++-- | Define a point on a curve.+data Point = Point Integer Integer+           | PointO -- ^ Point at Infinity+           deriving (Show,Read,Eq,Data,Typeable)++instance NFData Point where+    rnf (Point x y) = x `seq` y `seq` ()+    rnf PointO = ()++-- | Define an elliptic curve in 𝔽(2^m).+-- The firt parameter is the Integer representatioin of the irreducible polynomial f(x).+data CurveBinary = CurveBinary Integer CurveCommon+    deriving (Show,Read,Eq,Data,Typeable)++instance NFData CurveBinary where+    rnf (CurveBinary i cc) = i `seq` cc `seq` ()++-- | Define an elliptic curve in 𝔽p.+-- The first parameter is the Prime Number.+data CurvePrime = CurvePrime Integer CurveCommon+    deriving (Show,Read,Eq,Data,Typeable)++-- | Parameters in common between binary and prime curves.+common_curve :: Curve -> CurveCommon+common_curve (CurveF2m (CurveBinary _ cc)) = cc+common_curve (CurveFP  (CurvePrime  _ cc)) = cc++-- | Irreducible polynomial representing the characteristic of a CurveBinary.+ecc_fx :: CurveBinary -> Integer+ecc_fx (CurveBinary fx _) = fx++-- | Prime number representing the characteristic of a CurvePrime.+ecc_p :: CurvePrime -> Integer+ecc_p (CurvePrime p _) = p++-- | Define common parameters in a curve definition+-- of the form: y^2 = x^3 + ax + b.+data CurveCommon = CurveCommon+    { ecc_a :: Integer -- ^ curve parameter a+    , ecc_b :: Integer -- ^ curve parameter b+    , ecc_g :: Point   -- ^ base point+    , ecc_n :: Integer -- ^ order of G+    , ecc_h :: Integer -- ^ cofactor+    } deriving (Show,Read,Eq,Data,Typeable)++-- | Define names for known recommended curves.+data CurveName =+      SEC_p112r1+    | SEC_p112r2+    | SEC_p128r1+    | SEC_p128r2+    | SEC_p160k1+    | SEC_p160r1+    | SEC_p160r2+    | SEC_p192k1+    | SEC_p192r1 -- aka prime192v1+    | SEC_p224k1+    | SEC_p224r1+    | SEC_p256k1+    | SEC_p256r1 -- aka prime256v1+    | SEC_p384r1+    | SEC_p521r1+    | SEC_t113r1+    | SEC_t113r2+    | SEC_t131r1+    | SEC_t131r2+    | SEC_t163k1+    | SEC_t163r1+    | SEC_t163r2+    | SEC_t193r1+    | SEC_t193r2+    | SEC_t233k1 -- aka NIST K-233+    | SEC_t233r1+    | SEC_t239k1+    | SEC_t283k1+    | SEC_t283r1+    | SEC_t409k1+    | SEC_t409r1+    | SEC_t571k1+    | SEC_t571r1+    deriving (Show,Read,Eq,Ord,Enum,Data,Typeable)++{-+curvesOIDs :: [ (CurveName, [Integer]) ]+curvesOIDs =+    [ (SEC_p112r1, [1,3,132,0,6])+    , (SEC_p112r2, [1,3,132,0,7])+    , (SEC_p128r1, [1,3,132,0,28])+    , (SEC_p128r2, [1,3,132,0,29])+    , (SEC_p160k1, [1,3,132,0,9])+    , (SEC_p160r1, [1,3,132,0,8])+    , (SEC_p160r2, [1,3,132,0,30])+    , (SEC_p192k1, [1,3,132,0,31])+    , (SEC_p192r1, [1,2,840,10045,3,1,1])+    , (SEC_p224k1, [1,3,132,0,32])+    , (SEC_p224r1, [1,3,132,0,33])+    , (SEC_p256k1, [1,3,132,0,10])+    , (SEC_p256r1, [1,2,840,10045,3,1,7])+    , (SEC_p384r1, [1,3,132,0,34])+    , (SEC_p521r1, [1,3,132,0,35])+    , (SEC_t113r1, [1,3,132,0,4])+    , (SEC_t113r2, [1,3,132,0,5])+    , (SEC_t131r1, [1,3,132,0,22])+    , (SEC_t131r2, [1,3,132,0,23])+    , (SEC_t163k1, [1,3,132,0,1])+    , (SEC_t163r1, [1,3,132,0,2])+    , (SEC_t163r2, [1,3,132,0,15])+    , (SEC_t193r1, [1,3,132,0,24])+    , (SEC_t193r2, [1,3,132,0,25])+    , (SEC_t233k1, [1,3,132,0,26])+    , (SEC_t233r1, [1,3,132,0,27])+    , (SEC_t239k1, [1,3,132,0,3])+    , (SEC_t283k1, [1,3,132,0,16])+    , (SEC_t283r1, [1,3,132,0,17])+    , (SEC_t409k1, [1,3,132,0,36])+    , (SEC_t409r1, [1,3,132,0,37])+    , (SEC_t571k1, [1,3,132,0,38])+    , (SEC_t571r1, [1,3,132,0,39])+    ]+-}++-- | Get the curve definition associated with a recommended known curve name.+getCurveByName :: CurveName -> Curve+getCurveByName SEC_p112r1 = CurveFP  $ CurvePrime+    0xdb7c2abf62e35e668076bead208b+    (CurveCommon+        { ecc_a = 0xdb7c2abf62e35e668076bead2088+        , ecc_b = 0x659ef8ba043916eede8911702b22+        , ecc_g = Point 0x09487239995a5ee76b55f9c2f098+                        0xa89ce5af8724c0a23e0e0ff77500+        , ecc_n = 0xdb7c2abf62e35e7628dfac6561c5+        , ecc_h = 1+        })+getCurveByName SEC_p112r2 = CurveFP  $ CurvePrime+    0xdb7c2abf62e35e668076bead208b+    (CurveCommon+        { ecc_a = 0x6127c24c05f38a0aaaf65c0ef02c+        , ecc_b = 0x51def1815db5ed74fcc34c85d709+        , ecc_g = Point 0x4ba30ab5e892b4e1649dd0928643+                        0xadcd46f5882e3747def36e956e97+        , ecc_n = 0x36df0aafd8b8d7597ca10520d04b+        , ecc_h = 4+        })+getCurveByName SEC_p128r1 = CurveFP  $ CurvePrime+    0xfffffffdffffffffffffffffffffffff+    (CurveCommon+        { ecc_a = 0xfffffffdfffffffffffffffffffffffc+        , ecc_b = 0xe87579c11079f43dd824993c2cee5ed3+        , ecc_g = Point 0x161ff7528b899b2d0c28607ca52c5b86+                        0xcf5ac8395bafeb13c02da292dded7a83+        , ecc_n = 0xfffffffe0000000075a30d1b9038a115+        , ecc_h = 1+        })+getCurveByName SEC_p128r2 = CurveFP  $ CurvePrime+    0xfffffffdffffffffffffffffffffffff+    (CurveCommon+        { ecc_a = 0xd6031998d1b3bbfebf59cc9bbff9aee1+        , ecc_b = 0x5eeefca380d02919dc2c6558bb6d8a5d+        , ecc_g = Point 0x7b6aa5d85e572983e6fb32a7cdebc140+                        0x27b6916a894d3aee7106fe805fc34b44+        , ecc_n = 0x3fffffff7fffffffbe0024720613b5a3+        , ecc_h = 4+        })+getCurveByName SEC_p160k1 = CurveFP  $ CurvePrime+    0x00fffffffffffffffffffffffffffffffeffffac73+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000007+        , ecc_g = Point 0x003b4c382ce37aa192a4019e763036f4f5dd4d7ebb+                        0x00938cf935318fdced6bc28286531733c3f03c4fee+        , ecc_n = 0x0100000000000000000001b8fa16dfab9aca16b6b3+        , ecc_h = 1+        })+getCurveByName SEC_p160r1 = CurveFP  $ CurvePrime+    0x00ffffffffffffffffffffffffffffffff7fffffff+    (CurveCommon+        { ecc_a = 0x00ffffffffffffffffffffffffffffffff7ffffffc+        , ecc_b = 0x001c97befc54bd7a8b65acf89f81d4d4adc565fa45+        , ecc_g = Point 0x004a96b5688ef573284664698968c38bb913cbfc82+                        0x0023a628553168947d59dcc912042351377ac5fb32+        , ecc_n = 0x0100000000000000000001f4c8f927aed3ca752257+        , ecc_h = 1+        })+getCurveByName SEC_p160r2 = CurveFP  $ CurvePrime+    0x00fffffffffffffffffffffffffffffffeffffac73+    (CurveCommon+        { ecc_a = 0x00fffffffffffffffffffffffffffffffeffffac70+        , ecc_b = 0x00b4e134d3fb59eb8bab57274904664d5af50388ba+        , ecc_g = Point 0x0052dcb034293a117e1f4ff11b30f7199d3144ce6d+                        0x00feaffef2e331f296e071fa0df9982cfea7d43f2e+        , ecc_n = 0x0100000000000000000000351ee786a818f3a1a16b+        , ecc_h = 1+        })+getCurveByName SEC_p192k1 = CurveFP  $ CurvePrime+    0xfffffffffffffffffffffffffffffffffffffffeffffee37+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000000000003+        , ecc_g = Point 0xdb4ff10ec057e9ae26b07d0280b7f4341da5d1b1eae06c7d+                        0x9b2f2f6d9c5628a7844163d015be86344082aa88d95e2f9d+        , ecc_n = 0xfffffffffffffffffffffffe26f2fc170f69466a74defd8d+        , ecc_h = 1+        })+getCurveByName SEC_p192r1 = CurveFP  $ CurvePrime+    0xfffffffffffffffffffffffffffffffeffffffffffffffff+    (CurveCommon+        { ecc_a = 0xfffffffffffffffffffffffffffffffefffffffffffffffc+        , ecc_b = 0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1+        , ecc_g = Point 0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012+                        0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811+        , ecc_n = 0xffffffffffffffffffffffff99def836146bc9b1b4d22831+        , ecc_h = 1+        })+getCurveByName SEC_p224k1 = CurveFP  $ CurvePrime+    0x00fffffffffffffffffffffffffffffffffffffffffffffffeffffe56d+    (CurveCommon+        { ecc_a = 0x0000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x0000000000000000000000000000000000000000000000000000000005+        , ecc_g = Point 0x00a1455b334df099df30fc28a169a467e9e47075a90f7e650eb6b7a45c+                        0x007e089fed7fba344282cafbd6f7e319f7c0b0bd59e2ca4bdb556d61a5+        , ecc_n = 0x010000000000000000000000000001dce8d2ec6184caf0a971769fb1f7+        , ecc_h = 1+        })+getCurveByName SEC_p224r1 = CurveFP  $ CurvePrime+    0xffffffffffffffffffffffffffffffff000000000000000000000001+    (CurveCommon+        { ecc_a = 0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe+        , ecc_b = 0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4+        , ecc_g = Point 0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21+                        0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34+        , ecc_n = 0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d+        , ecc_h = 1+        })+getCurveByName SEC_p256k1 = CurveFP  $ CurvePrime+    0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f+    (CurveCommon+        { ecc_a = 0x0000000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x0000000000000000000000000000000000000000000000000000000000000007+        , ecc_g = Point 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798+                        0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8+        , ecc_n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141+        , ecc_h = 1+        })+getCurveByName SEC_p256r1 = CurveFP  $ CurvePrime+    0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff+    (CurveCommon+        { ecc_a = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc+        , ecc_b = 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b+        , ecc_g = Point 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296+                        0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5+        , ecc_n = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551+        , ecc_h = 1+        })+getCurveByName SEC_p384r1 = CurveFP  $ CurvePrime+    0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff+    (CurveCommon+        { ecc_a = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc+        , ecc_b = 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef+        , ecc_g = Point 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7+                        0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f+        , ecc_n = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973+        , ecc_h = 1+        })+getCurveByName SEC_p521r1 = CurveFP  $ CurvePrime+    0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff+    (CurveCommon+        { ecc_a = 0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc+        , ecc_b = 0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00+        , ecc_g = Point 0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66+                        0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650+        , ecc_n = 0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409+        , ecc_h = 1+        })+getCurveByName SEC_t113r1 = CurveF2m $ CurveBinary+    0x020000000000000000000000000201+    (CurveCommon+        { ecc_a = 0x003088250ca6e7c7fe649ce85820f7+        , ecc_b = 0x00e8bee4d3e2260744188be0e9c723+        , ecc_g = Point 0x009d73616f35f4ab1407d73562c10f+                        0x00a52830277958ee84d1315ed31886+        , ecc_n = 0x0100000000000000d9ccec8a39e56f+        , ecc_h = 2+        })+getCurveByName SEC_t113r2 = CurveF2m $ CurveBinary+    0x020000000000000000000000000201+    (CurveCommon+        { ecc_a = 0x00689918dbec7e5a0dd6dfc0aa55c7+        , ecc_b = 0x0095e9a9ec9b297bd4bf36e059184f+        , ecc_g = Point 0x01a57a6a7b26ca5ef52fcdb8164797+                        0x00b3adc94ed1fe674c06e695baba1d+        , ecc_n = 0x010000000000000108789b2496af93+        , ecc_h = 2+        })+getCurveByName SEC_t131r1 = CurveF2m $ CurveBinary+    0x080000000000000000000000000000010d+    (CurveCommon+        { ecc_a = 0x07a11b09a76b562144418ff3ff8c2570b8+        , ecc_b = 0x0217c05610884b63b9c6c7291678f9d341+        , ecc_g = Point 0x0081baf91fdf9833c40f9c181343638399+                        0x078c6e7ea38c001f73c8134b1b4ef9e150+        , ecc_n = 0x0400000000000000023123953a9464b54d+        , ecc_h = 2+        })+getCurveByName SEC_t131r2 = CurveF2m $ CurveBinary+    0x080000000000000000000000000000010d+    (CurveCommon+        { ecc_a = 0x03e5a88919d7cafcbf415f07c2176573b2+        , ecc_b = 0x04b8266a46c55657ac734ce38f018f2192+        , ecc_g = Point 0x0356dcd8f2f95031ad652d23951bb366a8+                        0x0648f06d867940a5366d9e265de9eb240f+        , ecc_n = 0x0400000000000000016954a233049ba98f+        , ecc_h = 2+        })+getCurveByName SEC_t163k1 = CurveF2m $ CurveBinary+    0x0800000000000000000000000000000000000000c9+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000001+        , ecc_b = 0x000000000000000000000000000000000000000001+        , ecc_g = Point 0x02fe13c0537bbc11acaa07d793de4e6d5e5c94eee8+                        0x0289070fb05d38ff58321f2e800536d538ccdaa3d9+        , ecc_n = 0x04000000000000000000020108a2e0cc0d99f8a5ef+        , ecc_h = 2+        })+getCurveByName SEC_t163r1 = CurveF2m $ CurveBinary+    0x0800000000000000000000000000000000000000c9+    (CurveCommon+        { ecc_a = 0x07b6882caaefa84f9554ff8428bd88e246d2782ae2+        , ecc_b = 0x0713612dcddcb40aab946bda29ca91f73af958afd9+        , ecc_g = Point 0x0369979697ab43897789566789567f787a7876a654+                        0x00435edb42efafb2989d51fefce3c80988f41ff883+        , ecc_n = 0x03ffffffffffffffffffff48aab689c29ca710279b+        , ecc_h = 2+        })+getCurveByName SEC_t163r2 = CurveF2m $ CurveBinary+    0x0800000000000000000000000000000000000000c9+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000001+        , ecc_b = 0x020a601907b8c953ca1481eb10512f78744a3205fd+        , ecc_g = Point 0x03f0eba16286a2d57ea0991168d4994637e8343e36+                        0x00d51fbc6c71a0094fa2cdd545b11c5c0c797324f1+        , ecc_n = 0x040000000000000000000292fe77e70c12a4234c33+        , ecc_h = 2+        })+getCurveByName SEC_t193r1 = CurveF2m $ CurveBinary+    0x02000000000000000000000000000000000000000000008001+    (CurveCommon+        { ecc_a = 0x0017858feb7a98975169e171f77b4087de098ac8a911df7b01+        , ecc_b = 0x00fdfb49bfe6c3a89facadaa7a1e5bbc7cc1c2e5d831478814+        , ecc_g = Point 0x01f481bc5f0ff84a74ad6cdf6fdef4bf6179625372d8c0c5e1+                        0x0025e399f2903712ccf3ea9e3a1ad17fb0b3201b6af7ce1b05+        , ecc_n = 0x01000000000000000000000000c7f34a778f443acc920eba49+        , ecc_h = 2+        })+getCurveByName SEC_t193r2 = CurveF2m $ CurveBinary+    0x02000000000000000000000000000000000000000000008001+    (CurveCommon+        { ecc_a = 0x0163f35a5137c2ce3ea6ed8667190b0bc43ecd69977702709b+        , ecc_b = 0x00c9bb9e8927d4d64c377e2ab2856a5b16e3efb7f61d4316ae+        , ecc_g = Point 0x00d9b67d192e0367c803f39e1a7e82ca14a651350aae617e8f+                        0x01ce94335607c304ac29e7defbd9ca01f596f927224cdecf6c+        , ecc_n = 0x010000000000000000000000015aab561b005413ccd4ee99d5+        , ecc_h = 2+        })+getCurveByName SEC_t233k1 = CurveF2m $ CurveBinary+    0x020000000000000000000000000000000000000004000000000000000001+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000000000000000000000001+        , ecc_g = Point 0x017232ba853a7e731af129f22ff4149563a419c26bf50a4c9d6eefad6126+                        0x01db537dece819b7f70f555a67c427a8cd9bf18aeb9b56e0c11056fae6a3+        , ecc_n = 0x008000000000000000000000000000069d5bb915bcd46efb1ad5f173abdf+        , ecc_h = 4+        })+getCurveByName SEC_t233r1 = CurveF2m $ CurveBinary+    0x020000000000000000000000000000000000000004000000000000000001+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000001+        , ecc_b = 0x0066647ede6c332c7f8c0923bb58213b333b20e9ce4281fe115f7d8f90ad+        , ecc_g = Point 0x00fac9dfcbac8313bb2139f1bb755fef65bc391f8b36f8f8eb7371fd558b+                        0x01006a08a41903350678e58528bebf8a0beff867a7ca36716f7e01f81052+        , ecc_n = 0x01000000000000000000000000000013e974e72f8a6922031d2603cfe0d7+        , ecc_h = 2+        })+getCurveByName SEC_t239k1 = CurveF2m $ CurveBinary+    0x800000000000000000004000000000000000000000000000000000000001+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000000000000000000000001+        , ecc_g = Point 0x29a0b6a887a983e9730988a68727a8b2d126c44cc2cc7b2a6555193035dc+                        0x76310804f12e549bdb011c103089e73510acb275fc312a5dc6b76553f0ca+        , ecc_n = 0x2000000000000000000000000000005a79fec67cb6e91f1c1da800e478a5+        , ecc_h = 4+        })+getCurveByName SEC_t283k1 = CurveF2m $ CurveBinary+    0x0800000000000000000000000000000000000000000000000000000000000000000010a1+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_g = Point 0x0503213f78ca44883f1a3b8162f188e553cd265f23c1567a16876913b0c2ac2458492836+                        0x01ccda380f1c9e318d90f95d07e5426fe87e45c0e8184698e45962364e34116177dd2259+        , ecc_n = 0x01ffffffffffffffffffffffffffffffffffe9ae2ed07577265dff7f94451e061e163c61+        , ecc_h = 4+        })+getCurveByName SEC_t283r1 = CurveF2m $ CurveBinary+    0x0800000000000000000000000000000000000000000000000000000000000000000010a1+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_b = 0x027b680ac8b8596da5a4af8a19a0303fca97fd7645309fa2a581485af6263e313b79a2f5+        , ecc_g = Point 0x05f939258db7dd90e1934f8c70b0dfec2eed25b8557eac9c80e2e198f8cdbecd86b12053+                        0x03676854fe24141cb98fe6d4b20d02b4516ff702350eddb0826779c813f0df45be8112f4+        , ecc_n = 0x03ffffffffffffffffffffffffffffffffffef90399660fc938a90165b042a7cefadb307+        , ecc_h = 2+        })+getCurveByName SEC_t409k1 = CurveF2m $ CurveBinary+    0x02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001+    (CurveCommon+        { ecc_a = 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_g = Point 0x0060f05f658f49c1ad3ab1890f7184210efd0987e307c84c27accfb8f9f67cc2c460189eb5aaaa62ee222eb1b35540cfe9023746+                        0x01e369050b7c4e42acba1dacbf04299c3460782f918ea427e6325165e9ea10e3da5f6c42e9c55215aa9ca27a5863ec48d8e0286b+        , ecc_n = 0x007ffffffffffffffffffffffffffffffffffffffffffffffffffe5f83b2d4ea20400ec4557d5ed3e3e7ca5b4b5c83b8e01e5fcf+        , ecc_h = 4+        })+getCurveByName SEC_t409r1 = CurveF2m $ CurveBinary+    0x02000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000001+    (CurveCommon+        { ecc_a = 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_b = 0x0021a5c2c8ee9feb5c4b9a753b7b476b7fd6422ef1f3dd674761fa99d6ac27c8a9a197b272822f6cd57a55aa4f50ae317b13545f+        , ecc_g = Point 0x015d4860d088ddb3496b0c6064756260441cde4af1771d4db01ffe5b34e59703dc255a868a1180515603aeab60794e54bb7996a7+                        0x0061b1cfab6be5f32bbfa78324ed106a7636b9c5a7bd198d0158aa4f5488d08f38514f1fdf4b4f40d2181b3681c364ba0273c706+        , ecc_n = 0x010000000000000000000000000000000000000000000000000001e2aad6a612f33307be5fa47c3c9e052f838164cd37d9a21173+        , ecc_h = 2+        })+getCurveByName SEC_t571k1 = CurveF2m $ CurveBinary+    0x080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000+        , ecc_b = 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_g = Point 0x026eb7a859923fbc82189631f8103fe4ac9ca2970012d5d46024804801841ca44370958493b205e647da304db4ceb08cbbd1ba39494776fb988b47174dca88c7e2945283a01c8972+                        0x0349dc807f4fbf374f4aeade3bca95314dd58cec9f307a54ffc61efc006d8a2c9d4979c0ac44aea74fbebbb9f772aedcb620b01a7ba7af1b320430c8591984f601cd4c143ef1c7a3+        , ecc_n = 0x020000000000000000000000000000000000000000000000000000000000000000000000131850e1f19a63e4b391a8db917f4138b630d84be5d639381e91deb45cfe778f637c1001+        , ecc_h = 4+        })+getCurveByName SEC_t571r1 = CurveF2m $ CurveBinary+    0x080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000425+    (CurveCommon+        { ecc_a = 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001+        , ecc_b = 0x02f40e7e2221f295de297117b7f3d62f5c6a97ffcb8ceff1cd6ba8ce4a9a18ad84ffabbd8efa59332be7ad6756a66e294afd185a78ff12aa520e4de739baca0c7ffeff7f2955727a+        , ecc_g = Point 0x0303001d34b856296c16c0d40d3cd7750a93d1d2955fa80aa5f40fc8db7b2abdbde53950f4c0d293cdd711a35b67fb1499ae60038614f1394abfa3b4c850d927e1e7769c8eec2d19+                        0x037bf27342da639b6dccfffeb73d69d78c6c27a6009cbbca1980f8533921e8a684423e43bab08a576291af8f461bb2a8b3531d2f0485c19b16e2f1516e23dd3c1a4827af1b8ac15b+        , ecc_n = 0x03ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe661ce18ff55987308059b186823851ec7dd9ca1161de93d5174d66e8382e9bb2fe84e47+        , ecc_h = 2+        })
+ Crypto/PubKey/Ed25519.hs view
@@ -0,0 +1,136 @@+-- |+-- Module      : Crypto.PubKey.Ed25519+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Ed25519 support+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+{-# LANGUAGE BangPatterns #-}+module Crypto.PubKey.Ed25519+    ( SecretKey+    , PublicKey+    , Signature+    -- * Smart constructors+    , signature+    , publicKey+    , secretKey+    -- * methods+    , toPublic+    , sign+    , verify+    ) where++import           Data.Word+import           Foreign.Ptr+import           Foreign.C.Types++import           Crypto.Internal.Compat+import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArrayAccess, withByteArray, ScrubbedBytes, Bytes)+import qualified Crypto.Internal.ByteArray as B+import           Crypto.Error++-- | An Ed25519 Secret key+newtype SecretKey = SecretKey ScrubbedBytes+    deriving (Eq,ByteArrayAccess,NFData)++-- | An Ed25519 public key+newtype PublicKey = PublicKey Bytes+    deriving (Show,Eq,ByteArrayAccess,NFData)++-- | An Ed25519 signature+newtype Signature = Signature Bytes+    deriving (Show,Eq,ByteArrayAccess,NFData)++-- | Try to build a public key from a bytearray+publicKey :: ByteArrayAccess ba => ba -> CryptoFailable PublicKey+publicKey bs+    | B.length bs == publicKeySize =+        CryptoPassed $ PublicKey $ B.copyAndFreeze bs (\_ -> return ())+    | otherwise =+        CryptoFailed $ CryptoError_PublicKeySizeInvalid++-- | Try to build a secret key from a bytearray+secretKey :: ByteArrayAccess ba => ba -> CryptoFailable SecretKey+secretKey bs+    | B.length bs == secretKeySize = unsafeDoIO $ withByteArray bs initialize+    | otherwise                    = CryptoFailed CryptoError_SecretKeyStructureInvalid+  where+        initialize inp = do+            valid <- isValidPtr inp+            if valid+                then (CryptoPassed . SecretKey) <$> B.copy bs (\_ -> return ())+                else return $ CryptoFailed CryptoError_SecretKeyStructureInvalid+        isValidPtr _ =+            return True+{-# NOINLINE secretKey #-}++-- | Try to build a signature from a bytearray+signature :: ByteArrayAccess ba => ba -> CryptoFailable Signature+signature bs+    | B.length bs == signatureSize =+        CryptoPassed $ Signature $ B.copyAndFreeze bs (\_ -> return ())+    | otherwise =+        CryptoFailed CryptoError_SecretKeyStructureInvalid++-- | Create a public key from a secret key+toPublic :: SecretKey -> PublicKey+toPublic (SecretKey sec) = PublicKey <$>+    B.allocAndFreeze publicKeySize $ \result ->+    withByteArray sec              $ \psec   ->+        ccryptonite_ed25519_publickey psec result+{-# NOINLINE toPublic #-}++-- | Sign a message using the key pair+sign :: ByteArrayAccess ba => SecretKey -> PublicKey -> ba -> Signature+sign secret public message =+    Signature $ B.allocAndFreeze signatureSize $ \sig ->+        withByteArray secret  $ \sec ->+        withByteArray public  $ \pub ->+        withByteArray message $ \msg ->+             ccryptonite_ed25519_sign msg (fromIntegral msgLen) sec pub sig+  where+    !msgLen = B.length message++-- | Verify a message+verify :: ByteArrayAccess ba => PublicKey -> ba -> Signature -> Bool+verify public message signatureVal = unsafeDoIO $+    withByteArray signatureVal $ \sig ->+    withByteArray public       $ \pub ->+    withByteArray message      $ \msg -> do+      r <- ccryptonite_ed25519_sign_open msg (fromIntegral msgLen) pub sig+      return (r == 0)+  where+    !msgLen = B.length message++publicKeySize :: Int+publicKeySize = 32++secretKeySize :: Int+secretKeySize = 32++signatureSize :: Int+signatureSize = 64++foreign import ccall "cryptonite_ed25519_publickey"+    ccryptonite_ed25519_publickey :: Ptr SecretKey -- secret key+                                  -> Ptr PublicKey -- public key+                                  -> IO ()++foreign import ccall "cryptonite_ed25519_sign_open"+    ccryptonite_ed25519_sign_open :: Ptr Word8     -- message+                                  -> CSize         -- message len+                                  -> Ptr PublicKey -- public+                                  -> Ptr Signature -- signature+                                  -> IO CInt++foreign import ccall "cryptonite_ed25519_sign"+    ccryptonite_ed25519_sign :: Ptr Word8     -- message+                             -> CSize         -- message len+                             -> Ptr SecretKey -- secret+                             -> Ptr PublicKey -- public+                             -> Ptr Signature -- signature+                             -> IO ()
+ Crypto/PubKey/ElGamal.hs view
@@ -0,0 +1,147 @@+-- |+-- Module      : Crypto.PubKey.ElGamal+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- This module is a work in progress. do not use:+-- it might eat your dog, your data or even both.+--+-- TODO: provide a mapping between integer and ciphertext+--       generate numbers correctly+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.PubKey.ElGamal+    ( Params+    , PublicNumber+    , PrivateNumber+    , EphemeralKey(..)+    , SharedKey+    , Signature+    -- * generation+    , generatePrivate+    , generatePublic+    -- * encryption and decryption with no scheme+    , encryptWith+    , encrypt+    , decrypt+    -- * signature primitives+    , signWith+    , sign+    -- * verification primitives+    , verify+    ) where++import Data.Maybe (fromJust)+import Crypto.Internal.Imports+import Crypto.Internal.ByteArray (ByteArrayAccess)+import Crypto.Number.ModArithmetic (expSafe, expFast, inverse)+import Crypto.Number.Generate (generateMax)+import Crypto.Number.Serialize (os2ip)+import Crypto.Number.Basic (gcde)+import Crypto.Random.Types+import Crypto.PubKey.DH (PrivateNumber(..), PublicNumber(..), Params(..), SharedKey(..))+import Crypto.Hash++-- | ElGamal Signature+data Signature = Signature (Integer, Integer)++-- | ElGamal Ephemeral key. also called Temporary key.+newtype EphemeralKey = EphemeralKey Integer+    deriving (NFData)++-- | generate a private number with no specific property+-- this number is usually called a and need to be between+-- 0 and q (order of the group G).+--+generatePrivate :: MonadRandom m => Integer -> m PrivateNumber+generatePrivate q = PrivateNumber <$> generateMax q++-- | generate an ephemeral key which is a number with no specific property,+-- and need to be between 0 and q (order of the group G).+--+generateEphemeral :: MonadRandom m => Integer -> m EphemeralKey+generateEphemeral q = toEphemeral <$> generatePrivate q+    where toEphemeral (PrivateNumber n) = EphemeralKey n++-- | generate a public number that is for the other party benefits.+-- this number is usually called h=g^a+generatePublic :: Params -> PrivateNumber -> PublicNumber+generatePublic (Params p g) (PrivateNumber a) = PublicNumber $ expSafe g a p++-- | encrypt with a specified ephemeral key+-- do not reuse ephemeral key.+encryptWith :: EphemeralKey -> Params -> PublicNumber -> Integer -> (Integer,Integer)+encryptWith (EphemeralKey b) (Params p g) (PublicNumber h) m = (c1,c2)+    where s  = expSafe h b p+          c1 = expSafe g b p+          c2 = (s * m) `mod` p++-- | encrypt a message using params and public keys+-- will generate b (called the ephemeral key)+encrypt :: MonadRandom m => Params -> PublicNumber -> Integer -> m (Integer,Integer)+encrypt params@(Params p _) public m = (\b -> encryptWith b params public m) <$> generateEphemeral q+    where q = p-1 -- p is prime, hence order of the group is p-1++-- | decrypt message+decrypt :: Params -> PrivateNumber -> (Integer, Integer) -> Integer+decrypt (Params p _) (PrivateNumber a) (c1,c2) = (c2 * sm1) `mod` p+    where s   = expSafe c1 a p+          sm1 = fromJust $ inverse s p -- always inversible in Zp++-- | sign a message with an explicit k number+--+-- if k is not appropriate, then no signature is returned.+--+-- with some appropriate value of k, the signature generation can fail,+-- and no signature is returned. User of this function need to retry+-- with a different k value.+signWith :: (ByteArrayAccess msg, HashAlgorithm hash)+         => Integer         -- ^ random number k, between 0 and p-1 and gcd(k,p-1)=1+         -> Params          -- ^ DH params (p,g)+         -> PrivateNumber   -- ^ DH private key+         -> hash            -- ^ collision resistant hash algorithm+         -> msg             -- ^ message to sign+         -> Maybe Signature+signWith k (Params p g) (PrivateNumber x) hashAlg msg+    | k >= p-1 || d > 1 = Nothing -- gcd(k,p-1) is not 1+    | s == 0            = Nothing+    | otherwise         = Just $ Signature (r,s)+    where r          = expSafe g k p+          h          = os2ip $ hashWith hashAlg msg+          s          = ((h - x*r) * kInv) `mod` (p-1)+          (kInv,_,d) = gcde k (p-1)++-- | sign message+--+-- This function will generate a random number, however+-- as the signature might fail, the function will automatically retry+-- until a proper signature has been created.+--+sign :: (ByteArrayAccess msg, HashAlgorithm hash, MonadRandom m)+     => Params         -- ^ DH params (p,g)+     -> PrivateNumber  -- ^ DH private key+     -> hash           -- ^ collision resistant hash algorithm+     -> msg            -- ^ message to sign+     -> m Signature+sign params@(Params p _) priv hashAlg msg = do+    k <- generateMax (p-1)+    case signWith k params priv hashAlg msg of+        Nothing  -> sign params priv hashAlg msg+        Just sig -> return sig++-- | verify a signature+verify :: (ByteArrayAccess msg, HashAlgorithm hash)+       => Params+       -> PublicNumber+       -> hash+       -> msg+       -> Signature+       -> Bool+verify (Params p g) (PublicNumber y) hashAlg msg (Signature (r,s))+    | or [r <= 0,r >= p,s <= 0,s >= (p-1)] = False+    | otherwise                            = lhs == rhs+    where h   = os2ip $ hashWith hashAlg msg+          lhs = expFast g h p+          rhs = (expFast y r p * expFast r s p) `mod` p
+ Crypto/PubKey/HashDescr.hs view
@@ -0,0 +1,101 @@+-- |+-- Module      : Crypto.PubKey.HashDescr+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- Standard digests wrapped in ASN1 structure+--+module Crypto.PubKey.HashDescr+    (+    -- * Types+      HashDescr+    , runHashDescr+    -- * List of known hash description+    , hashDescrMD2+    , hashDescrMD5+    , hashDescrSHA1+    , hashDescrSHA224+    , hashDescrSHA256+    , hashDescrSHA384+    , hashDescrSHA512+    , hashDescrRIPEMD160+    ) where++import           Data.Word+import           Crypto.Hash+import qualified Crypto.Internal.ByteArray as B++--+-- ** Hack **+--+-- this happens to not need a real ASN1 encoder, because+-- thanks to the digest being a specific size AND+-- that the digest data is the last bytes in the encoding,+-- this allows to just prepend the right prefix to the+-- computed digest, to make it in the expected and valid shape.+--+-- Otherwise the expected structure is in the following form:+--+--   Start Sequence+--     ,Start Sequence+--       ,OID oid+--       ,Null+--     ,End Sequence+--     ,OctetString digest+--   ,End Sequence++hashDescr :: (B.ByteArray ba, HashAlgorithm hashAlg)+          => hashAlg -- ^ hash algorithm to use+          -> [Word8] -- ^ the raw DER encoded ASN1 description of hash algorithm followed by the digest to be filled+          -> HashDescr hashAlg ba+hashDescr hashAlg preASN1Descr =+    HashDescr (\input -> B.pack preASN1Descr `B.append` B.convert (hashWith hashAlg input))++-- | A hash methods to generate a ASN.1 structure digest+data HashDescr hashAlg ba = HashDescr { unHashDescr :: ba -> ba }++-- | Run the digest function on some input and get the raw bytes+runHashDescr :: (HashAlgorithm hashAlg, B.ByteArray ba) => HashDescr hashAlg ba -> ba -> ba+runHashDescr h = unHashDescr h++-- | Describe the MD2 hashing algorithm+hashDescrMD2 :: B.ByteArray ba => HashDescr MD2 ba+hashDescrMD2 =+    hashDescr MD2 [0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x02,0x05,0x00,0x04,0x10]++-- | Describe the MD5 hashing algorithm+hashDescrMD5 :: B.ByteArray ba => HashDescr MD5 ba+hashDescrMD5 =+    hashDescr MD5 [0x30,0x20,0x30,0x0c,0x06,0x08,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x05,0x05,0x00,0x04,0x10]++-- | Describe the SHA1 hashing algorithm+hashDescrSHA1 :: B.ByteArray ba => HashDescr SHA1 ba+hashDescrSHA1 =+    hashDescr SHA1 [0x30,0x21,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1a,0x05,0x00,0x04,0x14]++-- | Describe the SHA224 hashing algorithm+hashDescrSHA224 :: B.ByteArray ba => HashDescr SHA224 ba+hashDescrSHA224 =+    hashDescr SHA224 [0x30,0x2d,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x04,0x05,0x00,0x04,0x1c]++-- | Describe the SHA256 hashing algorithm+hashDescrSHA256 :: B.ByteArray ba => HashDescr SHA256 ba+hashDescrSHA256 =+    hashDescr SHA256 [0x30,0x31,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x01,0x05,0x00,0x04,0x20]++-- | Describe the SHA384 hashing algorithm+hashDescrSHA384 :: B.ByteArray ba => HashDescr SHA384 ba+hashDescrSHA384 =+    hashDescr SHA384 [0x30,0x41,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x02,0x05,0x00,0x04,0x30]++-- | Describe the SHA512 hashing algorithm+hashDescrSHA512 :: B.ByteArray ba => HashDescr SHA512 ba+hashDescrSHA512 =+    hashDescr SHA512 [0x30,0x51,0x30,0x0d,0x06,0x09,0x60,0x86,0x48,0x01,0x65,0x03,0x04,0x02,0x03,0x05,0x00,0x04,0x40]++-- | Describe the RIPEMD160 hashing algorithm+hashDescrRIPEMD160 :: B.ByteArray ba => HashDescr RIPEMD160 ba+hashDescrRIPEMD160 =+    hashDescr RIPEMD160 [0x30,0x21,0x30,0x09,0x06,0x05,0x2b,0x24,0x03,0x02,0x01,0x05,0x00,0x04,0x14]
+ Crypto/PubKey/Internal.hs view
@@ -0,0 +1,24 @@+-- |+-- Module      : Crypto.PubKey.Internal+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.PubKey.Internal+    ( and'+    , (&&!)+    ) where++import Data.List (foldl')++-- | This is a strict version of and+and' :: [Bool] -> Bool+and' l = foldl' (&&!) True l++-- | This is a strict version of &&.+(&&!) :: Bool -> Bool -> Bool+True  &&! True  = True+True  &&! False = False+False &&! True  = False+False &&! False = False
+ Crypto/PubKey/MaskGenFunction.hs view
@@ -0,0 +1,40 @@+-- |+-- Module      : Crypto.PubKey.MaskGenFunction+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE BangPatterns #-}+module Crypto.PubKey.MaskGenFunction+    ( MaskGenAlgorithm+    , mgf1+    ) where++import           Crypto.Number.Serialize (i2ospOf_)+import           Crypto.Hash+import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray, Bytes)+import qualified Crypto.Internal.ByteArray as B++-- | Represent a mask generation algorithm+type MaskGenAlgorithm seed output =+       seed   -- ^ seed+    -> Int    -- ^ length to generate+    -> output++-- | Mask generation algorithm MGF1+mgf1 :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hashAlg)+     => hashAlg+     -> seed+     -> Int+     -> output+mgf1 hashAlg seed len =+    let !seededCtx = hashUpdate (hashInitWith hashAlg) seed+     in B.take len $ B.concat $ map (hashCounter seededCtx) [0..fromIntegral (maxCounter-1)]+  where+    digestLen     = hashDigestSize hashAlg+    (chunks,left) = len `divMod` digestLen+    maxCounter    = if left > 0 then chunks + 1 else chunks++    hashCounter :: HashAlgorithm a => Context a -> Integer -> Digest a+    hashCounter ctx counter = hashFinalize $ hashUpdate ctx (i2ospOf_ 4 counter :: Bytes)
+ Crypto/PubKey/RSA.hs view
@@ -0,0 +1,109 @@+-- |+-- Module      : Crypto.PubKey.RSA+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.PubKey.RSA+    ( Error(..)+    , PublicKey(..)+    , PrivateKey(..)+    , Blinder(..)+    -- * generation function+    , generateWith+    , generate+    , generateBlinder+    ) where++import Crypto.Internal.Imports+import Crypto.Random.Types+import Crypto.Number.ModArithmetic (inverse, inverseCoprimes)+import Crypto.Number.Generate (generateMax)+import Crypto.Number.Prime (generatePrime)+import Crypto.PubKey.RSA.Types++{-+-- some bad implementation will not serialize ASN.1 integer properly, leading+-- to negative modulus.+-- TODO : Find a better place for this+toPositive :: Integer -> Integer+toPositive int+    | int < 0   = uintOfBytes $ bytesOfInt int+    | otherwise = int+  where uintOfBytes = foldl (\acc n -> (acc `shiftL` 8) + fromIntegral n) 0+        bytesOfInt :: Integer -> [Word8]+        bytesOfInt n = if testBit (head nints) 7 then nints else 0xff : nints+          where nints = reverse $ plusOne $ reverse $ map complement $ bytesOfUInt (abs n)+                plusOne []     = [1]+                plusOne (x:xs) = if x == 0xff then 0 : plusOne xs else (x+1) : xs+                bytesOfUInt x = reverse (list x)+                  where list i = if i <= 0xff then [fromIntegral i] else (fromIntegral i .&. 0xff) : list (i `shiftR` 8)+-}++-- | Generate a key pair given p and q.+--+-- p and q need to be distinct prime numbers.+--+-- e need to be coprime to phi=(p-1)*(q-1). If that's not the+-- case, the function will not return a key pair.+-- A small hamming weight results in better performance.+--+-- * e=0x10001 is a popular choice+--+-- * e=3 is popular as well, but proven to not be as secure for some cases.+--+generateWith :: (Integer, Integer) -- ^ chosen distinct primes p and q+             -> Int                -- ^ size in bytes+             -> Integer            -- ^ RSA public exponant 'e'+             -> Maybe (PublicKey, PrivateKey)+generateWith (p,q) size e =+    case inverse e phi of+        Nothing -> Nothing+        Just d  -> Just (pub,priv d)+  where n   = p*q+        phi = (p-1)*(q-1)+        -- q and p should be *distinct* *prime* numbers, hence always coprime+        qinv = inverseCoprimes q p+        pub = PublicKey { public_size = size+                        , public_n    = n+                        , public_e    = e+                        }+        priv d = PrivateKey { private_pub  = pub+                            , private_d    = d+                            , private_p    = p+                            , private_q    = q+                            , private_dP   = d `mod` (p-1)+                            , private_dQ   = d `mod` (q-1)+                            , private_qinv = qinv+                            }++-- | generate a pair of (private, public) key of size in bytes.+generate :: MonadRandom m+         => Int     -- ^ size in bytes+         -> Integer -- ^ RSA public exponant 'e'+         -> m (PublicKey, PrivateKey)+generate size e = loop+  where+    loop = do -- loop until we find a valid key pair given e+        pq <- generatePQ+        case generateWith pq size e of+            Nothing -> loop+            Just pp -> return pp+    generatePQ = do+        p <- generatePrime (8 * (size `div` 2))+        q <- generateQ p+        return (p,q)+    generateQ p = do+        q <- generatePrime (8 * (size - (size `div` 2)))+        if p == q then generateQ p else return q++-- | Generate a blinder to use with decryption and signing operation+--+-- the unique parameter apart from the random number generator is the+-- public key value N.+generateBlinder :: MonadRandom m+                => Integer -- ^ RSA public N parameter.+                -> m Blinder+generateBlinder n =+    (\r -> Blinder r (inverseCoprimes r n)) <$> generateMax n
+ Crypto/PubKey/RSA/OAEP.hs view
@@ -0,0 +1,154 @@+-- |+-- Module      : Crypto.PubKey.RSA.OAEP+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- RSA OAEP mode+-- <http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding>+--+module Crypto.PubKey.RSA.OAEP+    (+      OAEPParams(..)+    , defaultOAEPParams+    -- * OAEP encryption+    , encryptWithSeed+    , encrypt+    -- * OAEP decryption+    , decrypt+    , decryptSafer+    ) where++import           Crypto.Hash+import           Crypto.Random.Types+import           Crypto.PubKey.RSA.Types+import           Crypto.PubKey.MaskGenFunction+import           Crypto.PubKey.RSA.Prim+import           Crypto.PubKey.RSA (generateBlinder)+import           Crypto.PubKey.Internal (and')+import           Data.ByteString (ByteString)+import qualified Data.ByteString as B+import           Data.Bits (xor)++import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B (convert)++-- | Parameters for OAEP encryption/decryption+data OAEPParams hash seed output = OAEPParams+    { oaepHash       :: hash                         -- ^ Hash function to use.+    , oaepMaskGenAlg :: MaskGenAlgorithm seed output -- ^ Mask Gen algorithm to use.+    , oaepLabel      :: Maybe ByteString             -- ^ Optional label prepended to message.+    }++-- | Default Params with a specified hash function+defaultOAEPParams :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hash)+                  => hash+                  -> OAEPParams hash seed output+defaultOAEPParams hashAlg =+    OAEPParams { oaepHash         = hashAlg+               , oaepMaskGenAlg   = mgf1 hashAlg+               , oaepLabel        = Nothing+               }++-- | Encrypt a message using OAEP with a predefined seed.+encryptWithSeed :: HashAlgorithm hash+                => ByteString      -- ^ Seed+                -> OAEPParams hash ByteString ByteString -- ^ OAEP params to use for encryption+                -> PublicKey       -- ^ Public key.+                -> ByteString      -- ^ Message to encrypt+                -> Either Error ByteString+encryptWithSeed seed oaep pk msg+    | k < 2*hashLen+2          = Left InvalidParameters+    | B.length seed /= hashLen = Left InvalidParameters+    | mLen > k - 2*hashLen-2   = Left MessageTooLong+    | otherwise                = Right $ ep pk em+    where -- parameters+          k          = public_size pk+          mLen       = B.length msg+          mgf        = oaepMaskGenAlg oaep+          labelHash  = hashWith (oaepHash oaep) (maybe B.empty id $ oaepLabel oaep)+          hashLen    = hashDigestSize (oaepHash oaep)++          -- put fields+          ps         = B.replicate (k - mLen - 2*hashLen - 2) 0+          db         = B.concat [B.convert labelHash, ps, B.singleton 0x1, msg]+          dbmask     = mgf seed (k - hashLen - 1)+          maskedDB   = B.pack $ B.zipWith xor db dbmask+          seedMask   = mgf maskedDB hashLen+          maskedSeed = B.pack $ B.zipWith xor seed seedMask+          em         = B.concat [B.singleton 0x0,maskedSeed,maskedDB]++-- | Encrypt a message using OAEP+encrypt :: (HashAlgorithm hash, MonadRandom m)+        => OAEPParams hash ByteString ByteString -- ^ OAEP params to use for encryption.+        -> PublicKey       -- ^ Public key.+        -> ByteString      -- ^ Message to encrypt+        -> m (Either Error ByteString)+encrypt oaep pk msg = do+    seed <- getRandomBytes hashLen+    return (encryptWithSeed seed oaep pk msg)+  where+    hashLen    = hashDigestSize (oaepHash oaep)++-- | un-pad a OAEP encoded message.+--+-- It doesn't apply the RSA decryption primitive+unpad :: HashAlgorithm hash+      => OAEPParams hash ByteString ByteString -- ^ OAEP params to use+      -> Int             -- ^ size of the key in bytes+      -> ByteString      -- ^ encoded message (not encrypted)+      -> Either Error ByteString+unpad oaep k em+    | paddingSuccess = Right msg+    | otherwise      = Left MessageNotRecognized+    where -- parameters+          mgf        = oaepMaskGenAlg oaep+          labelHash  = B.convert $ hashWith (oaepHash oaep) (maybe B.empty id $ oaepLabel oaep)+          hashLen    = hashDigestSize (oaepHash oaep)+          -- getting em's fields+          (pb, em0)  = B.splitAt 1 em+          (maskedSeed,maskedDB) = B.splitAt hashLen em0+          seedMask   = mgf maskedDB hashLen+          seed       = B.pack $ B.zipWith xor maskedSeed seedMask+          dbmask     = mgf seed (k - hashLen - 1)+          db         = B.pack $ B.zipWith xor maskedDB dbmask+          -- getting db's fields+          (labelHash',db1) = B.splitAt hashLen db+          (_,db2)    = B.break (/= 0) db1+          (ps1,msg)  = B.splitAt 1 db2++          paddingSuccess = and' [ labelHash' == labelHash -- no need for constant eq+                                , ps1        == B.replicate 1 0x1+                                , pb         == B.replicate 1 0x0+                                ]++-- | Decrypt a ciphertext using OAEP+--+-- When the signature is not in a context where an attacker could gain+-- information from the timing of the operation, the blinder can be set to None.+--+-- If unsure always set a blinder or use decryptSafer+decrypt :: HashAlgorithm hash+        => Maybe Blinder   -- ^ Optional blinder+        -> OAEPParams hash ByteString ByteString -- ^ OAEP params to use for decryption+        -> PrivateKey      -- ^ Private key+        -> ByteString      -- ^ Cipher text+        -> Either Error ByteString+decrypt blinder oaep pk cipher+    | B.length cipher /= k = Left MessageSizeIncorrect+    | k < 2*hashLen+2      = Left InvalidParameters+    | otherwise            = unpad oaep (private_size pk) $ dp blinder pk cipher+    where -- parameters+          k          = private_size pk+          hashLen    = hashDigestSize (oaepHash oaep)++-- | Decrypt a ciphertext using OAEP and by automatically generating a blinder.+decryptSafer :: (HashAlgorithm hash, MonadRandom m)+             => OAEPParams hash ByteString ByteString -- ^ OAEP params to use for decryption+             -> PrivateKey -- ^ Private key+             -> ByteString -- ^ Cipher text+             -> m (Either Error ByteString)+decryptSafer oaep pk cipher = do+    blinder <- generateBlinder (private_n pk)+    return (decrypt (Just blinder) oaep pk cipher)
+ Crypto/PubKey/RSA/PKCS15.hs view
@@ -0,0 +1,155 @@+-- |+-- Module      : Crypto.PubKey.RSA.PKCS15+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.PubKey.RSA.PKCS15+    (+    -- * padding and unpadding+      pad+    , padSignature+    , unpad+    -- * private key operations+    , decrypt+    , decryptSafer+    , sign+    , signSafer+    -- * public key operations+    , encrypt+    , verify+    ) where++import           Crypto.Random.Types+import           Crypto.PubKey.Internal (and')+import           Crypto.PubKey.RSA.Types+import           Crypto.PubKey.RSA.Prim+import           Crypto.PubKey.RSA (generateBlinder)+import           Crypto.PubKey.HashDescr+import           Crypto.Hash (HashAlgorithm)++import           Data.ByteString (ByteString)++import           Crypto.Internal.ByteArray (ByteArray, Bytes)+import qualified Crypto.Internal.ByteArray as B++-- | This produce a standard PKCS1.5 padding for encryption+pad :: (MonadRandom m, ByteArray message) => Int -> message -> m (Either Error message)+pad len m+    | B.length m > len - 11 = return (Left MessageTooLong)+    | otherwise             = do+        padding <- getNonNullRandom (len - B.length m - 3)+        return $ Right $ B.concat [ B.pack [0,2], padding, B.pack [0], m ]++  where+    -- get random non-null bytes+    getNonNullRandom :: (ByteArray bytearray, MonadRandom m) => Int -> m bytearray+    getNonNullRandom n = do+        bs0 <- getRandomBytes n+        let bytes = B.pack $ filter (/= 0) $ B.unpack (bs0 :: Bytes)+            left  = n - B.length bytes+        if left == 0+            then return bytes+            else do bend <- getNonNullRandom left+                    return (bytes `B.append` bend)++-- | Produce a standard PKCS1.5 padding for signature+padSignature :: ByteArray signature => Int -> signature -> Either Error signature+padSignature klen signature+    | klen < siglen+1 = Left SignatureTooLong+    | otherwise       = Right (B.pack padding `B.append` signature)+  where+        siglen    = B.length signature+        padding   = 0 : 1 : (replicate (klen - siglen - 3) 0xff ++ [0])++-- | Try to remove a standard PKCS1.5 encryption padding.+unpad :: ByteArray bytearray => bytearray -> Either Error bytearray+unpad packed+    | paddingSuccess = Right m+    | otherwise      = Left MessageNotRecognized+  where+        (zt, ps0m)   = B.splitAt 2 packed+        (ps, zm)     = B.span (/= 0) ps0m+        (z, m)       = B.splitAt 1 zm+        paddingSuccess = and' [ zt `B.constEq` (B.pack [0,2] :: Bytes)+                              , z == B.zero 1+                              , B.length ps >= 8+                              ]++-- | decrypt message using the private key.+--+-- When the decryption is not in a context where an attacker could gain+-- information from the timing of the operation, the blinder can be set to None.+--+-- If unsure always set a blinder or use decryptSafer+decrypt :: Maybe Blinder -- ^ optional blinder+        -> PrivateKey    -- ^ RSA private key+        -> ByteString    -- ^ cipher text+        -> Either Error ByteString+decrypt blinder pk c+    | B.length c /= (private_size pk) = Left MessageSizeIncorrect+    | otherwise                       = unpad $ dp blinder pk c++-- | decrypt message using the private key and by automatically generating a blinder.+decryptSafer :: MonadRandom m+             => PrivateKey -- ^ RSA private key+             -> ByteString -- ^ cipher text+             -> m (Either Error ByteString)+decryptSafer pk b = do+    blinder <- generateBlinder (private_n pk)+    return (decrypt (Just blinder) pk b)++-- | encrypt a bytestring using the public key and a CPRG random generator.+--+-- the message need to be smaller than the key size - 11+encrypt :: MonadRandom m => PublicKey -> ByteString -> m (Either Error ByteString)+encrypt pk m = do+    r <- pad (public_size pk) m+    case r of+        Left err -> return $ Left err+        Right em -> return $ Right (ep pk em)++-- | sign message using private key, a hash and its ASN1 description+--+-- When the signature is not in a context where an attacker could gain+-- information from the timing of the operation, the blinder can be set to None.+--+-- If unsure always set a blinder or use signSafer+sign :: HashAlgorithm hashAlg+     => Maybe Blinder -- ^ optional blinder+     -> HashDescr hashAlg ByteString -- ^ hash descriptor+     -> PrivateKey    -- ^ private key+     -> ByteString    -- ^ message to sign+     -> Either Error ByteString+sign blinder hashDescr pk m = dp blinder pk `fmap` makeSignature hashDescr (private_size pk) m++-- | sign message using the private key and by automatically generating a blinder.+signSafer :: (HashAlgorithm hashAlg, MonadRandom m)+          => HashDescr hashAlg ByteString -- ^ Hash descriptor+          -> PrivateKey -- ^ private key+          -> ByteString -- ^ message to sign+          -> m (Either Error ByteString)+signSafer hashDescr pk m = do+    blinder <- generateBlinder (private_n pk)+    return (sign (Just blinder) hashDescr pk m)++-- | verify message with the signed message+verify :: HashAlgorithm hashAlg+       => HashDescr hashAlg ByteString+       -> PublicKey+       -> ByteString+       -> ByteString+       -> Bool+verify hashDescr pk m sm =+    case makeSignature hashDescr (public_size pk) m of+        Left _  -> False+        Right s -> s == (ep pk sm)++-- | make signature digest, used in 'sign' and 'verify'+makeSignature :: HashAlgorithm hashAlg+              => HashDescr hashAlg ByteString+              -> Int+              -> ByteString+              -> Either Error ByteString+makeSignature hashDescr klen m = padSignature klen (runHashDescr hashDescr m)
+ Crypto/PubKey/RSA/PSS.hs view
@@ -0,0 +1,139 @@+-- |+-- Module      : Crypto.PubKey.RSA.PSS+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.PubKey.RSA.PSS+    ( PSSParams(..)+    , defaultPSSParams+    , defaultPSSParamsSHA1+    -- * Sign and verify functions+    , signWithSalt+    , sign+    , signSafer+    , verify+    ) where++import           Crypto.Random.Types+import           Crypto.PubKey.RSA.Types+import           Crypto.PubKey.RSA.Prim+import           Crypto.PubKey.RSA (generateBlinder)+import           Crypto.PubKey.MaskGenFunction+import           Crypto.Hash+import           Data.Bits (xor, shiftR, (.&.))+import           Data.Word++import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import qualified Crypto.Internal.ByteArray as B (convert)+import           Data.ByteString (ByteString)+import qualified Data.ByteString as B++-- | Parameters for PSS signature/verification.+data PSSParams hash seed output = PSSParams+    { pssHash         :: hash             -- ^ Hash function to use+    , pssMaskGenAlg   :: MaskGenAlgorithm seed output -- ^ Mask Gen algorithm to use+    , pssSaltLength   :: Int              -- ^ Length of salt. need to be <= to hLen.+    , pssTrailerField :: Word8            -- ^ Trailer field, usually 0xbc+    }++-- | Default Params with a specified hash function+defaultPSSParams :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hash)+                 => hash+                 -> PSSParams hash seed output+defaultPSSParams hashAlg =+    PSSParams { pssHash         = hashAlg+              , pssMaskGenAlg   = mgf1 hashAlg+              , pssSaltLength   = hashDigestSize hashAlg+              , pssTrailerField = 0xbc+              }++-- | Default Params using SHA1 algorithm.+defaultPSSParamsSHA1 :: PSSParams SHA1 ByteString ByteString+defaultPSSParamsSHA1 = defaultPSSParams SHA1++-- | Sign using the PSS parameters and the salt explicitely passed as parameters.+--+-- the function ignore SaltLength from the PSS Parameters+signWithSalt :: HashAlgorithm hash+             => ByteString    -- ^ Salt to use+             -> Maybe Blinder -- ^ optional blinder to use+             -> PSSParams hash ByteString ByteString -- ^ PSS Parameters to use+             -> PrivateKey    -- ^ RSA Private Key+             -> ByteString    -- ^ Message to sign+             -> Either Error ByteString+signWithSalt salt blinder params pk m+    | k < hashLen + saltLen + 2 = Left InvalidParameters+    | otherwise                 = Right $ dp blinder pk em+    where mHash    = B.convert $ hashWith (pssHash params) m+          k        = private_size pk+          dbLen    = k - hashLen - 1+          saltLen  = B.length salt+          hashLen  = hashDigestSize (pssHash params)+          pubBits  = private_size pk * 8 -- to change if public_size is converted in bytes++          m'       = B.concat [B.replicate 8 0,mHash,salt]+          h        = B.convert $ hashWith (pssHash params) m'+          db       = B.concat [B.replicate (dbLen - saltLen - 1) 0,B.singleton 1,salt]+          dbmask   = (pssMaskGenAlg params) h dbLen+          maskedDB = B.pack $ normalizeToKeySize pubBits $ B.zipWith xor db dbmask+          em       = B.concat [maskedDB, h, B.singleton (pssTrailerField params)]++-- | Sign using the PSS Parameters+sign :: (HashAlgorithm hash, MonadRandom m)+     => Maybe Blinder   -- ^ optional blinder to use+     -> PSSParams hash ByteString ByteString -- ^ PSS Parameters to use+     -> PrivateKey      -- ^ RSA Private Key+     -> ByteString      -- ^ Message to sign+     -> m (Either Error ByteString)+sign blinder params pk m = do+    salt <- getRandomBytes (pssSaltLength params)+    return (signWithSalt salt blinder params pk m)++-- | Sign using the PSS Parameters and an automatically generated blinder.+signSafer :: (HashAlgorithm hash, MonadRandom m)+          => PSSParams hash ByteString ByteString -- ^ PSS Parameters to use+          -> PrivateKey     -- ^ private key+          -> ByteString     -- ^ message to sign+          -> m (Either Error ByteString)+signSafer params pk m = do+    blinder <- generateBlinder (private_n pk)+    sign (Just blinder) params pk m++-- | Verify a signature using the PSS Parameters+verify :: HashAlgorithm hash+       => PSSParams hash ByteString ByteString+                     -- ^ PSS Parameters to use to verify,+                     --   this need to be identical to the parameters when signing+       -> PublicKey  -- ^ RSA Public Key+       -> ByteString -- ^ Message to verify+       -> ByteString -- ^ Signature+       -> Bool+verify params pk m s+    | public_size pk /= B.length s        = False+    | B.last em /= pssTrailerField params = False+    | not (B.all (== 0) ps0)              = False+    | b1 /= B.singleton 1                 = False+    | otherwise                           = h == B.convert h'+        where -- parameters+              hashLen   = hashDigestSize (pssHash params)+              dbLen     = public_size pk - hashLen - 1+              pubBits   = public_size pk * 8 -- to change if public_size is converted in bytes+              -- unmarshall fields+              em        = ep pk s+              maskedDB  = B.take (B.length em - hashLen - 1) em+              h         = B.take hashLen $ B.drop (B.length maskedDB) em+              dbmask    = (pssMaskGenAlg params) h dbLen+              db        = B.pack $ normalizeToKeySize pubBits $ B.zipWith xor maskedDB dbmask+              (ps0,z)   = B.break (== 1) db+              (b1,salt) = B.splitAt 1 z+              mHash     = B.convert $ hashWith (pssHash params) m+              m'        = B.concat [B.replicate 8 0,mHash,salt]+              h'        = hashWith (pssHash params) m'++normalizeToKeySize :: Int -> [Word8] -> [Word8]+normalizeToKeySize _    []     = [] -- very unlikely+normalizeToKeySize bits (x:xs) = x .&. mask : xs+    where mask = if sh > 0 then 0xff `shiftR` (8-sh) else 0xff+          sh   = ((bits-1) .&. 0x7)
+ Crypto/PubKey/RSA/Prim.hs view
@@ -0,0 +1,60 @@+-- |+-- Module      : Crypto.PubKey.RSA.Prim+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.PubKey.RSA.Prim+    (+    -- * decrypt primitive+      dp+    -- * encrypt primitive+    , ep+    ) where++import           Crypto.PubKey.RSA.Types+import           Crypto.Number.ModArithmetic (expFast, expSafe)+import           Crypto.Number.Serialize (os2ip, i2ospOf_)+import           Crypto.Internal.ByteArray (ByteArray)++{- dpSlow computes the decrypted message not using any precomputed cache value.+   only n and d need to valid. -}+dpSlow :: ByteArray ba => PrivateKey -> ba -> ba+dpSlow pk c = i2ospOf_ (private_size pk) $ expSafe (os2ip c) (private_d pk) (private_n pk)++{- dpFast computes the decrypted message more efficiently if the+   precomputed private values are available. mod p and mod q are faster+   to compute than mod pq -}+dpFast :: ByteArray ba => Blinder -> PrivateKey -> ba -> ba+dpFast (Blinder r rm1) pk c =+    i2ospOf_ (private_size pk) (multiplication rm1 (m2 + h * (private_q pk)) (private_n pk))+    where+        re  = expFast r (public_e $ private_pub pk) (private_n pk)+        iC  = multiplication re (os2ip c) (private_n pk)+        m1  = expSafe iC (private_dP pk) (private_p pk)+        m2  = expSafe iC (private_dQ pk) (private_q pk)+        h   = ((private_qinv pk) * (m1 - m2)) `mod` (private_p pk)++dpFastNoBlinder :: ByteArray ba => PrivateKey -> ba -> ba+dpFastNoBlinder pk c = i2ospOf_ (private_size pk) (m2 + h * (private_q pk))+     where iC = os2ip c+           m1 = expSafe iC (private_dP pk) (private_p pk)+           m2 = expSafe iC (private_dQ pk) (private_q pk)+           h  = ((private_qinv pk) * (m1 - m2)) `mod` (private_p pk)++-- | Compute the RSA decrypt primitive.+-- if the p and q numbers are available, then dpFast is used+-- otherwise, we use dpSlow which only need d and n.+dp :: ByteArray ba => Maybe Blinder -> PrivateKey -> ba -> ba+dp blinder pk+    | private_p pk /= 0 && private_q pk /= 0 = maybe dpFastNoBlinder dpFast blinder $ pk+    | otherwise                              = dpSlow pk++-- | Compute the RSA encrypt primitive+ep :: ByteArray ba => PublicKey -> ba -> ba+ep pk m = i2ospOf_ (public_size pk) $ expFast (os2ip m) (public_e pk) (public_n pk)++-- | multiply 2 integers in Zm only performing the modulo operation if necessary+multiplication :: Integer -> Integer -> Integer -> Integer+multiplication a b m = (a * b) `mod` m
+ Crypto/PubKey/RSA/Types.hs view
@@ -0,0 +1,98 @@+-- |+-- Module      : Crypto.PubKey.RSA.Types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.PubKey.RSA.Types+    ( Error(..)+    , Blinder(..)+    , PublicKey(..)+    , PrivateKey(..)+    , KeyPair(..)+    , toPublicKey+    , toPrivateKey+    , private_size+    , private_n+    , private_e+    ) where++import           Data.Data+import           Crypto.Internal.Imports++-- | Blinder which is used to obfuscate the timing+-- of the decryption primitive (used by decryption and signing).+data Blinder = Blinder !Integer !Integer+             deriving (Show,Eq)++-- | error possible during encryption, decryption or signing.+data Error =+      MessageSizeIncorrect -- ^ the message to decrypt is not of the correct size (need to be == private_size)+    | MessageTooLong       -- ^ the message to encrypt is too long+    | MessageNotRecognized -- ^ the message decrypted doesn't have a PKCS15 structure (0 2 .. 0 msg)+    | SignatureTooLong     -- ^ the message's digest is too long+    | InvalidParameters    -- ^ some parameters lead to breaking assumptions.+    deriving (Show,Eq)++-- | Represent a RSA public key+data PublicKey = PublicKey+    { public_size :: Int      -- ^ size of key in bytes+    , public_n    :: Integer  -- ^ public p*q+    , public_e    :: Integer  -- ^ public exponant e+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData PublicKey where+    rnf (PublicKey sz n e) = rnf n `seq` rnf e `seq` sz `seq` ()++-- | Represent a RSA private key.+-- +-- Only the pub, d fields are mandatory to fill.+--+-- p, q, dP, dQ, qinv are by-product during RSA generation,+-- but are useful to record here to speed up massively+-- the decrypt and sign operation.+--+-- implementations can leave optional fields to 0.+--+data PrivateKey = PrivateKey+    { private_pub  :: PublicKey -- ^ public part of a private key (size, n and e)+    , private_d    :: Integer   -- ^ private exponant d+    , private_p    :: Integer   -- ^ p prime number+    , private_q    :: Integer   -- ^ q prime number+    , private_dP   :: Integer   -- ^ d mod (p-1)+    , private_dQ   :: Integer   -- ^ d mod (q-1)+    , private_qinv :: Integer   -- ^ q^(-1) mod p+    } deriving (Show,Read,Eq,Data,Typeable)++instance NFData PrivateKey where+    rnf (PrivateKey pub d p q dp dq qinv) =+        rnf pub `seq` rnf d `seq` rnf p `seq` rnf q `seq` rnf dp `seq` rnf dq `seq` qinv `seq` ()++-- | get the size in bytes from a private key+private_size :: PrivateKey -> Int+private_size = public_size . private_pub++-- | get n from a private key+private_n :: PrivateKey -> Integer+private_n = public_n . private_pub++-- | get e from a private key+private_e :: PrivateKey -> Integer+private_e = public_e . private_pub++-- | Represent RSA KeyPair+--+-- note the RSA private key contains already an instance of public key for efficiency+newtype KeyPair = KeyPair PrivateKey+    deriving (Show,Read,Eq,Data,Typeable,NFData)++-- | Public key of a RSA KeyPair+toPublicKey :: KeyPair -> PublicKey+toPublicKey (KeyPair priv) = private_pub priv++-- | Private key of a RSA KeyPair+toPrivateKey :: KeyPair -> PrivateKey+toPrivateKey (KeyPair priv) = priv
+ Crypto/Random.hs view
@@ -0,0 +1,40 @@+-- |+-- Module      : Crypto.Random+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+module Crypto.Random+    (+    -- * Deterministic instances+      ChaChaDRG+    -- * Deterministic Random class+    , drgNew+    , drgNewTest+    , withDRG+    , DRG(..)+    -- * Random abstraction+    , MonadRandom(..)+    , MonadPseudoRandom+    ) where++import Crypto.Random.Types+import Crypto.Random.ChaChaDRG+import Crypto.Random.Entropy+import Data.ByteArray (ScrubbedBytes)+import Crypto.Internal.Imports++-- | Create a new DRG from system entropy+drgNew :: IO ChaChaDRG+drgNew = initialize <$> (getEntropy 40 :: IO ScrubbedBytes)++-- | Create a new DRG from 5 Word64.+--+-- This is a convenient interface to create deterministic interface+-- for quickcheck style testing.+--+-- It can also be used in other contexts provided the input+-- has been properly randomly generated.+drgNewTest :: (Word64, Word64, Word64, Word64, Word64) -> ChaChaDRG+drgNewTest = initializeWords
+ Crypto/Random/ChaChaDRG.hs view
@@ -0,0 +1,46 @@+-- |+-- Module      : Crypto.Random.ChaChaDRG+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+module Crypto.Random.ChaChaDRG+    ( ChaChaDRG+    , initialize+    , initializeWords+    ) where++import           Crypto.Random.Types+import           Crypto.Internal.Imports+import           Crypto.Internal.ByteArray (ByteArray, ScrubbedBytes)+import qualified Crypto.Internal.ByteArray as B+import           Foreign.Storable (pokeElemOff)++import qualified Crypto.Cipher.ChaCha as C++instance DRG ChaChaDRG where+    randomBytesGenerate = generate++-- | ChaCha Deterministic Random Generator+newtype ChaChaDRG = ChaChaDRG C.StateSimple+    deriving (NFData)++-- | Initialize a new ChaCha context with the number of rounds,+-- the key and the nonce associated.+initialize :: ByteArray seed+           => seed        -- ^ 40 bytes of seed+           -> ChaChaDRG   -- ^ the initial ChaCha state+initialize seed = ChaChaDRG $ C.initializeSimple seed++-- | Initialize a new ChaCha context from 5-tuple of words64.+-- This interface is useful when creating a RNG out of tests generators (e.g. QuickCheck).+initializeWords :: (Word64, Word64, Word64, Word64, Word64) -> ChaChaDRG+initializeWords (a,b,c,d,e) = initialize (B.allocAndFreeze 40 fill :: ScrubbedBytes)+  where fill s = mapM_ (uncurry (pokeElemOff s)) [(0,a), (1,b), (2,c), (3,d), (4,e)]++generate :: ByteArray output => Int -> ChaChaDRG -> (output, ChaChaDRG)+generate nbBytes st@(ChaChaDRG prevSt)+    | nbBytes <= 0 = (B.empty, st)+    | otherwise    = let (output, newSt) = C.generateSimple prevSt nbBytes in (output, ChaChaDRG newSt)
+ Crypto/Random/Entropy.hs view
@@ -0,0 +1,22 @@+-- |+-- Module      : Crypto.Random.Entropy+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.Entropy+    ( getEntropy+    ) where++import           Data.Maybe (catMaybes)+import           Crypto.Internal.ByteArray (ByteArray)+import qualified Crypto.Internal.ByteArray as B++import           Crypto.Random.Entropy.Unsafe++-- | Get some entropy from the system source of entropy+getEntropy :: ByteArray byteArray => Int -> IO byteArray+getEntropy n = do+    backends <- catMaybes `fmap` sequence supportedBackends+    B.alloc n (replenish n backends)
+ Crypto/Random/Entropy/Backend.hs view
@@ -0,0 +1,56 @@+-- |+-- Module      : Crypto.Random.Entropy.Backend+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : stable+-- Portability : good+--+{-# LANGUAGE CPP #-}+{-# LANGUAGE ExistentialQuantification #-}+module Crypto.Random.Entropy.Backend+    ( EntropyBackend+    , supportedBackends+    , gatherBackend+    ) where++import Foreign.Ptr+import Data.Word (Word8)+import Crypto.Random.Entropy.Source+#ifdef SUPPORT_RDRAND+import Crypto.Random.Entropy.RDRand+#endif+#ifdef WINDOWS+import Crypto.Random.Entropy.Windows+#else+import Crypto.Random.Entropy.Unix+#endif++-- | All supported backends +supportedBackends :: [IO (Maybe EntropyBackend)]+supportedBackends =+    [+#ifdef SUPPORT_RDRAND+    openBackend (undefined :: RDRand),+#endif+#ifdef WINDOWS+    openBackend (undefined :: WinCryptoAPI)+#else+    openBackend (undefined :: DevRandom), openBackend (undefined :: DevURandom)+#endif+    ]++-- | Any Entropy Backend+data EntropyBackend = forall b . EntropySource b => EntropyBackend b++-- | Open a backend handle+openBackend :: EntropySource b => b -> IO (Maybe EntropyBackend)+openBackend b = fmap EntropyBackend `fmap` callOpen b+  where callOpen :: EntropySource b => b -> IO (Maybe b)+        callOpen _ = entropyOpen++-- | Gather randomness from an open handle+gatherBackend :: EntropyBackend -- ^ An open Entropy Backend+              -> Ptr Word8      -- ^ Pointer to a buffer to write to+              -> Int            -- ^ number of bytes to write+              -> IO Int         -- ^ return the number of bytes actually written+gatherBackend (EntropyBackend backend) ptr n = entropyGather backend ptr n
+ Crypto/Random/Entropy/RDRand.hs view
@@ -0,0 +1,38 @@+-- |+-- Module      : Crypto.Random.Entropy.RDRand+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE ForeignFunctionInterface #-}+module Crypto.Random.Entropy.RDRand+    ( RDRand+    ) where++import Foreign.Ptr+import Foreign.C.Types+import Data.Word (Word8)+import Crypto.Random.Entropy.Source++foreign import ccall unsafe "cryptonite_cpu_has_rdrand"+   c_cpu_has_rdrand :: IO CInt++foreign import ccall unsafe "cryptonite_get_rand_bytes"+  c_get_rand_bytes :: Ptr Word8 -> CInt -> IO CInt++-- | fake handle to Intel RDRand entropy cpu instruction+data RDRand = RDRand++instance EntropySource RDRand where+    entropyOpen     = rdrandGrab+    entropyGather _ = rdrandGetBytes+    entropyClose  _ = return ()++rdrandGrab :: IO (Maybe RDRand)+rdrandGrab = supported `fmap` c_cpu_has_rdrand+  where supported 0 = Nothing+        supported _ = Just RDRand++rdrandGetBytes :: Ptr Word8 -> Int -> IO Int+rdrandGetBytes ptr sz = fromIntegral `fmap` c_get_rand_bytes ptr (fromIntegral sz)
+ Crypto/Random/Entropy/Source.hs view
@@ -0,0 +1,22 @@+-- |+-- Module      : Crypto.Random.Entropy.Source+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.Entropy.Source where++import Foreign.Ptr+import Data.Word (Word8)++-- | A handle to an entropy maker, either a system capability+-- or a hardware generator.+class EntropySource a where+    -- | try to open an handle for this source+    entropyOpen   :: IO (Maybe a)+    -- | try to gather a number of entropy bytes into a buffer.+    -- return the number of actual bytes gathered+    entropyGather :: a -> Ptr Word8 -> Int -> IO Int+    -- | Close an open handle+    entropyClose  :: a -> IO ()
+ Crypto/Random/Entropy/Unix.hs view
@@ -0,0 +1,69 @@+-- |+-- Module      : Crypto.Random.Entropy.Unix+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+{-# LANGUAGE ScopedTypeVariables #-}+module Crypto.Random.Entropy.Unix+    ( DevRandom+    , DevURandom+    ) where++import Foreign.Ptr+import Data.Word (Word8)+import Crypto.Random.Entropy.Source+import Control.Exception as E++--import System.Posix.Types (Fd)+import System.IO++type H = Handle+type DeviceName = String++-- | Entropy device /dev/random on unix system +newtype DevRandom  = DevRandom DeviceName++-- | Entropy device /dev/urandom on unix system +newtype DevURandom = DevURandom DeviceName++instance EntropySource DevRandom where+    entropyOpen = fmap DevRandom `fmap` testOpen "/dev/random"+    entropyGather (DevRandom name) ptr n =+        withDev name $ \h -> gatherDevEntropy h ptr n+    entropyClose (DevRandom _)  = return ()++instance EntropySource DevURandom where+    entropyOpen = fmap DevURandom `fmap` testOpen "/dev/urandom"+    entropyGather (DevURandom name) ptr n =+        withDev name $ \h -> gatherDevEntropy h ptr n+    entropyClose (DevURandom _)  = return ()++testOpen :: DeviceName -> IO (Maybe DeviceName)+testOpen filepath = do+    d <- openDev filepath+    case d of+        Nothing -> return Nothing+        Just h  -> closeDev h >> return (Just filepath)++openDev :: String -> IO (Maybe H)+openDev filepath = (Just `fmap` openAndNoBuffering) `E.catch` \(_ :: IOException) -> return Nothing+  where openAndNoBuffering = do+            h <- openBinaryFile filepath ReadMode+            hSetBuffering h NoBuffering+            return h++withDev :: String -> (H -> IO a) -> IO a+withDev filepath f = openDev filepath >>= \h ->+    case h of+        Nothing -> error ("device " ++ filepath ++ " cannot be grabbed")+        Just fd -> f fd >>= \r -> (closeDev fd >> return r)++closeDev :: H -> IO ()+closeDev h = hClose h++gatherDevEntropy :: H -> Ptr Word8 -> Int -> IO Int+gatherDevEntropy h ptr sz =+     (fromIntegral `fmap` hGetBufSome h ptr (fromIntegral sz))+    `E.catch` \(_ :: IOException) -> return 0
+ Crypto/Random/Entropy/Unsafe.hs view
@@ -0,0 +1,34 @@+-- |+-- Module      : Crypto.Random.Entropy.Unsafe+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.Entropy.Unsafe+    ( replenish+    , module Crypto.Random.Entropy.Backend+    ) where++import Data.Word (Word8)+import Foreign.Ptr (Ptr, plusPtr)+import Crypto.Random.Entropy.Backend++-- | Refill the entropy in a buffer+--+-- call each entropy backend in turn until the buffer has+-- been replenish.+--+-- If the buffer cannot be refill after 3 loopings, this will raise+-- an User Error exception+replenish :: Int -> [EntropyBackend] -> Ptr Word8 -> IO ()+replenish _        []       _   = fail "cryptonite: random: cannot get any source of entropy on this system"+replenish poolSize backends ptr = loop 0 backends ptr poolSize+  where loop :: Int -> [EntropyBackend] -> Ptr Word8 -> Int -> IO ()+        loop retry [] p n | n == 0     = return ()+                          | retry == 3 = error "cryptonite: random: cannot fully replenish"+                          | otherwise  = loop (retry+1) backends p n+        loop _     (_:_)  _ 0 = return ()+        loop retry (b:bs) p n = do+            r <- gatherBackend b p n+            loop retry bs (p `plusPtr` r) (n - r)
+ Crypto/Random/Entropy/Windows.hs view
@@ -0,0 +1,103 @@+-- |+-- Module      : Crypto.Random.Entropy.Windows+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+-- code originally from the entropy package and thus is:+--   Copyright (c) Thomas DuBuisson.+--+{-# LANGUAGE ForeignFunctionInterface #-}+{-# LANGUAGE CPP #-}+module Crypto.Random.Entropy.Windows+    ( WinCryptoAPI+    ) where++import Data.Int (Int32)+import Data.Word (Word32, Word8)+import Foreign.C.String (CString, withCString)+import Foreign.Ptr (Ptr, nullPtr)+import Foreign.Marshal.Alloc (alloca)+import Foreign.Marshal.Utils (toBool)+import Foreign.Storable (peek)+import System.Win32.Types (getLastError)++import Crypto.Random.Entropy.Source+++-- | handle to windows crypto API for random generation+data WinCryptoAPI = WinCryptoAPI++instance EntropySource WinCryptoAPI where+    entropyOpen = do+        mctx <- cryptAcquireCtx+        maybe (return Nothing) (\ctx -> cryptReleaseCtx ctx >> return (Just WinCryptoAPI)) mctx+    entropyGather WinCryptoAPI ptr n = do+        mctx <- cryptAcquireCtx+        case mctx of+            Nothing  -> do+                lastError <- getLastError+                fail $ "cannot re-grab win crypto api: error " ++ show lastError+            Just ctx -> do+                r <- cryptGenRandom ctx ptr n+                cryptReleaseCtx ctx+                return r+    entropyClose WinCryptoAPI = return ()+++type DWORD = Word32+type BOOL  = Int32+type BYTE  = Word8++#if defined(ARCH_X86)+# define WINDOWS_CCONV stdcall+type CryptCtx = Word32+#elif defined(ARCH_X86_64)+# define WINDOWS_CCONV ccall+type CryptCtx = Word64+#else+# error Unknown mingw32 arch+#endif++-- Declare the required CryptoAPI imports+foreign import WINDOWS_CCONV unsafe "CryptAcquireContextA"+   c_cryptAcquireCtx :: Ptr CryptCtx -> CString -> CString -> DWORD -> DWORD -> IO BOOL+foreign import WINDOWS_CCONV unsafe "CryptGenRandom"+   c_cryptGenRandom :: CryptCtx -> DWORD -> Ptr BYTE -> IO BOOL+foreign import WINDOWS_CCONV unsafe "CryptReleaseContext"+   c_cryptReleaseCtx :: CryptCtx -> DWORD -> IO BOOL+++-- Define the constants we need from WinCrypt.h+msDefProv :: String+msDefProv = "Microsoft Base Cryptographic Provider v1.0"++provRSAFull :: DWORD+provRSAFull = 1++cryptVerifyContext :: DWORD+cryptVerifyContext = 0xF0000000++cryptAcquireCtx :: IO (Maybe CryptCtx)+cryptAcquireCtx =+    alloca $ \handlePtr ->+    withCString msDefProv $ \provName -> do+        r <- toBool `fmap` c_cryptAcquireCtx handlePtr nullPtr provName provRSAFull cryptVerifyContext+        if r+            then Just `fmap` peek handlePtr+            else return Nothing++cryptGenRandom :: CryptCtx -> Ptr Word8 -> Int -> IO Int+cryptGenRandom h buf n = do+    success <- toBool `fmap` c_cryptGenRandom h (fromIntegral n) buf+    return $ if success then n else 0++cryptReleaseCtx :: CryptCtx -> IO ()+cryptReleaseCtx h = do+    success <- toBool `fmap` c_cryptReleaseCtx h 0+    if success+        then return ()+        else do+            lastError <- getLastError+            fail $ "cryptReleaseCtx: error " ++ show lastError
+ Crypto/Random/EntropyPool.hs view
@@ -0,0 +1,69 @@+-- |+-- Module      : Crypto.Random.EntropyPool+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.EntropyPool+    ( EntropyPool+    , createEntropyPool+    , createEntropyPoolWith+    , getEntropyFrom+    ) where++import           Control.Concurrent.MVar+import           Crypto.Random.Entropy.Unsafe+import           Crypto.Internal.ByteArray (ByteArray, ScrubbedBytes)+import qualified Crypto.Internal.ByteArray as B+import           Data.Word (Word8)+import           Data.Maybe (catMaybes)+import           Foreign.Marshal.Utils (copyBytes)+import           Foreign.Ptr (plusPtr, Ptr)++-- | Pool of Entropy. contains a self mutating pool of entropy,+-- that is always guarantee to contains data.+data EntropyPool = EntropyPool [EntropyBackend] (MVar Int) ScrubbedBytes++-- size of entropy pool by default+defaultPoolSize :: Int+defaultPoolSize = 4096++-- | Create a new entropy pool of a specific size+--+-- While you can create as many entropy pool as you want, the pool can be shared between multiples RNGs.+createEntropyPoolWith :: Int -> [EntropyBackend] -> IO EntropyPool+createEntropyPoolWith poolSize backends = do+    m  <- newMVar 0+    sm <- B.alloc poolSize (replenish poolSize backends)+    return $ EntropyPool backends m sm++-- | Create a new entropy pool with a default size.+--+-- While you can create as many entropy pool as you want, the pool can be shared between multiples RNGs.+createEntropyPool :: IO EntropyPool+createEntropyPool = do+    backends <- catMaybes `fmap` sequence supportedBackends+    createEntropyPoolWith defaultPoolSize backends++-- | Put a chunk of the entropy pool into a buffer+getEntropyPtr :: EntropyPool -> Int -> Ptr Word8 -> IO ()+getEntropyPtr (EntropyPool backends posM sm) n outPtr =+    B.withByteArray sm $ \entropyPoolPtr ->+        modifyMVar_ posM $ \pos ->+            copyLoop outPtr entropyPoolPtr pos n+  where poolSize = B.length sm+        copyLoop d s pos left+            | left == 0 = return pos+            | otherwise = do+                wrappedPos <-+                    if pos == poolSize+                        then replenish poolSize backends s >> return 0+                        else return pos+                let m = min (poolSize - wrappedPos) left+                copyBytes d (s `plusPtr` wrappedPos) m+                copyLoop (d `plusPtr` m) s (wrappedPos + m) (left - m)++-- | Grab a chunk of entropy from the entropy pool.+getEntropyFrom :: ByteArray byteArray => EntropyPool -> Int -> IO byteArray+getEntropyFrom pool n = B.alloc n (getEntropyPtr pool n)
+ Crypto/Random/Probabilistic.hs view
@@ -0,0 +1,28 @@+-- |+-- Module      : Crypto.Random.Probabilistic+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.Probabilistic+    ( probabilistic+    ) where++import Crypto.Internal.Compat+import Crypto.Random.Types+import Crypto.Random++-- | This create a random number generator out of thin air with+-- the system entropy; don't generally use as the IO is not exposed+-- this can have unexpected random for.+-- +-- This is useful for probabilistic algorithm like Miller Rabin+-- probably prime algorithm, given appropriate choice of the heuristic+--+-- Generally, it's advise not to use this function.+probabilistic :: MonadPseudoRandom ChaChaDRG a -> a+probabilistic f = fst $ withDRG drg f+  where {-# NOINLINE drg #-}+        drg = unsafeDoIO drgNew+{-# NOINLINE probabilistic #-}
+ Crypto/Random/Types.hs view
@@ -0,0 +1,61 @@+-- |+-- Module      : Crypto.Random.Types+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : Good+--+module Crypto.Random.Types+    (+      MonadRandom(..)+    , MonadPseudoRandom+    , DRG(..)+    , withDRG+    ) where++import Crypto.Random.Entropy+import Crypto.Internal.ByteArray+import Crypto.Internal.Imports++-- | A monad constraint that allows to generate random bytes+class (Functor m, Monad m) => MonadRandom m where+    getRandomBytes :: ByteArray byteArray => Int -> m byteArray++-- | A Deterministic Random Generator (DRG) class+class DRG gen where+    -- | Generate N bytes of randomness from a DRG+    randomBytesGenerate :: ByteArray byteArray => Int -> gen -> (byteArray, gen)++instance MonadRandom IO where+    getRandomBytes = getEntropy++-- | A simple Monad class very similar to a State Monad+-- with the state being a DRG.+newtype MonadPseudoRandom gen a = MonadPseudoRandom+    { runPseudoRandom :: gen -> (a, gen)+    }++instance DRG gen => Functor (MonadPseudoRandom gen) where+    fmap f m = MonadPseudoRandom $ \g1 ->+        let (a, g2) = runPseudoRandom m g1 in (f a, g2)++instance DRG gen => Applicative (MonadPseudoRandom gen) where+    pure a     = MonadPseudoRandom $ \g -> (a, g)+    (<*>) fm m = MonadPseudoRandom $ \g1 ->+        let (f, g2) = runPseudoRandom fm g1+            (a, g3) = runPseudoRandom m g2+         in (f a, g3)++instance DRG gen => Monad (MonadPseudoRandom gen) where+    return a    = MonadPseudoRandom $ \g -> (a, g)+    (>>=) m1 m2 = MonadPseudoRandom $ \g1 ->+        let (a, g2) = runPseudoRandom m1 g1+         in runPseudoRandom (m2 a) g2++instance DRG gen => MonadRandom (MonadPseudoRandom gen) where+    getRandomBytes n = MonadPseudoRandom (randomBytesGenerate n)++-- | Run a pure computation with a Deterministic Random Generator+-- in the 'MonadPseudoRandom'+withDRG :: DRG gen => gen -> MonadPseudoRandom gen a -> (a, gen)+withDRG gen m = runPseudoRandom m gen
+ LICENSE view
@@ -0,0 +1,28 @@+Copyright (c) 2006-2015 Vincent Hanquez <vincent@snarc.org>++All rights reserved.++Redistribution and use in source and binary forms, with or without+modification, are permitted provided that the following conditions+are met:++1. Redistributions of source code must retain the above copyright+   notice, this list of conditions and the following disclaimer.+2. Redistributions in binary form must reproduce the above copyright+   notice, this list of conditions and the following disclaimer in the+   documentation and/or other materials provided with the distribution.+3. Neither the name of the author nor the names of his contributors+   may be used to endorse or promote products derived from this software+   without specific prior written permission.++THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS AS IS'' AND+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+SUCH DAMAGE.
+ README.md view
@@ -0,0 +1,80 @@+cryptonite+==========++[![Build Status](https://travis-ci.org/vincenthz/cryptonite.png?branch=master)](https://travis-ci.org/vincenthz/cryptonite)+[![BSD](http://b.repl.ca/v1/license-BSD-blue.png)](http://en.wikipedia.org/wiki/BSD_licenses)+[![Haskell](http://b.repl.ca/v1/language-haskell-lightgrey.png)](http://haskell.org)++Cryptonite is a haskell repository of cryptographic primitives. Each crypto+algorithm have specificities, that are hard to wrap in common APIs and types,+so instead of trying to provide a common ground for algorithms that wouldn't+allow to provide all different usage or a really complicated system, this just+provide a non-consistant low-level API.++If you have no idea what're you doing, please do not use this directly, rely on+higher level protocols or higher level implementation.++Documentation: [cryptonite on hackage](http://hackage.haskell.org/package/cryptonite)++Versioning+----------++Development versions are an incremental number prefixed by 0.+No specific meaning is associated with the versions, specially+no API stability.++Production versions : TBD++Coding Style+------------++The coding style of this project mostly follows:+[haskell-style](https://github.com/tibbe/haskell-style-guide/blob/master/haskell-style.md)++Support+-------++cryptonite supports the following platform:++* Windows >= 8+* OSX >= 10.8+* Linux++On the following architectures:++* x86-64+* i386++On the following haskell versions:++* GHC 7.0.x+* GHC 7.4.x+* GHC 7.6.x+* GHC 7.8.x+* GHC 7.10.x++Further platforms and architectures probably works too, but until maintainer(s) don't have regular+access to them, we can't commit for further support++Links+-----++* [ChaCha](http://cr.yp.to/chacha.html)+* [ChaCha-test-vectors](https://github.com/secworks/chacha_testvectors.git)+* [Poly1305](http://cr.yp.to/mac.html)+* [Poly1305-test-vectors](http://tools.ietf.org/html/draft-nir-cfrg-chacha20-poly1305-06#page-12)+* [Salsa](http://cr.yp.to/snuffle.html)+* [Salsa128-test-vectors](https://github.com/alexwebr/salsa20/blob/master/test_vectors.128)+* [Salsa256-test-vectors](https://github.com/alexwebr/salsa20/blob/master/test_vectors.256)+* [PBKDF2](http://tools.ietf.org/html/rfc2898)+* [PBKDF2-test-vectors](http://www.ietf.org/rfc/rfc6070.txt)+* [Scrypt](http://www.tarsnap.com/scrypt.html)+* [Curve25519](http://cr.yp.to/ecdh.html)+* [Ed25519](http://ed25519.cr.yp.to/papers.html)+* [AFIS](http://clemens.endorphin.org/cryptography)++TODO+----++* finish google P256 binding+* add support for XSalsa
+ Setup.hs view
@@ -0,0 +1,2 @@+import Distribution.Simple+main = defaultMain
+ cbits/aes/block128.h view
@@ -0,0 +1,99 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ * + * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#ifndef BLOCK128_H+#define BLOCK128_H++#include <cryptonite_bitfn.h>++typedef union {+       uint64_t q[2];+       uint32_t d[4];+       uint16_t w[8];+       uint8_t  b[16];+} block128;++static inline void block128_copy_bytes(block128 *block, uint8_t *src, uint32_t len)+{+	int i;+	for (i = 0; i < len; i++) block->b[i] = src[i];+}++static inline void block128_copy(block128 *d, const block128 *s)+{+	d->q[0] = s->q[0]; d->q[1] = s->q[1];+}++static inline void block128_zero(block128 *d)+{+	d->q[0] = 0; d->q[1] = 0;+}++static inline void block128_xor(block128 *d, const block128 *s)+{+	d->q[0] ^= s->q[0];+	d->q[1] ^= s->q[1];+}++static inline void block128_vxor(block128 *d, const block128 *s1, const block128 *s2)+{+	d->q[0] = s1->q[0] ^ s2->q[0];+	d->q[1] = s1->q[1] ^ s2->q[1];+}++static inline void block128_xor_bytes(block128 *block, uint8_t *src, uint32_t len)+{+	int i;+	for (i = 0; i < len; i++) block->b[i] ^= src[i];+}++static inline void block128_inc_be(block128 *b)+{+	uint64_t v = be64_to_cpu(b->q[1]);+	if (++v == 0) {+		b->q[0] = cpu_to_be64(be64_to_cpu(b->q[0]) + 1);+		b->q[1] = 0;+	} else+		b->q[1] = cpu_to_be64(v);+}++#ifdef IMPL_DEBUG+#include <stdio.h>+static inline void block128_print(block128 *b)+{+	int i;+	for (i = 0; i < 16; i++) {+		printf("%02x ", b->b[i]);+	}+	printf("\n");+}+#endif++#endif
+ cbits/aes/generic.c view
@@ -0,0 +1,442 @@+/*+ * Copyright (C) 2008 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ * AES implementation+ */++#include <stdint.h>+#include <stdlib.h>+#include <cryptonite_aes.h>+#include <cryptonite_bitfn.h>++static uint8_t sbox[256] = {+	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe,+	0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4,+	0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7,+	0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15, 0x04, 0xc7, 0x23, 0xc3,+	0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75, 0x09,+	0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3,+	0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe,+	0x39, 0x4a, 0x4c, 0x58, 0xcf, 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,+	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92,+	0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c,+	0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19,+	0x73, 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,+	0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2,+	0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5,+	0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, 0xba, 0x78, 0x25,+	0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,+	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86,+	0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e,+	0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf, 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42,+	0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16+};++static uint8_t rsbox[256] = {+	0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81,+	0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e,+	0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23,+	0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e, 0x08, 0x2e, 0xa1, 0x66,+	0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25, 0x72,+	0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65,+	0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46,+	0x57, 0xa7, 0x8d, 0x9d, 0x84, 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a,+	0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca,+	0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91,+	0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6,+	0x73, 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,+	0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f,+	0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2,+	0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4, 0x1f, 0xdd, 0xa8,+	0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,+	0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93,+	0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb,+	0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61, 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6,+	0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d+};++static uint8_t Rcon[] = {+	0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,+	0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,+	0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,+	0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb,+};++#define G(a,b,c,d,e,f) { a,b,c,d,e,f }+uint8_t gmtab[256][6] =+{+	G(0x00, 0x00, 0x00, 0x00, 0x00, 0x00), G(0x02, 0x03, 0x09, 0x0b, 0x0d, 0x0e),+	G(0x04, 0x06, 0x12, 0x16, 0x1a, 0x1c), G(0x06, 0x05, 0x1b, 0x1d, 0x17, 0x12),+	G(0x08, 0x0c, 0x24, 0x2c, 0x34, 0x38), G(0x0a, 0x0f, 0x2d, 0x27, 0x39, 0x36),+	G(0x0c, 0x0a, 0x36, 0x3a, 0x2e, 0x24), G(0x0e, 0x09, 0x3f, 0x31, 0x23, 0x2a),+	G(0x10, 0x18, 0x48, 0x58, 0x68, 0x70), G(0x12, 0x1b, 0x41, 0x53, 0x65, 0x7e),+	G(0x14, 0x1e, 0x5a, 0x4e, 0x72, 0x6c), G(0x16, 0x1d, 0x53, 0x45, 0x7f, 0x62),+	G(0x18, 0x14, 0x6c, 0x74, 0x5c, 0x48), G(0x1a, 0x17, 0x65, 0x7f, 0x51, 0x46),+	G(0x1c, 0x12, 0x7e, 0x62, 0x46, 0x54), G(0x1e, 0x11, 0x77, 0x69, 0x4b, 0x5a),+	G(0x20, 0x30, 0x90, 0xb0, 0xd0, 0xe0), G(0x22, 0x33, 0x99, 0xbb, 0xdd, 0xee),+	G(0x24, 0x36, 0x82, 0xa6, 0xca, 0xfc), G(0x26, 0x35, 0x8b, 0xad, 0xc7, 0xf2),+	G(0x28, 0x3c, 0xb4, 0x9c, 0xe4, 0xd8), G(0x2a, 0x3f, 0xbd, 0x97, 0xe9, 0xd6),+	G(0x2c, 0x3a, 0xa6, 0x8a, 0xfe, 0xc4), G(0x2e, 0x39, 0xaf, 0x81, 0xf3, 0xca),+	G(0x30, 0x28, 0xd8, 0xe8, 0xb8, 0x90), G(0x32, 0x2b, 0xd1, 0xe3, 0xb5, 0x9e),+	G(0x34, 0x2e, 0xca, 0xfe, 0xa2, 0x8c), G(0x36, 0x2d, 0xc3, 0xf5, 0xaf, 0x82),+	G(0x38, 0x24, 0xfc, 0xc4, 0x8c, 0xa8), G(0x3a, 0x27, 0xf5, 0xcf, 0x81, 0xa6),+	G(0x3c, 0x22, 0xee, 0xd2, 0x96, 0xb4), G(0x3e, 0x21, 0xe7, 0xd9, 0x9b, 0xba),+	G(0x40, 0x60, 0x3b, 0x7b, 0xbb, 0xdb), G(0x42, 0x63, 0x32, 0x70, 0xb6, 0xd5),+	G(0x44, 0x66, 0x29, 0x6d, 0xa1, 0xc7), G(0x46, 0x65, 0x20, 0x66, 0xac, 0xc9),+	G(0x48, 0x6c, 0x1f, 0x57, 0x8f, 0xe3), G(0x4a, 0x6f, 0x16, 0x5c, 0x82, 0xed),+	G(0x4c, 0x6a, 0x0d, 0x41, 0x95, 0xff), G(0x4e, 0x69, 0x04, 0x4a, 0x98, 0xf1),+	G(0x50, 0x78, 0x73, 0x23, 0xd3, 0xab), G(0x52, 0x7b, 0x7a, 0x28, 0xde, 0xa5),+	G(0x54, 0x7e, 0x61, 0x35, 0xc9, 0xb7), G(0x56, 0x7d, 0x68, 0x3e, 0xc4, 0xb9),+	G(0x58, 0x74, 0x57, 0x0f, 0xe7, 0x93), G(0x5a, 0x77, 0x5e, 0x04, 0xea, 0x9d),+	G(0x5c, 0x72, 0x45, 0x19, 0xfd, 0x8f), G(0x5e, 0x71, 0x4c, 0x12, 0xf0, 0x81),+	G(0x60, 0x50, 0xab, 0xcb, 0x6b, 0x3b), G(0x62, 0x53, 0xa2, 0xc0, 0x66, 0x35),+	G(0x64, 0x56, 0xb9, 0xdd, 0x71, 0x27), G(0x66, 0x55, 0xb0, 0xd6, 0x7c, 0x29),+	G(0x68, 0x5c, 0x8f, 0xe7, 0x5f, 0x03), G(0x6a, 0x5f, 0x86, 0xec, 0x52, 0x0d),+	G(0x6c, 0x5a, 0x9d, 0xf1, 0x45, 0x1f), G(0x6e, 0x59, 0x94, 0xfa, 0x48, 0x11),+	G(0x70, 0x48, 0xe3, 0x93, 0x03, 0x4b), G(0x72, 0x4b, 0xea, 0x98, 0x0e, 0x45),+	G(0x74, 0x4e, 0xf1, 0x85, 0x19, 0x57), G(0x76, 0x4d, 0xf8, 0x8e, 0x14, 0x59),+	G(0x78, 0x44, 0xc7, 0xbf, 0x37, 0x73), G(0x7a, 0x47, 0xce, 0xb4, 0x3a, 0x7d),+	G(0x7c, 0x42, 0xd5, 0xa9, 0x2d, 0x6f), G(0x7e, 0x41, 0xdc, 0xa2, 0x20, 0x61),+	G(0x80, 0xc0, 0x76, 0xf6, 0x6d, 0xad), G(0x82, 0xc3, 0x7f, 0xfd, 0x60, 0xa3),+	G(0x84, 0xc6, 0x64, 0xe0, 0x77, 0xb1), G(0x86, 0xc5, 0x6d, 0xeb, 0x7a, 0xbf),+	G(0x88, 0xcc, 0x52, 0xda, 0x59, 0x95), G(0x8a, 0xcf, 0x5b, 0xd1, 0x54, 0x9b),+	G(0x8c, 0xca, 0x40, 0xcc, 0x43, 0x89), G(0x8e, 0xc9, 0x49, 0xc7, 0x4e, 0x87),+	G(0x90, 0xd8, 0x3e, 0xae, 0x05, 0xdd), G(0x92, 0xdb, 0x37, 0xa5, 0x08, 0xd3),+	G(0x94, 0xde, 0x2c, 0xb8, 0x1f, 0xc1), G(0x96, 0xdd, 0x25, 0xb3, 0x12, 0xcf),+	G(0x98, 0xd4, 0x1a, 0x82, 0x31, 0xe5), G(0x9a, 0xd7, 0x13, 0x89, 0x3c, 0xeb),+	G(0x9c, 0xd2, 0x08, 0x94, 0x2b, 0xf9), G(0x9e, 0xd1, 0x01, 0x9f, 0x26, 0xf7),+	G(0xa0, 0xf0, 0xe6, 0x46, 0xbd, 0x4d), G(0xa2, 0xf3, 0xef, 0x4d, 0xb0, 0x43),+	G(0xa4, 0xf6, 0xf4, 0x50, 0xa7, 0x51), G(0xa6, 0xf5, 0xfd, 0x5b, 0xaa, 0x5f),+	G(0xa8, 0xfc, 0xc2, 0x6a, 0x89, 0x75), G(0xaa, 0xff, 0xcb, 0x61, 0x84, 0x7b),+	G(0xac, 0xfa, 0xd0, 0x7c, 0x93, 0x69), G(0xae, 0xf9, 0xd9, 0x77, 0x9e, 0x67),+	G(0xb0, 0xe8, 0xae, 0x1e, 0xd5, 0x3d), G(0xb2, 0xeb, 0xa7, 0x15, 0xd8, 0x33),+	G(0xb4, 0xee, 0xbc, 0x08, 0xcf, 0x21), G(0xb6, 0xed, 0xb5, 0x03, 0xc2, 0x2f),+	G(0xb8, 0xe4, 0x8a, 0x32, 0xe1, 0x05), G(0xba, 0xe7, 0x83, 0x39, 0xec, 0x0b),+	G(0xbc, 0xe2, 0x98, 0x24, 0xfb, 0x19), G(0xbe, 0xe1, 0x91, 0x2f, 0xf6, 0x17),+	G(0xc0, 0xa0, 0x4d, 0x8d, 0xd6, 0x76), G(0xc2, 0xa3, 0x44, 0x86, 0xdb, 0x78),+	G(0xc4, 0xa6, 0x5f, 0x9b, 0xcc, 0x6a), G(0xc6, 0xa5, 0x56, 0x90, 0xc1, 0x64),+	G(0xc8, 0xac, 0x69, 0xa1, 0xe2, 0x4e), G(0xca, 0xaf, 0x60, 0xaa, 0xef, 0x40),+	G(0xcc, 0xaa, 0x7b, 0xb7, 0xf8, 0x52), G(0xce, 0xa9, 0x72, 0xbc, 0xf5, 0x5c),+	G(0xd0, 0xb8, 0x05, 0xd5, 0xbe, 0x06), G(0xd2, 0xbb, 0x0c, 0xde, 0xb3, 0x08),+	G(0xd4, 0xbe, 0x17, 0xc3, 0xa4, 0x1a), G(0xd6, 0xbd, 0x1e, 0xc8, 0xa9, 0x14),+	G(0xd8, 0xb4, 0x21, 0xf9, 0x8a, 0x3e), G(0xda, 0xb7, 0x28, 0xf2, 0x87, 0x30),+	G(0xdc, 0xb2, 0x33, 0xef, 0x90, 0x22), G(0xde, 0xb1, 0x3a, 0xe4, 0x9d, 0x2c),+	G(0xe0, 0x90, 0xdd, 0x3d, 0x06, 0x96), G(0xe2, 0x93, 0xd4, 0x36, 0x0b, 0x98),+	G(0xe4, 0x96, 0xcf, 0x2b, 0x1c, 0x8a), G(0xe6, 0x95, 0xc6, 0x20, 0x11, 0x84),+	G(0xe8, 0x9c, 0xf9, 0x11, 0x32, 0xae), G(0xea, 0x9f, 0xf0, 0x1a, 0x3f, 0xa0),+	G(0xec, 0x9a, 0xeb, 0x07, 0x28, 0xb2), G(0xee, 0x99, 0xe2, 0x0c, 0x25, 0xbc),+	G(0xf0, 0x88, 0x95, 0x65, 0x6e, 0xe6), G(0xf2, 0x8b, 0x9c, 0x6e, 0x63, 0xe8),+	G(0xf4, 0x8e, 0x87, 0x73, 0x74, 0xfa), G(0xf6, 0x8d, 0x8e, 0x78, 0x79, 0xf4),+	G(0xf8, 0x84, 0xb1, 0x49, 0x5a, 0xde), G(0xfa, 0x87, 0xb8, 0x42, 0x57, 0xd0),+	G(0xfc, 0x82, 0xa3, 0x5f, 0x40, 0xc2), G(0xfe, 0x81, 0xaa, 0x54, 0x4d, 0xcc),+	G(0x1b, 0x9b, 0xec, 0xf7, 0xda, 0x41), G(0x19, 0x98, 0xe5, 0xfc, 0xd7, 0x4f),+	G(0x1f, 0x9d, 0xfe, 0xe1, 0xc0, 0x5d), G(0x1d, 0x9e, 0xf7, 0xea, 0xcd, 0x53),+	G(0x13, 0x97, 0xc8, 0xdb, 0xee, 0x79), G(0x11, 0x94, 0xc1, 0xd0, 0xe3, 0x77),+	G(0x17, 0x91, 0xda, 0xcd, 0xf4, 0x65), G(0x15, 0x92, 0xd3, 0xc6, 0xf9, 0x6b),+	G(0x0b, 0x83, 0xa4, 0xaf, 0xb2, 0x31), G(0x09, 0x80, 0xad, 0xa4, 0xbf, 0x3f),+	G(0x0f, 0x85, 0xb6, 0xb9, 0xa8, 0x2d), G(0x0d, 0x86, 0xbf, 0xb2, 0xa5, 0x23),+	G(0x03, 0x8f, 0x80, 0x83, 0x86, 0x09), G(0x01, 0x8c, 0x89, 0x88, 0x8b, 0x07),+	G(0x07, 0x89, 0x92, 0x95, 0x9c, 0x15), G(0x05, 0x8a, 0x9b, 0x9e, 0x91, 0x1b),+	G(0x3b, 0xab, 0x7c, 0x47, 0x0a, 0xa1), G(0x39, 0xa8, 0x75, 0x4c, 0x07, 0xaf),+	G(0x3f, 0xad, 0x6e, 0x51, 0x10, 0xbd), G(0x3d, 0xae, 0x67, 0x5a, 0x1d, 0xb3),+	G(0x33, 0xa7, 0x58, 0x6b, 0x3e, 0x99), G(0x31, 0xa4, 0x51, 0x60, 0x33, 0x97),+	G(0x37, 0xa1, 0x4a, 0x7d, 0x24, 0x85), G(0x35, 0xa2, 0x43, 0x76, 0x29, 0x8b),+	G(0x2b, 0xb3, 0x34, 0x1f, 0x62, 0xd1), G(0x29, 0xb0, 0x3d, 0x14, 0x6f, 0xdf),+	G(0x2f, 0xb5, 0x26, 0x09, 0x78, 0xcd), G(0x2d, 0xb6, 0x2f, 0x02, 0x75, 0xc3),+	G(0x23, 0xbf, 0x10, 0x33, 0x56, 0xe9), G(0x21, 0xbc, 0x19, 0x38, 0x5b, 0xe7),+	G(0x27, 0xb9, 0x02, 0x25, 0x4c, 0xf5), G(0x25, 0xba, 0x0b, 0x2e, 0x41, 0xfb),+	G(0x5b, 0xfb, 0xd7, 0x8c, 0x61, 0x9a), G(0x59, 0xf8, 0xde, 0x87, 0x6c, 0x94),+	G(0x5f, 0xfd, 0xc5, 0x9a, 0x7b, 0x86), G(0x5d, 0xfe, 0xcc, 0x91, 0x76, 0x88),+	G(0x53, 0xf7, 0xf3, 0xa0, 0x55, 0xa2), G(0x51, 0xf4, 0xfa, 0xab, 0x58, 0xac),+	G(0x57, 0xf1, 0xe1, 0xb6, 0x4f, 0xbe), G(0x55, 0xf2, 0xe8, 0xbd, 0x42, 0xb0),+	G(0x4b, 0xe3, 0x9f, 0xd4, 0x09, 0xea), G(0x49, 0xe0, 0x96, 0xdf, 0x04, 0xe4),+	G(0x4f, 0xe5, 0x8d, 0xc2, 0x13, 0xf6), G(0x4d, 0xe6, 0x84, 0xc9, 0x1e, 0xf8),+	G(0x43, 0xef, 0xbb, 0xf8, 0x3d, 0xd2), G(0x41, 0xec, 0xb2, 0xf3, 0x30, 0xdc),+	G(0x47, 0xe9, 0xa9, 0xee, 0x27, 0xce), G(0x45, 0xea, 0xa0, 0xe5, 0x2a, 0xc0),+	G(0x7b, 0xcb, 0x47, 0x3c, 0xb1, 0x7a), G(0x79, 0xc8, 0x4e, 0x37, 0xbc, 0x74),+	G(0x7f, 0xcd, 0x55, 0x2a, 0xab, 0x66), G(0x7d, 0xce, 0x5c, 0x21, 0xa6, 0x68),+	G(0x73, 0xc7, 0x63, 0x10, 0x85, 0x42), G(0x71, 0xc4, 0x6a, 0x1b, 0x88, 0x4c),+	G(0x77, 0xc1, 0x71, 0x06, 0x9f, 0x5e), G(0x75, 0xc2, 0x78, 0x0d, 0x92, 0x50),+	G(0x6b, 0xd3, 0x0f, 0x64, 0xd9, 0x0a), G(0x69, 0xd0, 0x06, 0x6f, 0xd4, 0x04),+	G(0x6f, 0xd5, 0x1d, 0x72, 0xc3, 0x16), G(0x6d, 0xd6, 0x14, 0x79, 0xce, 0x18),+	G(0x63, 0xdf, 0x2b, 0x48, 0xed, 0x32), G(0x61, 0xdc, 0x22, 0x43, 0xe0, 0x3c),+	G(0x67, 0xd9, 0x39, 0x5e, 0xf7, 0x2e), G(0x65, 0xda, 0x30, 0x55, 0xfa, 0x20),+	G(0x9b, 0x5b, 0x9a, 0x01, 0xb7, 0xec), G(0x99, 0x58, 0x93, 0x0a, 0xba, 0xe2),+	G(0x9f, 0x5d, 0x88, 0x17, 0xad, 0xf0), G(0x9d, 0x5e, 0x81, 0x1c, 0xa0, 0xfe),+	G(0x93, 0x57, 0xbe, 0x2d, 0x83, 0xd4), G(0x91, 0x54, 0xb7, 0x26, 0x8e, 0xda),+	G(0x97, 0x51, 0xac, 0x3b, 0x99, 0xc8), G(0x95, 0x52, 0xa5, 0x30, 0x94, 0xc6),+	G(0x8b, 0x43, 0xd2, 0x59, 0xdf, 0x9c), G(0x89, 0x40, 0xdb, 0x52, 0xd2, 0x92),+	G(0x8f, 0x45, 0xc0, 0x4f, 0xc5, 0x80), G(0x8d, 0x46, 0xc9, 0x44, 0xc8, 0x8e),+	G(0x83, 0x4f, 0xf6, 0x75, 0xeb, 0xa4), G(0x81, 0x4c, 0xff, 0x7e, 0xe6, 0xaa),+	G(0x87, 0x49, 0xe4, 0x63, 0xf1, 0xb8), G(0x85, 0x4a, 0xed, 0x68, 0xfc, 0xb6),+	G(0xbb, 0x6b, 0x0a, 0xb1, 0x67, 0x0c), G(0xb9, 0x68, 0x03, 0xba, 0x6a, 0x02),+	G(0xbf, 0x6d, 0x18, 0xa7, 0x7d, 0x10), G(0xbd, 0x6e, 0x11, 0xac, 0x70, 0x1e),+	G(0xb3, 0x67, 0x2e, 0x9d, 0x53, 0x34), G(0xb1, 0x64, 0x27, 0x96, 0x5e, 0x3a),+	G(0xb7, 0x61, 0x3c, 0x8b, 0x49, 0x28), G(0xb5, 0x62, 0x35, 0x80, 0x44, 0x26),+	G(0xab, 0x73, 0x42, 0xe9, 0x0f, 0x7c), G(0xa9, 0x70, 0x4b, 0xe2, 0x02, 0x72),+	G(0xaf, 0x75, 0x50, 0xff, 0x15, 0x60), G(0xad, 0x76, 0x59, 0xf4, 0x18, 0x6e),+	G(0xa3, 0x7f, 0x66, 0xc5, 0x3b, 0x44), G(0xa1, 0x7c, 0x6f, 0xce, 0x36, 0x4a),+	G(0xa7, 0x79, 0x74, 0xd3, 0x21, 0x58), G(0xa5, 0x7a, 0x7d, 0xd8, 0x2c, 0x56),+	G(0xdb, 0x3b, 0xa1, 0x7a, 0x0c, 0x37), G(0xd9, 0x38, 0xa8, 0x71, 0x01, 0x39),+	G(0xdf, 0x3d, 0xb3, 0x6c, 0x16, 0x2b), G(0xdd, 0x3e, 0xba, 0x67, 0x1b, 0x25),+	G(0xd3, 0x37, 0x85, 0x56, 0x38, 0x0f), G(0xd1, 0x34, 0x8c, 0x5d, 0x35, 0x01),+	G(0xd7, 0x31, 0x97, 0x40, 0x22, 0x13), G(0xd5, 0x32, 0x9e, 0x4b, 0x2f, 0x1d),+	G(0xcb, 0x23, 0xe9, 0x22, 0x64, 0x47), G(0xc9, 0x20, 0xe0, 0x29, 0x69, 0x49),+	G(0xcf, 0x25, 0xfb, 0x34, 0x7e, 0x5b), G(0xcd, 0x26, 0xf2, 0x3f, 0x73, 0x55),+	G(0xc3, 0x2f, 0xcd, 0x0e, 0x50, 0x7f), G(0xc1, 0x2c, 0xc4, 0x05, 0x5d, 0x71),+	G(0xc7, 0x29, 0xdf, 0x18, 0x4a, 0x63), G(0xc5, 0x2a, 0xd6, 0x13, 0x47, 0x6d),+	G(0xfb, 0x0b, 0x31, 0xca, 0xdc, 0xd7), G(0xf9, 0x08, 0x38, 0xc1, 0xd1, 0xd9),+	G(0xff, 0x0d, 0x23, 0xdc, 0xc6, 0xcb), G(0xfd, 0x0e, 0x2a, 0xd7, 0xcb, 0xc5),+	G(0xf3, 0x07, 0x15, 0xe6, 0xe8, 0xef), G(0xf1, 0x04, 0x1c, 0xed, 0xe5, 0xe1),+	G(0xf7, 0x01, 0x07, 0xf0, 0xf2, 0xf3), G(0xf5, 0x02, 0x0e, 0xfb, 0xff, 0xfd),+	G(0xeb, 0x13, 0x79, 0x92, 0xb4, 0xa7), G(0xe9, 0x10, 0x70, 0x99, 0xb9, 0xa9),+	G(0xef, 0x15, 0x6b, 0x84, 0xae, 0xbb), G(0xed, 0x16, 0x62, 0x8f, 0xa3, 0xb5),+	G(0xe3, 0x1f, 0x5d, 0xbe, 0x80, 0x9f), G(0xe1, 0x1c, 0x54, 0xb5, 0x8d, 0x91),+	G(0xe7, 0x19, 0x4f, 0xa8, 0x9a, 0x83), G(0xe5, 0x1a, 0x46, 0xa3, 0x97, 0x8d),+};+#undef G++static void expand_key(uint8_t *expandedKey, uint8_t *key, int size, size_t expandedKeySize)+{+	int csz;+	int i;+	uint8_t t[4] = { 0 };++	for (i = 0; i < size; i++)+		expandedKey[i] = key[i];+	csz = size;++	i = 1;+	while (csz < expandedKeySize) {+		t[0] = expandedKey[(csz - 4) + 0];+		t[1] = expandedKey[(csz - 4) + 1];+		t[2] = expandedKey[(csz - 4) + 2];+		t[3] = expandedKey[(csz - 4) + 3];++		if (csz % size == 0) {+			uint8_t tmp;++			tmp = t[0];+			t[0] = sbox[t[1]] ^ Rcon[i++ % sizeof(Rcon)];+			t[1] = sbox[t[2]];+			t[2] = sbox[t[3]];+			t[3] = sbox[tmp];+		}++		if (size == 32 && ((csz % size) == 16)) {+			t[0] = sbox[t[0]];+			t[1] = sbox[t[1]];+			t[2] = sbox[t[2]];+			t[3] = sbox[t[3]];+		}++		expandedKey[csz] = expandedKey[csz - size] ^ t[0]; csz++;+		expandedKey[csz] = expandedKey[csz - size] ^ t[1]; csz++;+		expandedKey[csz] = expandedKey[csz - size] ^ t[2]; csz++;+		expandedKey[csz] = expandedKey[csz - size] ^ t[3]; csz++;+	}+}++static void shift_rows(uint8_t *state)+{+	uint32_t *s32;+	int i;++	for (i = 0; i < 16; i++)+		state[i] = sbox[state[i]];+	s32 = (uint32_t *) state;+	s32[1] = rol32_be(s32[1], 8);+	s32[2] = rol32_be(s32[2], 16);+	s32[3] = rol32_be(s32[3], 24);+}++static void add_round_key(uint8_t *state, uint8_t *rk)+{+	uint32_t *s32, *r32;++	s32 = (uint32_t *) state;+	r32 = (uint32_t *) rk;+	s32[0] ^= r32[0];+	s32[1] ^= r32[1];+	s32[2] ^= r32[2];+	s32[3] ^= r32[3];+}++#define gm1(a) (a)+#define gm2(a) gmtab[a][0]+#define gm3(a) gmtab[a][1]+#define gm9(a) gmtab[a][2]+#define gm11(a) gmtab[a][3]+#define gm13(a) gmtab[a][4]+#define gm14(a) gmtab[a][5]++static void mix_columns(uint8_t *state)+{+	int i;+	uint8_t cpy[4];++	for (i = 0; i < 4; i++) {+		cpy[0] = state[0 * 4 + i];+		cpy[1] = state[1 * 4 + i];+		cpy[2] = state[2 * 4 + i];+		cpy[3] = state[3 * 4 + i];+		state[i] = gm2(cpy[0]) ^ gm1(cpy[3]) ^ gm1(cpy[2]) ^ gm3(cpy[1]);+		state[4+i] = gm2(cpy[1]) ^ gm1(cpy[0]) ^ gm1(cpy[3]) ^ gm3(cpy[2]);+		state[8+i] = gm2(cpy[2]) ^ gm1(cpy[1]) ^ gm1(cpy[0]) ^ gm3(cpy[3]);+		state[12+i] = gm2(cpy[3]) ^ gm1(cpy[2]) ^ gm1(cpy[1]) ^ gm3(cpy[0]);+	}+}++static void create_round_key(uint8_t *expandedKey, uint8_t *rk)+{+	int i,j;+	for (i = 0; i < 4; i++)+		for (j = 0; j < 4; j++)+			rk[i + j * 4] = expandedKey[i * 4 + j];+}++static void aes_main(aes_key *key, uint8_t *state)+{+	int i = 0;+	uint8_t rk[16];++	create_round_key(key->data, rk);+	add_round_key(state, rk);++	for (i = 1; i < key->nbr; i++) {+		create_round_key(key->data + 16 * i, rk);+		shift_rows(state);+		mix_columns(state);+		add_round_key(state, rk);+	}++	create_round_key(key->data + 16 * key->nbr, rk);+	shift_rows(state);+	add_round_key(state, rk);+}++static void shift_rows_inv(uint8_t *state)+{+	uint32_t *s32;+	int i;++	s32 = (uint32_t *) state;+	s32[1] = ror32_be(s32[1], 8);+	s32[2] = ror32_be(s32[2], 16);+	s32[3] = ror32_be(s32[3], 24);+	for (i = 0; i < 16; i++)+		state[i] = rsbox[state[i]];+}++static void mix_columns_inv(uint8_t *state)+{+	int i;+	uint8_t cpy[4];++	for (i = 0; i < 4; i++) {+		cpy[0] = state[0 * 4 + i];+		cpy[1] = state[1 * 4 + i];+		cpy[2] = state[2 * 4 + i];+		cpy[3] = state[3 * 4 + i];+		state[i] = gm14(cpy[0]) ^ gm9(cpy[3]) ^ gm13(cpy[2]) ^ gm11(cpy[1]);+		state[4+i] = gm14(cpy[1]) ^ gm9(cpy[0]) ^ gm13(cpy[3]) ^ gm11(cpy[2]);+		state[8+i] = gm14(cpy[2]) ^ gm9(cpy[1]) ^ gm13(cpy[0]) ^ gm11(cpy[3]);+		state[12+i] = gm14(cpy[3]) ^ gm9(cpy[2]) ^ gm13(cpy[1]) ^ gm11(cpy[0]);+	}+}++static void aes_main_inv(aes_key *key, uint8_t *state)+{+	int i = 0;+	uint8_t rk[16];++	create_round_key(key->data + 16 * key->nbr, rk);+	add_round_key(state, rk);++	for (i = key->nbr - 1; i > 0; i--) {+		create_round_key(key->data + 16 * i, rk);+		shift_rows_inv(state);+		add_round_key(state, rk);+		mix_columns_inv(state);+	}++	create_round_key(key->data, rk);+	shift_rows_inv(state);+	add_round_key(state, rk);+}++/* Set the block values, for the block:+ * a0,0 a0,1 a0,2 a0,3+ * a1,0 a1,1 a1,2 a1,3 -> a0,0 a1,0 a2,0 a3,0 a0,1 a1,1 ... a2,3 a3,3+ * a2,0 a2,1 a2,2 a2,3+ * a3,0 a3,1 a3,2 a3,3+ */+#define swap_block(t, f) \+	t[0] = f[0]; t[4] = f[1]; t[8] = f[2]; t[12] = f[3]; \+	t[1] = f[4]; t[5] = f[5]; t[9] = f[6]; t[13] = f[7]; \+	t[2] = f[8]; t[6] = f[9]; t[10] = f[10]; t[14] = f[11]; \+	t[3] = f[12]; t[7] = f[13]; t[11] = f[14]; t[15] = f[15]++void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input)+{+	uint8_t block[16];+	uint8_t *iptr, *optr;++	iptr = (uint8_t *) input;+	optr = (uint8_t *) output;+	swap_block(block, iptr);+	aes_main(key, block);+	swap_block(optr, block);+}++void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input)+{+	uint8_t block[16];+	uint8_t *iptr, *optr;++	iptr = (uint8_t *) input;+	optr = (uint8_t *) output;+	swap_block(block, iptr);+	aes_main_inv(key, block);+	swap_block(optr, block);+}++void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size)+{+	int esz;++	switch (size) {+	case 16: key->nbr = 10; esz = 176; break;+	case 24: key->nbr = 12; esz = 208; break;+	case 32: key->nbr = 14; esz = 240; break;+	default: return;+	}+	expand_key(key->data, origkey, size, esz);+	return;+}
+ cbits/aes/generic.h view
@@ -0,0 +1,34 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#include "cryptonite_aes.h"++void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input);+void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input);+void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size);
+ cbits/aes/gf.c view
@@ -0,0 +1,72 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdio.h>+#include <stdint.h>+#include <cryptonite_cpu.h>+#include <aes/gf.h>+#include <aes/x86ni.h>++/* this is a really inefficient way to GF multiply.+ * the alternative without hw accel is building small tables+ * to speed up the multiplication.+ * TODO: optimise with tables+ */+void gf_mul(block128 *a, block128 *b)+{+	uint64_t a0, a1, v0, v1;+	int i, j;++	a0 = a1 = 0;+	v0 = cpu_to_be64(a->q[0]);+	v1 = cpu_to_be64(a->q[1]);++	for (i = 0; i < 16; i++)+		for (j = 0x80; j != 0; j >>= 1) {+			uint8_t x = b->b[i] & j;+			a0 ^= x ? v0 : 0;+			a1 ^= x ? v1 : 0;+			x = (uint8_t) v1 & 1;+			v1 = (v1 >> 1) | (v0 << 63);+			v0 = (v0 >> 1) ^ (x ? (0xe1ULL << 56) : 0);+		}+	a->q[0] = cpu_to_be64(a0);+	a->q[1] = cpu_to_be64(a1);+}++/* inplace GFMUL for xts mode */+void gf_mulx(block128 *a)+{+	const uint64_t gf_mask = cpu_to_le64(0x8000000000000000ULL);+	uint64_t r = ((a->q[1] & gf_mask) ? cpu_to_le64(0x87) : 0);+	a->q[1] = cpu_to_le64((le64_to_cpu(a->q[1]) << 1) | (a->q[0] & gf_mask ? 1 : 0));+	a->q[0] = cpu_to_le64(le64_to_cpu(a->q[0]) << 1) ^ r;+}+
+ cbits/aes/gf.h view
@@ -0,0 +1,38 @@+/*
+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef CRYPTONITE_AES_GF128MUL_H
+#define CRYPTONITE_AES_GF128MUL_H
+
+#include "aes/block128.h"
+
+void gf_mul(block128 *a, block128 *b);
+void gf_mulx(block128 *a);
+
+#endif
+ cbits/aes/x86ni.c view
@@ -0,0 +1,331 @@+/*+ * Copyright (c) 2012-2013 Vincent Hanquez <vincent@snarc.org>+ * + * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#ifdef WITH_AESNI++#include <wmmintrin.h>+#include <tmmintrin.h>+#include <string.h>+#include <cryptonite_aes.h>+#include <cryptonite_cpu.h>+#include <aes/x86ni.h>+#include <aes/block128.h>++#ifdef ARCH_X86+#define ALIGN_UP(addr, size) (((addr) + ((size) - 1)) & (~((size) - 1)))+#define ALIGNMENT(n) __attribute__((aligned(n)))++/* old GCC version doesn't cope with the shuffle parameters, that can take 2 values (0xff and 0xaa)+ * in our case, passed as argument despite being a immediate 8 bits constant anyway.+ * un-factorise aes_128_key_expansion into 2 version that have the shuffle parameter explicitly set */+static __m128i aes_128_key_expansion_ff(__m128i key, __m128i keygened)+{+	keygened = _mm_shuffle_epi32(keygened, 0xff);+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	return _mm_xor_si128(key, keygened);+}++static __m128i aes_128_key_expansion_aa(__m128i key, __m128i keygened)+{+	keygened = _mm_shuffle_epi32(keygened, 0xaa);+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	key = _mm_xor_si128(key, _mm_slli_si128(key, 4));+	return _mm_xor_si128(key, keygened);+}++void aes_ni_init(aes_key *key, uint8_t *ikey, uint8_t size)+{+	__m128i k[28];+	uint64_t *out = (uint64_t *) key->data;+	int i;++	switch (size) {+	case 16:+		k[0] = _mm_loadu_si128((const __m128i*) ikey);++		#define AES_128_key_exp(K, RCON) aes_128_key_expansion_ff(K, _mm_aeskeygenassist_si128(K, RCON))+		k[1]  = AES_128_key_exp(k[0], 0x01);+		k[2]  = AES_128_key_exp(k[1], 0x02);+		k[3]  = AES_128_key_exp(k[2], 0x04);+		k[4]  = AES_128_key_exp(k[3], 0x08);+		k[5]  = AES_128_key_exp(k[4], 0x10);+		k[6]  = AES_128_key_exp(k[5], 0x20);+		k[7]  = AES_128_key_exp(k[6], 0x40);+		k[8]  = AES_128_key_exp(k[7], 0x80);+		k[9]  = AES_128_key_exp(k[8], 0x1B);+		k[10] = AES_128_key_exp(k[9], 0x36);++		/* generate decryption keys in reverse order.+		 * k[10] is shared by last encryption and first decryption rounds+		 * k[20] is shared by first encryption round (and is the original user key) */+		k[11] = _mm_aesimc_si128(k[9]);+		k[12] = _mm_aesimc_si128(k[8]);+		k[13] = _mm_aesimc_si128(k[7]);+		k[14] = _mm_aesimc_si128(k[6]);+		k[15] = _mm_aesimc_si128(k[5]);+		k[16] = _mm_aesimc_si128(k[4]);+		k[17] = _mm_aesimc_si128(k[3]);+		k[18] = _mm_aesimc_si128(k[2]);+		k[19] = _mm_aesimc_si128(k[1]);++		for (i = 0; i < 20; i++)+			_mm_storeu_si128(((__m128i *) out) + i, k[i]);+		break;+	case 32:+#define AES_256_key_exp_1(K1, K2, RCON) aes_128_key_expansion_ff(K1, _mm_aeskeygenassist_si128(K2, RCON))+#define AES_256_key_exp_2(K1, K2)       aes_128_key_expansion_aa(K1, _mm_aeskeygenassist_si128(K2, 0x00))+		k[0]  = _mm_loadu_si128((const __m128i*) ikey);+		k[1]  = _mm_loadu_si128((const __m128i*) (ikey+16));+		k[2]  = AES_256_key_exp_1(k[0], k[1], 0x01);+		k[3]  = AES_256_key_exp_2(k[1], k[2]);+		k[4]  = AES_256_key_exp_1(k[2], k[3], 0x02);+		k[5]  = AES_256_key_exp_2(k[3], k[4]);+		k[6]  = AES_256_key_exp_1(k[4], k[5], 0x04);+		k[7]  = AES_256_key_exp_2(k[5], k[6]);+		k[8]  = AES_256_key_exp_1(k[6], k[7], 0x08);+		k[9]  = AES_256_key_exp_2(k[7], k[8]);+		k[10] = AES_256_key_exp_1(k[8], k[9], 0x10);+		k[11] = AES_256_key_exp_2(k[9], k[10]);+		k[12] = AES_256_key_exp_1(k[10], k[11], 0x20);+		k[13] = AES_256_key_exp_2(k[11], k[12]);+		k[14] = AES_256_key_exp_1(k[12], k[13], 0x40);++		k[15] = _mm_aesimc_si128(k[13]);+		k[16] = _mm_aesimc_si128(k[12]);+		k[17] = _mm_aesimc_si128(k[11]);+		k[18] = _mm_aesimc_si128(k[10]);+		k[19] = _mm_aesimc_si128(k[9]);+		k[20] = _mm_aesimc_si128(k[8]);+		k[21] = _mm_aesimc_si128(k[7]);+		k[22] = _mm_aesimc_si128(k[6]);+		k[23] = _mm_aesimc_si128(k[5]);+		k[24] = _mm_aesimc_si128(k[4]);+		k[25] = _mm_aesimc_si128(k[3]);+		k[26] = _mm_aesimc_si128(k[2]);+		k[27] = _mm_aesimc_si128(k[1]);+		for (i = 0; i < 28; i++)+			_mm_storeu_si128(((__m128i *) out) + i, k[i]);+		break;+	default:+		break;+	}+}++/* TO OPTIMISE: use pcmulqdq... or some faster code.+ * this is the lamest way of doing it, but i'm out of time.+ * this is basically a copy of gf_mulx in gf.c */+static __m128i gfmulx(__m128i v)+{+	uint64_t v_[2] ALIGNMENT(16);+	const uint64_t gf_mask = 0x8000000000000000;++	_mm_store_si128((__m128i *) v_, v);+	uint64_t r = ((v_[1] & gf_mask) ? 0x87 : 0);+	v_[1] = (v_[1] << 1) | (v_[0] & gf_mask ? 1 : 0);+	v_[0] = (v_[0] << 1) ^ r;+	v = _mm_load_si128((__m128i *) v_);+	return v;+}++static void unopt_gf_mul(block128 *a, block128 *b)+{+	uint64_t a0, a1, v0, v1;+	int i, j;++	a0 = a1 = 0;+	v0 = cpu_to_be64(a->q[0]);+	v1 = cpu_to_be64(a->q[1]);++	for (i = 0; i < 16; i++)+		for (j = 0x80; j != 0; j >>= 1) {+			uint8_t x = b->b[i] & j;+			a0 ^= x ? v0 : 0;+			a1 ^= x ? v1 : 0;+			x = (uint8_t) v1 & 1;+			v1 = (v1 >> 1) | (v0 << 63);+			v0 = (v0 >> 1) ^ (x ? (0xe1ULL << 56) : 0);+		}+	a->q[0] = cpu_to_be64(a0);+	a->q[1] = cpu_to_be64(a1);+}++static __m128i ghash_add(__m128i tag, __m128i h, __m128i m)+{+	aes_block _t, _h;+	tag = _mm_xor_si128(tag, m);++	_mm_store_si128((__m128i *) &_t, tag);+	_mm_store_si128((__m128i *) &_h, h);+	unopt_gf_mul(&_t, &_h);+	tag = _mm_load_si128((__m128i *) &_t);+	return tag;+}++#define PRELOAD_ENC_KEYS128(k) \+	__m128i K0  = _mm_loadu_si128(((__m128i *) k)+0); \+	__m128i K1  = _mm_loadu_si128(((__m128i *) k)+1); \+	__m128i K2  = _mm_loadu_si128(((__m128i *) k)+2); \+	__m128i K3  = _mm_loadu_si128(((__m128i *) k)+3); \+	__m128i K4  = _mm_loadu_si128(((__m128i *) k)+4); \+	__m128i K5  = _mm_loadu_si128(((__m128i *) k)+5); \+	__m128i K6  = _mm_loadu_si128(((__m128i *) k)+6); \+	__m128i K7  = _mm_loadu_si128(((__m128i *) k)+7); \+	__m128i K8  = _mm_loadu_si128(((__m128i *) k)+8); \+	__m128i K9  = _mm_loadu_si128(((__m128i *) k)+9); \+	__m128i K10 = _mm_loadu_si128(((__m128i *) k)+10);++#define PRELOAD_ENC_KEYS256(k) \+	PRELOAD_ENC_KEYS128(k) \+	__m128i K11 = _mm_loadu_si128(((__m128i *) k)+11); \+	__m128i K12 = _mm_loadu_si128(((__m128i *) k)+12); \+	__m128i K13 = _mm_loadu_si128(((__m128i *) k)+13); \+	__m128i K14 = _mm_loadu_si128(((__m128i *) k)+14);++#define DO_ENC_BLOCK128(m) \+	m = _mm_xor_si128(m, K0); \+	m = _mm_aesenc_si128(m, K1); \+	m = _mm_aesenc_si128(m, K2); \+	m = _mm_aesenc_si128(m, K3); \+	m = _mm_aesenc_si128(m, K4); \+	m = _mm_aesenc_si128(m, K5); \+	m = _mm_aesenc_si128(m, K6); \+	m = _mm_aesenc_si128(m, K7); \+	m = _mm_aesenc_si128(m, K8); \+	m = _mm_aesenc_si128(m, K9); \+	m = _mm_aesenclast_si128(m, K10);++#define DO_ENC_BLOCK256(m) \+	m = _mm_xor_si128(m, K0); \+	m = _mm_aesenc_si128(m, K1); \+	m = _mm_aesenc_si128(m, K2); \+	m = _mm_aesenc_si128(m, K3); \+	m = _mm_aesenc_si128(m, K4); \+	m = _mm_aesenc_si128(m, K5); \+	m = _mm_aesenc_si128(m, K6); \+	m = _mm_aesenc_si128(m, K7); \+	m = _mm_aesenc_si128(m, K8); \+	m = _mm_aesenc_si128(m, K9); \+	m = _mm_aesenc_si128(m, K10); \+	m = _mm_aesenc_si128(m, K11); \+	m = _mm_aesenc_si128(m, K12); \+	m = _mm_aesenc_si128(m, K13); \+	m = _mm_aesenclast_si128(m, K14);++/* load K0 at K9 from index 'at' */+#define PRELOAD_DEC_KEYS_AT(k, at) \+	__m128i K0  = _mm_loadu_si128(((__m128i *) k)+at+0); \+	__m128i K1  = _mm_loadu_si128(((__m128i *) k)+at+1); \+	__m128i K2  = _mm_loadu_si128(((__m128i *) k)+at+2); \+	__m128i K3  = _mm_loadu_si128(((__m128i *) k)+at+3); \+	__m128i K4  = _mm_loadu_si128(((__m128i *) k)+at+4); \+	__m128i K5  = _mm_loadu_si128(((__m128i *) k)+at+5); \+	__m128i K6  = _mm_loadu_si128(((__m128i *) k)+at+6); \+	__m128i K7  = _mm_loadu_si128(((__m128i *) k)+at+7); \+	__m128i K8  = _mm_loadu_si128(((__m128i *) k)+at+8); \+	__m128i K9  = _mm_loadu_si128(((__m128i *) k)+at+9); \++#define PRELOAD_DEC_KEYS128(k) \+	PRELOAD_DEC_KEYS_AT(k, 10) \+	__m128i K10 = _mm_loadu_si128(((__m128i *) k)+0);++#define PRELOAD_DEC_KEYS256(k) \+	PRELOAD_DEC_KEYS_AT(k, 14) \+	__m128i K10 = _mm_loadu_si128(((__m128i *) k)+14+10); \+	__m128i K11 = _mm_loadu_si128(((__m128i *) k)+14+11); \+	__m128i K12 = _mm_loadu_si128(((__m128i *) k)+14+12); \+	__m128i K13 = _mm_loadu_si128(((__m128i *) k)+14+13); \+	__m128i K14 = _mm_loadu_si128(((__m128i *) k)+0);++#define DO_DEC_BLOCK128(m) \+	m = _mm_xor_si128(m, K0); \+	m = _mm_aesdec_si128(m, K1); \+	m = _mm_aesdec_si128(m, K2); \+	m = _mm_aesdec_si128(m, K3); \+	m = _mm_aesdec_si128(m, K4); \+	m = _mm_aesdec_si128(m, K5); \+	m = _mm_aesdec_si128(m, K6); \+	m = _mm_aesdec_si128(m, K7); \+	m = _mm_aesdec_si128(m, K8); \+	m = _mm_aesdec_si128(m, K9); \+	m = _mm_aesdeclast_si128(m, K10);++#define DO_DEC_BLOCK256(m) \+	m = _mm_xor_si128(m, K0); \+	m = _mm_aesdec_si128(m, K1); \+	m = _mm_aesdec_si128(m, K2); \+	m = _mm_aesdec_si128(m, K3); \+	m = _mm_aesdec_si128(m, K4); \+	m = _mm_aesdec_si128(m, K5); \+	m = _mm_aesdec_si128(m, K6); \+	m = _mm_aesdec_si128(m, K7); \+	m = _mm_aesdec_si128(m, K8); \+	m = _mm_aesdec_si128(m, K9); \+	m = _mm_aesdec_si128(m, K10); \+	m = _mm_aesdec_si128(m, K11); \+	m = _mm_aesdec_si128(m, K12); \+	m = _mm_aesdec_si128(m, K13); \+	m = _mm_aesdeclast_si128(m, K14);++#define SIZE 128+#define SIZED(m) m##128+#define PRELOAD_ENC PRELOAD_ENC_KEYS128+#define DO_ENC_BLOCK DO_ENC_BLOCK128+#define PRELOAD_DEC PRELOAD_DEC_KEYS128+#define DO_DEC_BLOCK DO_DEC_BLOCK128+#include <aes/x86ni_impl.c>++#undef SIZE+#undef SIZED+#undef PRELOAD_ENC+#undef PRELOAD_DEC+#undef DO_ENC_BLOCK+#undef DO_DEC_BLOCK++#define SIZED(m) m##256+#define SIZE 256+#define PRELOAD_ENC PRELOAD_ENC_KEYS256+#define DO_ENC_BLOCK DO_ENC_BLOCK256+#define PRELOAD_DEC PRELOAD_DEC_KEYS256+#define DO_DEC_BLOCK DO_DEC_BLOCK256+#include <aes/x86ni_impl.c>++#undef SIZE+#undef SIZED+#undef PRELOAD_ENC+#undef PRELOAD_DEC+#undef DO_ENC_BLOCK+#undef DO_DEC_BLOCK++#endif++#endif
+ cbits/aes/x86ni.h view
@@ -0,0 +1,81 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ * + * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#ifndef AES_X86NI_H+#define AES_X86NI_H++#ifdef WITH_AESNI++#if defined(__i386__) || defined(__x86_64__)++#include <wmmintrin.h>+#include <tmmintrin.h>+#include <cryptonite_aes.h>+#include <aes/block128.h>++#ifdef IMPL_DEBUG+static void block128_sse_print(__m128i m)+{+	block128 b;+	_mm_storeu_si128((__m128i *) &b.b, m);+	block128_print(&b);+}+#endif++void aes_ni_init(aes_key *key, uint8_t *origkey, uint8_t size);+void aes_ni_encrypt_block128(aes_block *out, aes_key *key, aes_block *in);+void aes_ni_encrypt_block256(aes_block *out, aes_key *key, aes_block *in);+void aes_ni_decrypt_block128(aes_block *out, aes_key *key, aes_block *in);+void aes_ni_decrypt_block256(aes_block *out, aes_key *key, aes_block *in);+void aes_ni_encrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void aes_ni_encrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void aes_ni_decrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void aes_ni_decrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);+void aes_ni_encrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void aes_ni_encrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void aes_ni_decrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void aes_ni_decrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);+void aes_ni_encrypt_ctr128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void aes_ni_encrypt_ctr256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);+void aes_ni_encrypt_xts128(aes_block *out, aes_key *key1, aes_key *key2,+                           aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks);+void aes_ni_encrypt_xts256(aes_block *out, aes_key *key1, aes_key *key2,+                           aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks);++void aes_ni_gcm_encrypt128(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);+void aes_ni_gcm_encrypt256(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);++void gf_mul_x86ni(block128 *res, block128 *a_, block128 *b_);++#endif++#endif++#endif
+ cbits/aes/x86ni_impl.c view
@@ -0,0 +1,263 @@+/*+ * Copyright (c) 2012-2013 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++void SIZED(aes_ni_encrypt_block)(aes_block *out, aes_key *key, aes_block *in)+{+	__m128i *k = (__m128i *) key->data;+	PRELOAD_ENC(k);+	__m128i m = _mm_loadu_si128((__m128i *) in);+	DO_ENC_BLOCK(m);+	_mm_storeu_si128((__m128i *) out, m);+}++void SIZED(aes_ni_decrypt_block)(aes_block *out, aes_key *key, aes_block *in)+{+	__m128i *k = (__m128i *) key->data;+	PRELOAD_DEC(k);+	__m128i m = _mm_loadu_si128((__m128i *) in);+	DO_DEC_BLOCK(m);+	_mm_storeu_si128((__m128i *) out, m);+}++void SIZED(aes_ni_encrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)+{+	__m128i *k = (__m128i *) key->data;++	PRELOAD_ENC(k);+	for (; blocks-- > 0; in += 1, out += 1) {+		__m128i m = _mm_loadu_si128((__m128i *) in);+		DO_ENC_BLOCK(m);+		_mm_storeu_si128((__m128i *) out, m);+	}+}++void SIZED(aes_ni_decrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)+{+	__m128i *k = (__m128i *) key->data;++	PRELOAD_DEC(k);++	for (; blocks-- > 0; in += 1, out += 1) {+		__m128i m = _mm_loadu_si128((__m128i *) in);+		DO_DEC_BLOCK(m);+		_mm_storeu_si128((__m128i *) out, m);+	}+}++void SIZED(aes_ni_encrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)+{+	__m128i *k = (__m128i *) key->data;+	__m128i iv = _mm_loadu_si128((__m128i *) _iv);++	PRELOAD_ENC(k);++	for (; blocks-- > 0; in += 1, out += 1) {+		__m128i m = _mm_loadu_si128((__m128i *) in);+		m = _mm_xor_si128(m, iv);+		DO_ENC_BLOCK(m);+		iv = m;+		_mm_storeu_si128((__m128i *) out, m);+	}+}++void SIZED(aes_ni_decrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)+{+	__m128i *k = (__m128i *) key->data;+	__m128i iv = _mm_loadu_si128((__m128i *) _iv);++	PRELOAD_DEC(k);++	for (; blocks-- > 0; in += 1, out += 1) {+		__m128i m = _mm_loadu_si128((__m128i *) in);+		__m128i ivnext = m;++		DO_DEC_BLOCK(m);+		m = _mm_xor_si128(m, iv);++		_mm_storeu_si128((__m128i *) out, m);+		iv = ivnext;+	}+}++void SIZED(aes_ni_encrypt_ctr)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)+{+	__m128i *k = (__m128i *) key->data;+	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);+	__m128i one        = _mm_set_epi32(0,1,0,0);+	uint32_t nb_blocks = len / 16;+	uint32_t part_block_len = len % 16;++	/* get the IV in little endian format */+	__m128i iv = _mm_loadu_si128((__m128i *) _iv);+	iv = _mm_shuffle_epi8(iv, bswap_mask);++	PRELOAD_ENC(k);++	for (; nb_blocks-- > 0; output += 16, input += 16) {+		/* put back the iv in big endian mode,+		 * encrypt it and and xor it the input block+		 */+		__m128i tmp = _mm_shuffle_epi8(iv, bswap_mask);+		DO_ENC_BLOCK(tmp);+		__m128i m = _mm_loadu_si128((__m128i *) input);+		m = _mm_xor_si128(m, tmp);++		_mm_storeu_si128((__m128i *) output, m);+		/* iv += 1 */+		iv = _mm_add_epi64(iv, one);+	}++	if (part_block_len != 0) {+		aes_block block;+		memset(&block.b, 0, 16);+		memcpy(&block.b, input, part_block_len);++		__m128i m = _mm_loadu_si128((__m128i *) &block);+		__m128i tmp = _mm_shuffle_epi8(iv, bswap_mask);++		DO_ENC_BLOCK(tmp);+		m = _mm_xor_si128(m, tmp);+		_mm_storeu_si128((__m128i *) &block.b, m);+		memcpy(output, &block.b, part_block_len);+	}++	return ;+}++void SIZED(aes_ni_encrypt_xts)(aes_block *out, aes_key *key1, aes_key *key2,+                               aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks)+{+	__m128i tweak = _mm_loadu_si128((__m128i *) _tweak);++	do {+		__m128i *k2 = (__m128i *) key2->data;+		PRELOAD_ENC(k2);+		DO_ENC_BLOCK(tweak);++		while (spoint-- > 0)+			tweak = gfmulx(tweak);+	} while (0) ;++	do {+		__m128i *k1 = (__m128i *) key1->data;+		PRELOAD_ENC(k1);++		for ( ; blocks-- > 0; in += 1, out += 1, tweak = gfmulx(tweak)) {+			__m128i m = _mm_loadu_si128((__m128i *) in);++			m = _mm_xor_si128(m, tweak);+			DO_ENC_BLOCK(m);+			m = _mm_xor_si128(m, tweak);++			_mm_storeu_si128((__m128i *) out, m);+		}+	} while (0);+}++void SIZED(aes_ni_gcm_encrypt)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	__m128i *k = (__m128i *) key->data;+	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);+	__m128i one        = _mm_set_epi32(0,1,0,0);+	uint32_t nb_blocks = length / 16;+	uint32_t part_block_len = length % 16;++	gcm->length_input += length;++	__m128i h  = _mm_loadu_si128((__m128i *) &gcm->h);+	__m128i tag = _mm_loadu_si128((__m128i *) &gcm->tag);+	__m128i iv = _mm_loadu_si128((__m128i *) &gcm->civ);+	iv = _mm_shuffle_epi8(iv, bswap_mask);++	PRELOAD_ENC(k);++	for (; nb_blocks-- > 0; output += 16, input += 16) {+		/* iv += 1 */+		iv = _mm_add_epi64(iv, one);++		/* put back iv in big endian, encrypt it,+		 * and xor it to input */+		__m128i tmp = _mm_shuffle_epi8(iv, bswap_mask);+		DO_ENC_BLOCK(tmp);+		__m128i m = _mm_loadu_si128((__m128i *) input);+		m = _mm_xor_si128(m, tmp);++		tag = ghash_add(tag, h, m);++		/* store it out */+		_mm_storeu_si128((__m128i *) output, m);+	}+	if (part_block_len > 0) {+		__m128i mask;+		aes_block block;+		/* FIXME could do something a bit more clever (slli & sub & and maybe) ... */+		switch (part_block_len) {+		case 1: mask = _mm_setr_epi8(0,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 2: mask = _mm_setr_epi8(0,1,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 3: mask = _mm_setr_epi8(0,1,2,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 4: mask = _mm_setr_epi8(0,1,2,3,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 5: mask = _mm_setr_epi8(0,1,2,3,4,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 6: mask = _mm_setr_epi8(0,1,2,3,4,5,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 7: mask = _mm_setr_epi8(0,1,2,3,4,5,6,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 8: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,0x80,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 9: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,0x80,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 10: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,0x80,0x80,0x80,0x80,0x80,0x80); break;+		case 11: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,0x80,0x80,0x80,0x80,0x80); break;+		case 12: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,11,0x80,0x80,0x80,0x80); break;+		case 13: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,11,12,0x80,0x80,0x80); break;+		case 14: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,11,12,13,0x80,0x80); break;+		case 15: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,0x80); break;+		default: mask = _mm_setr_epi8(0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15); break;+		}+		block128_zero(&block);+		block128_copy_bytes(&block, input, part_block_len);++		/* iv += 1 */+		iv = _mm_add_epi64(iv, one);++		/* put back iv in big endian mode, encrypt it and xor it with input */+		__m128i tmp = _mm_shuffle_epi8(iv, bswap_mask);+		DO_ENC_BLOCK(tmp);++		__m128i m = _mm_loadu_si128((__m128i *) &block);+		m = _mm_xor_si128(m, tmp);+		m = _mm_shuffle_epi8(m, mask);++		tag = ghash_add(tag, h, m);++		/* make output */+		_mm_storeu_si128((__m128i *) &block.b, m);+		memcpy(output, &block.b, part_block_len);+	}+	/* store back IV & tag */+	__m128i tmp = _mm_shuffle_epi8(iv, bswap_mask);+	_mm_storeu_si128((__m128i *) &gcm->civ, tmp);+	_mm_storeu_si128((__m128i *) &gcm->tag, tag);+}
+ cbits/cryptonite_aes.c view
@@ -0,0 +1,750 @@+/*+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>++#include <cryptonite_cpu.h>+#include <cryptonite_aes.h>+#include <cryptonite_bitfn.h>++#include <aes/generic.h>+#include <aes/gf.h>+#include <aes/x86ni.h>++void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);+void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);++enum {+	/* init */+	INIT_128, INIT_192, INIT_256,+	/* single block */+	ENCRYPT_BLOCK_128, ENCRYPT_BLOCK_192, ENCRYPT_BLOCK_256,+	DECRYPT_BLOCK_128, DECRYPT_BLOCK_192, DECRYPT_BLOCK_256,+	/* ecb */+	ENCRYPT_ECB_128, ENCRYPT_ECB_192, ENCRYPT_ECB_256,+	DECRYPT_ECB_128, DECRYPT_ECB_192, DECRYPT_ECB_256,+	/* cbc */+	ENCRYPT_CBC_128, ENCRYPT_CBC_192, ENCRYPT_CBC_256,+	DECRYPT_CBC_128, DECRYPT_CBC_192, DECRYPT_CBC_256,+	/* ctr */+	ENCRYPT_CTR_128, ENCRYPT_CTR_192, ENCRYPT_CTR_256,+	/* xts */+	ENCRYPT_XTS_128, ENCRYPT_XTS_192, ENCRYPT_XTS_256,+	DECRYPT_XTS_128, DECRYPT_XTS_192, DECRYPT_XTS_256,+	/* gcm */+	ENCRYPT_GCM_128, ENCRYPT_GCM_192, ENCRYPT_GCM_256,+	DECRYPT_GCM_128, DECRYPT_GCM_192, DECRYPT_GCM_256,+	/* ocb */+	ENCRYPT_OCB_128, ENCRYPT_OCB_192, ENCRYPT_OCB_256,+	DECRYPT_OCB_128, DECRYPT_OCB_192, DECRYPT_OCB_256,+};++void *cryptonite_aes_branch_table[] = {+	/* INIT */+	[INIT_128]          = cryptonite_aes_generic_init,+	[INIT_192]          = cryptonite_aes_generic_init,+	[INIT_256]          = cryptonite_aes_generic_init,+	/* BLOCK */+	[ENCRYPT_BLOCK_128] = cryptonite_aes_generic_encrypt_block,+	[ENCRYPT_BLOCK_192] = cryptonite_aes_generic_encrypt_block,+	[ENCRYPT_BLOCK_256] = cryptonite_aes_generic_encrypt_block,+	[DECRYPT_BLOCK_128] = cryptonite_aes_generic_decrypt_block,+	[DECRYPT_BLOCK_192] = cryptonite_aes_generic_decrypt_block,+	[DECRYPT_BLOCK_256] = cryptonite_aes_generic_decrypt_block,+	/* ECB */+	[ENCRYPT_ECB_128]   = cryptonite_aes_generic_encrypt_ecb,+	[ENCRYPT_ECB_192]   = cryptonite_aes_generic_encrypt_ecb,+	[ENCRYPT_ECB_256]   = cryptonite_aes_generic_encrypt_ecb,+	[DECRYPT_ECB_128]   = cryptonite_aes_generic_decrypt_ecb,+	[DECRYPT_ECB_192]   = cryptonite_aes_generic_decrypt_ecb,+	[DECRYPT_ECB_256]   = cryptonite_aes_generic_decrypt_ecb,+	/* CBC */+	[ENCRYPT_CBC_128]   = cryptonite_aes_generic_encrypt_cbc,+	[ENCRYPT_CBC_192]   = cryptonite_aes_generic_encrypt_cbc,+	[ENCRYPT_CBC_256]   = cryptonite_aes_generic_encrypt_cbc,+	[DECRYPT_CBC_128]   = cryptonite_aes_generic_decrypt_cbc,+	[DECRYPT_CBC_192]   = cryptonite_aes_generic_decrypt_cbc,+	[DECRYPT_CBC_256]   = cryptonite_aes_generic_decrypt_cbc,+	/* CTR */+	[ENCRYPT_CTR_128]   = cryptonite_aes_generic_encrypt_ctr,+	[ENCRYPT_CTR_192]   = cryptonite_aes_generic_encrypt_ctr,+	[ENCRYPT_CTR_256]   = cryptonite_aes_generic_encrypt_ctr,+	/* XTS */+	[ENCRYPT_XTS_128]   = cryptonite_aes_generic_encrypt_xts,+	[ENCRYPT_XTS_192]   = cryptonite_aes_generic_encrypt_xts,+	[ENCRYPT_XTS_256]   = cryptonite_aes_generic_encrypt_xts,+	[DECRYPT_XTS_128]   = cryptonite_aes_generic_decrypt_xts,+	[DECRYPT_XTS_192]   = cryptonite_aes_generic_decrypt_xts,+	[DECRYPT_XTS_256]   = cryptonite_aes_generic_decrypt_xts,+	/* GCM */+	[ENCRYPT_GCM_128]   = cryptonite_aes_generic_gcm_encrypt,+	[ENCRYPT_GCM_192]   = cryptonite_aes_generic_gcm_encrypt,+	[ENCRYPT_GCM_256]   = cryptonite_aes_generic_gcm_encrypt,+	[DECRYPT_GCM_128]   = cryptonite_aes_generic_gcm_decrypt,+	[DECRYPT_GCM_192]   = cryptonite_aes_generic_gcm_decrypt,+	[DECRYPT_GCM_256]   = cryptonite_aes_generic_gcm_decrypt,+	/* OCB */+	[ENCRYPT_OCB_128]   = cryptonite_aes_generic_ocb_encrypt,+	[ENCRYPT_OCB_192]   = cryptonite_aes_generic_ocb_encrypt,+	[ENCRYPT_OCB_256]   = cryptonite_aes_generic_ocb_encrypt,+	[DECRYPT_OCB_128]   = cryptonite_aes_generic_ocb_decrypt,+	[DECRYPT_OCB_192]   = cryptonite_aes_generic_ocb_decrypt,+	[DECRYPT_OCB_256]   = cryptonite_aes_generic_ocb_decrypt,+};++typedef void (*init_f)(aes_key *, uint8_t *, uint8_t);+typedef void (*ecb_f)(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+typedef void (*cbc_f)(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+typedef void (*ctr_f)(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);+typedef void (*xts_f)(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit, uint32_t spoint, aes_block *input, uint32_t nb_blocks);+typedef void (*gcm_crypt_f)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+typedef void (*ocb_crypt_f)(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+typedef void (*block_f)(aes_block *output, aes_key *key, aes_block *input);++#ifdef WITH_AESNI+#define GET_INIT(strength) \+	((init_f) (cryptonite_aes_branch_table[INIT_128 + strength]))+#define GET_ECB_ENCRYPT(strength) \+	((ecb_f) (cryptonite_aes_branch_table[ENCRYPT_ECB_128 + strength]))+#define GET_ECB_DECRYPT(strength) \+	((ecb_f) (cryptonite_aes_branch_table[DECRYPT_ECB_128 + strength]))+#define GET_CBC_ENCRYPT(strength) \+	((cbc_f) (cryptonite_aes_branch_table[ENCRYPT_CBC_128 + strength]))+#define GET_CBC_DECRYPT(strength) \+	((cbc_f) (cryptonite_aes_branch_table[DECRYPT_CBC_128 + strength]))+#define GET_CTR_ENCRYPT(strength) \+	((ctr_f) (cryptonite_aes_branch_table[ENCRYPT_CTR_128 + strength]))+#define GET_XTS_ENCRYPT(strength) \+	((xts_f) (cryptonite_aes_branch_table[ENCRYPT_XTS_128 + strength]))+#define GET_XTS_DECRYPT(strength) \+	((xts_f) (cryptonite_aes_branch_table[DECRYPT_XTS_128 + strength]))+#define GET_GCM_ENCRYPT(strength) \+	((gcm_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_GCM_128 + strength]))+#define GET_GCM_DECRYPT(strength) \+	((gcm_crypt_f) (cryptonite_aes_branch_table[DECRYPT_GCM_128 + strength]))+#define GET_OCB_ENCRYPT(strength) \+	((ocb_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_OCB_128 + strength]))+#define GET_OCB_DECRYPT(strength) \+	((ocb_crypt_f) (cryptonite_aes_branch_table[DECRYPT_OCB_128 + strength]))+#define cryptonite_aes_encrypt_block(o,k,i) \+	(((block_f) (cryptonite_aes_branch_table[ENCRYPT_BLOCK_128 + k->strength]))(o,k,i))+#define cryptonite_aes_decrypt_block(o,k,i) \+	(((block_f) (cryptonite_aes_branch_table[DECRYPT_BLOCK_128 + k->strength]))(o,k,i))+#else+#define GET_INIT(strenght) cryptonite_aes_generic_init+#define GET_ECB_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ecb+#define GET_ECB_DECRYPT(strength) cryptonite_aes_generic_decrypt_ecb+#define GET_CBC_ENCRYPT(strength) cryptonite_aes_generic_encrypt_cbc+#define GET_CBC_DECRYPT(strength) cryptonite_aes_generic_decrypt_cbc+#define GET_CTR_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ctr+#define GET_XTS_ENCRYPT(strength) cryptonite_aes_generic_encrypt_xts+#define GET_XTS_DECRYPT(strength) cryptonite_aes_generic_decrypt_xts+#define GET_GCM_ENCRYPT(strength) cryptonite_aes_generic_gcm_encrypt+#define GET_GCM_DECRYPT(strength) cryptonite_aes_generic_gcm_decrypt+#define GET_OCB_ENCRYPT(strength) cryptonite_aes_generic_ocb_encrypt+#define GET_OCB_DECRYPT(strength) cryptonite_aes_generic_ocb_decrypt+#define cryptonite_aes_encrypt_block(o,k,i) cryptonite_aes_generic_encrypt_block(o,k,i)+#define cryptonite_aes_decrypt_block(o,k,i) cryptonite_aes_generic_decrypt_block(o,k,i)+#endif++#if defined(ARCH_X86) && defined(WITH_AESNI)+static void initialize_table_ni(int aesni, int pclmul)+{+	if (!aesni)+		return;+	cryptonite_aes_branch_table[INIT_128] = aes_ni_init;+	cryptonite_aes_branch_table[INIT_256] = aes_ni_init;++	cryptonite_aes_branch_table[ENCRYPT_BLOCK_128] = aes_ni_encrypt_block128;+	cryptonite_aes_branch_table[DECRYPT_BLOCK_128] = aes_ni_decrypt_block128;+	cryptonite_aes_branch_table[ENCRYPT_BLOCK_256] = aes_ni_encrypt_block256;+	cryptonite_aes_branch_table[DECRYPT_BLOCK_256] = aes_ni_decrypt_block256;+	/* ECB */+	cryptonite_aes_branch_table[ENCRYPT_ECB_128] = aes_ni_encrypt_ecb128;+	cryptonite_aes_branch_table[DECRYPT_ECB_128] = aes_ni_decrypt_ecb128;+	cryptonite_aes_branch_table[ENCRYPT_ECB_256] = aes_ni_encrypt_ecb256;+	cryptonite_aes_branch_table[DECRYPT_ECB_256] = aes_ni_decrypt_ecb256;+	/* CBC */+	cryptonite_aes_branch_table[ENCRYPT_CBC_128] = aes_ni_encrypt_cbc128;+	cryptonite_aes_branch_table[DECRYPT_CBC_128] = aes_ni_decrypt_cbc128;+	cryptonite_aes_branch_table[ENCRYPT_CBC_256] = aes_ni_encrypt_cbc256;+	cryptonite_aes_branch_table[DECRYPT_CBC_256] = aes_ni_decrypt_cbc256;+	/* CTR */+	cryptonite_aes_branch_table[ENCRYPT_CTR_128] = aes_ni_encrypt_ctr128;+	cryptonite_aes_branch_table[ENCRYPT_CTR_256] = aes_ni_encrypt_ctr256;+	/* XTS */+	cryptonite_aes_branch_table[ENCRYPT_XTS_128] = aes_ni_encrypt_xts128;+	cryptonite_aes_branch_table[ENCRYPT_XTS_256] = aes_ni_encrypt_xts256;+	/* GCM */+	cryptonite_aes_branch_table[ENCRYPT_GCM_128] = aes_ni_gcm_encrypt128;+	cryptonite_aes_branch_table[ENCRYPT_GCM_256] = aes_ni_gcm_encrypt256;+	/* OCB */+	/*+	cryptonite_aes_branch_table[ENCRYPT_OCB_128] = aes_ni_ocb_encrypt128;+	cryptonite_aes_branch_table[ENCRYPT_OCB_256] = aes_ni_ocb_encrypt256;+	*/+}+#endif++void cryptonite_aes_initkey(aes_key *key, uint8_t *origkey, uint8_t size)+{+	switch (size) {+	case 16: key->nbr = 10; key->strength = 0; break;+	case 24: key->nbr = 12; key->strength = 1; break;+	case 32: key->nbr = 14; key->strength = 2; break;+	}+#if defined(ARCH_X86) && defined(WITH_AESNI)+	initialize_hw(initialize_table_ni);+#endif+	init_f _init = GET_INIT(key->strength);+	_init(key, origkey, size);+}++void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	ecb_f e = GET_ECB_ENCRYPT(key->strength);+	e(output, key, input, nb_blocks);+}++void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	ecb_f d = GET_ECB_DECRYPT(key->strength);+	d(output, key, input, nb_blocks);+}++void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	cbc_f e = GET_CBC_ENCRYPT(key->strength);+	e(output, key, iv, input, nb_blocks);+}++void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	cbc_f d = GET_CBC_DECRYPT(key->strength);+	d(output, key, iv, input, nb_blocks);+}++void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {+		cryptonite_aes_encrypt_block(output, key, &block);+	}+}++void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {+		cryptonite_aes_encrypt_block(output, key, &block);+	}++	/* copy back the IV */+	block128_copy(iv, &block);+}++void cryptonite_aes_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	ctr_f e = GET_CTR_ENCRYPT(key->strength);+	e(output, key, iv, input, len);+}++void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	xts_f e = GET_XTS_ENCRYPT(k1->strength);+	e(output, k1, k2, dataunit, spoint, input, nb_blocks);+}++void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	cryptonite_aes_generic_decrypt_xts(output, k1, k2, dataunit, spoint, input, nb_blocks);+}++void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	gcm_crypt_f e = GET_GCM_ENCRYPT(key->strength);+	e(output, gcm, key, input, length);+}++void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	gcm_crypt_f d = GET_GCM_DECRYPT(key->strength);+	d(output, gcm, key, input, length);+}++void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_crypt_f e = GET_OCB_ENCRYPT(key->strength);+	e(output, ocb, key, input, length);+}++void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_crypt_f d = GET_OCB_DECRYPT(key->strength);+	d(output, ocb, key, input, length);+}++static void gcm_ghash_add(aes_gcm *gcm, block128 *b)+{+	block128_xor(&gcm->tag, b);+	gf_mul(&gcm->tag, &gcm->h);+}++void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len)+{+	gcm->length_aad = 0;+	gcm->length_input = 0;++	block128_zero(&gcm->h);+	block128_zero(&gcm->tag);+	block128_zero(&gcm->iv);++	/* prepare H : encrypt_K(0^128) */+	cryptonite_aes_encrypt_block(&gcm->h, key, &gcm->h);++	if (len == 12) {+		block128_copy_bytes(&gcm->iv, iv, 12);+		gcm->iv.b[15] = 0x01;+	} else {+		uint32_t origlen = len << 3;+		int i;+		for (; len >= 16; len -= 16, iv += 16) {+			block128_xor(&gcm->iv, (block128 *) iv);+			gf_mul(&gcm->iv, &gcm->h);+		}+		if (len > 0) {+			block128_xor_bytes(&gcm->iv, iv, len);+			gf_mul(&gcm->iv, &gcm->h);+		}+		for (i = 15; origlen; --i, origlen >>= 8)+			gcm->iv.b[i] ^= (uint8_t) origlen;+		gf_mul(&gcm->iv, &gcm->h);+	}++	block128_copy(&gcm->civ, &gcm->iv);+}++void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length)+{+	gcm->length_aad += length;+	for (; length >= 16; input += 16, length -= 16) {+		gcm_ghash_add(gcm, (block128 *) input);+	}+	if (length > 0) {+		aes_block tmp;+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		gcm_ghash_add(gcm, &tmp);+	}++}++void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key)+{+	aes_block lblock;+	int i;++	/* tag = (tag-1 xor (lenbits(a) | lenbits(c)) ) . H */+	lblock.q[0] = cpu_to_be64(gcm->length_aad << 3);+	lblock.q[1] = cpu_to_be64(gcm->length_input << 3);+	gcm_ghash_add(gcm, &lblock);++	cryptonite_aes_encrypt_block(&lblock, key, &gcm->iv);+	block128_xor(&gcm->tag, &lblock);++	for (i = 0; i < 16; i++) {+		tag[i] = gcm->tag.b[i];+	}+}++static inline void ocb_block_double(block128 *d, block128 *s)+{+	unsigned int i;+	uint8_t tmp = s->b[0];++	for (i=0; i<15; i++)+		d->b[i] = (s->b[i] << 1) | (s->b[i+1] >> 7);+	d->b[15] = (s->b[15] << 1) ^ ((tmp >> 7) * 0x87);+}++static void ocb_get_L_i(block128 *l, block128 *lis, unsigned int i)+{+#define L_CACHED 4+	i = bitfn_ntz(i);+	if (i < L_CACHED) {+		block128_copy(l, &lis[i]);+	} else {+		i -= (L_CACHED - 1);+		block128_copy(l, &lis[L_CACHED - 1]);+		while (i--) {+			ocb_block_double(l, l);+		}+	}+#undef L_CACHED+}++void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)+{+	block128 tmp, nonce, ktop;+	unsigned char stretch[24];+	unsigned bottom, byteshift, bitshift, i;++	/* we don't accept more than 15 bytes, any bytes higher will be ignored. */+	if (len > 15) {+		len = 15;+	}++	/* create L*, and L$,L0,L1,L2,L3 */+	block128_zero(&tmp);+	cryptonite_aes_encrypt_block(&ocb->lstar, key, &tmp);++	ocb_block_double(&ocb->ldollar, &ocb->lstar);+	ocb_block_double(&ocb->li[0], &ocb->ldollar);+	ocb_block_double(&ocb->li[1], &ocb->li[0]);+	ocb_block_double(&ocb->li[2], &ocb->li[1]);+	ocb_block_double(&ocb->li[3], &ocb->li[2]);++	/* create strech from the nonce */+	block128_zero(&nonce);+	memcpy(nonce.b + 4, iv, 12);+	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);+	nonce.b[16-12-1] |= 0x01;+	bottom = nonce.b[15] & 0x3F;+	nonce.b[15] &= 0xC0;+	cryptonite_aes_encrypt_block(&ktop, key, &nonce);+	memcpy(stretch, ktop.b, 16);++	memcpy(tmp.b, ktop.b + 1, 8);+	block128_xor(&tmp, &ktop);+	memcpy(stretch + 16, tmp.b, 8);++	/* initialize the encryption offset from stretch */+	byteshift = bottom / 8;+	bitshift = bottom % 8;+	if (bitshift != 0)+		for (i = 0; i < 16; i++)+			ocb->offset_enc.b[i] = (stretch[i+byteshift] << bitshift)+			                     | (stretch[i+byteshift+1] >> (8-bitshift));+	else+		for (i = 0; i < 16; i++)+			ocb->offset_enc.b[i] = stretch[i+byteshift];+	/* initialize checksum for aad and encryption, and the aad offset */+	block128_zero(&ocb->sum_aad);+	block128_zero(&ocb->sum_enc);+	block128_zero(&ocb->offset_aad);+}++void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	block128 tmp;+	unsigned int i;++	for (i=1; i<= length/16; i++, input=input+16) {+		ocb_get_L_i(&tmp, ocb->li, i);+		block128_xor(&ocb->offset_aad, &tmp);++		block128_vxor(&tmp, &ocb->offset_aad, (block128 *) input);+		cryptonite_aes_encrypt_block(&tmp, key, &tmp);+		block128_xor(&ocb->sum_aad, &tmp);+	}++	length = length % 16; /* Bytes in final block */+	if (length > 0) {+		block128_xor(&ocb->offset_aad, &ocb->lstar);+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		tmp.b[length] = 0x80;+		block128_xor(&tmp, &ocb->offset_aad);+		cryptonite_aes_encrypt_block(&tmp, key, &tmp);+		block128_xor(&ocb->sum_aad, &tmp);+	}+}++void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key)+{+	block128 tmp;++	block128_vxor(&tmp, &ocb->sum_enc, &ocb->offset_enc);+	block128_xor(&tmp, &ocb->ldollar);+	cryptonite_aes_encrypt_block((block128 *) tag, key, &tmp);+	block128_xor((block128 *) tag, &ocb->sum_aad);+}++void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	for ( ; nb_blocks-- > 0; input++, output++) {+		cryptonite_aes_generic_encrypt_block(output, key, input);+	}+}++void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)+{+	for ( ; nb_blocks-- > 0; input++, output++) {+		cryptonite_aes_generic_decrypt_block(output, key, input);+	}+}++void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)+{+	aes_block block;++	/* preload IV in block */+	block128_copy(&block, iv);+	for ( ; nb_blocks-- > 0; input++, output++) {+		block128_xor(&block, (block128 *) input);+		cryptonite_aes_generic_encrypt_block(&block, key, &block);+		block128_copy((block128 *) output, &block);+	}+}++void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *ivini, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, blocko;+	aes_block iv;++	/* preload IV in block */+	block128_copy(&iv, ivini);+	for ( ; nb_blocks-- > 0; input++, output++) {+		block128_copy(&block, (block128 *) input);+		cryptonite_aes_generic_decrypt_block(&blocko, key, &block);+		block128_vxor((block128 *) output, &blocko, &iv);+		block128_copy(&iv, &block);+	}+}++void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)+{+	aes_block block, o;+	uint32_t nb_blocks = len / 16;+	int i;++	/* preload IV in block */+	block128_copy(&block, iv);++	for ( ; nb_blocks-- > 0; block128_inc_be(&block), output += 16, input += 16) {+		cryptonite_aes_encrypt_block(&o, key, &block);+		block128_vxor((block128 *) output, &o, (block128 *) input);+	}++	if ((len % 16) != 0) {+		cryptonite_aes_encrypt_block(&o, key, &block);+		for (i = 0; i < (len % 16); i++) {+			*output = ((uint8_t *) &o)[i] ^ *input;+			output++;+			input++;+		}+	}+}++void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, tweak;++	/* load IV and encrypt it using k2 as the tweak */+	block128_copy(&tweak, dataunit);+	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);++	/* TO OPTIMISE: this is really inefficient way to do that */+	while (spoint-- > 0)+		gf_mulx(&tweak);++	for ( ; nb_blocks-- > 0; input++, output++, gf_mulx(&tweak)) {+		block128_vxor(&block, input, &tweak);+		cryptonite_aes_encrypt_block(&block, k1, &block);+		block128_vxor(output, &block, &tweak);+	}+}++void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)+{+	aes_block block, tweak;++	/* load IV and encrypt it using k2 as the tweak */+	block128_copy(&tweak, dataunit);+	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);++	/* TO OPTIMISE: this is really inefficient way to do that */+	while (spoint-- > 0)+		gf_mulx(&tweak);++	for ( ; nb_blocks-- > 0; input++, output++, gf_mulx(&tweak)) {+		block128_vxor(&block, input, &tweak);+		cryptonite_aes_decrypt_block(&block, k1, &block);+		block128_vxor(output, &block, &tweak);+	}+}++void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	aes_block out;++	gcm->length_input += length;+	for (; length >= 16; input += 16, output += 16, length -= 16) {+		block128_inc_be(&gcm->civ);++		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);+		block128_xor(&out, (block128 *) input);+		gcm_ghash_add(gcm, &out);+		block128_copy((block128 *) output, &out);+	}+	if (length > 0) {+		aes_block tmp;+		int i;++		block128_inc_be(&gcm->civ);+		/* create e(civ) in out */+		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);+		/* initialize a tmp as input and xor it to e(civ) */+		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		block128_xor_bytes(&tmp, out.b, length);++		gcm_ghash_add(gcm, &tmp);++		for (i = 0; i < length; i++) {+			output[i] = tmp.b[i];+		}+	}+}++void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)+{+	aes_block out;++	gcm->length_input += length;+	for (; length >= 16; input += 16, output += 16, length -= 16) {+		block128_inc_be(&gcm->civ);++		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);+		gcm_ghash_add(gcm, (block128 *) input);+		block128_xor(&out, (block128 *) input);+		block128_copy((block128 *) output, &out);+	}+	if (length > 0) {+		aes_block tmp;+		int i;++		block128_inc_be(&gcm->civ);++		block128_zero(&tmp);+		block128_copy_bytes(&tmp, input, length);+		gcm_ghash_add(gcm, &tmp);++		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);+		block128_xor_bytes(&tmp, out.b, length);++		for (i = 0; i < length; i++) {+			output[i] = tmp.b[i];+		}+	}+}++static void ocb_generic_crypt(uint8_t *output, aes_ocb *ocb, aes_key *key,+                              uint8_t *input, uint32_t length, int encrypt)+{+	block128 tmp, pad;+	unsigned int i;++	for (i = 1; i <= length/16; i++, input += 16, output += 16) {+		/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */+		ocb_get_L_i(&tmp, ocb->li, i);+		block128_xor(&ocb->offset_enc, &tmp);++		block128_vxor(&tmp, &ocb->offset_enc, (block128 *) input);+		if (encrypt) {+			cryptonite_aes_encrypt_block(&tmp, key, &tmp);+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);+			block128_xor(&ocb->sum_enc, (block128 *) input);+		} else {+			cryptonite_aes_decrypt_block(&tmp, key, &tmp);+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);+			block128_xor(&ocb->sum_enc, (block128 *) output);+		}+	}++	/* process the last partial block if any */+	length = length % 16;+	if (length > 0) {+		block128_xor(&ocb->offset_enc, &ocb->lstar);+		cryptonite_aes_encrypt_block(&pad, key, &ocb->offset_enc);++		if (encrypt) {+			block128_zero(&tmp);+			block128_copy_bytes(&tmp, input, length);+			tmp.b[length] = 0x80;+			block128_xor(&ocb->sum_enc, &tmp);+			block128_xor(&pad, &tmp);+			memcpy(output, pad.b, length);+			output += length;+		} else {+			block128_copy(&tmp, &pad);+			block128_copy_bytes(&tmp, input, length);+			block128_xor(&tmp, &pad);+			tmp.b[length] = 0x80;+			memcpy(output, tmp.b, length);+			block128_xor(&ocb->sum_enc, &tmp);+			input += length;+		}+	}+}++void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_generic_crypt(output, ocb, key, input, length, 1);+}++void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)+{+	ocb_generic_crypt(output, ocb, key, input, length, 0);+}
+ cbits/cryptonite_aes.h view
@@ -0,0 +1,100 @@+/*+ *	Copyright (C) 2008 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ * AES implementation+ */+#ifndef CRYPTONITE_AES_H+#define CRYPTONITE_AES_H++#include <stdint.h>+#include "aes/block128.h"++typedef block128 aes_block;++/* size = 456 */+typedef struct {+	uint8_t nbr; /* number of rounds: 10 (128), 12 (192), 14 (256) */+	uint8_t strength; /* 128 = 0, 192 = 1, 256 = 2 */+	uint8_t _padding[6];+	uint8_t data[16*14*2];+} aes_key;++/* size = 4*16+2*8= 80 */+typedef struct {+	aes_block tag;+	aes_block h;+	aes_block iv;+	aes_block civ;+	uint64_t length_aad;+	uint64_t length_input;+} aes_gcm;++typedef struct {+	block128 offset_aad;+	block128 offset_enc;+	block128 sum_aad;+	block128 sum_enc;+	block128 lstar;+	block128 ldollar;+	block128 li[4];+} aes_ocb;++/* in bytes: either 16,24,32 */+void cryptonite_aes_initkey(aes_key *ctx, uint8_t *key, uint8_t size);++void cryptonite_aes_encrypt(aes_block *output, aes_key *key, aes_block *input);+void cryptonite_aes_decrypt(aes_block *output, aes_key *key, aes_block *input);++void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);++void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);++void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks);+void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks);++void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);+void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);++void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len);+void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length);+void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key);++void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);+void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);+void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key);++#endif
+ cbits/cryptonite_bitfn.h view
@@ -0,0 +1,251 @@+/*+ * Copyright (C) 2006-2014 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef BITFN_H+#define BITFN_H+#include <stdint.h>++#ifndef NO_INLINE_ASM+/**********************************************************/+# if (defined(__i386__))+#  define ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}+/**********************************************************/+# elif (defined(__arm__))+#  define ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	uint32_t tmp = a;+	asm volatile ("eor %1, %0, %0, ror #16\n"+	              "bic %1, %1, #0xff0000\n"+	              "mov %0, %0, ror #8\n"+	              "eor %0, %0, %1, lsr #8\n"+	             : "=r" (a), "=r" (tmp) : "0" (a), "1" (tmp));+	return a;+}+/**********************************************************/+# elif defined(__x86_64__)+#  define ARCH_HAS_SWAP32+#  define ARCH_HAS_SWAP64+static inline uint32_t bitfn_swap32(uint32_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}++static inline uint64_t bitfn_swap64(uint64_t a)+{+	asm ("bswap %0" : "=r" (a) : "0" (a));+	return a;+}++# endif+#endif /* NO_INLINE_ASM */+/**********************************************************/++#ifndef ARCH_HAS_ROL32+static inline uint32_t rol32(uint32_t word, uint32_t shift)+{+	return (word << shift) | (word >> (32 - shift));+}+#endif++#ifndef ARCH_HAS_ROR32+static inline uint32_t ror32(uint32_t word, uint32_t shift)+{+	return (word >> shift) | (word << (32 - shift));+}+#endif++#ifndef ARCH_HAS_ROL64+static inline uint64_t rol64(uint64_t word, uint32_t shift)+{+	return (word << shift) | (word >> (64 - shift));+}+#endif++#ifndef ARCH_HAS_ROR64+static inline uint64_t ror64(uint64_t word, uint32_t shift)+{+	return (word >> shift) | (word << (64 - shift));+}+#endif++#ifndef ARCH_HAS_SWAP32+static inline uint32_t bitfn_swap32(uint32_t a)+{+	return (a << 24) | ((a & 0xff00) << 8) | ((a >> 8) & 0xff00) | (a >> 24);+}+#endif++#ifndef ARCH_HAS_ARRAY_SWAP32+static inline void array_swap32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--)+		*d++ = bitfn_swap32(*s++);+}+#endif++#ifndef ARCH_HAS_SWAP64+static inline uint64_t bitfn_swap64(uint64_t a)+{+	return ((uint64_t) bitfn_swap32((uint32_t) (a >> 32))) |+	       (((uint64_t) bitfn_swap32((uint32_t) a)) << 32);+}+#endif++#ifndef ARCH_HAS_ARRAY_SWAP64+static inline void array_swap64(uint64_t *d, uint64_t *s, uint32_t nb)+{+	while (nb--)+		*d++ = bitfn_swap64(*s++);+}+#endif++#ifndef ARCH_HAS_MEMORY_ZERO+static inline void memory_zero(void *ptr, uint32_t len)+{+	uint32_t *ptr32 = ptr;+	uint8_t *ptr8;+	int i;++	for (i = 0; i < len / 4; i++)+		*ptr32++ = 0;+	if (len % 4) {+		ptr8 = (uint8_t *) ptr32;+		for (i = len % 4; i >= 0; i--)+			ptr8[i] = 0;+	}+}+#endif++#ifndef ARCH_HAS_ARRAY_COPY32+static inline void array_copy32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--) *d++ = *s++;+}+#endif++#ifndef ARCH_HAS_ARRAY_XOR32+static inline void array_xor32(uint32_t *d, uint32_t *s, uint32_t nb)+{+	while (nb--) *d++ ^= *s++;+}+#endif++#ifndef ARCH_HAS_ARRAY_COPY64+static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb)+{+	while (nb--) *d++ = *s++;+}+#endif++#ifdef __GNUC__+#define bitfn_ntz(n) __builtin_ctz(n)+#else+#error "define ntz for your platform"+#endif++#ifdef __MINGW32__+  # define LITTLE_ENDIAN 1234+  # define BYTE_ORDER    LITTLE_ENDIAN+#elif defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)+  # include <sys/endian.h>+#elif defined(__OpenBSD__) || defined(__SVR4)+  # include <sys/types.h>+#elif defined(__APPLE__)+  # include <machine/endian.h>+#elif defined( BSD ) && ( BSD >= 199103 )+  # include <machine/endian.h>+#elif defined( __QNXNTO__ ) && defined( __LITTLEENDIAN__ )+  # define LITTLE_ENDIAN 1234+  # define BYTE_ORDER    LITTLE_ENDIAN+#elif defined( __QNXNTO__ ) && defined( __BIGENDIAN__ )+  # define BIG_ENDIAN 1234+  # define BYTE_ORDER    BIG_ENDIAN+#else+  # include <endian.h>+#endif+/* big endian to cpu */+#if LITTLE_ENDIAN == BYTE_ORDER++# define be32_to_cpu(a) bitfn_swap32(a)+# define cpu_to_be32(a) bitfn_swap32(a)+# define le32_to_cpu(a) (a)+# define cpu_to_le32(a) (a)+# define be64_to_cpu(a) bitfn_swap64(a)+# define cpu_to_be64(a) bitfn_swap64(a)+# define le64_to_cpu(a) (a)+# define cpu_to_le64(a) (a)++# define cpu_to_le32_array(d, s, l) array_copy32(d, s, l)+# define le32_to_cpu_array(d, s, l) array_copy32(d, s, l)+# define cpu_to_be32_array(d, s, l) array_swap32(d, s, l)+# define be32_to_cpu_array(d, s, l) array_swap32(d, s, l)++# define cpu_to_le64_array(d, s, l) array_copy64(d, s, l)+# define le64_to_cpu_array(d, s, l) array_copy64(d, s, l)+# define cpu_to_be64_array(d, s, l) array_swap64(d, s, l)+# define be64_to_cpu_array(d, s, l) array_swap64(d, s, l)++# define ror32_be(a, s) rol32(a, s)+# define rol32_be(a, s) ror32(a, s)++# define ARCH_IS_LITTLE_ENDIAN++#elif BIG_ENDIAN == BYTE_ORDER++# define be32_to_cpu(a) (a)+# define cpu_to_be32(a) (a)+# define be64_to_cpu(a) (a)+# define cpu_to_be64(a) (a)+# define le64_to_cpu(a) bitfn_swap64(a)+# define cpu_to_le64(a) bitfn_swap64(a)+# define le32_to_cpu(a) bitfn_swap32(a)+# define cpu_to_le32(a) bitfn_swap32(a)++# define cpu_to_le32_array(d, s, l) array_swap32(d, s, l)+# define le32_to_cpu_array(d, s, l) array_swap32(d, s, l)+# define cpu_to_be32_array(d, s, l) array_copy32(d, s, l)+# define be32_to_cpu_array(d, s, l) array_copy32(d, s, l)++# define cpu_to_le64_array(d, s, l) array_swap64(d, s, l)+# define le64_to_cpu_array(d, s, l) array_swap64(d, s, l)+# define cpu_to_be64_array(d, s, l) array_copy64(d, s, l)+# define be64_to_cpu_array(d, s, l) array_copy64(d, s, l)++# define ror32_be(a, s) ror32(a, s)+# define rol32_be(a, s) rol32(a, s)++# define ARCH_IS_BIG_ENDIAN++#else+# error "endian not supported"+#endif++#endif /* !BITFN_H */
+ cbits/cryptonite_chacha.c view
@@ -0,0 +1,291 @@+/*+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include "cryptonite_chacha.h"+#include "cryptonite_bitfn.h"+#include <stdio.h>++#define QR(a,b,c,d) \+	a += b; d = rol32(d ^ a,16); \+	c += d; b = rol32(b ^ c,12); \+	a += b; d = rol32(d ^ a, 8); \+	c += d; b = rol32(b ^ c, 7);++#define ALIGNED64(PTR) \+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)++static const uint8_t sigma[16] = "expand 32-byte k";+static const uint8_t tau[16] = "expand 16-byte k";++static inline uint32_t load32(const uint8_t *p)+{+	return le32_to_cpu(*((uint32_t *) p));+}++static void chacha_core(int rounds, block *out, const cryptonite_chacha_state *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];++	for (i = rounds; i > 0; i -= 2) {+		QR(x0, x4, x8, x12);+		QR(x1, x5, x9, x13);+		QR(x2, x6, x10, x14);+		QR(x3, x7, x11, x15);++		QR(x0, x5, x10, x15);+		QR(x1, x6, x11, x12);+		QR(x2, x7, x8, x13);+		QR(x3, x4, x9, x14);+	}++	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];++	out->d[0] = cpu_to_le32(x0);+	out->d[1] = cpu_to_le32(x1);+	out->d[2] = cpu_to_le32(x2);+	out->d[3] = cpu_to_le32(x3);+	out->d[4] = cpu_to_le32(x4);+	out->d[5] = cpu_to_le32(x5);+	out->d[6] = cpu_to_le32(x6);+	out->d[7] = cpu_to_le32(x7);+	out->d[8] = cpu_to_le32(x8);+	out->d[9] = cpu_to_le32(x9);+	out->d[10] = cpu_to_le32(x10);+	out->d[11] = cpu_to_le32(x11);+	out->d[12] = cpu_to_le32(x12);+	out->d[13] = cpu_to_le32(x13);+	out->d[14] = cpu_to_le32(x14);+	out->d[15] = cpu_to_le32(x15);+}++/* only 2 valids values are 256 (32) and 128 (16) */+void cryptonite_chacha_init_core(cryptonite_chacha_state *st,+                                 uint32_t keylen, const uint8_t *key,+                                 uint32_t ivlen, const uint8_t *iv)+{+	const uint8_t *constants = (keylen == 32) ? sigma : tau;+	int i;++	st->d[0] = load32(constants + 0);+	st->d[1] = load32(constants + 4);+	st->d[2] = load32(constants + 8);+	st->d[3] = load32(constants + 12);++	st->d[4] = load32(key + 0);+	st->d[5] = load32(key + 4);+	st->d[6] = load32(key + 8);+	st->d[7] = load32(key + 12);+	/* we repeat the key on 128 bits */+	if (keylen == 32)+		key += 16;+	st->d[8] = load32(key + 0);+	st->d[9] = load32(key + 4);+	st->d[10] = load32(key + 8);+	st->d[11] = load32(key + 12);+	st->d[12] = 0;+	switch (ivlen) {+	case 8:+		st->d[13] = 0;+		st->d[14] = load32(iv + 0);+		st->d[15] = load32(iv + 4);+		break;+	case 12:+		st->d[13] = load32(iv + 0);+		st->d[14] = load32(iv + 4);+		st->d[15] = load32(iv + 8);+	default:+		return;+	}+}++void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds,+                            uint32_t keylen, const uint8_t *key,+                            uint32_t ivlen, const uint8_t *iv)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->nb_rounds = nb_rounds;+	cryptonite_chacha_init_core(&ctx->st, keylen, key, ivlen, iv);+}++void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *ctx, const uint8_t *src, uint32_t bytes)+{+	block out;+	cryptonite_chacha_state *st;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		src += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	/* xor new 64-bytes chunks and store the left over if any */+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		for (i = 0; i < 64; ++i)+			dst[i] = src[i] ^ out.b[i];+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = src[i] ^ out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++) {+			ctx->prev[i] = out.b[i];+		}+	}+}++void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *ctx, uint32_t bytes)+{+	cryptonite_chacha_state *st;+	block out;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	if (ALIGNED64(dst)) {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			chacha_core(ctx->nb_rounds, (block *) dst, st);+			st->d[12] += 1;+			if (st->d[12] == 0)+				st->d[13] += 1;+		}+	} else {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			chacha_core(ctx->nb_rounds, &out, st);+			st->d[12] += 1;+			if (st->d[12] == 0)+				st->d[13] += 1;++			for (i = 0; i < 64; ++i)+				dst[i] = out.b[i];+		}+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		chacha_core(ctx->nb_rounds, &out, st);+		st->d[12] += 1;+		if (st->d[12] == 0)+			st->d[13] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++)+			ctx->prev[i] = out.b[i];+	}+}++void cryptonite_chacha_random(uint32_t rounds, uint8_t *dst, cryptonite_chacha_state *st, uint32_t bytes)+{+	block out;++	if (!bytes)+		return;+	for (; bytes >= 16; bytes -= 16, dst += 16) {+		chacha_core(rounds, &out, st);+		memcpy(dst, out.b + 40, 16);+		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);+	}+	if (bytes) {+		chacha_core(rounds, &out, st);+		memcpy(dst, out.b + 40, bytes);+		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);+	}+}
+ cbits/cryptonite_chacha.h view
@@ -0,0 +1,54 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTONITE_CHACHA+#define CRYPTONITE_CHACHA++typedef union {+	uint64_t q[8];+	uint32_t d[16];+	uint8_t  b[64];+} block;++typedef block cryptonite_chacha_state;++typedef struct {+	cryptonite_chacha_state st;+	uint8_t prev[64];+	uint8_t prev_ofs;+	uint8_t prev_len;+	uint8_t nb_rounds;+} cryptonite_chacha_context;++void cryptonite_chacha_init_core(cryptonite_chacha_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *st, const uint8_t *src, uint32_t bytes);+void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *st, uint32_t bytes);++#endif
+ cbits/cryptonite_cpu.c view
@@ -0,0 +1,75 @@+/*+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ */+#include "cryptonite_cpu.h"+#include <stdint.h>++#ifdef ARCH_X86+static void cpuid(uint32_t info, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)+{+	*eax = info;+	asm volatile+		(+#ifdef __x86_64__+		 "mov %%rbx, %%rdi;"+#else+		 "mov %%ebx, %%edi;"+#endif+		 "cpuid;"+		 "mov %%ebx, %%esi;"+#ifdef __x86_64__+		 "mov %%rdi, %%rbx;"+#else+		 "mov %%edi, %%ebx;"+#endif+		 :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)+		 : :"edi");+}++#ifdef USE_AESNI+void initialize_hw(void (*init_table)(int, int))+{+	static int inited = 0;+	if (inited == 0) {+		uint32_t eax, ebx, ecx, edx;+		int aesni, pclmul;++		inited = 1;+		cpuid(1, &eax, &ebx, &ecx, &edx);+		aesni = (ecx & 0x02000000);+		pclmul = (ecx & 0x00000001);+		init_table(aesni, pclmul);+	}+}+#else+#define initialize_hw(init_table) 	(0)+#endif++#endif
+ cbits/cryptonite_cpu.h view
@@ -0,0 +1,45 @@+/*+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ */+#ifndef CPU_H+#define CPU_H++#if defined(__i386__) || defined(__x86_64__)+#define ARCH_X86+#define USE_AESNI+#endif++#ifdef USE_AESNI+void initialize_hw(void (*init_table)(int, int));+#else+#define initialize_hw(init_table) 	(0)+#endif++#endif
+ cbits/cryptonite_curve25519.h view
@@ -0,0 +1,6 @@+#ifndef CRYPTONITE_CURVE25519_H+#define CRYPTONITE_CURVE25519_H++int cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint);++#endif
+ cbits/cryptonite_kekkak.c view
@@ -0,0 +1,159 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_kekkak.h"++#define KECCAK_NB_ROUNDS 24++/* rounds constants */+static const uint64_t keccak_rndc[24] =+{+	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,+	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,+	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,+	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,+	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,+	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,+	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,+	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,+};++/* triangular numbers constants */+static const int keccak_rotc[24] =+	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };++static const int keccak_piln[24] =+	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };++static inline void kekkak_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)+{+	int i, j, r;+	uint64_t tmp, bc[5];++	/* merge buf with state */+	for (i = 0; i < bufsz; i++)+		state[i] ^= le64_to_cpu(buf[i]);++	/* run keccak rounds */+	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {+		/* compute the parity of each columns */+		for (i = 0; i < 5; i++)+			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];++		for (i = 0; i < 5; i++) {+			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);+			for (j = 0; j < 25; j += 5)+				state[j + i] ^= tmp;+		}++		/* rho pi */+		tmp = state[1];+		for (i = 0; i < 24; i++) {+			j = keccak_piln[i];+			bc[0] = state[j];+			state[j] = rol64(tmp, keccak_rotc[i]);+			tmp = bc[0];+		}++		/* bitwise combine along rows using a = a xor (not b and c) */+		for (j = 0; j < 25; j += 5) {+			for (i = 0; i < 5; i++)+				bc[i] = state[j + i];+			#define andn(b,c) (~(b) & (c))+			state[j + 0] ^= andn(bc[1], bc[2]);+			state[j + 1] ^= andn(bc[2], bc[3]);+			state[j + 2] ^= andn(bc[3], bc[4]);+			state[j + 3] ^= andn(bc[4], bc[0]);+			state[j + 4] ^= andn(bc[0], bc[1]);+			#undef andn+		}++		/* xor the round constant */+		state[0] ^= keccak_rndc[r];+	}+}++void cryptonite_kekkak_init(struct kekkak_ctx *ctx, uint32_t hashlen)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->hashlen = hashlen / 8;+	ctx->bufsz = 200 - 2 * ctx->hashlen;+}++void cryptonite_kekkak_update(struct kekkak_ctx *ctx, uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	to_fill = ctx->bufsz - ctx->bufindex;++	if (ctx->bufindex == ctx->bufsz) {+		kekkak_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block */+	if (ctx->bufindex && len >= to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		kekkak_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	/* process as much ctx->bufsz-block */+	for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)+		kekkak_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void cryptonite_kekkak_finalize(struct kekkak_ctx *ctx, uint8_t *out)+{+	uint64_t w[25];++	/* process full buffer if needed */+	if (ctx->bufindex == ctx->bufsz) {+		kekkak_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* add the 10*1 padding */+	ctx->buf[ctx->bufindex++] = 1;+	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);+	ctx->buf[ctx->bufsz - 1] |= 0x80;++	/* process */+	kekkak_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);++	/* output */+	cpu_to_le64_array(w, ctx->state, 25);+	memcpy(out, w, ctx->hashlen);+}
+ cbits/cryptonite_kekkak.h view
@@ -0,0 +1,45 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA3_H+#define CRYPTOHASH_SHA3_H++#include <stdint.h>++struct kekkak_ctx+{+	uint32_t hashlen; /* in bytes */+	uint32_t bufindex;+	uint64_t state[25];+	uint32_t bufsz;+	uint32_t _padding;+	uint8_t  buf[144]; /* minimum SHA3-224, otherwise buffer need increases */+};++#define SHA3_CTX_SIZE		sizeof(struct kekkak_ctx)++void cryptonite_kekkak_init(struct kekkak_ctx *ctx, uint32_t hashlen);+void cryptonite_kekkak_update(struct kekkak_ctx *ctx, uint8_t *data, uint32_t len);+void cryptonite_kekkak_finalize(struct kekkak_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_md2.c view
@@ -0,0 +1,136 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_md2.h"++void cryptonite_md2_init(struct md2_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->sz = 0ULL;+}++static uint8_t S_table[]  = {+	0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, +	0x62, 0xA7, 0x05, 0xF3, 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, 0x82, 0xCA, +	0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, +	0xBE, 0x4E, 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, 0xBB, 0x2F, 0xEE, 0x7A, +	0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21,+	0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, +	0xFF, 0x19, 0x30, 0xB3, 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, 0xAA, 0xC6, +	0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, +	0x45, 0x9D, 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, 0xE6, 0x2D, 0xA8, 0x02, +	0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, +	0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, +	0x2C, 0x53, 0x0D, 0x6E, 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, 0x4D, 0x52, +	0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, +	0x78, 0x88, 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, 0x3B, 0x00, 0x1D, 0x39, +	0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, +	0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14+};++#define UBYTES(s) ((uint8_t *) s)+static uint8_t *padding_table[] = {+	UBYTES(""),+	UBYTES("\x1"),+	UBYTES("\x2\x2"),+	UBYTES("\x3\x3\x3"),+	UBYTES("\x4\x4\x4\x4"),+	UBYTES("\x5\x5\x5\x5\x5"),+	UBYTES("\x6\x6\x6\x6\x6\x6"),+	UBYTES("\x7\x7\x7\x7\x7\x7\x7"),+	UBYTES("\x8\x8\x8\x8\x8\x8\x8\x8"),+	UBYTES("\x9\x9\x9\x9\x9\x9\x9\x9\x9"),+	UBYTES("\xa\xa\xa\xa\xa\xa\xa\xa\xa\xa"),+	UBYTES("\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb"),+	UBYTES("\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc"),+	UBYTES("\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd"),+	UBYTES("\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe"),+	UBYTES("\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf"),+	UBYTES("\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10")+};++static void md2_do_chunk(struct md2_ctx *ctx, const uint8_t *buf)+{+	uint8_t i, j, t;+	uint8_t x[48];++	memcpy(x, ctx->h, 16);+	memcpy(x+16, buf, 16);++	for (i = 0; i < 16; i++)+		x[i+32] = ctx->h[i] ^ buf[i];++	for (t = i = 0; i < 18; i++) {+		for (j = 0; j < 48; j++)+			t = x[j] ^= S_table[t];+		t = (t + i) & 0xff;+	}++	memcpy(ctx->h, x, 16);++	t = ctx->cksum[15];+	for (i = 0; i < 16; i++)+		t = ctx->cksum[i] ^= S_table[buf[i] ^ t];+}++void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0xf);+	to_fill = 16 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md2_do_chunk(ctx, ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 16-block as possible */+	for (; len >= 16; len -= 16, data += 16)+		md2_do_chunk(ctx, data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out)+{+	uint32_t index, padlen;++	index = ctx->sz & 0xf;+	padlen = 16 - index;++	cryptonite_md2_update(ctx, padding_table[padlen], padlen);+	cryptonite_md2_update(ctx, ctx->cksum, 16);+	memcpy(out, ctx->h, 16);+}
+ cbits/cryptonite_md2.h view
@@ -0,0 +1,44 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD2_H+#define CRYPTOHASH_MD2_H++#include <stdint.h>++struct md2_ctx+{+	uint64_t sz;+	uint8_t  buf[16];+	uint8_t  h[16];+	uint8_t  cksum[16];+};++#define MD2_DIGEST_SIZE		16+#define MD2_CTX_SIZE		sizeof(struct md2_ctx)++void cryptonite_md2_init(struct md2_ctx *ctx);+void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_md4.c view
@@ -0,0 +1,161 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_md4.h"++void cryptonite_md4_init(struct md4_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->sz = 0ULL;+	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+}++#define f1(x, y, z)	((x & y) | ((~x) & z))+#define f2(x, y, z)	((x & y) | (x & z) | (y & z))+#define f3(x, y, z)	(x ^ y ^ z)++#define K1 	0x00000000+#define K2 	0x5A827999+#define K3 	0x6ED9EBA1+#define R(a,b,c,d,f,k,s,i) (a = rol32(a + f(b,c,d) + w[i] + k, s))++static void md4_do_chunk(struct md4_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, (uint32_t *) buf, 16);+#else+	uint32_t *w = buf;+#endif++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];++	R(a, b, c, d, f1, K1, 3, 0);+	R(d, a, b, c, f1, K1, 7, 1);+	R(c, d, a, b, f1, K1, 11, 2);+	R(b, c, d, a, f1, K1, 19, 3);+	R(a, b, c, d, f1, K1, 3, 4);+	R(d, a, b, c, f1, K1, 7, 5);+	R(c, d, a, b, f1, K1, 11, 6);+	R(b, c, d, a, f1, K1, 19, 7);+	R(a, b, c, d, f1, K1, 3, 8);+	R(d, a, b, c, f1, K1, 7, 9);+	R(c, d, a, b, f1, K1, 11, 10);+	R(b, c, d, a, f1, K1, 19, 11);+	R(a, b, c, d, f1, K1, 3, 12);+	R(d, a, b, c, f1, K1, 7, 13);+	R(c, d, a, b, f1, K1, 11, 14);+	R(b, c, d, a, f1, K1, 19, 15);++	R(a, b, c, d, f2, K2, 3, 0);+	R(d, a, b, c, f2, K2, 5, 4);+	R(c, d, a, b, f2, K2, 9, 8);+	R(b, c, d, a, f2, K2, 13, 12);+	R(a, b, c, d, f2, K2, 3, 1);+	R(d, a, b, c, f2, K2, 5, 5);+	R(c, d, a, b, f2, K2, 9, 9);+	R(b, c, d, a, f2, K2, 13, 13);+	R(a, b, c, d, f2, K2, 3, 2);+	R(d, a, b, c, f2, K2, 5, 6);+	R(c, d, a, b, f2, K2, 9, 10);+	R(b, c, d, a, f2, K2, 13, 14);+	R(a, b, c, d, f2, K2, 3, 3);+	R(d, a, b, c, f2, K2, 5, 7);+	R(c, d, a, b, f2, K2, 9, 11);+	R(b, c, d, a, f2, K2, 13, 15);++	R(a, b, c, d, f3, K3, 3, 0);+	R(d, a, b, c, f3, K3, 9, 8);+	R(c, d, a, b, f3, K3, 11, 4);+	R(b, c, d, a, f3, K3, 15, 12);+	R(a, b, c, d, f3, K3, 3, 2);+	R(d, a, b, c, f3, K3, 9, 10);+	R(c, d, a, b, f3, K3, 11, 6);+	R(b, c, d, a, f3, K3, 15, 14);+	R(a, b, c, d, f3, K3, 3, 1);+	R(d, a, b, c, f3, K3, 9, 9);+	R(c, d, a, b, f3, K3, 11, 5);+	R(b, c, d, a, f3, K3, 15, 13);+	R(a, b, c, d, f3, K3, 3, 3);+	R(d, a, b, c, f3, K3, 9, 11);+	R(c, d, a, b, f3, K3, 11, 7);+	R(b, c, d, a, f3, K3, 15, 15);++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+}++void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md4_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 64-block as possible */+	for (; len >= 64; len -= 64, data += 64)+		md4_do_chunk(ctx, (uint32_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_md4_update(ctx, padding, padlen);++	/* append length */+	cryptonite_md4_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	le32_to_cpu_array((uint32_t *) out, ctx->h, 4);+}
+ cbits/cryptonite_md4.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD4_H+#define CRYPTOHASH_MD4_H++#include <stdint.h>++struct md4_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[4];+};++#define MD4_DIGEST_SIZE		16+#define MD4_CTX_SIZE		sizeof(struct md4_ctx)++void cryptonite_md4_init(struct md4_ctx *ctx);+void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_md5.c view
@@ -0,0 +1,178 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include <stdio.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_md5.h"++void cryptonite_md5_init(struct md5_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->sz = 0ULL;+	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+}++#define f1(x, y, z)	(z ^ (x & (y ^ z)))+#define f2(x, y, z)	f1(z, x, y)+#define f3(x, y, z)	(x ^ y ^ z)+#define f4(x, y, z)	(y ^ (x | ~z))+#define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b++static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, buf, 16);+#else+	uint32_t *w = buf;+#endif+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];++	R(f1, a, b, c, d, 0, 0xd76aa478, 7);+	R(f1, d, a, b, c, 1, 0xe8c7b756, 12);+	R(f1, c, d, a, b, 2, 0x242070db, 17);+	R(f1, b, c, d, a, 3, 0xc1bdceee, 22);+	R(f1, a, b, c, d, 4, 0xf57c0faf, 7);+	R(f1, d, a, b, c, 5, 0x4787c62a, 12);+	R(f1, c, d, a, b, 6, 0xa8304613, 17);+	R(f1, b, c, d, a, 7, 0xfd469501, 22);+	R(f1, a, b, c, d, 8, 0x698098d8, 7);+	R(f1, d, a, b, c, 9, 0x8b44f7af, 12);+	R(f1, c, d, a, b, 10, 0xffff5bb1, 17);+	R(f1, b, c, d, a, 11, 0x895cd7be, 22);+	R(f1, a, b, c, d, 12, 0x6b901122, 7);+	R(f1, d, a, b, c, 13, 0xfd987193, 12);+	R(f1, c, d, a, b, 14, 0xa679438e, 17);+	R(f1, b, c, d, a, 15, 0x49b40821, 22);++	R(f2, a, b, c, d, 1, 0xf61e2562, 5);+	R(f2, d, a, b, c, 6, 0xc040b340, 9);+	R(f2, c, d, a, b, 11, 0x265e5a51, 14);+	R(f2, b, c, d, a, 0, 0xe9b6c7aa, 20);+	R(f2, a, b, c, d, 5, 0xd62f105d, 5);+	R(f2, d, a, b, c, 10, 0x02441453, 9);+	R(f2, c, d, a, b, 15, 0xd8a1e681, 14);+	R(f2, b, c, d, a, 4, 0xe7d3fbc8, 20);+	R(f2, a, b, c, d, 9, 0x21e1cde6, 5);+	R(f2, d, a, b, c, 14, 0xc33707d6, 9);+	R(f2, c, d, a, b, 3, 0xf4d50d87, 14);+	R(f2, b, c, d, a, 8, 0x455a14ed, 20);+	R(f2, a, b, c, d, 13, 0xa9e3e905, 5);+	R(f2, d, a, b, c, 2, 0xfcefa3f8, 9);+	R(f2, c, d, a, b, 7, 0x676f02d9, 14);+	R(f2, b, c, d, a, 12, 0x8d2a4c8a, 20);++	R(f3, a, b, c, d, 5, 0xfffa3942, 4);+	R(f3, d, a, b, c, 8, 0x8771f681, 11);+	R(f3, c, d, a, b, 11, 0x6d9d6122, 16);+	R(f3, b, c, d, a, 14, 0xfde5380c, 23);+	R(f3, a, b, c, d, 1, 0xa4beea44, 4);+	R(f3, d, a, b, c, 4, 0x4bdecfa9, 11);+	R(f3, c, d, a, b, 7, 0xf6bb4b60, 16);+	R(f3, b, c, d, a, 10, 0xbebfbc70, 23);+	R(f3, a, b, c, d, 13, 0x289b7ec6, 4);+	R(f3, d, a, b, c, 0, 0xeaa127fa, 11);+	R(f3, c, d, a, b, 3, 0xd4ef3085, 16);+	R(f3, b, c, d, a, 6, 0x04881d05, 23);+	R(f3, a, b, c, d, 9, 0xd9d4d039, 4);+	R(f3, d, a, b, c, 12, 0xe6db99e5, 11);+	R(f3, c, d, a, b, 15, 0x1fa27cf8, 16);+	R(f3, b, c, d, a, 2, 0xc4ac5665, 23);++	R(f4, a, b, c, d, 0, 0xf4292244, 6);+	R(f4, d, a, b, c, 7, 0x432aff97, 10);+	R(f4, c, d, a, b, 14, 0xab9423a7, 15);+	R(f4, b, c, d, a, 5, 0xfc93a039, 21);+	R(f4, a, b, c, d, 12, 0x655b59c3, 6);+	R(f4, d, a, b, c, 3, 0x8f0ccc92, 10);+	R(f4, c, d, a, b, 10, 0xffeff47d, 15);+	R(f4, b, c, d, a, 1, 0x85845dd1, 21);+	R(f4, a, b, c, d, 8, 0x6fa87e4f, 6);+	R(f4, d, a, b, c, 15, 0xfe2ce6e0, 10);+	R(f4, c, d, a, b, 6, 0xa3014314, 15);+	R(f4, b, c, d, a, 13, 0x4e0811a1, 21);+	R(f4, a, b, c, d, 4, 0xf7537e82, 6);+	R(f4, d, a, b, c, 11, 0xbd3af235, 10);+	R(f4, c, d, a, b, 2, 0x2ad7d2bb, 15);+	R(f4, b, c, d, a, 9, 0xeb86d391, 21);++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+}++void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		md5_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 64-block as possible */+	for (; len >= 64; len -= 64, data += 64)+		md5_do_chunk(ctx, (uint32_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;+	uint32_t *p = (uint32_t *) out;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_md5_update(ctx, padding, padlen);++	/* append length */+	cryptonite_md5_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	p[0] = cpu_to_le32(ctx->h[0]);+	p[1] = cpu_to_le32(ctx->h[1]);+	p[2] = cpu_to_le32(ctx->h[2]);+	p[3] = cpu_to_le32(ctx->h[3]);+}
+ cbits/cryptonite_md5.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_MD5_H+#define CRYPTOHASH_MD5_H++#include <stdint.h>++struct md5_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[4];+};++#define MD5_DIGEST_SIZE		16+#define MD5_CTX_SIZE		sizeof(struct md5_ctx)++void cryptonite_md5_init(struct md5_ctx *ctx);+void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_poly1305.c view
@@ -0,0 +1,207 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ *+ * The following code contains some code copied from and inspired by poly1305-donna+ * in poly1305_do_chunk and poly1305_finalize which is licensed under MIT or PUBLIC DOMAIN.+ * see [poly1305-donna](https://github.com/floodyberry/poly1305-donna)+ *+ */++#include <stdint.h>+#include <string.h>+#include "cryptonite_poly1305.h"+#include "cryptonite_bitfn.h"++static inline uint32_t load32(uint8_t *p)+{+	return (le32_to_cpu(*((uint32_t *) p)));+}++static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final)+{+	/* following is a cleanup copy of code available poly1305-donna */+	const uint32_t hibit = (final) ? 0 : (1 << 24); /* 1 << 128 */+	uint32_t r0,r1,r2,r3,r4;+	uint32_t s1,s2,s3,s4;+	uint32_t h0,h1,h2,h3,h4;+	uint64_t d0,d1,d2,d3,d4;+	uint32_t c;++	/* load r[i], h[i] */+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];+	r0 = ctx->r[0]; r1 = ctx->r[1]; r2 = ctx->r[2]; r3 = ctx->r[3]; r4 = ctx->r[4];++	/* s[i] = r[i] * 5 */+	s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5;++	while (blocks--) {+		h0 += (load32(data+ 0)     ) & 0x3ffffff;+		h1 += (load32(data+ 3) >> 2) & 0x3ffffff;+		h2 += (load32(data+ 6) >> 4) & 0x3ffffff;+		h3 += (load32(data+ 9) >> 6) & 0x3ffffff;+		h4 += (load32(data+12) >> 8) | hibit;++		d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1);+		d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2);+		d2 = ((uint64_t)h0 * r2) + ((uint64_t)h1 * r1) + ((uint64_t)h2 * r0) + ((uint64_t)h3 * s4) + ((uint64_t)h4 * s3);+		d3 = ((uint64_t)h0 * r3) + ((uint64_t)h1 * r2) + ((uint64_t)h2 * r1) + ((uint64_t)h3 * r0) + ((uint64_t)h4 * s4);+		d4 = ((uint64_t)h0 * r4) + ((uint64_t)h1 * r3) + ((uint64_t)h2 * r2) + ((uint64_t)h3 * r1) + ((uint64_t)h4 * r0);++		c = (uint32_t)(d0 >> 26); h0 = (uint32_t)d0 & 0x3ffffff;+		d1 += c;      c = (uint32_t)(d1 >> 26); h1 = (uint32_t)d1 & 0x3ffffff;+		d2 += c;      c = (uint32_t)(d2 >> 26); h2 = (uint32_t)d2 & 0x3ffffff;+		d3 += c;      c = (uint32_t)(d3 >> 26); h3 = (uint32_t)d3 & 0x3ffffff;+		d4 += c;      c = (uint32_t)(d4 >> 26); h4 = (uint32_t)d4 & 0x3ffffff;+		h0 += c * 5;  c =           (h0 >> 26); h0 = h0 & 0x3ffffff;+		h1 += c;++		data += 16;+	}++	/* store h[i] */+	ctx->h[0] = h0; ctx->h[1] = h1; ctx->h[2] = h2; ctx->h[3] = h3; ctx->h[4] = h4;+}++void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key)+{+	uint8_t *k = (uint8_t *) key;++	memset(ctx, 0, sizeof(poly1305_ctx));++	ctx->r[0] = (load32(&k[ 0])     ) & 0x3ffffff;+	ctx->r[1] = (load32(&k[ 3]) >> 2) & 0x3ffff03;+	ctx->r[2] = (load32(&k[ 6]) >> 4) & 0x3ffc0ff;+	ctx->r[3] = (load32(&k[ 9]) >> 6) & 0x3f03fff;+	ctx->r[4] = (load32(&k[12]) >> 8) & 0x00fffff;++	ctx->pad[0] = load32(&k[16]);+	ctx->pad[1] = load32(&k[20]);+	ctx->pad[2] = load32(&k[24]);+	ctx->pad[3] = load32(&k[28]);++	ctx->index = 0;+}++void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length)+{+	uint32_t to_fill, nb_blocks_bytes;++	to_fill = 16 - ctx->index;++	/* process partial buffer if there's enough data to make a block */+	if (ctx->index && length >= to_fill) {+		memcpy(ctx->buf + ctx->index, data, to_fill);+		poly1305_do_chunk(ctx, ctx->buf, 1, 0);+		ctx->index = 0;+		length -= to_fill;+		data += to_fill;+	}++	/* process as much 16-block as possible */+	nb_blocks_bytes = length & ~(16 - 1);+	poly1305_do_chunk(ctx, data, nb_blocks_bytes >> 4, 0);+	data += nb_blocks_bytes;+	length &= 0xf;++	/* fill the remaining bytes in the partial buffer */+	if (length) {+		memcpy(ctx->buf + ctx->index, data, length);+		ctx->index = length;+	}+}++void cryptonite_poly1305_finalize(poly1305_mac mac8, poly1305_ctx *ctx)+{+	uint32_t h0,h1,h2,h3,h4,c;+	uint32_t g0,g1,g2,g3,g4;+	uint64_t f;+	uint32_t mask;+	uint32_t *mac = (uint32_t *) mac8;+	int i;++	if (ctx->index) {+		/* append partial final buffer with 10* then process */+		ctx->buf[ctx->index] = 0x1;+		for (i = ctx->index + 1; i < 16; i++)+			ctx->buf[i] = 0x0;+		poly1305_do_chunk(ctx, ctx->buf, 1, 1);+	}++	/* following is a cleanup copy of code available poly1305-donna */++	/* fully carry h */+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];++	             c = h1 >> 26; h1 = h1 & 0x3ffffff;+	h2 +=     c; c = h2 >> 26; h2 = h2 & 0x3ffffff;+	h3 +=     c; c = h3 >> 26; h3 = h3 & 0x3ffffff;+	h4 +=     c; c = h4 >> 26; h4 = h4 & 0x3ffffff;+	h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;+	h1 +=     c;++	/* compute h + -p */+	g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;+	g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;+	g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;+	g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;+	g4 = h4 + c - (1 << 26);++	/* select h if h < p, or h + -p if h >= p */+	mask = (g4 >> ((sizeof(uint32_t) * 8) - 1)) - 1;+	g0 &= mask;+	g1 &= mask;+	g2 &= mask;+	g3 &= mask;+	g4 &= mask;+	mask = ~mask;+	h0 = (h0 & mask) | g0;+	h1 = (h1 & mask) | g1;+	h2 = (h2 & mask) | g2;+	h3 = (h3 & mask) | g3;+	h4 = (h4 & mask) | g4;++	/* h = h % (2^128) */+	h0 = ((h0      ) | (h1 << 26)) & 0xffffffff;+	h1 = ((h1 >>  6) | (h2 << 20)) & 0xffffffff;+	h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;+	h3 = ((h3 >> 18) | (h4 <<  8)) & 0xffffffff;++	/* mac = (h + pad) % (2^128) */+	f = (uint64_t)h0 + ctx->pad[0];+	mac[0] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h1 + ctx->pad[1] + (f >> 32);+	mac[1] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h2 + ctx->pad[2] + (f >> 32);+	mac[2] = cpu_to_le32((uint32_t) f);++	f = (uint64_t)h3 + ctx->pad[3] + (f >> 32);+	mac[3] = cpu_to_le32((uint32_t) f);+}
+ cbits/cryptonite_poly1305.h view
@@ -0,0 +1,50 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTONITE_POLY1305_H+# define CRYPTONITE_POLY1305_H++/* 8*8+1*16+1*4 = 84 */+typedef struct+{+	uint32_t r[5];+	uint32_t h[5];+	uint32_t pad[4];+	uint32_t index;+	uint8_t buf[16]; /* previous partial block */+} poly1305_ctx;++typedef uint8_t poly1305_mac[16];+typedef uint8_t poly1305_key[32];++void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key);+void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length);+void cryptonite_poly1305_finalize(poly1305_mac mac, poly1305_ctx *ctx);++#endif
+ cbits/cryptonite_rc4.c view
@@ -0,0 +1,63 @@+/* initial implementation by+ *   Peter White <peter@janrain.com>+ */++/* C Standard includes */+#include <stdlib.h>+#include <stdio.h>+#include <string.h>+#include <stdint.h>++/* Local include */+#include "cryptonite_rc4.h"++/* Swap array elements i=State[i] and b=State[j]. */+static void swap(uint8_t *i, uint8_t *j)+{+	uint8_t temp;++	temp = *i;+	*i = *j;+	*j = temp;+}++/* Key scheduling algorithm. Swap array elements based on the key. */+void cryptonite_rc4_init(uint8_t *key, uint32_t keylen, struct rc4_ctx *ctx)+{+	uint32_t i, j;+	memset(ctx, 0, sizeof(struct rc4_ctx));++	/* initialize context */+	for (i = 0; i < 256; i++)+		ctx->state[i] = i;+	for (i = j = 0; i < 256; i++) {+		j = (j + ctx->state[i] + key[i % keylen]) % 256;+		swap(&ctx->state[i], &ctx->state[j]);+	}+}++/* Combine the stream generated by the rc4 with some input */+void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output)+{+	uint32_t i = ctx->i;+	uint32_t j = ctx->j;+	uint32_t m;+	uint8_t si, sj;++	/* The RC4 algorithm */+	for (m = 0; m < len; m++) {+		i = (i + 1) & 0xff;+		si = ctx->state[i];+		j = (j + si) & 0xff;+		sj = ctx->state[j];+		/* swap(&state[i], &state[j]); */+		ctx->state[i] = sj;+		ctx->state[j] = si;+		/* Xor the key stream value into the input */+		*output++ = *input++ ^ (ctx->state[(si + sj) & 0xff]);+	}++	/* Output new S-box indices */+	ctx->i = i;+	ctx->j = j;+}
+ cbits/cryptonite_rc4.h view
@@ -0,0 +1,14 @@+#ifndef CRYPTONITE_RC4_H+# define CRYPTONITE_RC4_H++struct rc4_ctx+{+	uint8_t state[256];+	uint32_t i;+	uint32_t j;+};++void cryptonite_rc4_init(uint8_t * key, uint32_t keylen, struct rc4_ctx *ctx);+void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output);++#endif
+ cbits/cryptonite_rdrand.c view
@@ -0,0 +1,100 @@+/*+ * Copyright (C) Thomas DuBuisson+ * Copyright (C) 2013 Vincent Hanquez <tab@snarc.org>+ *+ * All rights reserved.+ * + * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <stdlib.h>+#include <stdio.h>+#include <string.h>++int cryptonite_cpu_has_rdrand()+{+	uint32_t ax,bx,cx,dx,func=1;+	__asm__ volatile ("cpuid": "=a" (ax), "=b" (bx), "=c" (cx), "=d" (dx) : "a" (func));+	return (cx & 0x40000000);+}++/* sadly many people are still using an old binutils,+ * leading to report that instruction is not recognized.+ */+#if 0+/* Returns 1 on success */+static inline int crypto_random_rdrand64_step(uint64_t *buffer)+{+	unsigned char err;+	asm volatile ("rdrand %0; setc %1" : "=r" (*buffer), "=qm" (err));+	return (int) err;+}+#endif++/* inline encoding of 'rdrand %rax' to cover old binutils+ * - no inputs+ * - 'cc' to the clobber list as we modify condition code.+ * - output of rdrand in rax and have a 8 bit error condition+ */+#define inline_rdrand_rax(val, err) \+	asm(".byte 0x48,0x0f,0xc7,0xf0; setc %1" \+	   : "=a" (val), "=q" (err) \+	   : \+	   : "cc")++/* Returns the number of bytes succesfully generated */+int cryptonite_get_rand_bytes(uint8_t *buffer, size_t len)+{+	uint64_t tmp;+	int aligned = (intptr_t) buffer % 8;+	int orig_len = len;+	int to_alignment = 8 - aligned;+	uint8_t ok;++	if (aligned != 0) {+		inline_rdrand_rax(tmp, ok);+		if (!ok)+			return 0;+		memcpy(buffer, (uint8_t *) &tmp, to_alignment);+		buffer += to_alignment;+		len -= to_alignment;+	}++	for (; len >= 8; buffer += 8, len -= 8) {+		inline_rdrand_rax(tmp, ok);+		if (!ok)+			return (orig_len - len);+		*((uint64_t *) buffer) = tmp;+	}++	if (len > 0) {+		inline_rdrand_rax(tmp, ok);+		if (!ok)+			return (orig_len - len);+		memcpy(buffer, (uint8_t *) &tmp, len);+	}+	return orig_len;+}
+ cbits/cryptonite_ripemd.c view
@@ -0,0 +1,299 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include "cryptonite_ripemd.h"+#include "cryptonite_bitfn.h"+#include <string.h>++void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+	ctx->h[4] = 0xc3d2e1f0;+}++#define K1  0x00000000+#define K2  0x5a827999+#define K3  0x6ed9eba1+#define K4  0x8f1bbcdc+#define K5  0xa953fd4e+#define K6  0x50a28be6+#define K7  0x5c4dd124+#define K8  0x6d703ef3+#define K9  0x7a6d76e9++#define f1(x, y, z) (x ^ y ^ z)+#define f2(x, y, z) (z ^ (x & (y ^ z)))+#define f3(x, y, z) ((x | ~y) ^ z)+#define f4(x, y, z) (y ^ (z & (x ^ y)))+#define f5(x, y, z) (x ^ (y | ~z))++#define R(a, b, c, d, e, f, k, i, s)	\+	a += f(b, c, d) + w[i] + k; a = rol32(a, s) + e; c = rol32(c, 10)++static void ripemd160_do_chunk(struct ripemd160_ctx *ctx, uint32_t *buf)+{+	uint32_t a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;+#ifdef ARCH_IS_BIG_ENDIAN+	uint32_t w[16];+	cpu_to_le32_array(w, buf, 16);+#else+	uint32_t *w = buf;+#endif++	a1 = ctx->h[0]; b1 = ctx->h[1]; c1 = ctx->h[2]; d1 = ctx->h[3]; e1 = ctx->h[4];+	a2 = ctx->h[0]; b2 = ctx->h[1]; c2 = ctx->h[2]; d2 = ctx->h[3]; e2 = ctx->h[4];++	/* 5 passes on first state copy */+	R(a1, b1, c1, d1, e1, f1, K1, 0, 11);+	R(e1, a1, b1, c1, d1, f1, K1, 1, 14);+	R(d1, e1, a1, b1, c1, f1, K1, 2, 15);+	R(c1, d1, e1, a1, b1, f1, K1, 3, 12);+	R(b1, c1, d1, e1, a1, f1, K1, 4, 5);+	R(a1, b1, c1, d1, e1, f1, K1, 5, 8);+	R(e1, a1, b1, c1, d1, f1, K1, 6, 7);+	R(d1, e1, a1, b1, c1, f1, K1, 7, 9);+	R(c1, d1, e1, a1, b1, f1, K1, 8, 11);+	R(b1, c1, d1, e1, a1, f1, K1, 9, 13);+	R(a1, b1, c1, d1, e1, f1, K1, 10, 14);+	R(e1, a1, b1, c1, d1, f1, K1, 11, 15);+	R(d1, e1, a1, b1, c1, f1, K1, 12, 6);+	R(c1, d1, e1, a1, b1, f1, K1, 13, 7);+	R(b1, c1, d1, e1, a1, f1, K1, 14, 9);+	R(a1, b1, c1, d1, e1, f1, K1, 15, 8);+	+	R(e1, a1, b1, c1, d1, f2, K2, 7, 7);+	R(d1, e1, a1, b1, c1, f2, K2, 4, 6);+	R(c1, d1, e1, a1, b1, f2, K2, 13, 8);+	R(b1, c1, d1, e1, a1, f2, K2, 1, 13);+	R(a1, b1, c1, d1, e1, f2, K2, 10, 11);+	R(e1, a1, b1, c1, d1, f2, K2, 6, 9);+	R(d1, e1, a1, b1, c1, f2, K2, 15, 7);+	R(c1, d1, e1, a1, b1, f2, K2, 3, 15);+	R(b1, c1, d1, e1, a1, f2, K2, 12, 7);+	R(a1, b1, c1, d1, e1, f2, K2, 0, 12);+	R(e1, a1, b1, c1, d1, f2, K2, 9, 15);+	R(d1, e1, a1, b1, c1, f2, K2, 5, 9);+	R(c1, d1, e1, a1, b1, f2, K2, 2, 11);+	R(b1, c1, d1, e1, a1, f2, K2, 14, 7);+	R(a1, b1, c1, d1, e1, f2, K2, 11, 13);+	R(e1, a1, b1, c1, d1, f2, K2, 8, 12);++	R(d1, e1, a1, b1, c1, f3, K3, 3, 11);+	R(c1, d1, e1, a1, b1, f3, K3, 10, 13);+	R(b1, c1, d1, e1, a1, f3, K3, 14, 6);+	R(a1, b1, c1, d1, e1, f3, K3, 4, 7);+	R(e1, a1, b1, c1, d1, f3, K3, 9, 14);+	R(d1, e1, a1, b1, c1, f3, K3, 15, 9);+	R(c1, d1, e1, a1, b1, f3, K3, 8, 13);+	R(b1, c1, d1, e1, a1, f3, K3, 1, 15);+	R(a1, b1, c1, d1, e1, f3, K3, 2, 14);+	R(e1, a1, b1, c1, d1, f3, K3, 7, 8);+	R(d1, e1, a1, b1, c1, f3, K3, 0, 13);+	R(c1, d1, e1, a1, b1, f3, K3, 6, 6);+	R(b1, c1, d1, e1, a1, f3, K3, 13, 5);+	R(a1, b1, c1, d1, e1, f3, K3, 11, 12);+	R(e1, a1, b1, c1, d1, f3, K3, 5, 7);+	R(d1, e1, a1, b1, c1, f3, K3, 12, 5);++	R(c1, d1, e1, a1, b1, f4, K4, 1, 11);+	R(b1, c1, d1, e1, a1, f4, K4, 9, 12);+	R(a1, b1, c1, d1, e1, f4, K4, 11, 14);+	R(e1, a1, b1, c1, d1, f4, K4, 10, 15);+	R(d1, e1, a1, b1, c1, f4, K4, 0, 14);+	R(c1, d1, e1, a1, b1, f4, K4, 8, 15);+	R(b1, c1, d1, e1, a1, f4, K4, 12, 9);+	R(a1, b1, c1, d1, e1, f4, K4, 4, 8);+	R(e1, a1, b1, c1, d1, f4, K4, 13, 9);+	R(d1, e1, a1, b1, c1, f4, K4, 3, 14);+	R(c1, d1, e1, a1, b1, f4, K4, 7, 5);+	R(b1, c1, d1, e1, a1, f4, K4, 15, 6);+	R(a1, b1, c1, d1, e1, f4, K4, 14, 8);+	R(e1, a1, b1, c1, d1, f4, K4, 5, 6);+	R(d1, e1, a1, b1, c1, f4, K4, 6, 5);+	R(c1, d1, e1, a1, b1, f4, K4, 2, 12);++	R(b1, c1, d1, e1, a1, f5, K5, 4, 9);+	R(a1, b1, c1, d1, e1, f5, K5, 0, 15);+	R(e1, a1, b1, c1, d1, f5, K5, 5, 5);+	R(d1, e1, a1, b1, c1, f5, K5, 9, 11);+	R(c1, d1, e1, a1, b1, f5, K5, 7, 6);+	R(b1, c1, d1, e1, a1, f5, K5, 12, 8);+	R(a1, b1, c1, d1, e1, f5, K5, 2, 13);+	R(e1, a1, b1, c1, d1, f5, K5, 10, 12);+	R(d1, e1, a1, b1, c1, f5, K5, 14, 5);+	R(c1, d1, e1, a1, b1, f5, K5, 1, 12);+	R(b1, c1, d1, e1, a1, f5, K5, 3, 13);+	R(a1, b1, c1, d1, e1, f5, K5, 8, 14);+	R(e1, a1, b1, c1, d1, f5, K5, 11, 11);+	R(d1, e1, a1, b1, c1, f5, K5, 6, 8);+	R(c1, d1, e1, a1, b1, f5, K5, 15, 5);+	R(b1, c1, d1, e1, a1, f5, K5, 13, 6);++	/* 5 passes on second state copy */+	R(a2, b2, c2, d2, e2, f5, K6, 5, 8);+	R(e2, a2, b2, c2, d2, f5, K6, 14, 9);+	R(d2, e2, a2, b2, c2, f5, K6, 7, 9);+	R(c2, d2, e2, a2, b2, f5, K6, 0, 11);+	R(b2, c2, d2, e2, a2, f5, K6, 9, 13);+	R(a2, b2, c2, d2, e2, f5, K6, 2, 15);+	R(e2, a2, b2, c2, d2, f5, K6, 11, 15);+	R(d2, e2, a2, b2, c2, f5, K6, 4, 5);+	R(c2, d2, e2, a2, b2, f5, K6, 13, 7);+	R(b2, c2, d2, e2, a2, f5, K6, 6, 7);+	R(a2, b2, c2, d2, e2, f5, K6, 15, 8);+	R(e2, a2, b2, c2, d2, f5, K6, 8, 11);+	R(d2, e2, a2, b2, c2, f5, K6, 1, 14);+	R(c2, d2, e2, a2, b2, f5, K6, 10, 14);+	R(b2, c2, d2, e2, a2, f5, K6, 3, 12);+	R(a2, b2, c2, d2, e2, f5, K6, 12, 6);++	R(e2, a2, b2, c2, d2, f4, K7, 6, 9);+	R(d2, e2, a2, b2, c2, f4, K7, 11, 13);+	R(c2, d2, e2, a2, b2, f4, K7, 3, 15);+	R(b2, c2, d2, e2, a2, f4, K7, 7, 7);+	R(a2, b2, c2, d2, e2, f4, K7, 0, 12);+	R(e2, a2, b2, c2, d2, f4, K7, 13, 8);+	R(d2, e2, a2, b2, c2, f4, K7, 5, 9);+	R(c2, d2, e2, a2, b2, f4, K7, 10, 11);+	R(b2, c2, d2, e2, a2, f4, K7, 14, 7);+	R(a2, b2, c2, d2, e2, f4, K7, 15, 7);+	R(e2, a2, b2, c2, d2, f4, K7, 8, 12);+	R(d2, e2, a2, b2, c2, f4, K7, 12, 7);+	R(c2, d2, e2, a2, b2, f4, K7, 4, 6);+	R(b2, c2, d2, e2, a2, f4, K7, 9, 15);+	R(a2, b2, c2, d2, e2, f4, K7, 1, 13);+	R(e2, a2, b2, c2, d2, f4, K7, 2, 11);++	R(d2, e2, a2, b2, c2, f3, K8, 15, 9);+	R(c2, d2, e2, a2, b2, f3, K8, 5, 7);+	R(b2, c2, d2, e2, a2, f3, K8, 1, 15);+	R(a2, b2, c2, d2, e2, f3, K8, 3, 11);+	R(e2, a2, b2, c2, d2, f3, K8, 7, 8);+	R(d2, e2, a2, b2, c2, f3, K8, 14, 6);+	R(c2, d2, e2, a2, b2, f3, K8, 6, 6);+	R(b2, c2, d2, e2, a2, f3, K8, 9, 14);+	R(a2, b2, c2, d2, e2, f3, K8, 11, 12);+	R(e2, a2, b2, c2, d2, f3, K8, 8, 13);+	R(d2, e2, a2, b2, c2, f3, K8, 12, 5);+	R(c2, d2, e2, a2, b2, f3, K8, 2, 14);+	R(b2, c2, d2, e2, a2, f3, K8, 10, 13);+	R(a2, b2, c2, d2, e2, f3, K8, 0, 13);+	R(e2, a2, b2, c2, d2, f3, K8, 4, 7);+	R(d2, e2, a2, b2, c2, f3, K8, 13, 5);++	R(c2, d2, e2, a2, b2, f2, K9, 8, 15);+	R(b2, c2, d2, e2, a2, f2, K9, 6, 5);+	R(a2, b2, c2, d2, e2, f2, K9, 4, 8);+	R(e2, a2, b2, c2, d2, f2, K9, 1, 11);+	R(d2, e2, a2, b2, c2, f2, K9, 3, 14);+	R(c2, d2, e2, a2, b2, f2, K9, 11, 14);+	R(b2, c2, d2, e2, a2, f2, K9, 15, 6);+	R(a2, b2, c2, d2, e2, f2, K9, 0, 14);+	R(e2, a2, b2, c2, d2, f2, K9, 5, 6);+	R(d2, e2, a2, b2, c2, f2, K9, 12, 9);+	R(c2, d2, e2, a2, b2, f2, K9, 2, 12);+	R(b2, c2, d2, e2, a2, f2, K9, 13, 9);+	R(a2, b2, c2, d2, e2, f2, K9, 9, 12);+	R(e2, a2, b2, c2, d2, f2, K9, 7, 5);+	R(d2, e2, a2, b2, c2, f2, K9, 10, 15);+	R(c2, d2, e2, a2, b2, f2, K9, 14, 8);++	R(b2, c2, d2, e2, a2, f1, K1, 12, 8);+	R(a2, b2, c2, d2, e2, f1, K1, 15, 5);+	R(e2, a2, b2, c2, d2, f1, K1, 10, 12);+	R(d2, e2, a2, b2, c2, f1, K1, 4, 9);+	R(c2, d2, e2, a2, b2, f1, K1, 1, 12);+	R(b2, c2, d2, e2, a2, f1, K1, 5, 5);+	R(a2, b2, c2, d2, e2, f1, K1, 8, 14);+	R(e2, a2, b2, c2, d2, f1, K1, 7, 6);+	R(d2, e2, a2, b2, c2, f1, K1, 6, 8);+	R(c2, d2, e2, a2, b2, f1, K1, 2, 13);+	R(b2, c2, d2, e2, a2, f1, K1, 13, 6);+	R(a2, b2, c2, d2, e2, f1, K1, 14, 5);+	R(e2, a2, b2, c2, d2, f1, K1, 0, 15);+	R(d2, e2, a2, b2, c2, f1, K1, 3, 13);+	R(c2, d2, e2, a2, b2, f1, K1, 9, 11);+	R(b2, c2, d2, e2, a2, f1, K1, 11, 11);++	d2 += c1 + ctx->h[1];+	ctx->h[1] = ctx->h[2] + d1 + e2;+	ctx->h[2] = ctx->h[3] + e1 + a2;+	ctx->h[3] = ctx->h[4] + a1 + b2;+	ctx->h[4] = ctx->h[0] + b1 + c2;+	ctx->h[0] = d2;+}++void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		ripemd160_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	for (; len >= 64; len -= 64, data += 64)+		ripemd160_do_chunk(ctx, (uint32_t *) data);++	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;+	uint32_t *p = (uint32_t *) out;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_ripemd160_update(ctx, padding, padlen);++	/* append length */+	cryptonite_ripemd160_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output digest */+	p[0] = cpu_to_le32(ctx->h[0]);+	p[1] = cpu_to_le32(ctx->h[1]);+	p[2] = cpu_to_le32(ctx->h[2]);+	p[3] = cpu_to_le32(ctx->h[3]);+	p[4] = cpu_to_le32(ctx->h[4]);+}
+ cbits/cryptonite_ripemd.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_RIPEMD_H+#define CRYPTOHASH_RIPEMD_H++#include <stdint.h>++struct ripemd160_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[5];+};++#define RIPEMD160_DIGEST_SIZE	20+#define RIPEMD160_CTX_SIZE	sizeof(struct ripemd160_ctx)++void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx);+void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_salsa.c view
@@ -0,0 +1,297 @@+/*+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include <stdio.h>+#include "cryptonite_salsa.h"+#include "cryptonite_bitfn.h"++static const uint8_t sigma[16] = "expand 32-byte k";+static const uint8_t tau[16] = "expand 16-byte k";++#define QR(a,b,c,d) \+	b ^= rol32(a+d, 7); \+	c ^= rol32(b+a, 9); \+	d ^= rol32(c+b, 13); \+	a ^= rol32(d+c, 18);++#define ALIGNED64(PTR) \+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)++#define SALSA_CORE_LOOP \+	for (i = rounds; i > 0; i -= 2) { \+		QR (x0,x4,x8,x12); \+		QR (x5,x9,x13,x1); \+		QR (x10,x14,x2,x6); \+		QR (x15,x3,x7,x11); \+		QR (x0,x1,x2,x3); \+		QR (x5,x6,x7,x4); \+		QR (x10,x11,x8,x9); \+		QR (x15,x12,x13,x14); \+	}++static inline uint32_t load32(const uint8_t *p)+{+	return le32_to_cpu(*((uint32_t *) p));+}++static void salsa_core(int rounds, block *out, const cryptonite_salsa_state *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];++	SALSA_CORE_LOOP;++	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];++	out->d[0] = cpu_to_le32(x0);+	out->d[1] = cpu_to_le32(x1);+	out->d[2] = cpu_to_le32(x2);+	out->d[3] = cpu_to_le32(x3);+	out->d[4] = cpu_to_le32(x4);+	out->d[5] = cpu_to_le32(x5);+	out->d[6] = cpu_to_le32(x6);+	out->d[7] = cpu_to_le32(x7);+	out->d[8] = cpu_to_le32(x8);+	out->d[9] = cpu_to_le32(x9);+	out->d[10] = cpu_to_le32(x10);+	out->d[11] = cpu_to_le32(x11);+	out->d[12] = cpu_to_le32(x12);+	out->d[13] = cpu_to_le32(x13);+	out->d[14] = cpu_to_le32(x14);+	out->d[15] = cpu_to_le32(x15);+}++void cryptonite_salsa_core_xor(int rounds, block *out, block *in)+{+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;+	int i;++#define LOAD(i) (out->d[i] ^= in->d[i])+	x0 = LOAD(0); x1 = LOAD(1); x2 = LOAD(2); x3 = LOAD(3);+	x4 = LOAD(4); x5 = LOAD(5); x6 = LOAD(6); x7 = LOAD(7);+	x8 = LOAD(8); x9 = LOAD(9); x10 = LOAD(10); x11 = LOAD(11);+	x12 = LOAD(12); x13 = LOAD(13); x14 = LOAD(14); x15 = LOAD(15);+#undef LOAD++	SALSA_CORE_LOOP;++	out->d[0] += x0; out->d[1] += x1; out->d[2] += x2; out->d[3] += x3;+	out->d[4] += x4; out->d[5] += x5; out->d[6] += x6; out->d[7] += x7;+	out->d[8] += x8; out->d[9] += x9; out->d[10] += x10; out->d[11] += x11;+	out->d[12] += x12; out->d[13] += x13; out->d[14] += x14; out->d[15] += x15;+}++/* only 2 valid values for keylen are 256 (32) and 128 (16) */+void cryptonite_salsa_init_core(cryptonite_salsa_state *st,+                                uint32_t keylen, const uint8_t *key,+                                uint32_t ivlen, const uint8_t *iv)+{+	const uint8_t *constants = (keylen == 32) ? sigma : tau;+	int i;++	st->d[0] = load32(constants + 0);+	st->d[5] = load32(constants + 4);+	st->d[10] = load32(constants + 8);+	st->d[15] = load32(constants + 12);++	st->d[1] = load32(key + 0);+	st->d[2] = load32(key + 4);+	st->d[3] = load32(key + 8);+	st->d[4] = load32(key + 12);+	/* we repeat the key on 128 bits */+	if (keylen == 32)+		key += 16;+	st->d[11] = load32(key + 0);+	st->d[12] = load32(key + 4);+	st->d[13] = load32(key + 8);+	st->d[14] = load32(key + 12);++	st->d[9] = 0;+	switch (ivlen) {+	case 8:+		st->d[6] = load32(iv + 0);+		st->d[7] = load32(iv + 4);+		st->d[8] = 0;+		break;+	case 12:+		st->d[6] = load32(iv + 0);+		st->d[7] = load32(iv + 4);+		st->d[8] = load32(iv + 8);+	default:+		return;+	}+}++void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds,+                           uint32_t keylen, const uint8_t *key,+                           uint32_t ivlen, const uint8_t *iv)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->nb_rounds = nb_rounds;+	cryptonite_salsa_init_core(&ctx->st, keylen, key, ivlen, iv);+}++void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *ctx, const uint8_t *src, uint32_t bytes)+{+	block out;+	cryptonite_salsa_state *st;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		src += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	/* xor new 64-bytes chunks and store the left over if any */+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		for (i = 0; i < 64; ++i)+			dst[i] = src[i] ^ out.b[i];+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = src[i] ^ out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++) {+			ctx->prev[i] = out.b[i];+		}+	}+}++void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *ctx, uint32_t bytes)+{+	cryptonite_salsa_state *st;+	block out;+	int i;++	if (!bytes)+		return;++	/* xor the previous buffer first (if any) */+	if (ctx->prev_len > 0) {+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;+		for (i = 0; i < to_copy; i++)+			dst[i] = ctx->prev[ctx->prev_ofs+i];+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);+		ctx->prev_len -= to_copy;+		ctx->prev_ofs += to_copy;+		dst += to_copy;+		bytes -= to_copy;+	}++	if (bytes == 0)+		return;++	st = &ctx->st;++	if (ALIGNED64(dst)) {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			salsa_core(ctx->nb_rounds, (block *) dst, st);+			st->d[8] += 1;+			if (st->d[8] == 0)+				st->d[9] += 1;+		}+	} else {+		/* xor new 64-bytes chunks and store the left over if any */+		for (; bytes >= 64; bytes -= 64, dst += 64) {+			/* generate new chunk and update state */+			salsa_core(ctx->nb_rounds, &out, st);+			st->d[8] += 1;+			if (st->d[8] == 0)+				st->d[9] += 1;++			for (i = 0; i < 64; ++i)+				dst[i] = out.b[i];+		}+	}++	if (bytes > 0) {+		/* generate new chunk and update state */+		salsa_core(ctx->nb_rounds, &out, st);+		st->d[8] += 1;+		if (st->d[8] == 0)+			st->d[9] += 1;++		/* xor as much as needed */+		for (i = 0; i < bytes; i++)+			dst[i] = out.b[i];+		+		/* copy the left over in the buffer */+		ctx->prev_len = 64 - bytes;+		ctx->prev_ofs = i;+		for (; i < 64; i++)+			ctx->prev[i] = out.b[i];+	}+}+
+ cbits/cryptonite_salsa.h view
@@ -0,0 +1,57 @@+/*+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ * 3. Neither the name of the author nor the names of his contributors+ *    may be used to endorse or promote products derived from this software+ *    without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF+ * SUCH DAMAGE.+ */+#ifndef CRYPTONITE_SALSA+#define CRYPTONITE_SALSA++typedef union {+	uint64_t q[8];+	uint32_t d[16];+	uint8_t  b[64];+} block;++typedef block cryptonite_salsa_state;++typedef struct {+	cryptonite_salsa_state st;+	uint8_t prev[64];+	uint8_t prev_ofs;+	uint8_t prev_len;+	uint8_t nb_rounds;+} cryptonite_salsa_context;++/* for scrypt */+void cryptonite_salsa_core_xor(int rounds, block *out, block *in);++void cryptonite_salsa_init_core(cryptonite_salsa_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);+void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *st, const uint8_t *src, uint32_t bytes);+void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *st, uint32_t bytes);++#endif
+ cbits/cryptonite_scrypt.c view
@@ -0,0 +1,90 @@+/*+ * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ *+ * Based on scrypt from Colin Percival's paper+ */++#include <stdint.h>+#include <string.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_salsa.h"++static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)+{+	int i;++	array_copy32(X, &in[(2 * r - 1) * 16], 16);++	for (i = 0; i < 2 * r; i += 2) {+		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);+		array_copy32(&out[i * 8], X, 16);++		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);+		array_copy32(&out[i * 8 + r * 16], X, 16);+	}+}++static inline uint64_t integerify(uint32_t *B, const uint32_t r)+{+	return le64_to_cpu(*((uint64_t *) (B + (2*r-1) * 16)));+}++static inline uint32_t load32(const uint8_t *p)+{+	return le32_to_cpu(*((uint32_t *) p));+}++static inline void store32(const uint8_t *p, uint32_t val)+{+	*((uint32_t *) p) = cpu_to_le32(val);+}++void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)+{+	uint32_t *X = XY;+	uint32_t *Y = &XY[32 * r];+	uint32_t *Z = &XY[64 * r];+	uint64_t i, j;+	int k;+	const int r32 = 32*r;++	for (k = 0; k < r32; k++)+		X[k] = load32(&B[4 * k]);+	for (i = 0; i < N; i += 2) {+		array_copy32(&V[i * r32], X, r32);+		blockmix_salsa8(X, Y, Z, r);+		array_copy32(&V[(i + 1) * r32], Y, r32);+		blockmix_salsa8(Y, X, Z, r);+	}+	for (i = 0; i < N; i += 2) {+		j = integerify(X, r) & (N - 1);+		array_xor32(X, &V[j * r32], r32);+		blockmix_salsa8(X, Y, Z, r);++		j = integerify(Y, r) & (N - 1);+		array_xor32(Y, &V[j * r32], r32);+		blockmix_salsa8(Y, X, Z, r);+	}+	for (k = 0; k < r32; k++)+		store32(&B[4*k], X[k]);+}
+ cbits/cryptonite_sha1.c view
@@ -0,0 +1,209 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_sha1.h"+#include "cryptonite_bitfn.h"++void cryptonite_sha1_init(struct sha1_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x67452301;+	ctx->h[1] = 0xefcdab89;+	ctx->h[2] = 0x98badcfe;+	ctx->h[3] = 0x10325476;+	ctx->h[4] = 0xc3d2e1f0;+}++#define f1(x, y, z)   (z ^ (x & (y ^ z)))+#define f2(x, y, z)   (x ^ y ^ z)+#define f3(x, y, z)   ((x & y) + (z & (x ^ y)))+#define f4(x, y, z)   f2(x, y, z)++#define K1  0x5a827999+#define K2  0x6ed9eba1+#define K3  0x8f1bbcdc+#define K4  0xca62c1d6++#define R(a, b, c, d, e, f, k, w)  \+	e += rol32(a, 5) + f(b, c, d) + k + w; b = rol32(b, 30)++#define M(i)  (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \+              ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1))++static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf)+{+	uint32_t a, b, c, d, e;+	uint32_t w[16];+#define CPY(i)	w[i] = be32_to_cpu(buf[i])+	CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7);+	CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15);+#undef CPY++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; e = ctx->h[4];++	R(a, b, c, d, e, f1, K1, w[0]);+	R(e, a, b, c, d, f1, K1, w[1]);+	R(d, e, a, b, c, f1, K1, w[2]);+	R(c, d, e, a, b, f1, K1, w[3]);+	R(b, c, d, e, a, f1, K1, w[4]);+	R(a, b, c, d, e, f1, K1, w[5]);+	R(e, a, b, c, d, f1, K1, w[6]);+	R(d, e, a, b, c, f1, K1, w[7]);+	R(c, d, e, a, b, f1, K1, w[8]);+	R(b, c, d, e, a, f1, K1, w[9]);+	R(a, b, c, d, e, f1, K1, w[10]);+	R(e, a, b, c, d, f1, K1, w[11]);+	R(d, e, a, b, c, f1, K1, w[12]);+	R(c, d, e, a, b, f1, K1, w[13]);+	R(b, c, d, e, a, f1, K1, w[14]);+	R(a, b, c, d, e, f1, K1, w[15]);+	R(e, a, b, c, d, f1, K1, M(16));+	R(d, e, a, b, c, f1, K1, M(17));+	R(c, d, e, a, b, f1, K1, M(18));+	R(b, c, d, e, a, f1, K1, M(19));++	R(a, b, c, d, e, f2, K2, M(20));+	R(e, a, b, c, d, f2, K2, M(21));+	R(d, e, a, b, c, f2, K2, M(22));+	R(c, d, e, a, b, f2, K2, M(23));+	R(b, c, d, e, a, f2, K2, M(24));+	R(a, b, c, d, e, f2, K2, M(25));+	R(e, a, b, c, d, f2, K2, M(26));+	R(d, e, a, b, c, f2, K2, M(27));+	R(c, d, e, a, b, f2, K2, M(28));+	R(b, c, d, e, a, f2, K2, M(29));+	R(a, b, c, d, e, f2, K2, M(30));+	R(e, a, b, c, d, f2, K2, M(31));+	R(d, e, a, b, c, f2, K2, M(32));+	R(c, d, e, a, b, f2, K2, M(33));+	R(b, c, d, e, a, f2, K2, M(34));+	R(a, b, c, d, e, f2, K2, M(35));+	R(e, a, b, c, d, f2, K2, M(36));+	R(d, e, a, b, c, f2, K2, M(37));+	R(c, d, e, a, b, f2, K2, M(38));+	R(b, c, d, e, a, f2, K2, M(39));++	R(a, b, c, d, e, f3, K3, M(40));+	R(e, a, b, c, d, f3, K3, M(41));+	R(d, e, a, b, c, f3, K3, M(42));+	R(c, d, e, a, b, f3, K3, M(43));+	R(b, c, d, e, a, f3, K3, M(44));+	R(a, b, c, d, e, f3, K3, M(45));+	R(e, a, b, c, d, f3, K3, M(46));+	R(d, e, a, b, c, f3, K3, M(47));+	R(c, d, e, a, b, f3, K3, M(48));+	R(b, c, d, e, a, f3, K3, M(49));+	R(a, b, c, d, e, f3, K3, M(50));+	R(e, a, b, c, d, f3, K3, M(51));+	R(d, e, a, b, c, f3, K3, M(52));+	R(c, d, e, a, b, f3, K3, M(53));+	R(b, c, d, e, a, f3, K3, M(54));+	R(a, b, c, d, e, f3, K3, M(55));+	R(e, a, b, c, d, f3, K3, M(56));+	R(d, e, a, b, c, f3, K3, M(57));+	R(c, d, e, a, b, f3, K3, M(58));+	R(b, c, d, e, a, f3, K3, M(59));++	R(a, b, c, d, e, f4, K4, M(60));+	R(e, a, b, c, d, f4, K4, M(61));+	R(d, e, a, b, c, f4, K4, M(62));+	R(c, d, e, a, b, f4, K4, M(63));+	R(b, c, d, e, a, f4, K4, M(64));+	R(a, b, c, d, e, f4, K4, M(65));+	R(e, a, b, c, d, f4, K4, M(66));+	R(d, e, a, b, c, f4, K4, M(67));+	R(c, d, e, a, b, f4, K4, M(68));+	R(b, c, d, e, a, f4, K4, M(69));+	R(a, b, c, d, e, f4, K4, M(70));+	R(e, a, b, c, d, f4, K4, M(71));+	R(d, e, a, b, c, f4, K4, M(72));+	R(c, d, e, a, b, f4, K4, M(73));+	R(b, c, d, e, a, f4, K4, M(74));+	R(a, b, c, d, e, f4, K4, M(75));+	R(e, a, b, c, d, f4, K4, M(76));+	R(d, e, a, b, c, f4, K4, M(77));+	R(c, d, e, a, b, f4, K4, M(78));+	R(b, c, d, e, a, f4, K4, M(79));++	ctx->h[0] += a;+	ctx->h[1] += b;+	ctx->h[2] += c;+	ctx->h[3] += d;+	ctx->h[4] += e;+}++void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha1_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 64-block as possible */+	for (; len >= 64; len -= 64, data += 64)+		sha1_do_chunk(ctx, (uint32_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t index, padlen;+	uint32_t *p = (uint32_t *) out;++	/* add padding and update data with it */+	bits = cpu_to_be64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_sha1_update(ctx, padding, padlen);++	/* append length */+	cryptonite_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	p[0] = cpu_to_be32(ctx->h[0]);+	p[1] = cpu_to_be32(ctx->h[1]);+	p[2] = cpu_to_be32(ctx->h[2]);+	p[3] = cpu_to_be32(ctx->h[3]);+	p[4] = cpu_to_be32(ctx->h[4]);+}
+ cbits/cryptonite_sha1.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA1_H+#define CRYPTOHASH_SHA1_H++#include <stdint.h>++struct sha1_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint32_t h[5];+};++#define SHA1_DIGEST_SIZE	20+#define SHA1_CTX_SIZE 		(sizeof(struct sha1_ctx))++void cryptonite_sha1_init(struct sha1_ctx *ctx);+void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_sha256.c view
@@ -0,0 +1,175 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_sha256.h"+#include "cryptonite_bitfn.h"++void cryptonite_sha224_init(struct sha224_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0xc1059ed8;+	ctx->h[1] = 0x367cd507;+	ctx->h[2] = 0x3070dd17;+	ctx->h[3] = 0xf70e5939;+	ctx->h[4] = 0xffc00b31;+	ctx->h[5] = 0x68581511;+	ctx->h[6] = 0x64f98fa7;+	ctx->h[7] = 0xbefa4fa4;+}++void cryptonite_sha256_init(struct sha256_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x6a09e667;+	ctx->h[1] = 0xbb67ae85;+	ctx->h[2] = 0x3c6ef372;+	ctx->h[3] = 0xa54ff53a;+	ctx->h[4] = 0x510e527f;+	ctx->h[5] = 0x9b05688c;+	ctx->h[6] = 0x1f83d9ab;+	ctx->h[7] = 0x5be0cd19;+}++/* 232 times the cube root of the first 64 primes 2..311 */+static const uint32_t k[] = {+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,+	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,+	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,+	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,+	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,+	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,+	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,+	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,+	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2+};++#define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))+#define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))+#define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))+#define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))++static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[])+{+	uint32_t a, b, c, d, e, f, g, h, t1, t2;+	int i;+	uint32_t w[64];++	cpu_to_be32_array(w, buf, 16);+	for (i = 16; i < 64; i++)+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];++#define R(a, b, c, d, e, f, g, h, k, w)			\+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w; 	\+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\+	d += t1;					\+	h = t1 + t2;++	for (i = 0; i < 64; i += 8) {+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);+	}++#undef R++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;+}++void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return cryptonite_sha256_update(ctx, data, len);+}++void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	/* check for partial buffer */+	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha256_do_chunk(ctx, (uint32_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 64-block as possible */+	for (; len >= 64; len -= 64, data += 64)+		sha256_do_chunk(ctx, (uint32_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out)+{+	uint8_t intermediate[SHA256_DIGEST_SIZE];++	cryptonite_sha256_finalize(ctx, intermediate);+	memcpy(out, intermediate, SHA224_DIGEST_SIZE);+}++void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x80, };+	uint64_t bits;+	uint32_t i, index, padlen;+	uint32_t *p = (uint32_t *) out;++	/* cpu -> big endian */+	bits = cpu_to_be64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_sha256_update(ctx, padding, padlen);++	/* append length */+	cryptonite_sha256_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* store to digest */+	for (i = 0; i < 8; i++)+		p[i] = cpu_to_be32(ctx->h[i]);+}
+ cbits/cryptonite_sha256.h view
@@ -0,0 +1,53 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef CRYPTOHASH_SHA256_H+#define CRYPTOHASH_SHA256_H++#include <stdint.h>++struct sha256_ctx+{+	uint64_t sz;+	uint8_t  buf[128];+	uint32_t h[8];+};++#define sha224_ctx 		sha256_ctx++#define SHA224_DIGEST_SIZE	28+#define SHA224_CTX_SIZE		sizeof(struct sha224_ctx)++#define SHA256_DIGEST_SIZE	32+#define SHA256_CTX_SIZE		sizeof(struct sha256_ctx)++void cryptonite_sha224_init(struct sha224_ctx *ctx);+void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out);++void cryptonite_sha256_init(struct sha256_ctx *ctx);+void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_sha3.c view
@@ -0,0 +1,159 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <stdint.h>+#include <string.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_sha3.h"++#define KECCAK_NB_ROUNDS 24++/* rounds constants */+static const uint64_t keccak_rndc[24] =+{+	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,+	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,+	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,+	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,+	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,+	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,+	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,+	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,+};++/* triangular numbers constants */+static const int keccak_rotc[24] =+	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };++static const int keccak_piln[24] =+	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };++static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)+{+	int i, j, r;+	uint64_t tmp, bc[5];++	/* merge buf with state */+	for (i = 0; i < bufsz; i++)+		state[i] ^= le64_to_cpu(buf[i]);++	/* run keccak rounds */+	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {+		/* compute the parity of each columns */+		for (i = 0; i < 5; i++)+			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];++		for (i = 0; i < 5; i++) {+			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);+			for (j = 0; j < 25; j += 5)+				state[j + i] ^= tmp;+		}++		/* rho pi */+		tmp = state[1];+		for (i = 0; i < 24; i++) {+			j = keccak_piln[i];+			bc[0] = state[j];+			state[j] = rol64(tmp, keccak_rotc[i]);+			tmp = bc[0];+		}++		/* bitwise combine along rows using a = a xor (not b and c) */+		for (j = 0; j < 25; j += 5) {+			for (i = 0; i < 5; i++)+				bc[i] = state[j + i];+			#define andn(b,c) (~(b) & (c))+			state[j + 0] ^= andn(bc[1], bc[2]);+			state[j + 1] ^= andn(bc[2], bc[3]);+			state[j + 2] ^= andn(bc[3], bc[4]);+			state[j + 3] ^= andn(bc[4], bc[0]);+			state[j + 4] ^= andn(bc[0], bc[1]);+			#undef andn+		}++		/* xor the round constant */+		state[0] ^= keccak_rndc[r];+	}+}++void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen)+{+	memset(ctx, 0, sizeof(*ctx));+	ctx->hashlen = hashlen / 8;+	ctx->bufsz = 200 - 2 * ctx->hashlen;+}++void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	to_fill = ctx->bufsz - ctx->bufindex;++	if (ctx->bufindex == ctx->bufsz) {+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block */+	if (ctx->bufindex && len >= to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	/* process as much ctx->bufsz-block */+	for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)+		sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint8_t *out)+{+	uint64_t w[25];++	/* process full buffer if needed */+	if (ctx->bufindex == ctx->bufsz) {+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);+		ctx->bufindex = 0;+	}++	/* add the 10*1 padding */+	ctx->buf[ctx->bufindex++] = 0x06;+	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);+	ctx->buf[ctx->bufsz - 1] |= 0x80;++	/* process */+	sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);++	/* output */+	cpu_to_le64_array(w, ctx->state, 25);+	memcpy(out, w, ctx->hashlen);+}
+ cbits/cryptonite_sha3.h view
@@ -0,0 +1,45 @@+/*+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA3_H+#define CRYPTOHASH_SHA3_H++#include <stdint.h>++struct sha3_ctx+{+	uint32_t hashlen; /* in bytes */+	uint32_t bufindex;+	uint64_t state[25];+	uint32_t bufsz;+	uint32_t _padding;+	uint8_t  buf[144]; /* minimum SHA3-224, otherwise buffer need increases */+};++#define SHA3_CTX_SIZE		sizeof(struct sha3_ctx)++void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen);+void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_sha512.c view
@@ -0,0 +1,261 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_bitfn.h"+#include "cryptonite_sha512.h"++void cryptonite_sha384_init(struct sha512_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0xcbbb9d5dc1059ed8ULL;+	ctx->h[1] = 0x629a292a367cd507ULL;+	ctx->h[2] = 0x9159015a3070dd17ULL;+	ctx->h[3] = 0x152fecd8f70e5939ULL;+	ctx->h[4] = 0x67332667ffc00b31ULL;+	ctx->h[5] = 0x8eb44a8768581511ULL;+	ctx->h[6] = 0xdb0c2e0d64f98fa7ULL;+	ctx->h[7] = 0x47b5481dbefa4fa4ULL;+}++void cryptonite_sha512_init(struct sha512_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x6a09e667f3bcc908ULL;+	ctx->h[1] = 0xbb67ae8584caa73bULL;+	ctx->h[2] = 0x3c6ef372fe94f82bULL;+	ctx->h[3] = 0xa54ff53a5f1d36f1ULL;+	ctx->h[4] = 0x510e527fade682d1ULL;+	ctx->h[5] = 0x9b05688c2b3e6c1fULL;+	ctx->h[6] = 0x1f83d9abfb41bd6bULL;+	ctx->h[7] = 0x5be0cd19137e2179ULL;+}++/* 232 times the cube root of the first 64 primes 2..311 */+static const uint64_t k[] = {+	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,+	0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,+	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,+	0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,+	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,+	0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,+	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,+	0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,+	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,+	0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,+	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,+	0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,+	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,+	0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,+	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,+	0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,+	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,+	0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,+	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,+	0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,+	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,+	0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,+	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,+	0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,+	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,+	0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,+	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,+};++#define e0(x)       (ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39))+#define e1(x)       (ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41))+#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))+#define s1(x)       (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6))++static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf)+{+	uint64_t a, b, c, d, e, f, g, h, t1, t2;+	int i;+	uint64_t w[80];++	cpu_to_be64_array(w, buf, 16);++	for (i = 16; i < 80; i++)+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];++	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];++#define R(a, b, c, d, e, f, g, h, k, w)			\+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w;	\+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\+	d += t1;					\+	h = t1 + t2++	for (i = 0; i < 80; i += 8) {+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);+	}++#undef R++	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;+}++void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return cryptonite_sha512_update(ctx, data, len);+}++void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)+{+	unsigned int index, to_fill;++	/* check for partial buffer */+	index = (unsigned int) (ctx->sz[0] & 0x7f);+	to_fill = 128 - index;++	ctx->sz[0] += len;+	if (ctx->sz[0] < len)+		ctx->sz[1]++;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		sha512_do_chunk(ctx, (uint64_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 128-block as possible */+	for (; len >= 128; len -= 128, data += 128)+		sha512_do_chunk(ctx, (uint64_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out)+{+	uint8_t intermediate[SHA512_DIGEST_SIZE];++	cryptonite_sha512_finalize(ctx, intermediate);+	memcpy(out, intermediate, SHA384_DIGEST_SIZE);+}++void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[128] = { 0x80, };+	uint32_t i, index, padlen;+	uint64_t bits[2];+	uint64_t *p = (uint64_t *) out;++	/* cpu -> big endian */+	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));+	bits[1] = cpu_to_be64((ctx->sz[0] << 3));++	/* pad out to 56 */+	index = (unsigned int) (ctx->sz[0] & 0x7f);+	padlen = (index < 112) ? (112 - index) : ((128 + 112) - index);+	cryptonite_sha512_update(ctx, padding, padlen);++	/* append length */+	cryptonite_sha512_update(ctx, (uint8_t *) bits, sizeof(bits));++	/* store to digest */+	for (i = 0; i < 8; i++)+		p[i] = cpu_to_be64(ctx->h[i]);+}++#include <stdio.h>++void cryptonite_sha512t_init(struct sha512t_ctx *tctx, int t)+{+	struct sha512_ctx *ctx = &tctx->ctx;+	memset(ctx, 0, sizeof(*ctx));+	if (t >= 512)+		return;+	tctx->t = t;++	switch (t) {+	case 224:+		ctx->h[0] = 0x8c3d37c819544da2ULL;+		ctx->h[1] = 0x73e1996689dcd4d6ULL;+		ctx->h[2] = 0x1dfab7ae32ff9c82ULL;+		ctx->h[3] = 0x679dd514582f9fcfULL;+		ctx->h[4] = 0x0f6d2b697bd44da8ULL;+		ctx->h[5] = 0x77e36f7304c48942ULL;+		ctx->h[6] = 0x3f9d85a86a1d36c8ULL;+		ctx->h[7] = 0x1112e6ad91d692a1ULL;+		break;+	case 256:+		ctx->h[0] = 0x22312194fc2bf72cULL;+		ctx->h[1] = 0x9f555fa3c84c64c2ULL;+		ctx->h[2] = 0x2393b86b6f53b151ULL;+		ctx->h[3] = 0x963877195940eabdULL;+		ctx->h[4] = 0x96283ee2a88effe3ULL;+		ctx->h[5] = 0xbe5e1e2553863992ULL;+		ctx->h[6] = 0x2b0199fc2c85b8aaULL;+		ctx->h[7] = 0x0eb72ddc81c52ca2ULL;+		break;+	default: {+		char buf[8+4];+		uint8_t out[64];+		int i;++		cryptonite_sha512_init(ctx);+		for (i = 0; i < 8; i++)+			ctx->h[i] ^= 0xa5a5a5a5a5a5a5a5ULL;++		i = sprintf(buf, "SHA-512/%d", t);+		cryptonite_sha512_update(ctx, (uint8_t *) buf, i);+		cryptonite_sha512_finalize(ctx, out);++		/* re-init the context, otherwise len is changed */+		memset(ctx, 0, sizeof(*ctx));+		for (i = 0; i < 8; i++)+			ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]);+		}+	}+}++void cryptonite_sha512t_update(struct sha512t_ctx *ctx, const uint8_t *data, uint32_t len)+{+	return cryptonite_sha512_update(&ctx->ctx, data, len);+}++void cryptonite_sha512t_finalize(struct sha512t_ctx *ctx, uint8_t *out)+{+	uint8_t intermediate[SHA512_DIGEST_SIZE];++	cryptonite_sha512_finalize(&ctx->ctx, intermediate);+	memcpy(out, intermediate, ctx->t / 8);+}+
+ cbits/cryptonite_sha512.h view
@@ -0,0 +1,65 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SHA512_H+#define CRYPTOHASH_SHA512_H++#include <stdint.h>++struct sha512_ctx+{+	uint64_t sz[2];+	uint8_t  buf[128];+	uint64_t h[8];+};++struct sha512t_ctx+{+	struct sha512_ctx ctx;+	uint64_t t; /* the custom t (e.g. 224 for SHA512/224) */+};++#define sha384_ctx sha512_ctx++#define SHA384_DIGEST_SIZE	64+#define SHA384_CTX_SIZE		sizeof(struct sha384_ctx)++#define SHA512_DIGEST_SIZE	64+#define SHA512_CTX_SIZE		sizeof(struct sha512_ctx)++#define SHA512t_CTX_SIZE	sizeof(struct sha512t_ctx)++void cryptonite_sha384_init(struct sha384_ctx *ctx);+void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out);++void cryptonite_sha512_init(struct sha512_ctx *ctx);+void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out);++/* only multiples of 8 are supported as valid t values */+void cryptonite_sha512t_init(struct sha512t_ctx *ctx, int t);+void cryptonite_sha512t_update(struct sha512t_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_sha512t_finalize(struct sha512t_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_skein.h view
@@ -0,0 +1,46 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN_H+#define CRYPTOHASH_SKEIN_H++#define SKEIN_VERSION 1ULL+#define SKEIN_IDSTRING 0x33414853ULL++/*+t0 0-63 || t1 64-127+0-95      96-111      112-118    119     120-125  126    127+Position  reserved    TreeLevel  BitPad  Type     First  Final+*/+#define FLAG_FIRST   (1ULL << 62)+#define FLAG_FINAL   (1ULL << 63)+#define FLAG_TYPE(x) (((uint64_t) ((x) & 0x3f)) << 56)++#define TYPE_KEY     0x00+#define TYPE_CFG     0x04+#define TYPE_MSG     0x30+#define TYPE_OUT     0x3f++#define SET_TYPE(ctx, ty) ctx->t0 = 0; ctx->t1 = (ty)++#endif
+ cbits/cryptonite_skein256.c view
@@ -0,0 +1,196 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_skein.h"+#include "cryptonite_skein256.h"+#include "cryptonite_bitfn.h"++static const uint8_t K256_0[2] = { 14, 16, };+static const uint8_t K256_1[2] = { 52, 57, };+static const uint8_t K256_2[2] = { 23, 40, };+static const uint8_t K256_3[2] = {  5, 37, };+static const uint8_t K256_4[2] = { 25, 33, };+static const uint8_t K256_5[2] = { 46, 12, };+static const uint8_t K256_6[2] = { 58, 22, };+static const uint8_t K256_7[2] = { 32, 32, };++static inline void skein256_do_chunk(struct skein256_ctx *ctx, uint64_t *buf, uint32_t len)+{+	uint64_t x[4];+	uint64_t ts[3];+	uint64_t ks[4+1];++	ks[4] = 0x1bd11bdaa9fc1a22ULL;+	ks[0] = ctx->h[0]; ks[4] ^= ctx->h[0];+	ks[1] = ctx->h[1]; ks[4] ^= ctx->h[1];+	ks[2] = ctx->h[2]; ks[4] ^= ctx->h[2];+	ks[3] = ctx->h[3]; ks[4] ^= ctx->h[3];++	ts[0] = ctx->t0;+	ts[1] = ctx->t1;++	ts[0] += len;++	ts[2] = ts[0] ^ ts[1];++#define INJECTKEY(r) \+	x[0] += ks[((r)+0) % (4+1)];                   \+	x[1] += ks[((r)+1) % (4+1)] + ts[((r)+0) % 3]; \+	x[2] += ks[((r)+2) % (4+1)] + ts[((r)+1) % 3]; \+	x[3] += ks[((r)+3) % (4+1)] + (r)++#define ROUND(a,b,c,d,k) \+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c];++#define PASS(i) \+	ROUND(0,1,2,3,K256_0); \+	ROUND(0,3,2,1,K256_1); \+	ROUND(0,1,2,3,K256_2); \+	ROUND(0,3,2,1,K256_3); \+	INJECTKEY((i*2) + 1);          \+	ROUND(0,1,2,3,K256_4); \+	ROUND(0,3,2,1,K256_5); \+	ROUND(0,1,2,3,K256_6); \+	ROUND(0,3,2,1,K256_7); \+	INJECTKEY((i*2) + 2)++	x[0] = le64_to_cpu(buf[0]) + ks[0];+	x[1] = le64_to_cpu(buf[1]) + ks[1] + ts[0];+	x[2] = le64_to_cpu(buf[2]) + ks[2] + ts[1];+	x[3] = le64_to_cpu(buf[3]) + ks[3];++	/* 9 pass of 8 rounds = 72 rounds */+	PASS(0);+	PASS(1);+	PASS(2);+	PASS(3);+	PASS(4);+	PASS(5);+	PASS(6);+	PASS(7);+	PASS(8);++	ts[1] &= ~FLAG_FIRST;+	ctx->t0 = ts[0];+	ctx->t1 = ts[1];++	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);+}++void cryptonite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen)+{+	uint64_t buf[4];+	memset(ctx, 0, sizeof(*ctx));++	ctx->hashlen = (hashlen + 7) >> 3;+	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));+	+	memset(buf, '\0', sizeof(buf));+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);+	buf[1] = cpu_to_le64(hashlen);+	buf[2] = 0; /* tree info, not implemented */+	skein256_do_chunk(ctx, buf, 4*8);++	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));+}++void cryptonite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	if (!len)+		return;++	to_fill = 32 - ctx->bufindex;++	if (ctx->bufindex == 32) {+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block+	 * and there's without doubt further blocks */+	if (ctx->bufindex && len > to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	/* process as much 32-block as possible except the last one in case we finalize */+	for (; len > 32; len -= 32, data += 32)+		skein256_do_chunk(ctx, (uint64_t *) data, 32);++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void cryptonite_skein256_finalize(struct skein256_ctx *ctx, uint8_t *out)+{+	uint32_t outsize;+	uint64_t *p = (uint64_t *) out;+	uint64_t x[4];+	int i, j, n;++	ctx->t1 |= FLAG_FINAL;+	/* if buf is not complete pad with 0 bytes */+	if (ctx->bufindex < 32)+		memset(ctx->buf + ctx->bufindex, '\0', 32 - ctx->bufindex);+	skein256_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);++	memset(ctx->buf, '\0', 32);++	/* make sure we have a 8 bit rounded value */+	outsize = ctx->hashlen;++	/* backup h[0--4] */+	for (j = 0; j < 4; j++)+		x[j] = ctx->h[j];+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */+	for (i = 0; i*32 < outsize; i++) {+		uint64_t w[4];+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));++		n = outsize - i * 32;+		if (n >= 32) n = 32;++		cpu_to_le64_array(w, ctx->h, 4);+		memcpy(out + i*32, w, n);++		/* restore h[0--4] */+		for (j = 0; j < 4; j++)+			ctx->h[j] = x[j];+	}+}
+ cbits/cryptonite_skein256.h view
@@ -0,0 +1,45 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN256_H+#define CRYPTOHASH_SKEIN256_H++#include <stdint.h>++struct skein256_ctx+{+	uint32_t hashlen;+	uint32_t bufindex;+	uint8_t  buf[32];+	uint64_t h[4];+	uint64_t t0;+	uint64_t t1;+};++#define SKEIN256_CTX_SIZE		sizeof(struct skein256_ctx)++void cryponite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen);+void cryponite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len);+void cryponite_skein256_finalize(struct skein256_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_skein512.c view
@@ -0,0 +1,214 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_skein.h"+#include "cryptonite_skein512.h"+#include "cryptonite_bitfn.h"++static const uint8_t K512_0[4] = { 46, 36, 19, 37, };+static const uint8_t K512_1[4] = { 33, 27, 14, 42, };+static const uint8_t K512_2[4] = { 17, 49, 36, 39, };+static const uint8_t K512_3[4] = { 44,  9, 54, 56, };+static const uint8_t K512_4[4] = { 39, 30, 34, 24, };+static const uint8_t K512_5[4] = { 13, 50, 10, 17, };+static const uint8_t K512_6[4] = { 25, 29, 39, 43, };+static const uint8_t K512_7[4] = {  8, 35, 56, 22, };++static inline void skein512_do_chunk(struct skein512_ctx *ctx, uint64_t *buf, uint32_t len)+{+	uint64_t x[8];+	uint64_t ts[3];+	uint64_t ks[8+1];++	ks[8] = 0x1bd11bdaa9fc1a22ULL;+	ks[0] = ctx->h[0]; ks[8] ^= ctx->h[0];+	ks[1] = ctx->h[1]; ks[8] ^= ctx->h[1];+	ks[2] = ctx->h[2]; ks[8] ^= ctx->h[2];+	ks[3] = ctx->h[3]; ks[8] ^= ctx->h[3];+	ks[4] = ctx->h[4]; ks[8] ^= ctx->h[4];+	ks[5] = ctx->h[5]; ks[8] ^= ctx->h[5];+	ks[6] = ctx->h[6]; ks[8] ^= ctx->h[6];+	ks[7] = ctx->h[7]; ks[8] ^= ctx->h[7];++	ts[0] = ctx->t0;+	ts[1] = ctx->t1;++	ts[0] += len;++	ts[2] = ts[0] ^ ts[1];++#define INJECTKEY(r) \+	x[0] += ks[((r)+0) % (8+1)];                   \+	x[1] += ks[((r)+1) % (8+1)];                   \+	x[2] += ks[((r)+2) % (8+1)];                   \+	x[3] += ks[((r)+3) % (8+1)];                   \+	x[4] += ks[((r)+4) % (8+1)];                   \+	x[5] += ks[((r)+5) % (8+1)] + ts[((r)+0) % 3]; \+	x[6] += ks[((r)+6) % (8+1)] + ts[((r)+1) % 3]; \+	x[7] += ks[((r)+7) % (8+1)] + (r)++#define ROUND(a,b,c,d,e,f,g,h,k) \+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c]; \+	x[e] += x[f]; x[f] = rol64(x[f],k[2]); x[f] ^= x[e]; \+	x[g] += x[h]; x[h] = rol64(x[h],k[3]); x[h] ^= x[g];++#define PASS(i) \+	ROUND(0,1,2,3,4,5,6,7,K512_0); \+	ROUND(2,1,4,7,6,5,0,3,K512_1); \+	ROUND(4,1,6,3,0,5,2,7,K512_2); \+	ROUND(6,1,0,7,2,5,4,3,K512_3); \+	INJECTKEY((i*2) + 1);          \+	ROUND(0,1,2,3,4,5,6,7,K512_4); \+	ROUND(2,1,4,7,6,5,0,3,K512_5); \+	ROUND(4,1,6,3,0,5,2,7,K512_6); \+	ROUND(6,1,0,7,2,5,4,3,K512_7); \+	INJECTKEY((i*2) + 2)++	x[0] = le64_to_cpu(buf[0]) + ks[0];+	x[1] = le64_to_cpu(buf[1]) + ks[1];+	x[2] = le64_to_cpu(buf[2]) + ks[2];+	x[3] = le64_to_cpu(buf[3]) + ks[3];+	x[4] = le64_to_cpu(buf[4]) + ks[4];+	x[5] = le64_to_cpu(buf[5]) + ks[5] + ts[0];+	x[6] = le64_to_cpu(buf[6]) + ks[6] + ts[1];+	x[7] = le64_to_cpu(buf[7]) + ks[7];++	/* 9 pass of 8 rounds = 72 rounds */+	PASS(0);+	PASS(1);+	PASS(2);+	PASS(3);+	PASS(4);+	PASS(5);+	PASS(6);+	PASS(7);+	PASS(8);++	ts[1] &= ~FLAG_FIRST;+	ctx->t0 = ts[0];+	ctx->t1 = ts[1];++	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);+        ctx->h[4] = x[4] ^ cpu_to_le64(buf[4]);+        ctx->h[5] = x[5] ^ cpu_to_le64(buf[5]);+        ctx->h[6] = x[6] ^ cpu_to_le64(buf[6]);+        ctx->h[7] = x[7] ^ cpu_to_le64(buf[7]);+}++void cryptonite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen)+{+	uint64_t buf[8];+	memset(ctx, 0, sizeof(*ctx));++	ctx->hashlen = (hashlen + 7) >> 3;+	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));+	+	memset(buf, '\0', sizeof(buf));+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);+	buf[1] = cpu_to_le64(hashlen);+	buf[2] = 0; /* tree info, not implemented */+	skein512_do_chunk(ctx, buf, 4*8);++	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));+}++void cryptonite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t to_fill;++	if (!len)+		return;++	to_fill = 64 - ctx->bufindex;++	if (ctx->bufindex == 64) {+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);+		ctx->bufindex = 0;+	}++	/* process partial buffer if there's enough data to make a block+	 * and there's without doubt further blocks */+	if (ctx->bufindex && len > to_fill) {+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);+		len -= to_fill;+		data += to_fill;+		ctx->bufindex = 0;+	}++	/* process as much 64-block as possible except the last one in case we finalize */+	for (; len > 64; len -= 64, data += 64)+		skein512_do_chunk(ctx, (uint64_t *) data, 64);++	/* append data into buf */+	if (len) {+		memcpy(ctx->buf + ctx->bufindex, data, len);+		ctx->bufindex += len;+	}+}++void cryptonite_skein512_finalize(struct skein512_ctx *ctx, uint8_t *out)+{+	uint32_t outsize;+	uint64_t *p = (uint64_t *) out;+	uint64_t x[8];+	int i, j, n;++	ctx->t1 |= FLAG_FINAL;+	/* if buf is not complete pad with 0 bytes */+	if (ctx->bufindex < 64)+		memset(ctx->buf + ctx->bufindex, '\0', 64 - ctx->bufindex);+	skein512_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);++	memset(ctx->buf, '\0', 64);++	/* make sure we have a 8 bit rounded value */+	outsize = ctx->hashlen;++	/* backup h[0--7] */+	for (j = 0; j < 8; j++)+		x[j] = ctx->h[j];+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */+	for (i = 0; i*64 < outsize; i++) {+		uint64_t w[8];+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));++		n = outsize - i * 64;+		if (n >= 64) n = 64;++		cpu_to_le64_array(w, ctx->h, 8);+		memcpy(out + i*64, w, n);++		/* restore h[0--7] */+		for (j = 0; j < 8; j++)+			ctx->h[j] = x[j];+	}+}
+ cbits/cryptonite_skein512.h view
@@ -0,0 +1,45 @@+/*+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_SKEIN512_H+#define CRYPTOHASH_SKEIN512_H++#include <stdint.h>++struct skein512_ctx+{+	uint32_t hashlen; /* in bytes, typically 384/8, 512/8 */+	uint32_t bufindex;+	uint8_t  buf[64];+	uint64_t h[8];+	uint64_t t0;+	uint64_t t1;+};++#define SKEIN512_CTX_SIZE		sizeof(struct skein512_ctx)++void cryponite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen);+void cryponite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len);+void cryponite_skein512_finalize(struct skein512_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_tiger.c view
@@ -0,0 +1,415 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#include <string.h>+#include "cryptonite_tiger.h"+#include "cryptonite_bitfn.h"++static const uint64_t t1[256] = {+	0x02aab17cf7e90c5eULL,0xac424b03e243a8ecULL,0x72cd5be30dd5fcd3ULL,0x6d019b93f6f97f3aULL,+	0xcd9978ffd21f9193ULL,0x7573a1c9708029e2ULL,0xb164326b922a83c3ULL,0x46883eee04915870ULL,+	0xeaace3057103ece6ULL,0xc54169b808a3535cULL,0x4ce754918ddec47cULL,0x0aa2f4dfdc0df40cULL,+	0x10b76f18a74dbefaULL,0xc6ccb6235ad1ab6aULL,0x13726121572fe2ffULL,0x1a488c6f199d921eULL,+	0x4bc9f9f4da0007caULL,0x26f5e6f6e85241c7ULL,0x859079dbea5947b6ULL,0x4f1885c5c99e8c92ULL,+	0xd78e761ea96f864bULL,0x8e36428c52b5c17dULL,0x69cf6827373063c1ULL,0xb607c93d9bb4c56eULL,+	0x7d820e760e76b5eaULL,0x645c9cc6f07fdc42ULL,0xbf38a078243342e0ULL,0x5f6b343c9d2e7d04ULL,+	0xf2c28aeb600b0ec6ULL,0x6c0ed85f7254bcacULL,0x71592281a4db4fe5ULL,0x1967fa69ce0fed9fULL,+	0xfd5293f8b96545dbULL,0xc879e9d7f2a7600bULL,0x860248920193194eULL,0xa4f9533b2d9cc0b3ULL,+	0x9053836c15957613ULL,0xdb6dcf8afc357bf1ULL,0x18beea7a7a370f57ULL,0x037117ca50b99066ULL,+	0x6ab30a9774424a35ULL,0xf4e92f02e325249bULL,0x7739db07061ccae1ULL,0xd8f3b49ceca42a05ULL,+	0xbd56be3f51382f73ULL,0x45faed5843b0bb28ULL,0x1c813d5c11bf1f83ULL,0x8af0e4b6d75fa169ULL,+	0x33ee18a487ad9999ULL,0x3c26e8eab1c94410ULL,0xb510102bc0a822f9ULL,0x141eef310ce6123bULL,+	0xfc65b90059ddb154ULL,0xe0158640c5e0e607ULL,0x884e079826c3a3cfULL,0x930d0d9523c535fdULL,+	0x35638d754e9a2b00ULL,0x4085fccf40469dd5ULL,0xc4b17ad28be23a4cULL,0xcab2f0fc6a3e6a2eULL,+	0x2860971a6b943fcdULL,0x3dde6ee212e30446ULL,0x6222f32ae01765aeULL,0x5d550bb5478308feULL,+	0xa9efa98da0eda22aULL,0xc351a71686c40da7ULL,0x1105586d9c867c84ULL,0xdcffee85fda22853ULL,+	0xccfbd0262c5eef76ULL,0xbaf294cb8990d201ULL,0xe69464f52afad975ULL,0x94b013afdf133e14ULL,+	0x06a7d1a32823c958ULL,0x6f95fe5130f61119ULL,0xd92ab34e462c06c0ULL,0xed7bde33887c71d2ULL,+	0x79746d6e6518393eULL,0x5ba419385d713329ULL,0x7c1ba6b948a97564ULL,0x31987c197bfdac67ULL,+	0xde6c23c44b053d02ULL,0x581c49fed002d64dULL,0xdd474d6338261571ULL,0xaa4546c3e473d062ULL,+	0x928fce349455f860ULL,0x48161bbacaab94d9ULL,0x63912430770e6f68ULL,0x6ec8a5e602c6641cULL,+	0x87282515337ddd2bULL,0x2cda6b42034b701bULL,0xb03d37c181cb096dULL,0xe108438266c71c6fULL,+	0x2b3180c7eb51b255ULL,0xdf92b82f96c08bbcULL,0x5c68c8c0a632f3baULL,0x5504cc861c3d0556ULL,+	0xabbfa4e55fb26b8fULL,0x41848b0ab3baceb4ULL,0xb334a273aa445d32ULL,0xbca696f0a85ad881ULL,+	0x24f6ec65b528d56cULL,0x0ce1512e90f4524aULL,0x4e9dd79d5506d35aULL,0x258905fac6ce9779ULL,+	0x2019295b3e109b33ULL,0xf8a9478b73a054ccULL,0x2924f2f934417eb0ULL,0x3993357d536d1bc4ULL,+	0x38a81ac21db6ff8bULL,0x47c4fbf17d6016bfULL,0x1e0faadd7667e3f5ULL,0x7abcff62938beb96ULL,+	0xa78dad948fc179c9ULL,0x8f1f98b72911e50dULL,0x61e48eae27121a91ULL,0x4d62f7ad31859808ULL,+	0xeceba345ef5ceaebULL,0xf5ceb25ebc9684ceULL,0xf633e20cb7f76221ULL,0xa32cdf06ab8293e4ULL,+	0x985a202ca5ee2ca4ULL,0xcf0b8447cc8a8fb1ULL,0x9f765244979859a3ULL,0xa8d516b1a1240017ULL,+	0x0bd7ba3ebb5dc726ULL,0xe54bca55b86adb39ULL,0x1d7a3afd6c478063ULL,0x519ec608e7669eddULL,+	0x0e5715a2d149aa23ULL,0x177d4571848ff194ULL,0xeeb55f3241014c22ULL,0x0f5e5ca13a6e2ec2ULL,+	0x8029927b75f5c361ULL,0xad139fabc3d6e436ULL,0x0d5df1a94ccf402fULL,0x3e8bd948bea5dfc8ULL,+	0xa5a0d357bd3ff77eULL,0xa2d12e251f74f645ULL,0x66fd9e525e81a082ULL,0x2e0c90ce7f687a49ULL,+	0xc2e8bcbeba973bc5ULL,0x000001bce509745fULL,0x423777bbe6dab3d6ULL,0xd1661c7eaef06eb5ULL,+	0xa1781f354daacfd8ULL,0x2d11284a2b16affcULL,0xf1fc4f67fa891d1fULL,0x73ecc25dcb920adaULL,+	0xae610c22c2a12651ULL,0x96e0a810d356b78aULL,0x5a9a381f2fe7870fULL,0xd5ad62ede94e5530ULL,+	0xd225e5e8368d1427ULL,0x65977b70c7af4631ULL,0x99f889b2de39d74fULL,0x233f30bf54e1d143ULL,+	0x9a9675d3d9a63c97ULL,0x5470554ff334f9a8ULL,0x166acb744a4f5688ULL,0x70c74caab2e4aeadULL,+	0xf0d091646f294d12ULL,0x57b82a89684031d1ULL,0xefd95a5a61be0b6bULL,0x2fbd12e969f2f29aULL,+	0x9bd37013feff9fe8ULL,0x3f9b0404d6085a06ULL,0x4940c1f3166cfe15ULL,0x09542c4dcdf3defbULL,+	0xb4c5218385cd5ce3ULL,0xc935b7dc4462a641ULL,0x3417f8a68ed3b63fULL,0xb80959295b215b40ULL,+	0xf99cdaef3b8c8572ULL,0x018c0614f8fcb95dULL,0x1b14accd1a3acdf3ULL,0x84d471f200bb732dULL,+	0xc1a3110e95e8da16ULL,0x430a7220bf1a82b8ULL,0xb77e090d39df210eULL,0x5ef4bd9f3cd05e9dULL,+	0x9d4ff6da7e57a444ULL,0xda1d60e183d4a5f8ULL,0xb287c38417998e47ULL,0xfe3edc121bb31886ULL,+	0xc7fe3ccc980ccbefULL,0xe46fb590189bfd03ULL,0x3732fd469a4c57dcULL,0x7ef700a07cf1ad65ULL,+	0x59c64468a31d8859ULL,0x762fb0b4d45b61f6ULL,0x155baed099047718ULL,0x68755e4c3d50baa6ULL,+	0xe9214e7f22d8b4dfULL,0x2addbf532eac95f4ULL,0x32ae3909b4bd0109ULL,0x834df537b08e3450ULL,+	0xfa209da84220728dULL,0x9e691d9b9efe23f7ULL,0x0446d288c4ae8d7fULL,0x7b4cc524e169785bULL,+	0x21d87f0135ca1385ULL,0xcebb400f137b8aa5ULL,0x272e2b66580796beULL,0x3612264125c2b0deULL,+	0x057702bdad1efbb2ULL,0xd4babb8eacf84be9ULL,0x91583139641bc67bULL,0x8bdc2de08036e024ULL,+	0x603c8156f49f68edULL,0xf7d236f7dbef5111ULL,0x9727c4598ad21e80ULL,0xa08a0896670a5fd7ULL,+	0xcb4a8f4309eba9cbULL,0x81af564b0f7036a1ULL,0xc0b99aa778199abdULL,0x959f1ec83fc8e952ULL,+	0x8c505077794a81b9ULL,0x3acaaf8f056338f0ULL,0x07b43f50627a6778ULL,0x4a44ab49f5eccc77ULL,+	0x3bc3d6e4b679ee98ULL,0x9cc0d4d1cf14108cULL,0x4406c00b206bc8a0ULL,0x82a18854c8d72d89ULL,+	0x67e366b35c3c432cULL,0xb923dd61102b37f2ULL,0x56ab2779d884271dULL,0xbe83e1b0ff1525afULL,+	0xfb7c65d4217e49a9ULL,0x6bdbe0e76d48e7d4ULL,0x08df828745d9179eULL,0x22ea6a9add53bd34ULL,+	0xe36e141c5622200aULL,0x7f805d1b8cb750eeULL,0xafe5c7a59f58e837ULL,0xe27f996a4fb1c23cULL,+	0xd3867dfb0775f0d0ULL,0xd0e673de6e88891aULL,0x123aeb9eafb86c25ULL,0x30f1d5d5c145b895ULL,+	0xbb434a2dee7269e7ULL,0x78cb67ecf931fa38ULL,0xf33b0372323bbf9cULL,0x52d66336fb279c74ULL,+	0x505f33ac0afb4eaaULL,0xe8a5cd99a2cce187ULL,0x534974801e2d30bbULL,0x8d2d5711d5876d90ULL,+	0x1f1a412891bc038eULL,0xd6e2e71d82e56648ULL,0x74036c3a497732b7ULL,0x89b67ed96361f5abULL,+	0xffed95d8f1ea02a2ULL,0xe72b3bd61464d43dULL,0xa6300f170bdc4820ULL,0xebc18760ed78a77aULL,+};++static const uint64_t t2[256] =+{+	0xe6a6be5a05a12138ULL,0xb5a122a5b4f87c98ULL,0x563c6089140b6990ULL,0x4c46cb2e391f5dd5ULL,+	0xd932addbc9b79434ULL,0x08ea70e42015aff5ULL,0xd765a6673e478cf1ULL,0xc4fb757eab278d99ULL,+	0xdf11c6862d6e0692ULL,0xddeb84f10d7f3b16ULL,0x6f2ef604a665ea04ULL,0x4a8e0f0ff0e0dfb3ULL,+	0xa5edeef83dbcba51ULL,0xfc4f0a2a0ea4371eULL,0xe83e1da85cb38429ULL,0xdc8ff882ba1b1ce2ULL,+	0xcd45505e8353e80dULL,0x18d19a00d4db0717ULL,0x34a0cfeda5f38101ULL,0x0be77e518887caf2ULL,+	0x1e341438b3c45136ULL,0xe05797f49089ccf9ULL,0xffd23f9df2591d14ULL,0x543dda228595c5cdULL,+	0x661f81fd99052a33ULL,0x8736e641db0f7b76ULL,0x15227725418e5307ULL,0xe25f7f46162eb2faULL,+	0x48a8b2126c13d9feULL,0xafdc541792e76eeaULL,0x03d912bfc6d1898fULL,0x31b1aafa1b83f51bULL,+	0xf1ac2796e42ab7d9ULL,0x40a3a7d7fcd2ebacULL,0x1056136d0afbbcc5ULL,0x7889e1dd9a6d0c85ULL,+	0xd33525782a7974aaULL,0xa7e25d09078ac09bULL,0xbd4138b3eac6edd0ULL,0x920abfbe71eb9e70ULL,+	0xa2a5d0f54fc2625cULL,0xc054e36b0b1290a3ULL,0xf6dd59ff62fe932bULL,0x3537354511a8ac7dULL,+	0xca845e9172fadcd4ULL,0x84f82b60329d20dcULL,0x79c62ce1cd672f18ULL,0x8b09a2add124642cULL,+	0xd0c1e96a19d9e726ULL,0x5a786a9b4ba9500cULL,0x0e020336634c43f3ULL,0xc17b474aeb66d822ULL,+	0x6a731ae3ec9baac2ULL,0x8226667ae0840258ULL,0x67d4567691caeca5ULL,0x1d94155c4875adb5ULL,+	0x6d00fd985b813fdfULL,0x51286efcb774cd06ULL,0x5e8834471fa744afULL,0xf72ca0aee761ae2eULL,+	0xbe40e4cdaee8e09aULL,0xe9970bbb5118f665ULL,0x726e4beb33df1964ULL,0x703b000729199762ULL,+	0x4631d816f5ef30a7ULL,0xb880b5b51504a6beULL,0x641793c37ed84b6cULL,0x7b21ed77f6e97d96ULL,+	0x776306312ef96b73ULL,0xae528948e86ff3f4ULL,0x53dbd7f286a3f8f8ULL,0x16cadce74cfc1063ULL,+	0x005c19bdfa52c6ddULL,0x68868f5d64d46ad3ULL,0x3a9d512ccf1e186aULL,0x367e62c2385660aeULL,+	0xe359e7ea77dcb1d7ULL,0x526c0773749abe6eULL,0x735ae5f9d09f734bULL,0x493fc7cc8a558ba8ULL,+	0xb0b9c1533041ab45ULL,0x321958ba470a59bdULL,0x852db00b5f46c393ULL,0x91209b2bd336b0e5ULL,+	0x6e604f7d659ef19fULL,0xb99a8ae2782ccb24ULL,0xccf52ab6c814c4c7ULL,0x4727d9afbe11727bULL,+	0x7e950d0c0121b34dULL,0x756f435670ad471fULL,0xf5add442615a6849ULL,0x4e87e09980b9957aULL,+	0x2acfa1df50aee355ULL,0xd898263afd2fd556ULL,0xc8f4924dd80c8fd6ULL,0xcf99ca3d754a173aULL,+	0xfe477bacaf91bf3cULL,0xed5371f6d690c12dULL,0x831a5c285e687094ULL,0xc5d3c90a3708a0a4ULL,+	0x0f7f903717d06580ULL,0x19f9bb13b8fdf27fULL,0xb1bd6f1b4d502843ULL,0x1c761ba38fff4012ULL,+	0x0d1530c4e2e21f3bULL,0x8943ce69a7372c8aULL,0xe5184e11feb5ce66ULL,0x618bdb80bd736621ULL,+	0x7d29bad68b574d0bULL,0x81bb613e25e6fe5bULL,0x071c9c10bc07913fULL,0xc7beeb7909ac2d97ULL,+	0xc3e58d353bc5d757ULL,0xeb017892f38f61e8ULL,0xd4effb9c9b1cc21aULL,0x99727d26f494f7abULL,+	0xa3e063a2956b3e03ULL,0x9d4a8b9a4aa09c30ULL,0x3f6ab7d500090fb4ULL,0x9cc0f2a057268ac0ULL,+	0x3dee9d2dedbf42d1ULL,0x330f49c87960a972ULL,0xc6b2720287421b41ULL,0x0ac59ec07c00369cULL,+	0xef4eac49cb353425ULL,0xf450244eef0129d8ULL,0x8acc46e5caf4deb6ULL,0x2ffeab63989263f7ULL,+	0x8f7cb9fe5d7a4578ULL,0x5bd8f7644e634635ULL,0x427a7315bf2dc900ULL,0x17d0c4aa2125261cULL,+	0x3992486c93518e50ULL,0xb4cbfee0a2d7d4c3ULL,0x7c75d6202c5ddd8dULL,0xdbc295d8e35b6c61ULL,+	0x60b369d302032b19ULL,0xce42685fdce44132ULL,0x06f3ddb9ddf65610ULL,0x8ea4d21db5e148f0ULL,+	0x20b0fce62fcd496fULL,0x2c1b912358b0ee31ULL,0xb28317b818f5a308ULL,0xa89c1e189ca6d2cfULL,+	0x0c6b18576aaadbc8ULL,0xb65deaa91299fae3ULL,0xfb2b794b7f1027e7ULL,0x04e4317f443b5bebULL,+	0x4b852d325939d0a6ULL,0xd5ae6beefb207ffcULL,0x309682b281c7d374ULL,0xbae309a194c3b475ULL,+	0x8cc3f97b13b49f05ULL,0x98a9422ff8293967ULL,0x244b16b01076ff7cULL,0xf8bf571c663d67eeULL,+	0x1f0d6758eee30da1ULL,0xc9b611d97adeb9b7ULL,0xb7afd5887b6c57a2ULL,0x6290ae846b984fe1ULL,+	0x94df4cdeacc1a5fdULL,0x058a5bd1c5483affULL,0x63166cc142ba3c37ULL,0x8db8526eb2f76f40ULL,+	0xe10880036f0d6d4eULL,0x9e0523c9971d311dULL,0x45ec2824cc7cd691ULL,0x575b8359e62382c9ULL,+	0xfa9e400dc4889995ULL,0xd1823ecb45721568ULL,0xdafd983b8206082fULL,0xaa7d29082386a8cbULL,+	0x269fcd4403b87588ULL,0x1b91f5f728bdd1e0ULL,0xe4669f39040201f6ULL,0x7a1d7c218cf04adeULL,+	0x65623c29d79ce5ceULL,0x2368449096c00bb1ULL,0xab9bf1879da503baULL,0xbc23ecb1a458058eULL,+	0x9a58df01bb401eccULL,0xa070e868a85f143dULL,0x4ff188307df2239eULL,0x14d565b41a641183ULL,+	0xee13337452701602ULL,0x950e3dcf3f285e09ULL,0x59930254b9c80953ULL,0x3bf299408930da6dULL,+	0xa955943f53691387ULL,0xa15edecaa9cb8784ULL,0x29142127352be9a0ULL,0x76f0371fff4e7afbULL,+	0x0239f450274f2228ULL,0xbb073af01d5e868bULL,0xbfc80571c10e96c1ULL,0xd267088568222e23ULL,+	0x9671a3d48e80b5b0ULL,0x55b5d38ae193bb81ULL,0x693ae2d0a18b04b8ULL,0x5c48b4ecadd5335fULL,+	0xfd743b194916a1caULL,0x2577018134be98c4ULL,0xe77987e83c54a4adULL,0x28e11014da33e1b9ULL,+	0x270cc59e226aa213ULL,0x71495f756d1a5f60ULL,0x9be853fb60afef77ULL,0xadc786a7f7443dbfULL,+	0x0904456173b29a82ULL,0x58bc7a66c232bd5eULL,0xf306558c673ac8b2ULL,0x41f639c6b6c9772aULL,+	0x216defe99fda35daULL,0x11640cc71c7be615ULL,0x93c43694565c5527ULL,0xea038e6246777839ULL,+	0xf9abf3ce5a3e2469ULL,0x741e768d0fd312d2ULL,0x0144b883ced652c6ULL,0xc20b5a5ba33f8552ULL,+	0x1ae69633c3435a9dULL,0x97a28ca4088cfdecULL,0x8824a43c1e96f420ULL,0x37612fa66eeea746ULL,+	0x6b4cb165f9cf0e5aULL,0x43aa1c06a0abfb4aULL,0x7f4dc26ff162796bULL,0x6cbacc8e54ed9b0fULL,+	0xa6b7ffefd2bb253eULL,0x2e25bc95b0a29d4fULL,0x86d6a58bdef1388cULL,0xded74ac576b6f054ULL,+	0x8030bdbc2b45805dULL,0x3c81af70e94d9289ULL,0x3eff6dda9e3100dbULL,0xb38dc39fdfcc8847ULL,+	0x123885528d17b87eULL,0xf2da0ed240b1b642ULL,0x44cefadcd54bf9a9ULL,0x1312200e433c7ee6ULL,+	0x9ffcc84f3a78c748ULL,0xf0cd1f72248576bbULL,0xec6974053638cfe4ULL,0x2ba7b67c0cec4e4cULL,+	0xac2f4df3e5ce32edULL,0xcb33d14326ea4c11ULL,0xa4e9044cc77e58bcULL,0x5f513293d934fcefULL,+	0x5dc9645506e55444ULL,0x50de418f317de40aULL,0x388cb31a69dde259ULL,0x2db4a83455820a86ULL,+	0x9010a91e84711ae9ULL,0x4df7f0b7b1498371ULL,0xd62a2eabc0977179ULL,0x22fac097aa8d5c0eULL,+}; ++static const uint64_t t3[256]= {+	0xf49fcc2ff1daf39bULL,0x487fd5c66ff29281ULL,0xe8a30667fcdca83fULL,0x2c9b4be3d2fcce63ULL,+	0xda3ff74b93fbbbc2ULL,0x2fa165d2fe70ba66ULL,0xa103e279970e93d4ULL,0xbecdec77b0e45e71ULL,+	0xcfb41e723985e497ULL,0xb70aaa025ef75017ULL,0xd42309f03840b8e0ULL,0x8efc1ad035898579ULL,+	0x96c6920be2b2abc5ULL,0x66af4163375a9172ULL,0x2174abdcca7127fbULL,0xb33ccea64a72ff41ULL,+	0xf04a4933083066a5ULL,0x8d970acdd7289af5ULL,0x8f96e8e031c8c25eULL,0xf3fec02276875d47ULL,+	0xec7bf310056190ddULL,0xf5adb0aebb0f1491ULL,0x9b50f8850fd58892ULL,0x4975488358b74de8ULL,+	0xa3354ff691531c61ULL,0x0702bbe481d2c6eeULL,0x89fb24057deded98ULL,0xac3075138596e902ULL,+	0x1d2d3580172772edULL,0xeb738fc28e6bc30dULL,0x5854ef8f63044326ULL,0x9e5c52325add3bbeULL,+	0x90aa53cf325c4623ULL,0xc1d24d51349dd067ULL,0x2051cfeea69ea624ULL,0x13220f0a862e7e4fULL,+	0xce39399404e04864ULL,0xd9c42ca47086fcb7ULL,0x685ad2238a03e7ccULL,0x066484b2ab2ff1dbULL,+	0xfe9d5d70efbf79ecULL,0x5b13b9dd9c481854ULL,0x15f0d475ed1509adULL,0x0bebcd060ec79851ULL,+	0xd58c6791183ab7f8ULL,0xd1187c5052f3eee4ULL,0xc95d1192e54e82ffULL,0x86eea14cb9ac6ca2ULL,+	0x3485beb153677d5dULL,0xdd191d781f8c492aULL,0xf60866baa784ebf9ULL,0x518f643ba2d08c74ULL,+	0x8852e956e1087c22ULL,0xa768cb8dc410ae8dULL,0x38047726bfec8e1aULL,0xa67738b4cd3b45aaULL,+	0xad16691cec0dde19ULL,0xc6d4319380462e07ULL,0xc5a5876d0ba61938ULL,0x16b9fa1fa58fd840ULL,+	0x188ab1173ca74f18ULL,0xabda2f98c99c021fULL,0x3e0580ab134ae816ULL,0x5f3b05b773645abbULL,+	0x2501a2be5575f2f6ULL,0x1b2f74004e7e8ba9ULL,0x1cd7580371e8d953ULL,0x7f6ed89562764e30ULL,+	0xb15926ff596f003dULL,0x9f65293da8c5d6b9ULL,0x6ecef04dd690f84cULL,0x4782275fff33af88ULL,+	0xe41433083f820801ULL,0xfd0dfe409a1af9b5ULL,0x4325a3342cdb396bULL,0x8ae77e62b301b252ULL,+	0xc36f9e9f6655615aULL,0x85455a2d92d32c09ULL,0xf2c7dea949477485ULL,0x63cfb4c133a39ebaULL,+	0x83b040cc6ebc5462ULL,0x3b9454c8fdb326b0ULL,0x56f56a9e87ffd78cULL,0x2dc2940d99f42bc6ULL,+	0x98f7df096b096e2dULL,0x19a6e01e3ad852bfULL,0x42a99ccbdbd4b40bULL,0xa59998af45e9c559ULL,+	0x366295e807d93186ULL,0x6b48181bfaa1f773ULL,0x1fec57e2157a0a1dULL,0x4667446af6201ad5ULL,+	0xe615ebcacfb0f075ULL,0xb8f31f4f68290778ULL,0x22713ed6ce22d11eULL,0x3057c1a72ec3c93bULL,+	0xcb46acc37c3f1f2fULL,0xdbb893fd02aaf50eULL,0x331fd92e600b9fcfULL,0xa498f96148ea3ad6ULL,+	0xa8d8426e8b6a83eaULL,0xa089b274b7735cdcULL,0x87f6b3731e524a11ULL,0x118808e5cbc96749ULL,+	0x9906e4c7b19bd394ULL,0xafed7f7e9b24a20cULL,0x6509eadeeb3644a7ULL,0x6c1ef1d3e8ef0edeULL,+	0xb9c97d43e9798fb4ULL,0xa2f2d784740c28a3ULL,0x7b8496476197566fULL,0x7a5be3e6b65f069dULL,+	0xf96330ed78be6f10ULL,0xeee60de77a076a15ULL,0x2b4bee4aa08b9bd0ULL,0x6a56a63ec7b8894eULL,+	0x02121359ba34fef4ULL,0x4cbf99f8283703fcULL,0x398071350caf30c8ULL,0xd0a77a89f017687aULL,+	0xf1c1a9eb9e423569ULL,0x8c7976282dee8199ULL,0x5d1737a5dd1f7abdULL,0x4f53433c09a9fa80ULL,+	0xfa8b0c53df7ca1d9ULL,0x3fd9dcbc886ccb77ULL,0xc040917ca91b4720ULL,0x7dd00142f9d1dcdfULL,+	0x8476fc1d4f387b58ULL,0x23f8e7c5f3316503ULL,0x032a2244e7e37339ULL,0x5c87a5d750f5a74bULL,+	0x082b4cc43698992eULL,0xdf917becb858f63cULL,0x3270b8fc5bf86ddaULL,0x10ae72bb29b5dd76ULL,+	0x576ac94e7700362bULL,0x1ad112dac61efb8fULL,0x691bc30ec5faa427ULL,0xff246311cc327143ULL,+	0x3142368e30e53206ULL,0x71380e31e02ca396ULL,0x958d5c960aad76f1ULL,0xf8d6f430c16da536ULL,+	0xc8ffd13f1be7e1d2ULL,0x7578ae66004ddbe1ULL,0x05833f01067be646ULL,0xbb34b5ad3bfe586dULL,+	0x095f34c9a12b97f0ULL,0x247ab64525d60ca8ULL,0xdcdbc6f3017477d1ULL,0x4a2e14d4decad24dULL,+	0xbdb5e6d9be0a1eebULL,0x2a7e70f7794301abULL,0xdef42d8a270540fdULL,0x01078ec0a34c22c1ULL,+	0xe5de511af4c16387ULL,0x7ebb3a52bd9a330aULL,0x77697857aa7d6435ULL,0x004e831603ae4c32ULL,+	0xe7a21020ad78e312ULL,0x9d41a70c6ab420f2ULL,0x28e06c18ea1141e6ULL,0xd2b28cbd984f6b28ULL,+	0x26b75f6c446e9d83ULL,0xba47568c4d418d7fULL,0xd80badbfe6183d8eULL,0x0e206d7f5f166044ULL,+	0xe258a43911cbca3eULL,0x723a1746b21dc0bcULL,0xc7caa854f5d7cdd3ULL,0x7cac32883d261d9cULL,+	0x7690c26423ba942cULL,0x17e55524478042b8ULL,0xe0be477656a2389fULL,0x4d289b5e67ab2da0ULL,+	0x44862b9c8fbbfd31ULL,0xb47cc8049d141365ULL,0x822c1b362b91c793ULL,0x4eb14655fb13dfd8ULL,+	0x1ecbba0714e2a97bULL,0x6143459d5cde5f14ULL,0x53a8fbf1d5f0ac89ULL,0x97ea04d81c5e5b00ULL,+	0x622181a8d4fdb3f3ULL,0xe9bcd341572a1208ULL,0x1411258643cce58aULL,0x9144c5fea4c6e0a4ULL,+	0x0d33d06565cf620fULL,0x54a48d489f219ca1ULL,0xc43e5eac6d63c821ULL,0xa9728b3a72770dafULL,+	0xd7934e7b20df87efULL,0xe35503b61a3e86e5ULL,0xcae321fbc819d504ULL,0x129a50b3ac60bfa6ULL,+	0xcd5e68ea7e9fb6c3ULL,0xb01c90199483b1c7ULL,0x3de93cd5c295376cULL,0xaed52edf2ab9ad13ULL,+	0x2e60f512c0a07884ULL,0xbc3d86a3e36210c9ULL,0x35269d9b163951ceULL,0x0c7d6e2ad0cdb5faULL,+	0x59e86297d87f5733ULL,0x298ef221898db0e7ULL,0x55000029d1a5aa7eULL,0x8bc08ae1b5061b45ULL,+	0xc2c31c2b6c92703aULL,0x94cc596baf25ef42ULL,0x0a1d73db22540456ULL,0x04b6a0f9d9c4179aULL,+	0xeffdafa2ae3d3c60ULL,0xf7c8075bb49496c4ULL,0x9cc5c7141d1cd4e3ULL,0x78bd1638218e5534ULL,+	0xb2f11568f850246aULL,0xedfabcfa9502bc29ULL,0x796ce5f2da23051bULL,0xaae128b0dc93537cULL,+	0x3a493da0ee4b29aeULL,0xb5df6b2c416895d7ULL,0xfcabbd25122d7f37ULL,0x70810b58105dc4b1ULL,+	0xe10fdd37f7882a90ULL,0x524dcab5518a3f5cULL,0x3c9e85878451255bULL,0x4029828119bd34e2ULL,+	0x74a05b6f5d3ceccbULL,0xb610021542e13ecaULL,0x0ff979d12f59e2acULL,0x6037da27e4f9cc50ULL,+	0x5e92975a0df1847dULL,0xd66de190d3e623feULL,0x5032d6b87b568048ULL,0x9a36b7ce8235216eULL,+	0x80272a7a24f64b4aULL,0x93efed8b8c6916f7ULL,0x37ddbff44cce1555ULL,0x4b95db5d4b99bd25ULL,+	0x92d3fda169812fc0ULL,0xfb1a4a9a90660bb6ULL,0x730c196946a4b9b2ULL,0x81e289aa7f49da68ULL,+	0x64669a0f83b1a05fULL,0x27b3ff7d9644f48bULL,0xcc6b615c8db675b3ULL,0x674f20b9bcebbe95ULL,+	0x6f31238275655982ULL,0x5ae488713e45cf05ULL,0xbf619f9954c21157ULL,0xeabac46040a8eae9ULL,+	0x454c6fe9f2c0c1cdULL,0x419cf6496412691cULL,0xd3dc3bef265b0f70ULL,0x6d0e60f5c3578a9eULL,+};++static const uint64_t t4[256]=+{+	0x5b0e608526323c55ULL,0x1a46c1a9fa1b59f5ULL, 0xa9e245a17c4c8ffaULL,0x65ca5159db2955d7ULL,+	0x05db0a76ce35afc2ULL,0x81eac77ea9113d45ULL, 0x528ef88ab6ac0a0dULL,0xa09ea253597be3ffULL,+	0x430ddfb3ac48cd56ULL,0xc4b3a67af45ce46fULL, 0x4ececfd8fbe2d05eULL,0x3ef56f10b39935f0ULL,+	0x0b22d6829cd619c6ULL,0x17fd460a74df2069ULL, 0x6cf8cc8e8510ed40ULL,0xd6c824bf3a6ecaa7ULL,+	0x61243d581a817049ULL,0x048bacb6bbc163a2ULL, 0xd9a38ac27d44cc32ULL,0x7fddff5baaf410abULL,+	0xad6d495aa804824bULL,0xe1a6a74f2d8c9f94ULL, 0xd4f7851235dee8e3ULL,0xfd4b7f886540d893ULL,+	0x247c20042aa4bfdaULL,0x096ea1c517d1327cULL, 0xd56966b4361a6685ULL,0x277da5c31221057dULL,+	0x94d59893a43acff7ULL,0x64f0c51ccdc02281ULL, 0x3d33bcc4ff6189dbULL,0xe005cb184ce66af1ULL,+	0xff5ccd1d1db99beaULL,0xb0b854a7fe42980fULL, 0x7bd46a6a718d4b9fULL,0xd10fa8cc22a5fd8cULL,+	0xd31484952be4bd31ULL,0xc7fa975fcb243847ULL, 0x4886ed1e5846c407ULL,0x28cddb791eb70b04ULL,+	0xc2b00be2f573417fULL,0x5c9590452180f877ULL, 0x7a6bddfff370eb00ULL,0xce509e38d6d9d6a4ULL,+	0xebeb0f00647fa702ULL,0x1dcc06cf76606f06ULL, 0xe4d9f28ba286ff0aULL,0xd85a305dc918c262ULL,+	0x475b1d8732225f54ULL,0x2d4fb51668ccb5feULL, 0xa679b9d9d72bba20ULL,0x53841c0d912d43a5ULL,+	0x3b7eaa48bf12a4e8ULL,0x781e0e47f22f1ddfULL, 0xeff20ce60ab50973ULL,0x20d261d19dffb742ULL,+	0x16a12b03062a2e39ULL,0x1960eb2239650495ULL, 0x251c16fed50eb8b8ULL,0x9ac0c330f826016eULL,+	0xed152665953e7671ULL,0x02d63194a6369570ULL, 0x5074f08394b1c987ULL,0x70ba598c90b25ce1ULL,+	0x794a15810b9742f6ULL,0x0d5925e9fcaf8c6cULL, 0x3067716cd868744eULL,0x910ab077e8d7731bULL,+	0x6a61bbdb5ac42f61ULL,0x93513efbf0851567ULL, 0xf494724b9e83e9d5ULL,0xe887e1985c09648dULL,+	0x34b1d3c675370cfdULL,0xdc35e433bc0d255dULL, 0xd0aab84234131be0ULL,0x08042a50b48b7eafULL,+	0x9997c4ee44a3ab35ULL,0x829a7b49201799d0ULL, 0x263b8307b7c54441ULL,0x752f95f4fd6a6ca6ULL,+	0x927217402c08c6e5ULL,0x2a8ab754a795d9eeULL, 0xa442f7552f72943dULL,0x2c31334e19781208ULL,+	0x4fa98d7ceaee6291ULL,0x55c3862f665db309ULL, 0xbd0610175d53b1f3ULL,0x46fe6cb840413f27ULL,+	0x3fe03792df0cfa59ULL,0xcfe700372eb85e8fULL, 0xa7be29e7adbce118ULL,0xe544ee5cde8431ddULL,+	0x8a781b1b41f1873eULL,0xa5c94c78a0d2f0e7ULL, 0x39412e2877b60728ULL,0xa1265ef3afc9a62cULL,+	0xbcc2770c6a2506c5ULL,0x3ab66dd5dce1ce12ULL, 0xe65499d04a675b37ULL,0x7d8f523481bfd216ULL,+	0x0f6f64fcec15f389ULL,0x74efbe618b5b13c8ULL, 0xacdc82b714273e1dULL,0xdd40bfe003199d17ULL,+	0x37e99257e7e061f8ULL,0xfa52626904775aaaULL, 0x8bbbf63a463d56f9ULL,0xf0013f1543a26e64ULL,+	0xa8307e9f879ec898ULL,0xcc4c27a4150177ccULL, 0x1b432f2cca1d3348ULL,0xde1d1f8f9f6fa013ULL,+	0x606602a047a7ddd6ULL,0xd237ab64cc1cb2c7ULL, 0x9b938e7225fcd1d3ULL,0xec4e03708e0ff476ULL,+	0xfeb2fbda3d03c12dULL,0xae0bced2ee43889aULL, 0x22cb8923ebfb4f43ULL,0x69360d013cf7396dULL,+	0x855e3602d2d4e022ULL,0x073805bad01f784cULL, 0x33e17a133852f546ULL,0xdf4874058ac7b638ULL,+	0xba92b29c678aa14aULL,0x0ce89fc76cfaadcdULL, 0x5f9d4e0908339e34ULL,0xf1afe9291f5923b9ULL,+	0x6e3480f60f4a265fULL,0xeebf3a2ab29b841cULL, 0xe21938a88f91b4adULL,0x57dfeff845c6d3c3ULL,+	0x2f006b0bf62caaf2ULL,0x62f479ef6f75ee78ULL, 0x11a55ad41c8916a9ULL,0xf229d29084fed453ULL,+	0x42f1c27b16b000e6ULL,0x2b1f76749823c074ULL, 0x4b76eca3c2745360ULL,0x8c98f463b91691bdULL,+	0x14bcc93cf1ade66aULL,0x8885213e6d458397ULL, 0x8e177df0274d4711ULL,0xb49b73b5503f2951ULL,+	0x10168168c3f96b6bULL,0x0e3d963b63cab0aeULL, 0x8dfc4b5655a1db14ULL,0xf789f1356e14de5cULL,+	0x683e68af4e51dac1ULL,0xc9a84f9d8d4b0fd9ULL, 0x3691e03f52a0f9d1ULL,0x5ed86e46e1878e80ULL,+	0x3c711a0e99d07150ULL,0x5a0865b20c4e9310ULL, 0x56fbfc1fe4f0682eULL,0xea8d5de3105edf9bULL,+	0x71abfdb12379187aULL,0x2eb99de1bee77b9cULL, 0x21ecc0ea33cf4523ULL,0x59a4d7521805c7a1ULL,+	0x3896f5eb56ae7c72ULL,0xaa638f3db18f75dcULL, 0x9f39358dabe9808eULL,0xb7defa91c00b72acULL,+	0x6b5541fd62492d92ULL,0x6dc6dee8f92e4d5bULL, 0x353f57abc4beea7eULL,0x735769d6da5690ceULL,+	0x0a234aa642391484ULL,0xf6f9508028f80d9dULL, 0xb8e319a27ab3f215ULL,0x31ad9c1151341a4dULL,+	0x773c22a57bef5805ULL,0x45c7561a07968633ULL, 0xf913da9e249dbe36ULL,0xda652d9b78a64c68ULL,+	0x4c27a97f3bc334efULL,0x76621220e66b17f4ULL, 0x967743899acd7d0bULL,0xf3ee5bcae0ed6782ULL,+	0x409f753600c879fcULL,0x06d09a39b5926db6ULL, 0x6f83aeb0317ac588ULL,0x01e6ca4a86381f21ULL,+	0x66ff3462d19f3025ULL,0x72207c24ddfd3bfbULL, 0x4af6b6d3e2ece2ebULL,0x9c994dbec7ea08deULL,+	0x49ace597b09a8bc4ULL,0xb38c4766cf0797baULL, 0x131b9373c57c2a75ULL,0xb1822cce61931e58ULL,+	0x9d7555b909ba1c0cULL,0x127fafdd937d11d2ULL, 0x29da3badc66d92e4ULL,0xa2c1d57154c2ecbcULL,+	0x58c5134d82f6fe24ULL,0x1c3ae3515b62274fULL, 0xe907c82e01cb8126ULL,0xf8ed091913e37fcbULL,+	0x3249d8f9c80046c9ULL,0x80cf9bede388fb63ULL, 0x1881539a116cf19eULL,0x5103f3f76bd52457ULL,+	0x15b7e6f5ae47f7a8ULL,0xdbd7c6ded47e9ccfULL, 0x44e55c410228bb1aULL,0xb647d4255edb4e99ULL,+	0x5d11882bb8aafc30ULL,0xf5098bbb29d3212aULL, 0x8fb5ea14e90296b3ULL,0x677b942157dd025aULL,+	0xfb58e7c0a390acb5ULL,0x89d3674c83bd4a01ULL, 0x9e2da4df4bf3b93bULL,0xfcc41e328cab4829ULL,+	0x03f38c96ba582c52ULL,0xcad1bdbd7fd85db2ULL, 0xbbb442c16082ae83ULL,0xb95fe86ba5da9ab0ULL,+	0xb22e04673771a93fULL,0x845358c9493152d8ULL, 0xbe2a488697b4541eULL,0x95a2dc2dd38e6966ULL,+	0xc02c11ac923c852bULL,0x2388b1990df2a87bULL, 0x7c8008fa1b4f37beULL,0x1f70d0c84d54e503ULL,+	0x5490adec7ece57d4ULL,0x002b3c27d9063a3aULL, 0x7eaea3848030a2bfULL,0xc602326ded2003c0ULL,+	0x83a7287d69a94086ULL,0xc57a5fcb30f57a8aULL, 0xb56844e479ebe779ULL,0xa373b40f05dcbce9ULL,+	0xd71a786e88570ee2ULL,0x879cbacdbde8f6a0ULL, 0x976ad1bcc164a32fULL,0xab21e25e9666d78bULL,+	0x901063aae5e5c33cULL,0x9818b34448698d90ULL, 0xe36487ae3e1e8abbULL,0xafbdf931893bdcb4ULL,+	0x6345a0dc5fbbd519ULL,0x8628fe269b9465caULL, 0x1e5d01603f9c51ecULL,0x4de44006a15049b7ULL,+	0xbf6c70e5f776cbb1ULL,0x411218f2ef552bedULL, 0xcb0c0708705a36a3ULL,0xe74d14754f986044ULL,+	0xcd56d9430ea8280eULL,0xc12591d7535f5065ULL, 0xc83223f1720aef96ULL,0xc3a0396f7363a51fULL,+}; ++void cryptonite_tiger_init(struct tiger_ctx *ctx)+{+	memset(ctx, 0, sizeof(*ctx));++	ctx->h[0] = 0x0123456789abcdefULL;+	ctx->h[1] = 0xfedcba9876543210ULL;+	ctx->h[2] = 0xf096a5b4c3b2e187ULL;+}++static inline void tiger_do_chunk(struct tiger_ctx *ctx, uint64_t *buf)+{+	uint64_t x0, x1, x2, x3, x4, x5, x6, x7;+	uint64_t a,b,c;+	a = ctx->h[0];+	b = ctx->h[1];+	c = ctx->h[2];++	x0 = cpu_to_le64(buf[0]); x1 = cpu_to_le64(buf[1]); x2 = cpu_to_le64(buf[2]); x3 = cpu_to_le64(buf[3]);+	x4 = cpu_to_le64(buf[4]); x5 = cpu_to_le64(buf[5]); x6 = cpu_to_le64(buf[6]); x7 = cpu_to_le64(buf[7]);++#define BYTEOF(c, n) ((uint8_t) (c >> ((n * 8))))++#define ROUND(a,b,c,x,mul)                                                          \+	c ^= x;                                                                     \+	a -= t1[BYTEOF(c,0)] ^ t2[BYTEOF(c,2)] ^ t3[BYTEOF(c,4)] ^ t4[BYTEOF(c,6)]; \+	b += t4[BYTEOF(c,1)] ^ t3[BYTEOF(c,3)] ^ t2[BYTEOF(c,5)] ^ t1[BYTEOF(c,7)]; \+	b *= mul;++#define PASS(a,b,c,mul)	     \+	ROUND(a,b,c,x0,mul); \+	ROUND(b,c,a,x1,mul); \+	ROUND(c,a,b,x2,mul); \+	ROUND(a,b,c,x3,mul); \+	ROUND(b,c,a,x4,mul); \+	ROUND(c,a,b,x5,mul); \+	ROUND(a,b,c,x6,mul); \+	ROUND(b,c,a,x7,mul)++#define SCHEDULE()                        \+	x0 -= x7 ^ 0xa5a5a5a5a5a5a5a5ULL; \+	x1 ^= x0;                         \+	x2 += x1;                         \+	x3 -= x2 ^ ((~x1)<<19);           \+	x4 ^= x3;                         \+	x5 += x4;                         \+	x6 -= x5 ^ ((~x4)>>23);           \+	x7 ^= x6;                         \+	x0 += x7;                         \+	x1 -= x0 ^ ((~x7)<<19);           \+	x2 ^= x1;                         \+	x3 += x2;                         \+	x4 -= x3 ^ ((~x2)>>23);           \+	x5 ^= x4;                         \+	x6 += x5;                         \+	x7 -= x6 ^ 0x0123456789abcdefULL++	PASS(a,b,c,5);+	SCHEDULE();+	PASS(c,a,b,7);+	SCHEDULE();+	PASS(b,c,a,9);++	ctx->h[0] ^= a;+	ctx->h[1] = b - ctx->h[1];+	ctx->h[2] += c;+}++void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len)+{+	uint32_t index, to_fill;++	index = (uint32_t) (ctx->sz & 0x3f);+	to_fill = 64 - index;++	ctx->sz += len;++	/* process partial buffer if there's enough data to make a block */+	if (index && len >= to_fill) {+		memcpy(ctx->buf + index, data, to_fill);+		tiger_do_chunk(ctx, (uint64_t *) ctx->buf);+		len -= to_fill;+		data += to_fill;+		index = 0;+	}++	/* process as much 64-block as possible */+	for (; len >= 64; len -= 64, data += 64)+		tiger_do_chunk(ctx, (uint64_t *) data);++	/* append data into buf */+	if (len)+		memcpy(ctx->buf + index, data, len);+}++void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out)+{+	static uint8_t padding[64] = { 0x01, };+	uint64_t bits;+	uint32_t index, padlen;+	uint64_t *p = (uint64_t *) out;++	/* add padding and update data with it */+	bits = cpu_to_le64(ctx->sz << 3);++	/* pad out to 56 */+	index = (uint32_t) (ctx->sz & 0x3f);+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);+	cryptonite_tiger_update(ctx, padding, padlen);++	/* append length */+	cryptonite_tiger_update(ctx, (uint8_t *) &bits, sizeof(bits));++	/* output hash */+	p[0] = cpu_to_le64(ctx->h[0]);+	p[1] = cpu_to_le64(ctx->h[1]);+	p[2] = cpu_to_le64(ctx->h[2]);+}
+ cbits/cryptonite_tiger.h view
@@ -0,0 +1,43 @@+/*+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions+ * are met:+ * 1. Redistributions of source code must retain the above copyright+ *    notice, this list of conditions and the following disclaimer.+ * 2. Redistributions in binary form must reproduce the above copyright+ *    notice, this list of conditions and the following disclaimer in the+ *    documentation and/or other materials provided with the distribution.+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */+#ifndef CRYPTOHASH_TIGER_H+#define CRYPTOHASH_TIGER_H++#include <stdint.h>++struct tiger_ctx+{+	uint64_t sz;+	uint8_t  buf[64];+	uint64_t h[3];+};++#define TIGER_DIGEST_SIZE	24+#define TIGER_CTX_SIZE 		(sizeof(struct tiger_ctx))++void cryptonite_tiger_init(struct tiger_ctx *ctx);+void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len);+void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out);++#endif
+ cbits/cryptonite_whirlpool.c view
@@ -0,0 +1,1027 @@+/**+ * The Whirlpool hashing function.+ *+ * <P>+ * <b>References</b>+ *+ * <P>+ * The Whirlpool algorithm was developed by+ * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and+ * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.+ *+ * See+ *      P.S.L.M. Barreto, V. Rijmen,+ *      ``The Whirlpool hashing function,''+ *      NESSIE submission, 2000 (tweaked version, 2001),+ *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>+ * + * @author  Paulo S.L.M. Barreto+ * @author  Vincent Rijmen.+ *+ * @version 3.0 (2003.03.12)+ *+ * =============================================================================+ *+ * Differences from version 2.1:+ *+ * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).+ *+ * =============================================================================+ *+ * Differences from version 2.0:+ *+ * - Generation of ISO/IEC 10118-3 test vectors.+ * - Bug fix: nonzero carry was ignored when tallying the data length+ *      (this bug apparently only manifested itself when feeding data+ *      in pieces rather than in a single chunk at once).+ * - Support for MS Visual C++ 64-bit integer arithmetic.+ *+ * Differences from version 1.0:+ *+ * - Original S-box replaced by the tweaked, hardware-efficient version.+ *+ * =============================================================================+ *+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ *+ */+/* Modified by Stijn van Drongelen for use in the cryptohash library.+*/++#include <stdlib.h>+#include <string.h>++#include "cryptonite_bitfn.h"+#include "cryptonite_whirlpool.h"++/* #define TRACE_INTERMEDIATE_VALUES */++/*+ * The number of rounds of the internal dedicated block cipher.+ */+#define R 10++/*+ * Though Whirlpool is endianness-neutral, the encryption tables are listed+ * in BIG-ENDIAN format, which is adopted throughout this implementation+ * (but little-endian notation would be equally suitable if consistently+ * employed).+ */++static const uint64_t C0[256] = {+	0x18186018c07830d8ULL, 0x23238c2305af4626ULL, 0xc6c63fc67ef991b8ULL, 0xe8e887e8136fcdfbULL,+	0x878726874ca113cbULL, 0xb8b8dab8a9626d11ULL, 0x0101040108050209ULL, 0x4f4f214f426e9e0dULL,+	0x3636d836adee6c9bULL, 0xa6a6a2a6590451ffULL, 0xd2d26fd2debdb90cULL, 0xf5f5f3f5fb06f70eULL,+	0x7979f979ef80f296ULL, 0x6f6fa16f5fcede30ULL, 0x91917e91fcef3f6dULL, 0x52525552aa07a4f8ULL,+	0x60609d6027fdc047ULL, 0xbcbccabc89766535ULL, 0x9b9b569baccd2b37ULL, 0x8e8e028e048c018aULL,+	0xa3a3b6a371155bd2ULL, 0x0c0c300c603c186cULL, 0x7b7bf17bff8af684ULL, 0x3535d435b5e16a80ULL,+	0x1d1d741de8693af5ULL, 0xe0e0a7e05347ddb3ULL, 0xd7d77bd7f6acb321ULL, 0xc2c22fc25eed999cULL,+	0x2e2eb82e6d965c43ULL, 0x4b4b314b627a9629ULL, 0xfefedffea321e15dULL, 0x575741578216aed5ULL,+	0x15155415a8412abdULL, 0x7777c1779fb6eee8ULL, 0x3737dc37a5eb6e92ULL, 0xe5e5b3e57b56d79eULL,+	0x9f9f469f8cd92313ULL, 0xf0f0e7f0d317fd23ULL, 0x4a4a354a6a7f9420ULL, 0xdada4fda9e95a944ULL,+	0x58587d58fa25b0a2ULL, 0xc9c903c906ca8fcfULL, 0x2929a429558d527cULL, 0x0a0a280a5022145aULL,+	0xb1b1feb1e14f7f50ULL, 0xa0a0baa0691a5dc9ULL, 0x6b6bb16b7fdad614ULL, 0x85852e855cab17d9ULL,+	0xbdbdcebd8173673cULL, 0x5d5d695dd234ba8fULL, 0x1010401080502090ULL, 0xf4f4f7f4f303f507ULL,+	0xcbcb0bcb16c08bddULL, 0x3e3ef83eedc67cd3ULL, 0x0505140528110a2dULL, 0x676781671fe6ce78ULL,+	0xe4e4b7e47353d597ULL, 0x27279c2725bb4e02ULL, 0x4141194132588273ULL, 0x8b8b168b2c9d0ba7ULL,+	0xa7a7a6a7510153f6ULL, 0x7d7de97dcf94fab2ULL, 0x95956e95dcfb3749ULL, 0xd8d847d88e9fad56ULL,+	0xfbfbcbfb8b30eb70ULL, 0xeeee9fee2371c1cdULL, 0x7c7ced7cc791f8bbULL, 0x6666856617e3cc71ULL,+	0xdddd53dda68ea77bULL, 0x17175c17b84b2eafULL, 0x4747014702468e45ULL, 0x9e9e429e84dc211aULL,+	0xcaca0fca1ec589d4ULL, 0x2d2db42d75995a58ULL, 0xbfbfc6bf9179632eULL, 0x07071c07381b0e3fULL,+	0xadad8ead012347acULL, 0x5a5a755aea2fb4b0ULL, 0x838336836cb51befULL, 0x3333cc3385ff66b6ULL,+	0x636391633ff2c65cULL, 0x02020802100a0412ULL, 0xaaaa92aa39384993ULL, 0x7171d971afa8e2deULL,+	0xc8c807c80ecf8dc6ULL, 0x19196419c87d32d1ULL, 0x494939497270923bULL, 0xd9d943d9869aaf5fULL,+	0xf2f2eff2c31df931ULL, 0xe3e3abe34b48dba8ULL, 0x5b5b715be22ab6b9ULL, 0x88881a8834920dbcULL,+	0x9a9a529aa4c8293eULL, 0x262698262dbe4c0bULL, 0x3232c8328dfa64bfULL, 0xb0b0fab0e94a7d59ULL,+	0xe9e983e91b6acff2ULL, 0x0f0f3c0f78331e77ULL, 0xd5d573d5e6a6b733ULL, 0x80803a8074ba1df4ULL,+	0xbebec2be997c6127ULL, 0xcdcd13cd26de87ebULL, 0x3434d034bde46889ULL, 0x48483d487a759032ULL,+	0xffffdbffab24e354ULL, 0x7a7af57af78ff48dULL, 0x90907a90f4ea3d64ULL, 0x5f5f615fc23ebe9dULL,+	0x202080201da0403dULL, 0x6868bd6867d5d00fULL, 0x1a1a681ad07234caULL, 0xaeae82ae192c41b7ULL,+	0xb4b4eab4c95e757dULL, 0x54544d549a19a8ceULL, 0x93937693ece53b7fULL, 0x222288220daa442fULL,+	0x64648d6407e9c863ULL, 0xf1f1e3f1db12ff2aULL, 0x7373d173bfa2e6ccULL, 0x12124812905a2482ULL,+	0x40401d403a5d807aULL, 0x0808200840281048ULL, 0xc3c32bc356e89b95ULL, 0xecec97ec337bc5dfULL,+	0xdbdb4bdb9690ab4dULL, 0xa1a1bea1611f5fc0ULL, 0x8d8d0e8d1c830791ULL, 0x3d3df43df5c97ac8ULL,+	0x97976697ccf1335bULL, 0x0000000000000000ULL, 0xcfcf1bcf36d483f9ULL, 0x2b2bac2b4587566eULL,+	0x7676c57697b3ece1ULL, 0x8282328264b019e6ULL, 0xd6d67fd6fea9b128ULL, 0x1b1b6c1bd87736c3ULL,+	0xb5b5eeb5c15b7774ULL, 0xafaf86af112943beULL, 0x6a6ab56a77dfd41dULL, 0x50505d50ba0da0eaULL,+	0x45450945124c8a57ULL, 0xf3f3ebf3cb18fb38ULL, 0x3030c0309df060adULL, 0xefef9bef2b74c3c4ULL,+	0x3f3ffc3fe5c37edaULL, 0x55554955921caac7ULL, 0xa2a2b2a2791059dbULL, 0xeaea8fea0365c9e9ULL,+	0x656589650fecca6aULL, 0xbabad2bab9686903ULL, 0x2f2fbc2f65935e4aULL, 0xc0c027c04ee79d8eULL,+	0xdede5fdebe81a160ULL, 0x1c1c701ce06c38fcULL, 0xfdfdd3fdbb2ee746ULL, 0x4d4d294d52649a1fULL,+	0x92927292e4e03976ULL, 0x7575c9758fbceafaULL, 0x06061806301e0c36ULL, 0x8a8a128a249809aeULL,+	0xb2b2f2b2f940794bULL, 0xe6e6bfe66359d185ULL, 0x0e0e380e70361c7eULL, 0x1f1f7c1ff8633ee7ULL,+	0x6262956237f7c455ULL, 0xd4d477d4eea3b53aULL, 0xa8a89aa829324d81ULL, 0x96966296c4f43152ULL,+	0xf9f9c3f99b3aef62ULL, 0xc5c533c566f697a3ULL, 0x2525942535b14a10ULL, 0x59597959f220b2abULL,+	0x84842a8454ae15d0ULL, 0x7272d572b7a7e4c5ULL, 0x3939e439d5dd72ecULL, 0x4c4c2d4c5a619816ULL,+	0x5e5e655eca3bbc94ULL, 0x7878fd78e785f09fULL, 0x3838e038ddd870e5ULL, 0x8c8c0a8c14860598ULL,+	0xd1d163d1c6b2bf17ULL, 0xa5a5aea5410b57e4ULL, 0xe2e2afe2434dd9a1ULL, 0x616199612ff8c24eULL,+	0xb3b3f6b3f1457b42ULL, 0x2121842115a54234ULL, 0x9c9c4a9c94d62508ULL, 0x1e1e781ef0663ceeULL,+	0x4343114322528661ULL, 0xc7c73bc776fc93b1ULL, 0xfcfcd7fcb32be54fULL, 0x0404100420140824ULL,+	0x51515951b208a2e3ULL, 0x99995e99bcc72f25ULL, 0x6d6da96d4fc4da22ULL, 0x0d0d340d68391a65ULL,+	0xfafacffa8335e979ULL, 0xdfdf5bdfb684a369ULL, 0x7e7ee57ed79bfca9ULL, 0x242490243db44819ULL,+	0x3b3bec3bc5d776feULL, 0xabab96ab313d4b9aULL, 0xcece1fce3ed181f0ULL, 0x1111441188552299ULL,+	0x8f8f068f0c890383ULL, 0x4e4e254e4a6b9c04ULL, 0xb7b7e6b7d1517366ULL, 0xebeb8beb0b60cbe0ULL,+	0x3c3cf03cfdcc78c1ULL, 0x81813e817cbf1ffdULL, 0x94946a94d4fe3540ULL, 0xf7f7fbf7eb0cf31cULL,+	0xb9b9deb9a1676f18ULL, 0x13134c13985f268bULL, 0x2c2cb02c7d9c5851ULL, 0xd3d36bd3d6b8bb05ULL,+	0xe7e7bbe76b5cd38cULL, 0x6e6ea56e57cbdc39ULL, 0xc4c437c46ef395aaULL, 0x03030c03180f061bULL,+	0x565645568a13acdcULL, 0x44440d441a49885eULL, 0x7f7fe17fdf9efea0ULL, 0xa9a99ea921374f88ULL,+	0x2a2aa82a4d825467ULL, 0xbbbbd6bbb16d6b0aULL, 0xc1c123c146e29f87ULL, 0x53535153a202a6f1ULL,+	0xdcdc57dcae8ba572ULL, 0x0b0b2c0b58271653ULL, 0x9d9d4e9d9cd32701ULL, 0x6c6cad6c47c1d82bULL,+	0x3131c43195f562a4ULL, 0x7474cd7487b9e8f3ULL, 0xf6f6fff6e309f115ULL, 0x464605460a438c4cULL,+	0xacac8aac092645a5ULL, 0x89891e893c970fb5ULL, 0x14145014a04428b4ULL, 0xe1e1a3e15b42dfbaULL,+	0x16165816b04e2ca6ULL, 0x3a3ae83acdd274f7ULL, 0x6969b9696fd0d206ULL, 0x09092409482d1241ULL,+	0x7070dd70a7ade0d7ULL, 0xb6b6e2b6d954716fULL, 0xd0d067d0ceb7bd1eULL, 0xeded93ed3b7ec7d6ULL,+	0xcccc17cc2edb85e2ULL, 0x424215422a578468ULL, 0x98985a98b4c22d2cULL, 0xa4a4aaa4490e55edULL,+	0x2828a0285d885075ULL, 0x5c5c6d5cda31b886ULL, 0xf8f8c7f8933fed6bULL, 0x8686228644a411c2ULL,+};++static const uint64_t C1[256] = {+	0xd818186018c07830ULL, 0x2623238c2305af46ULL, 0xb8c6c63fc67ef991ULL, 0xfbe8e887e8136fcdULL,+	0xcb878726874ca113ULL, 0x11b8b8dab8a9626dULL, 0x0901010401080502ULL, 0x0d4f4f214f426e9eULL,+	0x9b3636d836adee6cULL, 0xffa6a6a2a6590451ULL, 0x0cd2d26fd2debdb9ULL, 0x0ef5f5f3f5fb06f7ULL,+	0x967979f979ef80f2ULL, 0x306f6fa16f5fcedeULL, 0x6d91917e91fcef3fULL, 0xf852525552aa07a4ULL,+	0x4760609d6027fdc0ULL, 0x35bcbccabc897665ULL, 0x379b9b569baccd2bULL, 0x8a8e8e028e048c01ULL,+	0xd2a3a3b6a371155bULL, 0x6c0c0c300c603c18ULL, 0x847b7bf17bff8af6ULL, 0x803535d435b5e16aULL,+	0xf51d1d741de8693aULL, 0xb3e0e0a7e05347ddULL, 0x21d7d77bd7f6acb3ULL, 0x9cc2c22fc25eed99ULL,+	0x432e2eb82e6d965cULL, 0x294b4b314b627a96ULL, 0x5dfefedffea321e1ULL, 0xd5575741578216aeULL,+	0xbd15155415a8412aULL, 0xe87777c1779fb6eeULL, 0x923737dc37a5eb6eULL, 0x9ee5e5b3e57b56d7ULL,+	0x139f9f469f8cd923ULL, 0x23f0f0e7f0d317fdULL, 0x204a4a354a6a7f94ULL, 0x44dada4fda9e95a9ULL,+	0xa258587d58fa25b0ULL, 0xcfc9c903c906ca8fULL, 0x7c2929a429558d52ULL, 0x5a0a0a280a502214ULL,+	0x50b1b1feb1e14f7fULL, 0xc9a0a0baa0691a5dULL, 0x146b6bb16b7fdad6ULL, 0xd985852e855cab17ULL,+	0x3cbdbdcebd817367ULL, 0x8f5d5d695dd234baULL, 0x9010104010805020ULL, 0x07f4f4f7f4f303f5ULL,+	0xddcbcb0bcb16c08bULL, 0xd33e3ef83eedc67cULL, 0x2d0505140528110aULL, 0x78676781671fe6ceULL,+	0x97e4e4b7e47353d5ULL, 0x0227279c2725bb4eULL, 0x7341411941325882ULL, 0xa78b8b168b2c9d0bULL,+	0xf6a7a7a6a7510153ULL, 0xb27d7de97dcf94faULL, 0x4995956e95dcfb37ULL, 0x56d8d847d88e9fadULL,+	0x70fbfbcbfb8b30ebULL, 0xcdeeee9fee2371c1ULL, 0xbb7c7ced7cc791f8ULL, 0x716666856617e3ccULL,+	0x7bdddd53dda68ea7ULL, 0xaf17175c17b84b2eULL, 0x454747014702468eULL, 0x1a9e9e429e84dc21ULL,+	0xd4caca0fca1ec589ULL, 0x582d2db42d75995aULL, 0x2ebfbfc6bf917963ULL, 0x3f07071c07381b0eULL,+	0xacadad8ead012347ULL, 0xb05a5a755aea2fb4ULL, 0xef838336836cb51bULL, 0xb63333cc3385ff66ULL,+	0x5c636391633ff2c6ULL, 0x1202020802100a04ULL, 0x93aaaa92aa393849ULL, 0xde7171d971afa8e2ULL,+	0xc6c8c807c80ecf8dULL, 0xd119196419c87d32ULL, 0x3b49493949727092ULL, 0x5fd9d943d9869aafULL,+	0x31f2f2eff2c31df9ULL, 0xa8e3e3abe34b48dbULL, 0xb95b5b715be22ab6ULL, 0xbc88881a8834920dULL,+	0x3e9a9a529aa4c829ULL, 0x0b262698262dbe4cULL, 0xbf3232c8328dfa64ULL, 0x59b0b0fab0e94a7dULL,+	0xf2e9e983e91b6acfULL, 0x770f0f3c0f78331eULL, 0x33d5d573d5e6a6b7ULL, 0xf480803a8074ba1dULL,+	0x27bebec2be997c61ULL, 0xebcdcd13cd26de87ULL, 0x893434d034bde468ULL, 0x3248483d487a7590ULL,+	0x54ffffdbffab24e3ULL, 0x8d7a7af57af78ff4ULL, 0x6490907a90f4ea3dULL, 0x9d5f5f615fc23ebeULL,+	0x3d202080201da040ULL, 0x0f6868bd6867d5d0ULL, 0xca1a1a681ad07234ULL, 0xb7aeae82ae192c41ULL,+	0x7db4b4eab4c95e75ULL, 0xce54544d549a19a8ULL, 0x7f93937693ece53bULL, 0x2f222288220daa44ULL,+	0x6364648d6407e9c8ULL, 0x2af1f1e3f1db12ffULL, 0xcc7373d173bfa2e6ULL, 0x8212124812905a24ULL,+	0x7a40401d403a5d80ULL, 0x4808082008402810ULL, 0x95c3c32bc356e89bULL, 0xdfecec97ec337bc5ULL,+	0x4ddbdb4bdb9690abULL, 0xc0a1a1bea1611f5fULL, 0x918d8d0e8d1c8307ULL, 0xc83d3df43df5c97aULL,+	0x5b97976697ccf133ULL, 0x0000000000000000ULL, 0xf9cfcf1bcf36d483ULL, 0x6e2b2bac2b458756ULL,+	0xe17676c57697b3ecULL, 0xe68282328264b019ULL, 0x28d6d67fd6fea9b1ULL, 0xc31b1b6c1bd87736ULL,+	0x74b5b5eeb5c15b77ULL, 0xbeafaf86af112943ULL, 0x1d6a6ab56a77dfd4ULL, 0xea50505d50ba0da0ULL,+	0x5745450945124c8aULL, 0x38f3f3ebf3cb18fbULL, 0xad3030c0309df060ULL, 0xc4efef9bef2b74c3ULL,+	0xda3f3ffc3fe5c37eULL, 0xc755554955921caaULL, 0xdba2a2b2a2791059ULL, 0xe9eaea8fea0365c9ULL,+	0x6a656589650feccaULL, 0x03babad2bab96869ULL, 0x4a2f2fbc2f65935eULL, 0x8ec0c027c04ee79dULL,+	0x60dede5fdebe81a1ULL, 0xfc1c1c701ce06c38ULL, 0x46fdfdd3fdbb2ee7ULL, 0x1f4d4d294d52649aULL,+	0x7692927292e4e039ULL, 0xfa7575c9758fbceaULL, 0x3606061806301e0cULL, 0xae8a8a128a249809ULL,+	0x4bb2b2f2b2f94079ULL, 0x85e6e6bfe66359d1ULL, 0x7e0e0e380e70361cULL, 0xe71f1f7c1ff8633eULL,+	0x556262956237f7c4ULL, 0x3ad4d477d4eea3b5ULL, 0x81a8a89aa829324dULL, 0x5296966296c4f431ULL,+	0x62f9f9c3f99b3aefULL, 0xa3c5c533c566f697ULL, 0x102525942535b14aULL, 0xab59597959f220b2ULL,+	0xd084842a8454ae15ULL, 0xc57272d572b7a7e4ULL, 0xec3939e439d5dd72ULL, 0x164c4c2d4c5a6198ULL,+	0x945e5e655eca3bbcULL, 0x9f7878fd78e785f0ULL, 0xe53838e038ddd870ULL, 0x988c8c0a8c148605ULL,+	0x17d1d163d1c6b2bfULL, 0xe4a5a5aea5410b57ULL, 0xa1e2e2afe2434dd9ULL, 0x4e616199612ff8c2ULL,+	0x42b3b3f6b3f1457bULL, 0x342121842115a542ULL, 0x089c9c4a9c94d625ULL, 0xee1e1e781ef0663cULL,+	0x6143431143225286ULL, 0xb1c7c73bc776fc93ULL, 0x4ffcfcd7fcb32be5ULL, 0x2404041004201408ULL,+	0xe351515951b208a2ULL, 0x2599995e99bcc72fULL, 0x226d6da96d4fc4daULL, 0x650d0d340d68391aULL,+	0x79fafacffa8335e9ULL, 0x69dfdf5bdfb684a3ULL, 0xa97e7ee57ed79bfcULL, 0x19242490243db448ULL,+	0xfe3b3bec3bc5d776ULL, 0x9aabab96ab313d4bULL, 0xf0cece1fce3ed181ULL, 0x9911114411885522ULL,+	0x838f8f068f0c8903ULL, 0x044e4e254e4a6b9cULL, 0x66b7b7e6b7d15173ULL, 0xe0ebeb8beb0b60cbULL,+	0xc13c3cf03cfdcc78ULL, 0xfd81813e817cbf1fULL, 0x4094946a94d4fe35ULL, 0x1cf7f7fbf7eb0cf3ULL,+	0x18b9b9deb9a1676fULL, 0x8b13134c13985f26ULL, 0x512c2cb02c7d9c58ULL, 0x05d3d36bd3d6b8bbULL,+	0x8ce7e7bbe76b5cd3ULL, 0x396e6ea56e57cbdcULL, 0xaac4c437c46ef395ULL, 0x1b03030c03180f06ULL,+	0xdc565645568a13acULL, 0x5e44440d441a4988ULL, 0xa07f7fe17fdf9efeULL, 0x88a9a99ea921374fULL,+	0x672a2aa82a4d8254ULL, 0x0abbbbd6bbb16d6bULL, 0x87c1c123c146e29fULL, 0xf153535153a202a6ULL,+	0x72dcdc57dcae8ba5ULL, 0x530b0b2c0b582716ULL, 0x019d9d4e9d9cd327ULL, 0x2b6c6cad6c47c1d8ULL,+	0xa43131c43195f562ULL, 0xf37474cd7487b9e8ULL, 0x15f6f6fff6e309f1ULL, 0x4c464605460a438cULL,+	0xa5acac8aac092645ULL, 0xb589891e893c970fULL, 0xb414145014a04428ULL, 0xbae1e1a3e15b42dfULL,+	0xa616165816b04e2cULL, 0xf73a3ae83acdd274ULL, 0x066969b9696fd0d2ULL, 0x4109092409482d12ULL,+	0xd77070dd70a7ade0ULL, 0x6fb6b6e2b6d95471ULL, 0x1ed0d067d0ceb7bdULL, 0xd6eded93ed3b7ec7ULL,+	0xe2cccc17cc2edb85ULL, 0x68424215422a5784ULL, 0x2c98985a98b4c22dULL, 0xeda4a4aaa4490e55ULL,+	0x752828a0285d8850ULL, 0x865c5c6d5cda31b8ULL, 0x6bf8f8c7f8933fedULL, 0xc28686228644a411ULL,+};++static const uint64_t C2[256] = {+	0x30d818186018c078ULL, 0x462623238c2305afULL, 0x91b8c6c63fc67ef9ULL, 0xcdfbe8e887e8136fULL,+	0x13cb878726874ca1ULL, 0x6d11b8b8dab8a962ULL, 0x0209010104010805ULL, 0x9e0d4f4f214f426eULL,+	0x6c9b3636d836adeeULL, 0x51ffa6a6a2a65904ULL, 0xb90cd2d26fd2debdULL, 0xf70ef5f5f3f5fb06ULL,+	0xf2967979f979ef80ULL, 0xde306f6fa16f5fceULL, 0x3f6d91917e91fcefULL, 0xa4f852525552aa07ULL,+	0xc04760609d6027fdULL, 0x6535bcbccabc8976ULL, 0x2b379b9b569baccdULL, 0x018a8e8e028e048cULL,+	0x5bd2a3a3b6a37115ULL, 0x186c0c0c300c603cULL, 0xf6847b7bf17bff8aULL, 0x6a803535d435b5e1ULL,+	0x3af51d1d741de869ULL, 0xddb3e0e0a7e05347ULL, 0xb321d7d77bd7f6acULL, 0x999cc2c22fc25eedULL,+	0x5c432e2eb82e6d96ULL, 0x96294b4b314b627aULL, 0xe15dfefedffea321ULL, 0xaed5575741578216ULL,+	0x2abd15155415a841ULL, 0xeee87777c1779fb6ULL, 0x6e923737dc37a5ebULL, 0xd79ee5e5b3e57b56ULL,+	0x23139f9f469f8cd9ULL, 0xfd23f0f0e7f0d317ULL, 0x94204a4a354a6a7fULL, 0xa944dada4fda9e95ULL,+	0xb0a258587d58fa25ULL, 0x8fcfc9c903c906caULL, 0x527c2929a429558dULL, 0x145a0a0a280a5022ULL,+	0x7f50b1b1feb1e14fULL, 0x5dc9a0a0baa0691aULL, 0xd6146b6bb16b7fdaULL, 0x17d985852e855cabULL,+	0x673cbdbdcebd8173ULL, 0xba8f5d5d695dd234ULL, 0x2090101040108050ULL, 0xf507f4f4f7f4f303ULL,+	0x8bddcbcb0bcb16c0ULL, 0x7cd33e3ef83eedc6ULL, 0x0a2d050514052811ULL, 0xce78676781671fe6ULL,+	0xd597e4e4b7e47353ULL, 0x4e0227279c2725bbULL, 0x8273414119413258ULL, 0x0ba78b8b168b2c9dULL,+	0x53f6a7a7a6a75101ULL, 0xfab27d7de97dcf94ULL, 0x374995956e95dcfbULL, 0xad56d8d847d88e9fULL,+	0xeb70fbfbcbfb8b30ULL, 0xc1cdeeee9fee2371ULL, 0xf8bb7c7ced7cc791ULL, 0xcc716666856617e3ULL,+	0xa77bdddd53dda68eULL, 0x2eaf17175c17b84bULL, 0x8e45474701470246ULL, 0x211a9e9e429e84dcULL,+	0x89d4caca0fca1ec5ULL, 0x5a582d2db42d7599ULL, 0x632ebfbfc6bf9179ULL, 0x0e3f07071c07381bULL,+	0x47acadad8ead0123ULL, 0xb4b05a5a755aea2fULL, 0x1bef838336836cb5ULL, 0x66b63333cc3385ffULL,+	0xc65c636391633ff2ULL, 0x041202020802100aULL, 0x4993aaaa92aa3938ULL, 0xe2de7171d971afa8ULL,+	0x8dc6c8c807c80ecfULL, 0x32d119196419c87dULL, 0x923b494939497270ULL, 0xaf5fd9d943d9869aULL,+	0xf931f2f2eff2c31dULL, 0xdba8e3e3abe34b48ULL, 0xb6b95b5b715be22aULL, 0x0dbc88881a883492ULL,+	0x293e9a9a529aa4c8ULL, 0x4c0b262698262dbeULL, 0x64bf3232c8328dfaULL, 0x7d59b0b0fab0e94aULL,+	0xcff2e9e983e91b6aULL, 0x1e770f0f3c0f7833ULL, 0xb733d5d573d5e6a6ULL, 0x1df480803a8074baULL,+	0x6127bebec2be997cULL, 0x87ebcdcd13cd26deULL, 0x68893434d034bde4ULL, 0x903248483d487a75ULL,+	0xe354ffffdbffab24ULL, 0xf48d7a7af57af78fULL, 0x3d6490907a90f4eaULL, 0xbe9d5f5f615fc23eULL,+	0x403d202080201da0ULL, 0xd00f6868bd6867d5ULL, 0x34ca1a1a681ad072ULL, 0x41b7aeae82ae192cULL,+	0x757db4b4eab4c95eULL, 0xa8ce54544d549a19ULL, 0x3b7f93937693ece5ULL, 0x442f222288220daaULL,+	0xc86364648d6407e9ULL, 0xff2af1f1e3f1db12ULL, 0xe6cc7373d173bfa2ULL, 0x248212124812905aULL,+	0x807a40401d403a5dULL, 0x1048080820084028ULL, 0x9b95c3c32bc356e8ULL, 0xc5dfecec97ec337bULL,+	0xab4ddbdb4bdb9690ULL, 0x5fc0a1a1bea1611fULL, 0x07918d8d0e8d1c83ULL, 0x7ac83d3df43df5c9ULL,+	0x335b97976697ccf1ULL, 0x0000000000000000ULL, 0x83f9cfcf1bcf36d4ULL, 0x566e2b2bac2b4587ULL,+	0xece17676c57697b3ULL, 0x19e68282328264b0ULL, 0xb128d6d67fd6fea9ULL, 0x36c31b1b6c1bd877ULL,+	0x7774b5b5eeb5c15bULL, 0x43beafaf86af1129ULL, 0xd41d6a6ab56a77dfULL, 0xa0ea50505d50ba0dULL,+	0x8a5745450945124cULL, 0xfb38f3f3ebf3cb18ULL, 0x60ad3030c0309df0ULL, 0xc3c4efef9bef2b74ULL,+	0x7eda3f3ffc3fe5c3ULL, 0xaac755554955921cULL, 0x59dba2a2b2a27910ULL, 0xc9e9eaea8fea0365ULL,+	0xca6a656589650fecULL, 0x6903babad2bab968ULL, 0x5e4a2f2fbc2f6593ULL, 0x9d8ec0c027c04ee7ULL,+	0xa160dede5fdebe81ULL, 0x38fc1c1c701ce06cULL, 0xe746fdfdd3fdbb2eULL, 0x9a1f4d4d294d5264ULL,+	0x397692927292e4e0ULL, 0xeafa7575c9758fbcULL, 0x0c3606061806301eULL, 0x09ae8a8a128a2498ULL,+	0x794bb2b2f2b2f940ULL, 0xd185e6e6bfe66359ULL, 0x1c7e0e0e380e7036ULL, 0x3ee71f1f7c1ff863ULL,+	0xc4556262956237f7ULL, 0xb53ad4d477d4eea3ULL, 0x4d81a8a89aa82932ULL, 0x315296966296c4f4ULL,+	0xef62f9f9c3f99b3aULL, 0x97a3c5c533c566f6ULL, 0x4a102525942535b1ULL, 0xb2ab59597959f220ULL,+	0x15d084842a8454aeULL, 0xe4c57272d572b7a7ULL, 0x72ec3939e439d5ddULL, 0x98164c4c2d4c5a61ULL,+	0xbc945e5e655eca3bULL, 0xf09f7878fd78e785ULL, 0x70e53838e038ddd8ULL, 0x05988c8c0a8c1486ULL,+	0xbf17d1d163d1c6b2ULL, 0x57e4a5a5aea5410bULL, 0xd9a1e2e2afe2434dULL, 0xc24e616199612ff8ULL,+	0x7b42b3b3f6b3f145ULL, 0x42342121842115a5ULL, 0x25089c9c4a9c94d6ULL, 0x3cee1e1e781ef066ULL,+	0x8661434311432252ULL, 0x93b1c7c73bc776fcULL, 0xe54ffcfcd7fcb32bULL, 0x0824040410042014ULL,+	0xa2e351515951b208ULL, 0x2f2599995e99bcc7ULL, 0xda226d6da96d4fc4ULL, 0x1a650d0d340d6839ULL,+	0xe979fafacffa8335ULL, 0xa369dfdf5bdfb684ULL, 0xfca97e7ee57ed79bULL, 0x4819242490243db4ULL,+	0x76fe3b3bec3bc5d7ULL, 0x4b9aabab96ab313dULL, 0x81f0cece1fce3ed1ULL, 0x2299111144118855ULL,+	0x03838f8f068f0c89ULL, 0x9c044e4e254e4a6bULL, 0x7366b7b7e6b7d151ULL, 0xcbe0ebeb8beb0b60ULL,+	0x78c13c3cf03cfdccULL, 0x1ffd81813e817cbfULL, 0x354094946a94d4feULL, 0xf31cf7f7fbf7eb0cULL,+	0x6f18b9b9deb9a167ULL, 0x268b13134c13985fULL, 0x58512c2cb02c7d9cULL, 0xbb05d3d36bd3d6b8ULL,+	0xd38ce7e7bbe76b5cULL, 0xdc396e6ea56e57cbULL, 0x95aac4c437c46ef3ULL, 0x061b03030c03180fULL,+	0xacdc565645568a13ULL, 0x885e44440d441a49ULL, 0xfea07f7fe17fdf9eULL, 0x4f88a9a99ea92137ULL,+	0x54672a2aa82a4d82ULL, 0x6b0abbbbd6bbb16dULL, 0x9f87c1c123c146e2ULL, 0xa6f153535153a202ULL,+	0xa572dcdc57dcae8bULL, 0x16530b0b2c0b5827ULL, 0x27019d9d4e9d9cd3ULL, 0xd82b6c6cad6c47c1ULL,+	0x62a43131c43195f5ULL, 0xe8f37474cd7487b9ULL, 0xf115f6f6fff6e309ULL, 0x8c4c464605460a43ULL,+	0x45a5acac8aac0926ULL, 0x0fb589891e893c97ULL, 0x28b414145014a044ULL, 0xdfbae1e1a3e15b42ULL,+	0x2ca616165816b04eULL, 0x74f73a3ae83acdd2ULL, 0xd2066969b9696fd0ULL, 0x124109092409482dULL,+	0xe0d77070dd70a7adULL, 0x716fb6b6e2b6d954ULL, 0xbd1ed0d067d0ceb7ULL, 0xc7d6eded93ed3b7eULL,+	0x85e2cccc17cc2edbULL, 0x8468424215422a57ULL, 0x2d2c98985a98b4c2ULL, 0x55eda4a4aaa4490eULL,+	0x50752828a0285d88ULL, 0xb8865c5c6d5cda31ULL, 0xed6bf8f8c7f8933fULL, 0x11c28686228644a4ULL,+};++static const uint64_t C3[256] = {+	0x7830d818186018c0ULL, 0xaf462623238c2305ULL, 0xf991b8c6c63fc67eULL, 0x6fcdfbe8e887e813ULL,+	0xa113cb878726874cULL, 0x626d11b8b8dab8a9ULL, 0x0502090101040108ULL, 0x6e9e0d4f4f214f42ULL,+	0xee6c9b3636d836adULL, 0x0451ffa6a6a2a659ULL, 0xbdb90cd2d26fd2deULL, 0x06f70ef5f5f3f5fbULL,+	0x80f2967979f979efULL, 0xcede306f6fa16f5fULL, 0xef3f6d91917e91fcULL, 0x07a4f852525552aaULL,+	0xfdc04760609d6027ULL, 0x766535bcbccabc89ULL, 0xcd2b379b9b569bacULL, 0x8c018a8e8e028e04ULL,+	0x155bd2a3a3b6a371ULL, 0x3c186c0c0c300c60ULL, 0x8af6847b7bf17bffULL, 0xe16a803535d435b5ULL,+	0x693af51d1d741de8ULL, 0x47ddb3e0e0a7e053ULL, 0xacb321d7d77bd7f6ULL, 0xed999cc2c22fc25eULL,+	0x965c432e2eb82e6dULL, 0x7a96294b4b314b62ULL, 0x21e15dfefedffea3ULL, 0x16aed55757415782ULL,+	0x412abd15155415a8ULL, 0xb6eee87777c1779fULL, 0xeb6e923737dc37a5ULL, 0x56d79ee5e5b3e57bULL,+	0xd923139f9f469f8cULL, 0x17fd23f0f0e7f0d3ULL, 0x7f94204a4a354a6aULL, 0x95a944dada4fda9eULL,+	0x25b0a258587d58faULL, 0xca8fcfc9c903c906ULL, 0x8d527c2929a42955ULL, 0x22145a0a0a280a50ULL,+	0x4f7f50b1b1feb1e1ULL, 0x1a5dc9a0a0baa069ULL, 0xdad6146b6bb16b7fULL, 0xab17d985852e855cULL,+	0x73673cbdbdcebd81ULL, 0x34ba8f5d5d695dd2ULL, 0x5020901010401080ULL, 0x03f507f4f4f7f4f3ULL,+	0xc08bddcbcb0bcb16ULL, 0xc67cd33e3ef83eedULL, 0x110a2d0505140528ULL, 0xe6ce78676781671fULL,+	0x53d597e4e4b7e473ULL, 0xbb4e0227279c2725ULL, 0x5882734141194132ULL, 0x9d0ba78b8b168b2cULL,+	0x0153f6a7a7a6a751ULL, 0x94fab27d7de97dcfULL, 0xfb374995956e95dcULL, 0x9fad56d8d847d88eULL,+	0x30eb70fbfbcbfb8bULL, 0x71c1cdeeee9fee23ULL, 0x91f8bb7c7ced7cc7ULL, 0xe3cc716666856617ULL,+	0x8ea77bdddd53dda6ULL, 0x4b2eaf17175c17b8ULL, 0x468e454747014702ULL, 0xdc211a9e9e429e84ULL,+	0xc589d4caca0fca1eULL, 0x995a582d2db42d75ULL, 0x79632ebfbfc6bf91ULL, 0x1b0e3f07071c0738ULL,+	0x2347acadad8ead01ULL, 0x2fb4b05a5a755aeaULL, 0xb51bef838336836cULL, 0xff66b63333cc3385ULL,+	0xf2c65c636391633fULL, 0x0a04120202080210ULL, 0x384993aaaa92aa39ULL, 0xa8e2de7171d971afULL,+	0xcf8dc6c8c807c80eULL, 0x7d32d119196419c8ULL, 0x70923b4949394972ULL, 0x9aaf5fd9d943d986ULL,+	0x1df931f2f2eff2c3ULL, 0x48dba8e3e3abe34bULL, 0x2ab6b95b5b715be2ULL, 0x920dbc88881a8834ULL,+	0xc8293e9a9a529aa4ULL, 0xbe4c0b262698262dULL, 0xfa64bf3232c8328dULL, 0x4a7d59b0b0fab0e9ULL,+	0x6acff2e9e983e91bULL, 0x331e770f0f3c0f78ULL, 0xa6b733d5d573d5e6ULL, 0xba1df480803a8074ULL,+	0x7c6127bebec2be99ULL, 0xde87ebcdcd13cd26ULL, 0xe468893434d034bdULL, 0x75903248483d487aULL,+	0x24e354ffffdbffabULL, 0x8ff48d7a7af57af7ULL, 0xea3d6490907a90f4ULL, 0x3ebe9d5f5f615fc2ULL,+	0xa0403d202080201dULL, 0xd5d00f6868bd6867ULL, 0x7234ca1a1a681ad0ULL, 0x2c41b7aeae82ae19ULL,+	0x5e757db4b4eab4c9ULL, 0x19a8ce54544d549aULL, 0xe53b7f93937693ecULL, 0xaa442f222288220dULL,+	0xe9c86364648d6407ULL, 0x12ff2af1f1e3f1dbULL, 0xa2e6cc7373d173bfULL, 0x5a24821212481290ULL,+	0x5d807a40401d403aULL, 0x2810480808200840ULL, 0xe89b95c3c32bc356ULL, 0x7bc5dfecec97ec33ULL,+	0x90ab4ddbdb4bdb96ULL, 0x1f5fc0a1a1bea161ULL, 0x8307918d8d0e8d1cULL, 0xc97ac83d3df43df5ULL,+	0xf1335b97976697ccULL, 0x0000000000000000ULL, 0xd483f9cfcf1bcf36ULL, 0x87566e2b2bac2b45ULL,+	0xb3ece17676c57697ULL, 0xb019e68282328264ULL, 0xa9b128d6d67fd6feULL, 0x7736c31b1b6c1bd8ULL,+	0x5b7774b5b5eeb5c1ULL, 0x2943beafaf86af11ULL, 0xdfd41d6a6ab56a77ULL, 0x0da0ea50505d50baULL,+	0x4c8a574545094512ULL, 0x18fb38f3f3ebf3cbULL, 0xf060ad3030c0309dULL, 0x74c3c4efef9bef2bULL,+	0xc37eda3f3ffc3fe5ULL, 0x1caac75555495592ULL, 0x1059dba2a2b2a279ULL, 0x65c9e9eaea8fea03ULL,+	0xecca6a656589650fULL, 0x686903babad2bab9ULL, 0x935e4a2f2fbc2f65ULL, 0xe79d8ec0c027c04eULL,+	0x81a160dede5fdebeULL, 0x6c38fc1c1c701ce0ULL, 0x2ee746fdfdd3fdbbULL, 0x649a1f4d4d294d52ULL,+	0xe0397692927292e4ULL, 0xbceafa7575c9758fULL, 0x1e0c360606180630ULL, 0x9809ae8a8a128a24ULL,+	0x40794bb2b2f2b2f9ULL, 0x59d185e6e6bfe663ULL, 0x361c7e0e0e380e70ULL, 0x633ee71f1f7c1ff8ULL,+	0xf7c4556262956237ULL, 0xa3b53ad4d477d4eeULL, 0x324d81a8a89aa829ULL, 0xf4315296966296c4ULL,+	0x3aef62f9f9c3f99bULL, 0xf697a3c5c533c566ULL, 0xb14a102525942535ULL, 0x20b2ab59597959f2ULL,+	0xae15d084842a8454ULL, 0xa7e4c57272d572b7ULL, 0xdd72ec3939e439d5ULL, 0x6198164c4c2d4c5aULL,+	0x3bbc945e5e655ecaULL, 0x85f09f7878fd78e7ULL, 0xd870e53838e038ddULL, 0x8605988c8c0a8c14ULL,+	0xb2bf17d1d163d1c6ULL, 0x0b57e4a5a5aea541ULL, 0x4dd9a1e2e2afe243ULL, 0xf8c24e616199612fULL,+	0x457b42b3b3f6b3f1ULL, 0xa542342121842115ULL, 0xd625089c9c4a9c94ULL, 0x663cee1e1e781ef0ULL,+	0x5286614343114322ULL, 0xfc93b1c7c73bc776ULL, 0x2be54ffcfcd7fcb3ULL, 0x1408240404100420ULL,+	0x08a2e351515951b2ULL, 0xc72f2599995e99bcULL, 0xc4da226d6da96d4fULL, 0x391a650d0d340d68ULL,+	0x35e979fafacffa83ULL, 0x84a369dfdf5bdfb6ULL, 0x9bfca97e7ee57ed7ULL, 0xb44819242490243dULL,+	0xd776fe3b3bec3bc5ULL, 0x3d4b9aabab96ab31ULL, 0xd181f0cece1fce3eULL, 0x5522991111441188ULL,+	0x8903838f8f068f0cULL, 0x6b9c044e4e254e4aULL, 0x517366b7b7e6b7d1ULL, 0x60cbe0ebeb8beb0bULL,+	0xcc78c13c3cf03cfdULL, 0xbf1ffd81813e817cULL, 0xfe354094946a94d4ULL, 0x0cf31cf7f7fbf7ebULL,+	0x676f18b9b9deb9a1ULL, 0x5f268b13134c1398ULL, 0x9c58512c2cb02c7dULL, 0xb8bb05d3d36bd3d6ULL,+	0x5cd38ce7e7bbe76bULL, 0xcbdc396e6ea56e57ULL, 0xf395aac4c437c46eULL, 0x0f061b03030c0318ULL,+	0x13acdc565645568aULL, 0x49885e44440d441aULL, 0x9efea07f7fe17fdfULL, 0x374f88a9a99ea921ULL,+	0x8254672a2aa82a4dULL, 0x6d6b0abbbbd6bbb1ULL, 0xe29f87c1c123c146ULL, 0x02a6f153535153a2ULL,+	0x8ba572dcdc57dcaeULL, 0x2716530b0b2c0b58ULL, 0xd327019d9d4e9d9cULL, 0xc1d82b6c6cad6c47ULL,+	0xf562a43131c43195ULL, 0xb9e8f37474cd7487ULL, 0x09f115f6f6fff6e3ULL, 0x438c4c464605460aULL,+	0x2645a5acac8aac09ULL, 0x970fb589891e893cULL, 0x4428b414145014a0ULL, 0x42dfbae1e1a3e15bULL,+	0x4e2ca616165816b0ULL, 0xd274f73a3ae83acdULL, 0xd0d2066969b9696fULL, 0x2d12410909240948ULL,+	0xade0d77070dd70a7ULL, 0x54716fb6b6e2b6d9ULL, 0xb7bd1ed0d067d0ceULL, 0x7ec7d6eded93ed3bULL,+	0xdb85e2cccc17cc2eULL, 0x578468424215422aULL, 0xc22d2c98985a98b4ULL, 0x0e55eda4a4aaa449ULL,+	0x8850752828a0285dULL, 0x31b8865c5c6d5cdaULL, 0x3fed6bf8f8c7f893ULL, 0xa411c28686228644ULL,+};++static const uint64_t C4[256] = {+	0xc07830d818186018ULL, 0x05af462623238c23ULL, 0x7ef991b8c6c63fc6ULL, 0x136fcdfbe8e887e8ULL,+	0x4ca113cb87872687ULL, 0xa9626d11b8b8dab8ULL, 0x0805020901010401ULL, 0x426e9e0d4f4f214fULL,+	0xadee6c9b3636d836ULL, 0x590451ffa6a6a2a6ULL, 0xdebdb90cd2d26fd2ULL, 0xfb06f70ef5f5f3f5ULL,+	0xef80f2967979f979ULL, 0x5fcede306f6fa16fULL, 0xfcef3f6d91917e91ULL, 0xaa07a4f852525552ULL,+	0x27fdc04760609d60ULL, 0x89766535bcbccabcULL, 0xaccd2b379b9b569bULL, 0x048c018a8e8e028eULL,+	0x71155bd2a3a3b6a3ULL, 0x603c186c0c0c300cULL, 0xff8af6847b7bf17bULL, 0xb5e16a803535d435ULL,+	0xe8693af51d1d741dULL, 0x5347ddb3e0e0a7e0ULL, 0xf6acb321d7d77bd7ULL, 0x5eed999cc2c22fc2ULL,+	0x6d965c432e2eb82eULL, 0x627a96294b4b314bULL, 0xa321e15dfefedffeULL, 0x8216aed557574157ULL,+	0xa8412abd15155415ULL, 0x9fb6eee87777c177ULL, 0xa5eb6e923737dc37ULL, 0x7b56d79ee5e5b3e5ULL,+	0x8cd923139f9f469fULL, 0xd317fd23f0f0e7f0ULL, 0x6a7f94204a4a354aULL, 0x9e95a944dada4fdaULL,+	0xfa25b0a258587d58ULL, 0x06ca8fcfc9c903c9ULL, 0x558d527c2929a429ULL, 0x5022145a0a0a280aULL,+	0xe14f7f50b1b1feb1ULL, 0x691a5dc9a0a0baa0ULL, 0x7fdad6146b6bb16bULL, 0x5cab17d985852e85ULL,+	0x8173673cbdbdcebdULL, 0xd234ba8f5d5d695dULL, 0x8050209010104010ULL, 0xf303f507f4f4f7f4ULL,+	0x16c08bddcbcb0bcbULL, 0xedc67cd33e3ef83eULL, 0x28110a2d05051405ULL, 0x1fe6ce7867678167ULL,+	0x7353d597e4e4b7e4ULL, 0x25bb4e0227279c27ULL, 0x3258827341411941ULL, 0x2c9d0ba78b8b168bULL,+	0x510153f6a7a7a6a7ULL, 0xcf94fab27d7de97dULL, 0xdcfb374995956e95ULL, 0x8e9fad56d8d847d8ULL,+	0x8b30eb70fbfbcbfbULL, 0x2371c1cdeeee9feeULL, 0xc791f8bb7c7ced7cULL, 0x17e3cc7166668566ULL,+	0xa68ea77bdddd53ddULL, 0xb84b2eaf17175c17ULL, 0x02468e4547470147ULL, 0x84dc211a9e9e429eULL,+	0x1ec589d4caca0fcaULL, 0x75995a582d2db42dULL, 0x9179632ebfbfc6bfULL, 0x381b0e3f07071c07ULL,+	0x012347acadad8eadULL, 0xea2fb4b05a5a755aULL, 0x6cb51bef83833683ULL, 0x85ff66b63333cc33ULL,+	0x3ff2c65c63639163ULL, 0x100a041202020802ULL, 0x39384993aaaa92aaULL, 0xafa8e2de7171d971ULL,+	0x0ecf8dc6c8c807c8ULL, 0xc87d32d119196419ULL, 0x7270923b49493949ULL, 0x869aaf5fd9d943d9ULL,+	0xc31df931f2f2eff2ULL, 0x4b48dba8e3e3abe3ULL, 0xe22ab6b95b5b715bULL, 0x34920dbc88881a88ULL,+	0xa4c8293e9a9a529aULL, 0x2dbe4c0b26269826ULL, 0x8dfa64bf3232c832ULL, 0xe94a7d59b0b0fab0ULL,+	0x1b6acff2e9e983e9ULL, 0x78331e770f0f3c0fULL, 0xe6a6b733d5d573d5ULL, 0x74ba1df480803a80ULL,+	0x997c6127bebec2beULL, 0x26de87ebcdcd13cdULL, 0xbde468893434d034ULL, 0x7a75903248483d48ULL,+	0xab24e354ffffdbffULL, 0xf78ff48d7a7af57aULL, 0xf4ea3d6490907a90ULL, 0xc23ebe9d5f5f615fULL,+	0x1da0403d20208020ULL, 0x67d5d00f6868bd68ULL, 0xd07234ca1a1a681aULL, 0x192c41b7aeae82aeULL,+	0xc95e757db4b4eab4ULL, 0x9a19a8ce54544d54ULL, 0xece53b7f93937693ULL, 0x0daa442f22228822ULL,+	0x07e9c86364648d64ULL, 0xdb12ff2af1f1e3f1ULL, 0xbfa2e6cc7373d173ULL, 0x905a248212124812ULL,+	0x3a5d807a40401d40ULL, 0x4028104808082008ULL, 0x56e89b95c3c32bc3ULL, 0x337bc5dfecec97ecULL,+	0x9690ab4ddbdb4bdbULL, 0x611f5fc0a1a1bea1ULL, 0x1c8307918d8d0e8dULL, 0xf5c97ac83d3df43dULL,+	0xccf1335b97976697ULL, 0x0000000000000000ULL, 0x36d483f9cfcf1bcfULL, 0x4587566e2b2bac2bULL,+	0x97b3ece17676c576ULL, 0x64b019e682823282ULL, 0xfea9b128d6d67fd6ULL, 0xd87736c31b1b6c1bULL,+	0xc15b7774b5b5eeb5ULL, 0x112943beafaf86afULL, 0x77dfd41d6a6ab56aULL, 0xba0da0ea50505d50ULL,+	0x124c8a5745450945ULL, 0xcb18fb38f3f3ebf3ULL, 0x9df060ad3030c030ULL, 0x2b74c3c4efef9befULL,+	0xe5c37eda3f3ffc3fULL, 0x921caac755554955ULL, 0x791059dba2a2b2a2ULL, 0x0365c9e9eaea8feaULL,+	0x0fecca6a65658965ULL, 0xb9686903babad2baULL, 0x65935e4a2f2fbc2fULL, 0x4ee79d8ec0c027c0ULL,+	0xbe81a160dede5fdeULL, 0xe06c38fc1c1c701cULL, 0xbb2ee746fdfdd3fdULL, 0x52649a1f4d4d294dULL,+	0xe4e0397692927292ULL, 0x8fbceafa7575c975ULL, 0x301e0c3606061806ULL, 0x249809ae8a8a128aULL,+	0xf940794bb2b2f2b2ULL, 0x6359d185e6e6bfe6ULL, 0x70361c7e0e0e380eULL, 0xf8633ee71f1f7c1fULL,+	0x37f7c45562629562ULL, 0xeea3b53ad4d477d4ULL, 0x29324d81a8a89aa8ULL, 0xc4f4315296966296ULL,+	0x9b3aef62f9f9c3f9ULL, 0x66f697a3c5c533c5ULL, 0x35b14a1025259425ULL, 0xf220b2ab59597959ULL,+	0x54ae15d084842a84ULL, 0xb7a7e4c57272d572ULL, 0xd5dd72ec3939e439ULL, 0x5a6198164c4c2d4cULL,+	0xca3bbc945e5e655eULL, 0xe785f09f7878fd78ULL, 0xddd870e53838e038ULL, 0x148605988c8c0a8cULL,+	0xc6b2bf17d1d163d1ULL, 0x410b57e4a5a5aea5ULL, 0x434dd9a1e2e2afe2ULL, 0x2ff8c24e61619961ULL,+	0xf1457b42b3b3f6b3ULL, 0x15a5423421218421ULL, 0x94d625089c9c4a9cULL, 0xf0663cee1e1e781eULL,+	0x2252866143431143ULL, 0x76fc93b1c7c73bc7ULL, 0xb32be54ffcfcd7fcULL, 0x2014082404041004ULL,+	0xb208a2e351515951ULL, 0xbcc72f2599995e99ULL, 0x4fc4da226d6da96dULL, 0x68391a650d0d340dULL,+	0x8335e979fafacffaULL, 0xb684a369dfdf5bdfULL, 0xd79bfca97e7ee57eULL, 0x3db4481924249024ULL,+	0xc5d776fe3b3bec3bULL, 0x313d4b9aabab96abULL, 0x3ed181f0cece1fceULL, 0x8855229911114411ULL,+	0x0c8903838f8f068fULL, 0x4a6b9c044e4e254eULL, 0xd1517366b7b7e6b7ULL, 0x0b60cbe0ebeb8bebULL,+	0xfdcc78c13c3cf03cULL, 0x7cbf1ffd81813e81ULL, 0xd4fe354094946a94ULL, 0xeb0cf31cf7f7fbf7ULL,+	0xa1676f18b9b9deb9ULL, 0x985f268b13134c13ULL, 0x7d9c58512c2cb02cULL, 0xd6b8bb05d3d36bd3ULL,+	0x6b5cd38ce7e7bbe7ULL, 0x57cbdc396e6ea56eULL, 0x6ef395aac4c437c4ULL, 0x180f061b03030c03ULL,+	0x8a13acdc56564556ULL, 0x1a49885e44440d44ULL, 0xdf9efea07f7fe17fULL, 0x21374f88a9a99ea9ULL,+	0x4d8254672a2aa82aULL, 0xb16d6b0abbbbd6bbULL, 0x46e29f87c1c123c1ULL, 0xa202a6f153535153ULL,+	0xae8ba572dcdc57dcULL, 0x582716530b0b2c0bULL, 0x9cd327019d9d4e9dULL, 0x47c1d82b6c6cad6cULL,+	0x95f562a43131c431ULL, 0x87b9e8f37474cd74ULL, 0xe309f115f6f6fff6ULL, 0x0a438c4c46460546ULL,+	0x092645a5acac8aacULL, 0x3c970fb589891e89ULL, 0xa04428b414145014ULL, 0x5b42dfbae1e1a3e1ULL,+	0xb04e2ca616165816ULL, 0xcdd274f73a3ae83aULL, 0x6fd0d2066969b969ULL, 0x482d124109092409ULL,+	0xa7ade0d77070dd70ULL, 0xd954716fb6b6e2b6ULL, 0xceb7bd1ed0d067d0ULL, 0x3b7ec7d6eded93edULL,+	0x2edb85e2cccc17ccULL, 0x2a57846842421542ULL, 0xb4c22d2c98985a98ULL, 0x490e55eda4a4aaa4ULL,+	0x5d8850752828a028ULL, 0xda31b8865c5c6d5cULL, 0x933fed6bf8f8c7f8ULL, 0x44a411c286862286ULL,+};++static const uint64_t C5[256] = {+	0x18c07830d8181860ULL, 0x2305af462623238cULL, 0xc67ef991b8c6c63fULL, 0xe8136fcdfbe8e887ULL,+	0x874ca113cb878726ULL, 0xb8a9626d11b8b8daULL, 0x0108050209010104ULL, 0x4f426e9e0d4f4f21ULL,+	0x36adee6c9b3636d8ULL, 0xa6590451ffa6a6a2ULL, 0xd2debdb90cd2d26fULL, 0xf5fb06f70ef5f5f3ULL,+	0x79ef80f2967979f9ULL, 0x6f5fcede306f6fa1ULL, 0x91fcef3f6d91917eULL, 0x52aa07a4f8525255ULL,+	0x6027fdc04760609dULL, 0xbc89766535bcbccaULL, 0x9baccd2b379b9b56ULL, 0x8e048c018a8e8e02ULL,+	0xa371155bd2a3a3b6ULL, 0x0c603c186c0c0c30ULL, 0x7bff8af6847b7bf1ULL, 0x35b5e16a803535d4ULL,+	0x1de8693af51d1d74ULL, 0xe05347ddb3e0e0a7ULL, 0xd7f6acb321d7d77bULL, 0xc25eed999cc2c22fULL,+	0x2e6d965c432e2eb8ULL, 0x4b627a96294b4b31ULL, 0xfea321e15dfefedfULL, 0x578216aed5575741ULL,+	0x15a8412abd151554ULL, 0x779fb6eee87777c1ULL, 0x37a5eb6e923737dcULL, 0xe57b56d79ee5e5b3ULL,+	0x9f8cd923139f9f46ULL, 0xf0d317fd23f0f0e7ULL, 0x4a6a7f94204a4a35ULL, 0xda9e95a944dada4fULL,+	0x58fa25b0a258587dULL, 0xc906ca8fcfc9c903ULL, 0x29558d527c2929a4ULL, 0x0a5022145a0a0a28ULL,+	0xb1e14f7f50b1b1feULL, 0xa0691a5dc9a0a0baULL, 0x6b7fdad6146b6bb1ULL, 0x855cab17d985852eULL,+	0xbd8173673cbdbdceULL, 0x5dd234ba8f5d5d69ULL, 0x1080502090101040ULL, 0xf4f303f507f4f4f7ULL,+	0xcb16c08bddcbcb0bULL, 0x3eedc67cd33e3ef8ULL, 0x0528110a2d050514ULL, 0x671fe6ce78676781ULL,+	0xe47353d597e4e4b7ULL, 0x2725bb4e0227279cULL, 0x4132588273414119ULL, 0x8b2c9d0ba78b8b16ULL,+	0xa7510153f6a7a7a6ULL, 0x7dcf94fab27d7de9ULL, 0x95dcfb374995956eULL, 0xd88e9fad56d8d847ULL,+	0xfb8b30eb70fbfbcbULL, 0xee2371c1cdeeee9fULL, 0x7cc791f8bb7c7cedULL, 0x6617e3cc71666685ULL,+	0xdda68ea77bdddd53ULL, 0x17b84b2eaf17175cULL, 0x4702468e45474701ULL, 0x9e84dc211a9e9e42ULL,+	0xca1ec589d4caca0fULL, 0x2d75995a582d2db4ULL, 0xbf9179632ebfbfc6ULL, 0x07381b0e3f07071cULL,+	0xad012347acadad8eULL, 0x5aea2fb4b05a5a75ULL, 0x836cb51bef838336ULL, 0x3385ff66b63333ccULL,+	0x633ff2c65c636391ULL, 0x02100a0412020208ULL, 0xaa39384993aaaa92ULL, 0x71afa8e2de7171d9ULL,+	0xc80ecf8dc6c8c807ULL, 0x19c87d32d1191964ULL, 0x497270923b494939ULL, 0xd9869aaf5fd9d943ULL,+	0xf2c31df931f2f2efULL, 0xe34b48dba8e3e3abULL, 0x5be22ab6b95b5b71ULL, 0x8834920dbc88881aULL,+	0x9aa4c8293e9a9a52ULL, 0x262dbe4c0b262698ULL, 0x328dfa64bf3232c8ULL, 0xb0e94a7d59b0b0faULL,+	0xe91b6acff2e9e983ULL, 0x0f78331e770f0f3cULL, 0xd5e6a6b733d5d573ULL, 0x8074ba1df480803aULL,+	0xbe997c6127bebec2ULL, 0xcd26de87ebcdcd13ULL, 0x34bde468893434d0ULL, 0x487a75903248483dULL,+	0xffab24e354ffffdbULL, 0x7af78ff48d7a7af5ULL, 0x90f4ea3d6490907aULL, 0x5fc23ebe9d5f5f61ULL,+	0x201da0403d202080ULL, 0x6867d5d00f6868bdULL, 0x1ad07234ca1a1a68ULL, 0xae192c41b7aeae82ULL,+	0xb4c95e757db4b4eaULL, 0x549a19a8ce54544dULL, 0x93ece53b7f939376ULL, 0x220daa442f222288ULL,+	0x6407e9c86364648dULL, 0xf1db12ff2af1f1e3ULL, 0x73bfa2e6cc7373d1ULL, 0x12905a2482121248ULL,+	0x403a5d807a40401dULL, 0x0840281048080820ULL, 0xc356e89b95c3c32bULL, 0xec337bc5dfecec97ULL,+	0xdb9690ab4ddbdb4bULL, 0xa1611f5fc0a1a1beULL, 0x8d1c8307918d8d0eULL, 0x3df5c97ac83d3df4ULL,+	0x97ccf1335b979766ULL, 0x0000000000000000ULL, 0xcf36d483f9cfcf1bULL, 0x2b4587566e2b2bacULL,+	0x7697b3ece17676c5ULL, 0x8264b019e6828232ULL, 0xd6fea9b128d6d67fULL, 0x1bd87736c31b1b6cULL,+	0xb5c15b7774b5b5eeULL, 0xaf112943beafaf86ULL, 0x6a77dfd41d6a6ab5ULL, 0x50ba0da0ea50505dULL,+	0x45124c8a57454509ULL, 0xf3cb18fb38f3f3ebULL, 0x309df060ad3030c0ULL, 0xef2b74c3c4efef9bULL,+	0x3fe5c37eda3f3ffcULL, 0x55921caac7555549ULL, 0xa2791059dba2a2b2ULL, 0xea0365c9e9eaea8fULL,+	0x650fecca6a656589ULL, 0xbab9686903babad2ULL, 0x2f65935e4a2f2fbcULL, 0xc04ee79d8ec0c027ULL,+	0xdebe81a160dede5fULL, 0x1ce06c38fc1c1c70ULL, 0xfdbb2ee746fdfdd3ULL, 0x4d52649a1f4d4d29ULL,+	0x92e4e03976929272ULL, 0x758fbceafa7575c9ULL, 0x06301e0c36060618ULL, 0x8a249809ae8a8a12ULL,+	0xb2f940794bb2b2f2ULL, 0xe66359d185e6e6bfULL, 0x0e70361c7e0e0e38ULL, 0x1ff8633ee71f1f7cULL,+	0x6237f7c455626295ULL, 0xd4eea3b53ad4d477ULL, 0xa829324d81a8a89aULL, 0x96c4f43152969662ULL,+	0xf99b3aef62f9f9c3ULL, 0xc566f697a3c5c533ULL, 0x2535b14a10252594ULL, 0x59f220b2ab595979ULL,+	0x8454ae15d084842aULL, 0x72b7a7e4c57272d5ULL, 0x39d5dd72ec3939e4ULL, 0x4c5a6198164c4c2dULL,+	0x5eca3bbc945e5e65ULL, 0x78e785f09f7878fdULL, 0x38ddd870e53838e0ULL, 0x8c148605988c8c0aULL,+	0xd1c6b2bf17d1d163ULL, 0xa5410b57e4a5a5aeULL, 0xe2434dd9a1e2e2afULL, 0x612ff8c24e616199ULL,+	0xb3f1457b42b3b3f6ULL, 0x2115a54234212184ULL, 0x9c94d625089c9c4aULL, 0x1ef0663cee1e1e78ULL,+	0x4322528661434311ULL, 0xc776fc93b1c7c73bULL, 0xfcb32be54ffcfcd7ULL, 0x0420140824040410ULL,+	0x51b208a2e3515159ULL, 0x99bcc72f2599995eULL, 0x6d4fc4da226d6da9ULL, 0x0d68391a650d0d34ULL,+	0xfa8335e979fafacfULL, 0xdfb684a369dfdf5bULL, 0x7ed79bfca97e7ee5ULL, 0x243db44819242490ULL,+	0x3bc5d776fe3b3becULL, 0xab313d4b9aabab96ULL, 0xce3ed181f0cece1fULL, 0x1188552299111144ULL,+	0x8f0c8903838f8f06ULL, 0x4e4a6b9c044e4e25ULL, 0xb7d1517366b7b7e6ULL, 0xeb0b60cbe0ebeb8bULL,+	0x3cfdcc78c13c3cf0ULL, 0x817cbf1ffd81813eULL, 0x94d4fe354094946aULL, 0xf7eb0cf31cf7f7fbULL,+	0xb9a1676f18b9b9deULL, 0x13985f268b13134cULL, 0x2c7d9c58512c2cb0ULL, 0xd3d6b8bb05d3d36bULL,+	0xe76b5cd38ce7e7bbULL, 0x6e57cbdc396e6ea5ULL, 0xc46ef395aac4c437ULL, 0x03180f061b03030cULL,+	0x568a13acdc565645ULL, 0x441a49885e44440dULL, 0x7fdf9efea07f7fe1ULL, 0xa921374f88a9a99eULL,+	0x2a4d8254672a2aa8ULL, 0xbbb16d6b0abbbbd6ULL, 0xc146e29f87c1c123ULL, 0x53a202a6f1535351ULL,+	0xdcae8ba572dcdc57ULL, 0x0b582716530b0b2cULL, 0x9d9cd327019d9d4eULL, 0x6c47c1d82b6c6cadULL,+	0x3195f562a43131c4ULL, 0x7487b9e8f37474cdULL, 0xf6e309f115f6f6ffULL, 0x460a438c4c464605ULL,+	0xac092645a5acac8aULL, 0x893c970fb589891eULL, 0x14a04428b4141450ULL, 0xe15b42dfbae1e1a3ULL,+	0x16b04e2ca6161658ULL, 0x3acdd274f73a3ae8ULL, 0x696fd0d2066969b9ULL, 0x09482d1241090924ULL,+	0x70a7ade0d77070ddULL, 0xb6d954716fb6b6e2ULL, 0xd0ceb7bd1ed0d067ULL, 0xed3b7ec7d6eded93ULL,+	0xcc2edb85e2cccc17ULL, 0x422a578468424215ULL, 0x98b4c22d2c98985aULL, 0xa4490e55eda4a4aaULL,+	0x285d8850752828a0ULL, 0x5cda31b8865c5c6dULL, 0xf8933fed6bf8f8c7ULL, 0x8644a411c2868622ULL,+};++static const uint64_t C6[256] = {+	0x6018c07830d81818ULL, 0x8c2305af46262323ULL, 0x3fc67ef991b8c6c6ULL, 0x87e8136fcdfbe8e8ULL,+	0x26874ca113cb8787ULL, 0xdab8a9626d11b8b8ULL, 0x0401080502090101ULL, 0x214f426e9e0d4f4fULL,+	0xd836adee6c9b3636ULL, 0xa2a6590451ffa6a6ULL, 0x6fd2debdb90cd2d2ULL, 0xf3f5fb06f70ef5f5ULL,+	0xf979ef80f2967979ULL, 0xa16f5fcede306f6fULL, 0x7e91fcef3f6d9191ULL, 0x5552aa07a4f85252ULL,+	0x9d6027fdc0476060ULL, 0xcabc89766535bcbcULL, 0x569baccd2b379b9bULL, 0x028e048c018a8e8eULL,+	0xb6a371155bd2a3a3ULL, 0x300c603c186c0c0cULL, 0xf17bff8af6847b7bULL, 0xd435b5e16a803535ULL,+	0x741de8693af51d1dULL, 0xa7e05347ddb3e0e0ULL, 0x7bd7f6acb321d7d7ULL, 0x2fc25eed999cc2c2ULL,+	0xb82e6d965c432e2eULL, 0x314b627a96294b4bULL, 0xdffea321e15dfefeULL, 0x41578216aed55757ULL,+	0x5415a8412abd1515ULL, 0xc1779fb6eee87777ULL, 0xdc37a5eb6e923737ULL, 0xb3e57b56d79ee5e5ULL,+	0x469f8cd923139f9fULL, 0xe7f0d317fd23f0f0ULL, 0x354a6a7f94204a4aULL, 0x4fda9e95a944dadaULL,+	0x7d58fa25b0a25858ULL, 0x03c906ca8fcfc9c9ULL, 0xa429558d527c2929ULL, 0x280a5022145a0a0aULL,+	0xfeb1e14f7f50b1b1ULL, 0xbaa0691a5dc9a0a0ULL, 0xb16b7fdad6146b6bULL, 0x2e855cab17d98585ULL,+	0xcebd8173673cbdbdULL, 0x695dd234ba8f5d5dULL, 0x4010805020901010ULL, 0xf7f4f303f507f4f4ULL,+	0x0bcb16c08bddcbcbULL, 0xf83eedc67cd33e3eULL, 0x140528110a2d0505ULL, 0x81671fe6ce786767ULL,+	0xb7e47353d597e4e4ULL, 0x9c2725bb4e022727ULL, 0x1941325882734141ULL, 0x168b2c9d0ba78b8bULL,+	0xa6a7510153f6a7a7ULL, 0xe97dcf94fab27d7dULL, 0x6e95dcfb37499595ULL, 0x47d88e9fad56d8d8ULL,+	0xcbfb8b30eb70fbfbULL, 0x9fee2371c1cdeeeeULL, 0xed7cc791f8bb7c7cULL, 0x856617e3cc716666ULL,+	0x53dda68ea77bddddULL, 0x5c17b84b2eaf1717ULL, 0x014702468e454747ULL, 0x429e84dc211a9e9eULL,+	0x0fca1ec589d4cacaULL, 0xb42d75995a582d2dULL, 0xc6bf9179632ebfbfULL, 0x1c07381b0e3f0707ULL,+	0x8ead012347acadadULL, 0x755aea2fb4b05a5aULL, 0x36836cb51bef8383ULL, 0xcc3385ff66b63333ULL,+	0x91633ff2c65c6363ULL, 0x0802100a04120202ULL, 0x92aa39384993aaaaULL, 0xd971afa8e2de7171ULL,+	0x07c80ecf8dc6c8c8ULL, 0x6419c87d32d11919ULL, 0x39497270923b4949ULL, 0x43d9869aaf5fd9d9ULL,+	0xeff2c31df931f2f2ULL, 0xabe34b48dba8e3e3ULL, 0x715be22ab6b95b5bULL, 0x1a8834920dbc8888ULL,+	0x529aa4c8293e9a9aULL, 0x98262dbe4c0b2626ULL, 0xc8328dfa64bf3232ULL, 0xfab0e94a7d59b0b0ULL,+	0x83e91b6acff2e9e9ULL, 0x3c0f78331e770f0fULL, 0x73d5e6a6b733d5d5ULL, 0x3a8074ba1df48080ULL,+	0xc2be997c6127bebeULL, 0x13cd26de87ebcdcdULL, 0xd034bde468893434ULL, 0x3d487a7590324848ULL,+	0xdbffab24e354ffffULL, 0xf57af78ff48d7a7aULL, 0x7a90f4ea3d649090ULL, 0x615fc23ebe9d5f5fULL,+	0x80201da0403d2020ULL, 0xbd6867d5d00f6868ULL, 0x681ad07234ca1a1aULL, 0x82ae192c41b7aeaeULL,+	0xeab4c95e757db4b4ULL, 0x4d549a19a8ce5454ULL, 0x7693ece53b7f9393ULL, 0x88220daa442f2222ULL,+	0x8d6407e9c8636464ULL, 0xe3f1db12ff2af1f1ULL, 0xd173bfa2e6cc7373ULL, 0x4812905a24821212ULL,+	0x1d403a5d807a4040ULL, 0x2008402810480808ULL, 0x2bc356e89b95c3c3ULL, 0x97ec337bc5dfececULL,+	0x4bdb9690ab4ddbdbULL, 0xbea1611f5fc0a1a1ULL, 0x0e8d1c8307918d8dULL, 0xf43df5c97ac83d3dULL,+	0x6697ccf1335b9797ULL, 0x0000000000000000ULL, 0x1bcf36d483f9cfcfULL, 0xac2b4587566e2b2bULL,+	0xc57697b3ece17676ULL, 0x328264b019e68282ULL, 0x7fd6fea9b128d6d6ULL, 0x6c1bd87736c31b1bULL,+	0xeeb5c15b7774b5b5ULL, 0x86af112943beafafULL, 0xb56a77dfd41d6a6aULL, 0x5d50ba0da0ea5050ULL,+	0x0945124c8a574545ULL, 0xebf3cb18fb38f3f3ULL, 0xc0309df060ad3030ULL, 0x9bef2b74c3c4efefULL,+	0xfc3fe5c37eda3f3fULL, 0x4955921caac75555ULL, 0xb2a2791059dba2a2ULL, 0x8fea0365c9e9eaeaULL,+	0x89650fecca6a6565ULL, 0xd2bab9686903babaULL, 0xbc2f65935e4a2f2fULL, 0x27c04ee79d8ec0c0ULL,+	0x5fdebe81a160dedeULL, 0x701ce06c38fc1c1cULL, 0xd3fdbb2ee746fdfdULL, 0x294d52649a1f4d4dULL,+	0x7292e4e039769292ULL, 0xc9758fbceafa7575ULL, 0x1806301e0c360606ULL, 0x128a249809ae8a8aULL,+	0xf2b2f940794bb2b2ULL, 0xbfe66359d185e6e6ULL, 0x380e70361c7e0e0eULL, 0x7c1ff8633ee71f1fULL,+	0x956237f7c4556262ULL, 0x77d4eea3b53ad4d4ULL, 0x9aa829324d81a8a8ULL, 0x6296c4f431529696ULL,+	0xc3f99b3aef62f9f9ULL, 0x33c566f697a3c5c5ULL, 0x942535b14a102525ULL, 0x7959f220b2ab5959ULL,+	0x2a8454ae15d08484ULL, 0xd572b7a7e4c57272ULL, 0xe439d5dd72ec3939ULL, 0x2d4c5a6198164c4cULL,+	0x655eca3bbc945e5eULL, 0xfd78e785f09f7878ULL, 0xe038ddd870e53838ULL, 0x0a8c148605988c8cULL,+	0x63d1c6b2bf17d1d1ULL, 0xaea5410b57e4a5a5ULL, 0xafe2434dd9a1e2e2ULL, 0x99612ff8c24e6161ULL,+	0xf6b3f1457b42b3b3ULL, 0x842115a542342121ULL, 0x4a9c94d625089c9cULL, 0x781ef0663cee1e1eULL,+	0x1143225286614343ULL, 0x3bc776fc93b1c7c7ULL, 0xd7fcb32be54ffcfcULL, 0x1004201408240404ULL,+	0x5951b208a2e35151ULL, 0x5e99bcc72f259999ULL, 0xa96d4fc4da226d6dULL, 0x340d68391a650d0dULL,+	0xcffa8335e979fafaULL, 0x5bdfb684a369dfdfULL, 0xe57ed79bfca97e7eULL, 0x90243db448192424ULL,+	0xec3bc5d776fe3b3bULL, 0x96ab313d4b9aababULL, 0x1fce3ed181f0ceceULL, 0x4411885522991111ULL,+	0x068f0c8903838f8fULL, 0x254e4a6b9c044e4eULL, 0xe6b7d1517366b7b7ULL, 0x8beb0b60cbe0ebebULL,+	0xf03cfdcc78c13c3cULL, 0x3e817cbf1ffd8181ULL, 0x6a94d4fe35409494ULL, 0xfbf7eb0cf31cf7f7ULL,+	0xdeb9a1676f18b9b9ULL, 0x4c13985f268b1313ULL, 0xb02c7d9c58512c2cULL, 0x6bd3d6b8bb05d3d3ULL,+	0xbbe76b5cd38ce7e7ULL, 0xa56e57cbdc396e6eULL, 0x37c46ef395aac4c4ULL, 0x0c03180f061b0303ULL,+	0x45568a13acdc5656ULL, 0x0d441a49885e4444ULL, 0xe17fdf9efea07f7fULL, 0x9ea921374f88a9a9ULL,+	0xa82a4d8254672a2aULL, 0xd6bbb16d6b0abbbbULL, 0x23c146e29f87c1c1ULL, 0x5153a202a6f15353ULL,+	0x57dcae8ba572dcdcULL, 0x2c0b582716530b0bULL, 0x4e9d9cd327019d9dULL, 0xad6c47c1d82b6c6cULL,+	0xc43195f562a43131ULL, 0xcd7487b9e8f37474ULL, 0xfff6e309f115f6f6ULL, 0x05460a438c4c4646ULL,+	0x8aac092645a5acacULL, 0x1e893c970fb58989ULL, 0x5014a04428b41414ULL, 0xa3e15b42dfbae1e1ULL,+	0x5816b04e2ca61616ULL, 0xe83acdd274f73a3aULL, 0xb9696fd0d2066969ULL, 0x2409482d12410909ULL,+	0xdd70a7ade0d77070ULL, 0xe2b6d954716fb6b6ULL, 0x67d0ceb7bd1ed0d0ULL, 0x93ed3b7ec7d6ededULL,+	0x17cc2edb85e2ccccULL, 0x15422a5784684242ULL, 0x5a98b4c22d2c9898ULL, 0xaaa4490e55eda4a4ULL,+	0xa0285d8850752828ULL, 0x6d5cda31b8865c5cULL, 0xc7f8933fed6bf8f8ULL, 0x228644a411c28686ULL,+};++static const uint64_t C7[256] = {+	0x186018c07830d818ULL, 0x238c2305af462623ULL, 0xc63fc67ef991b8c6ULL, 0xe887e8136fcdfbe8ULL,+	0x8726874ca113cb87ULL, 0xb8dab8a9626d11b8ULL, 0x0104010805020901ULL, 0x4f214f426e9e0d4fULL,+	0x36d836adee6c9b36ULL, 0xa6a2a6590451ffa6ULL, 0xd26fd2debdb90cd2ULL, 0xf5f3f5fb06f70ef5ULL,+	0x79f979ef80f29679ULL, 0x6fa16f5fcede306fULL, 0x917e91fcef3f6d91ULL, 0x525552aa07a4f852ULL,+	0x609d6027fdc04760ULL, 0xbccabc89766535bcULL, 0x9b569baccd2b379bULL, 0x8e028e048c018a8eULL,+	0xa3b6a371155bd2a3ULL, 0x0c300c603c186c0cULL, 0x7bf17bff8af6847bULL, 0x35d435b5e16a8035ULL,+	0x1d741de8693af51dULL, 0xe0a7e05347ddb3e0ULL, 0xd77bd7f6acb321d7ULL, 0xc22fc25eed999cc2ULL,+	0x2eb82e6d965c432eULL, 0x4b314b627a96294bULL, 0xfedffea321e15dfeULL, 0x5741578216aed557ULL,+	0x155415a8412abd15ULL, 0x77c1779fb6eee877ULL, 0x37dc37a5eb6e9237ULL, 0xe5b3e57b56d79ee5ULL,+	0x9f469f8cd923139fULL, 0xf0e7f0d317fd23f0ULL, 0x4a354a6a7f94204aULL, 0xda4fda9e95a944daULL,+	0x587d58fa25b0a258ULL, 0xc903c906ca8fcfc9ULL, 0x29a429558d527c29ULL, 0x0a280a5022145a0aULL,+	0xb1feb1e14f7f50b1ULL, 0xa0baa0691a5dc9a0ULL, 0x6bb16b7fdad6146bULL, 0x852e855cab17d985ULL,+	0xbdcebd8173673cbdULL, 0x5d695dd234ba8f5dULL, 0x1040108050209010ULL, 0xf4f7f4f303f507f4ULL,+	0xcb0bcb16c08bddcbULL, 0x3ef83eedc67cd33eULL, 0x05140528110a2d05ULL, 0x6781671fe6ce7867ULL,+	0xe4b7e47353d597e4ULL, 0x279c2725bb4e0227ULL, 0x4119413258827341ULL, 0x8b168b2c9d0ba78bULL,+	0xa7a6a7510153f6a7ULL, 0x7de97dcf94fab27dULL, 0x956e95dcfb374995ULL, 0xd847d88e9fad56d8ULL,+	0xfbcbfb8b30eb70fbULL, 0xee9fee2371c1cdeeULL, 0x7ced7cc791f8bb7cULL, 0x66856617e3cc7166ULL,+	0xdd53dda68ea77bddULL, 0x175c17b84b2eaf17ULL, 0x47014702468e4547ULL, 0x9e429e84dc211a9eULL,+	0xca0fca1ec589d4caULL, 0x2db42d75995a582dULL, 0xbfc6bf9179632ebfULL, 0x071c07381b0e3f07ULL,+	0xad8ead012347acadULL, 0x5a755aea2fb4b05aULL, 0x8336836cb51bef83ULL, 0x33cc3385ff66b633ULL,+	0x6391633ff2c65c63ULL, 0x020802100a041202ULL, 0xaa92aa39384993aaULL, 0x71d971afa8e2de71ULL,+	0xc807c80ecf8dc6c8ULL, 0x196419c87d32d119ULL, 0x4939497270923b49ULL, 0xd943d9869aaf5fd9ULL,+	0xf2eff2c31df931f2ULL, 0xe3abe34b48dba8e3ULL, 0x5b715be22ab6b95bULL, 0x881a8834920dbc88ULL,+	0x9a529aa4c8293e9aULL, 0x2698262dbe4c0b26ULL, 0x32c8328dfa64bf32ULL, 0xb0fab0e94a7d59b0ULL,+	0xe983e91b6acff2e9ULL, 0x0f3c0f78331e770fULL, 0xd573d5e6a6b733d5ULL, 0x803a8074ba1df480ULL,+	0xbec2be997c6127beULL, 0xcd13cd26de87ebcdULL, 0x34d034bde4688934ULL, 0x483d487a75903248ULL,+	0xffdbffab24e354ffULL, 0x7af57af78ff48d7aULL, 0x907a90f4ea3d6490ULL, 0x5f615fc23ebe9d5fULL,+	0x2080201da0403d20ULL, 0x68bd6867d5d00f68ULL, 0x1a681ad07234ca1aULL, 0xae82ae192c41b7aeULL,+	0xb4eab4c95e757db4ULL, 0x544d549a19a8ce54ULL, 0x937693ece53b7f93ULL, 0x2288220daa442f22ULL,+	0x648d6407e9c86364ULL, 0xf1e3f1db12ff2af1ULL, 0x73d173bfa2e6cc73ULL, 0x124812905a248212ULL,+	0x401d403a5d807a40ULL, 0x0820084028104808ULL, 0xc32bc356e89b95c3ULL, 0xec97ec337bc5dfecULL,+	0xdb4bdb9690ab4ddbULL, 0xa1bea1611f5fc0a1ULL, 0x8d0e8d1c8307918dULL, 0x3df43df5c97ac83dULL,+	0x976697ccf1335b97ULL, 0x0000000000000000ULL, 0xcf1bcf36d483f9cfULL, 0x2bac2b4587566e2bULL,+	0x76c57697b3ece176ULL, 0x82328264b019e682ULL, 0xd67fd6fea9b128d6ULL, 0x1b6c1bd87736c31bULL,+	0xb5eeb5c15b7774b5ULL, 0xaf86af112943beafULL, 0x6ab56a77dfd41d6aULL, 0x505d50ba0da0ea50ULL,+	0x450945124c8a5745ULL, 0xf3ebf3cb18fb38f3ULL, 0x30c0309df060ad30ULL, 0xef9bef2b74c3c4efULL,+	0x3ffc3fe5c37eda3fULL, 0x554955921caac755ULL, 0xa2b2a2791059dba2ULL, 0xea8fea0365c9e9eaULL,+	0x6589650fecca6a65ULL, 0xbad2bab9686903baULL, 0x2fbc2f65935e4a2fULL, 0xc027c04ee79d8ec0ULL,+	0xde5fdebe81a160deULL, 0x1c701ce06c38fc1cULL, 0xfdd3fdbb2ee746fdULL, 0x4d294d52649a1f4dULL,+	0x927292e4e0397692ULL, 0x75c9758fbceafa75ULL, 0x061806301e0c3606ULL, 0x8a128a249809ae8aULL,+	0xb2f2b2f940794bb2ULL, 0xe6bfe66359d185e6ULL, 0x0e380e70361c7e0eULL, 0x1f7c1ff8633ee71fULL,+	0x62956237f7c45562ULL, 0xd477d4eea3b53ad4ULL, 0xa89aa829324d81a8ULL, 0x966296c4f4315296ULL,+	0xf9c3f99b3aef62f9ULL, 0xc533c566f697a3c5ULL, 0x25942535b14a1025ULL, 0x597959f220b2ab59ULL,+	0x842a8454ae15d084ULL, 0x72d572b7a7e4c572ULL, 0x39e439d5dd72ec39ULL, 0x4c2d4c5a6198164cULL,+	0x5e655eca3bbc945eULL, 0x78fd78e785f09f78ULL, 0x38e038ddd870e538ULL, 0x8c0a8c148605988cULL,+	0xd163d1c6b2bf17d1ULL, 0xa5aea5410b57e4a5ULL, 0xe2afe2434dd9a1e2ULL, 0x6199612ff8c24e61ULL,+	0xb3f6b3f1457b42b3ULL, 0x21842115a5423421ULL, 0x9c4a9c94d625089cULL, 0x1e781ef0663cee1eULL,+	0x4311432252866143ULL, 0xc73bc776fc93b1c7ULL, 0xfcd7fcb32be54ffcULL, 0x0410042014082404ULL,+	0x515951b208a2e351ULL, 0x995e99bcc72f2599ULL, 0x6da96d4fc4da226dULL, 0x0d340d68391a650dULL,+	0xfacffa8335e979faULL, 0xdf5bdfb684a369dfULL, 0x7ee57ed79bfca97eULL, 0x2490243db4481924ULL,+	0x3bec3bc5d776fe3bULL, 0xab96ab313d4b9aabULL, 0xce1fce3ed181f0ceULL, 0x1144118855229911ULL,+	0x8f068f0c8903838fULL, 0x4e254e4a6b9c044eULL, 0xb7e6b7d1517366b7ULL, 0xeb8beb0b60cbe0ebULL,+	0x3cf03cfdcc78c13cULL, 0x813e817cbf1ffd81ULL, 0x946a94d4fe354094ULL, 0xf7fbf7eb0cf31cf7ULL,+	0xb9deb9a1676f18b9ULL, 0x134c13985f268b13ULL, 0x2cb02c7d9c58512cULL, 0xd36bd3d6b8bb05d3ULL,+	0xe7bbe76b5cd38ce7ULL, 0x6ea56e57cbdc396eULL, 0xc437c46ef395aac4ULL, 0x030c03180f061b03ULL,+	0x5645568a13acdc56ULL, 0x440d441a49885e44ULL, 0x7fe17fdf9efea07fULL, 0xa99ea921374f88a9ULL,+	0x2aa82a4d8254672aULL, 0xbbd6bbb16d6b0abbULL, 0xc123c146e29f87c1ULL, 0x535153a202a6f153ULL,+	0xdc57dcae8ba572dcULL, 0x0b2c0b582716530bULL, 0x9d4e9d9cd327019dULL, 0x6cad6c47c1d82b6cULL,+	0x31c43195f562a431ULL, 0x74cd7487b9e8f374ULL, 0xf6fff6e309f115f6ULL, 0x4605460a438c4c46ULL,+	0xac8aac092645a5acULL, 0x891e893c970fb589ULL, 0x145014a04428b414ULL, 0xe1a3e15b42dfbae1ULL,+	0x165816b04e2ca616ULL, 0x3ae83acdd274f73aULL, 0x69b9696fd0d20669ULL, 0x092409482d124109ULL,+	0x70dd70a7ade0d770ULL, 0xb6e2b6d954716fb6ULL, 0xd067d0ceb7bd1ed0ULL, 0xed93ed3b7ec7d6edULL,+	0xcc17cc2edb85e2ccULL, 0x4215422a57846842ULL, 0x985a98b4c22d2c98ULL, 0xa4aaa4490e55eda4ULL,+	0x28a0285d88507528ULL, 0x5c6d5cda31b8865cULL, 0xf8c7f8933fed6bf8ULL, 0x86228644a411c286ULL,+};++static const uint64_t rc[R + 1] = {+	0x0000000000000000ULL,+	0x1823c6e887b8014fULL,+	0x36a6d2f5796f9152ULL,+	0x60bc9b8ea30c7b35ULL,+	0x1de0d7c22e4bfe57ULL,+	0x157737e59ff04adaULL,+	0x58c9290ab1a06b85ULL,+	0xbd5d10f4cb3e0567ULL,+	0xe427418ba77d95d8ULL,+	0xfbee7c66dd17479eULL,+	0xca2dbf07ad5a8333ULL,+};++/* This might not be true for all platforms and compilers. */+#define SANE_ARRAY_PACKING 1++#if defined(SANE_ARRAY_PACKING) && (defined(ARCH_IS_LITTLE_ENDIAN) || defined(ARCH_IS_BIG_ENDIAN))++#if defined(ARCH_IS_LITTLE_ENDIAN)+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 7]] \+	^ C1[mu[((n+7)%8) * 8 + 6]] \+	^ C2[mu[((n+6)%8) * 8 + 5]] \+	^ C3[mu[((n+5)%8) * 8 + 4]] \+	^ C4[mu[((n+4)%8) * 8 + 3]] \+	^ C5[mu[((n+3)%8) * 8 + 2]] \+	^ C6[mu[((n+2)%8) * 8 + 1]] \+	^ C7[mu[((n+1)%8) * 8 + 0]] \+	; } while (0)+#else+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 0]] \+	^ C1[mu[((n+7)%8) * 8 + 1]] \+	^ C2[mu[((n+6)%8) * 8 + 2]] \+	^ C3[mu[((n+5)%8) * 8 + 3]] \+	^ C4[mu[((n+4)%8) * 8 + 4]] \+	^ C5[mu[((n+3)%8) * 8 + 5]] \+	^ C6[mu[((n+2)%8) * 8 + 6]] \+	^ C7[mu[((n+1)%8) * 8 + 7]] \+	; } while (0)+#endif++static void transformMatrix(uint64_t m[8])+{+	uint64_t L[8];+	uint8_t *mu = (uint8_t*)m;++	LB(0);+	LB(1);+	LB(2);+	LB(3);+	LB(4);+	LB(5);+	LB(6);+	LB(7);++	array_copy64(m, L, 8);+}++#else++static void transformMatrix(uint64_t m[8])+{+	uint64_t L[8];++	L[0] =+		C0[(int)(m[0] >> 56)       ] ^+		C1[(int)(m[7] >> 48) & 0xff] ^+		C2[(int)(m[6] >> 40) & 0xff] ^+		C3[(int)(m[5] >> 32) & 0xff] ^+		C4[(int)(m[4] >> 24) & 0xff] ^+		C5[(int)(m[3] >> 16) & 0xff] ^+		C6[(int)(m[2] >>  8) & 0xff] ^+		C7[(int)(m[1]      ) & 0xff];+	L[1] =+		C0[(int)(m[1] >> 56)       ] ^+		C1[(int)(m[0] >> 48) & 0xff] ^+		C2[(int)(m[7] >> 40) & 0xff] ^+		C3[(int)(m[6] >> 32) & 0xff] ^+		C4[(int)(m[5] >> 24) & 0xff] ^+		C5[(int)(m[4] >> 16) & 0xff] ^+		C6[(int)(m[3] >>  8) & 0xff] ^+		C7[(int)(m[2]      ) & 0xff];+	L[2] =+		C0[(int)(m[2] >> 56)       ] ^+		C1[(int)(m[1] >> 48) & 0xff] ^+		C2[(int)(m[0] >> 40) & 0xff] ^+		C3[(int)(m[7] >> 32) & 0xff] ^+		C4[(int)(m[6] >> 24) & 0xff] ^+		C5[(int)(m[5] >> 16) & 0xff] ^+		C6[(int)(m[4] >>  8) & 0xff] ^+		C7[(int)(m[3]      ) & 0xff];+	L[3] =+		C0[(int)(m[3] >> 56)       ] ^+		C1[(int)(m[2] >> 48) & 0xff] ^+		C2[(int)(m[1] >> 40) & 0xff] ^+		C3[(int)(m[0] >> 32) & 0xff] ^+		C4[(int)(m[7] >> 24) & 0xff] ^+		C5[(int)(m[6] >> 16) & 0xff] ^+		C6[(int)(m[5] >>  8) & 0xff] ^+		C7[(int)(m[4]      ) & 0xff];+	L[4] =+		C0[(int)(m[4] >> 56)       ] ^+		C1[(int)(m[3] >> 48) & 0xff] ^+		C2[(int)(m[2] >> 40) & 0xff] ^+		C3[(int)(m[1] >> 32) & 0xff] ^+		C4[(int)(m[0] >> 24) & 0xff] ^+		C5[(int)(m[7] >> 16) & 0xff] ^+		C6[(int)(m[6] >>  8) & 0xff] ^+		C7[(int)(m[5]      ) & 0xff];+	L[5] =+		C0[(int)(m[5] >> 56)       ] ^+		C1[(int)(m[4] >> 48) & 0xff] ^+		C2[(int)(m[3] >> 40) & 0xff] ^+		C3[(int)(m[2] >> 32) & 0xff] ^+		C4[(int)(m[1] >> 24) & 0xff] ^+		C5[(int)(m[0] >> 16) & 0xff] ^+		C6[(int)(m[7] >>  8) & 0xff] ^+		C7[(int)(m[6]      ) & 0xff];+	L[6] =+		C0[(int)(m[6] >> 56)       ] ^+		C1[(int)(m[5] >> 48) & 0xff] ^+		C2[(int)(m[4] >> 40) & 0xff] ^+		C3[(int)(m[3] >> 32) & 0xff] ^+		C4[(int)(m[2] >> 24) & 0xff] ^+		C5[(int)(m[1] >> 16) & 0xff] ^+		C6[(int)(m[0] >>  8) & 0xff] ^+		C7[(int)(m[7]      ) & 0xff];+	L[7] =+		C0[(int)(m[7] >> 56)       ] ^+		C1[(int)(m[6] >> 48) & 0xff] ^+		C2[(int)(m[5] >> 40) & 0xff] ^+		C3[(int)(m[4] >> 32) & 0xff] ^+		C4[(int)(m[3] >> 24) & 0xff] ^+		C5[(int)(m[2] >> 16) & 0xff] ^+		C6[(int)(m[1] >>  8) & 0xff] ^+		C7[(int)(m[0]      ) & 0xff];++	array_copy64(m, L, 8);+}++#endif++static void inplaceXor(uint64_t dst[8], uint64_t src[8])+{+	dst[0] ^= src[0];+	dst[1] ^= src[1];+	dst[2] ^= src[2];+	dst[3] ^= src[3];+	dst[4] ^= src[4];+	dst[5] ^= src[5];+	dst[6] ^= src[6];+	dst[7] ^= src[7];+}++/**+ * The core Whirlpool transform.+ */+static void processBuffer(whirlpool_ctx * const ctx)+{+	int i, r;+	uint64_t K[8];        /* the round key */+	uint64_t block[8];    /* mu(buffer) */+	uint64_t state[8];    /* the cipher state */+	uint64_t L[8];+	uint8_t *buffer = ctx->buffer;++	/*+	 * map the buffer to a block:+	 */+	for (i = 0; i < 8; i++, buffer += 8) {+		block[i] =+			(((uint64_t)buffer[0]        ) << 56) ^+			(((uint64_t)buffer[1] & 0xffL) << 48) ^+			(((uint64_t)buffer[2] & 0xffL) << 40) ^+			(((uint64_t)buffer[3] & 0xffL) << 32) ^+			(((uint64_t)buffer[4] & 0xffL) << 24) ^+			(((uint64_t)buffer[5] & 0xffL) << 16) ^+			(((uint64_t)buffer[6] & 0xffL) <<  8) ^+			(((uint64_t)buffer[7] & 0xffL)      );+	}++	/*+	 * compute and apply K^0 to the cipher state:+	 */+	array_copy64(K, ctx->hash, 8);+	array_copy64(state, block, 8);+	inplaceXor(state, K);++	/*+	 * iterate over all rounds:+	 */+	for (r = 1; r <= R; r++) {+		/*+		 * compute K^r from K^{r-1}:+		 */+		transformMatrix(K);+		K[0] ^= rc[r];++		/*+		 * apply the r-th round transformation:+		 */+		transformMatrix(state);+		inplaceXor(state, K);+	}+	/*+	 * apply the Miyaguchi-Preneel compression function:+	 */+	inplaceXor(ctx->hash, state);+	inplaceXor(ctx->hash, block);+}++/**+ * Initialize the hashing state.+ */+void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx)+{+	int i;++	memset(ctx->bitLength, 0, 32);+	ctx->bufferBits = ctx->bufferPos = 0;+	ctx->buffer[0] = 0; /* it's only necessary to cleanup buffer[bufferPos] */+	for (i = 0; i < 8; i++) {+		ctx->hash[i] = 0L; /* initial value */+	}+}++/**+ * Delivers input data to the hashing algorithm.+ *+ * @param    source        plaintext data to hash.+ * @param    sourceBits    how many bits of plaintext to process.+ *+ * This method maintains the invariant: bufferBits < DIGESTBITS+ */+void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t sourceBytes)+{+	/*+	   sourcePos+	   |+	   +-------+-------+-------+	   ||||||||||||||||||||| source+	   +-------+-------+-------+	   +-------+-------+-------+-------+-------+-------+	   ||||||||||||||||||||||                           buffer+	   +-------+-------+-------+-------+-------+-------+	   |+	   bufferPos+	   */+	int sourceBits   = sourceBytes * 8;+	int sourcePos    = 0; /* index of leftmost source uint8_t containing data (1 to 8 bits). */+	int sourceGap    = (8 - ((int)sourceBits & 7)) & 7; /* space on source[sourcePos]. */+	int bufferRem    = ctx->bufferBits & 7; /* occupied bits on buffer[bufferPos]. */+	int i;+	uint32_t b, carry;+	uint8_t *buffer       = ctx->buffer;+	uint8_t *bitLength    = ctx->bitLength;+	int bufferBits   = ctx->bufferBits;+	int bufferPos    = ctx->bufferPos;++	/*+	 * tally the length of the added data:+	 */+	uint64_t value = sourceBits;+	for (i = 31, carry = 0; i >= 0 && (carry != 0 || value != 0ULL); i--) {+		carry += bitLength[i] + ((uint32_t)value & 0xff);+		bitLength[i] = (uint8_t)carry;+		carry >>= 8;+		value >>= 8;+	}+	/*+	 * process data in chunks of 8 bits (a more efficient approach would be to take whole-word chunks):+	 */+	while (sourceBits > 8) {+		/* N.B. at least source[sourcePos] and source[sourcePos+1] contain data. */+		/*+		 * take a byte from the source:+		 */+		b = ((source[sourcePos] << sourceGap) & 0xff) |+			((source[sourcePos + 1] & 0xff) >> (8 - sourceGap));+		/*+		 * process this byte:+		 */+		buffer[bufferPos++] |= (uint8_t)(b >> bufferRem);+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */+		if (bufferBits == DIGESTBITS) {+			/*+			 * process data block:+			 */+			processBuffer(ctx);+			/*+			 * reset buffer:+			 */+			bufferBits = bufferPos = 0;+		}+		buffer[bufferPos] = b << (8 - bufferRem);+		bufferBits += bufferRem;+		/*+		 * proceed to remaining data:+		 */+		sourceBits -= 8;+		sourcePos++;+	}+	/* now 0 <= sourceBits <= 8;+	 * furthermore, all data (if any is left) is in source[sourcePos].+	 */+	if (sourceBits > 0) {+		b = (source[sourcePos] << sourceGap) & 0xff; /* bits are left-justified on b. */+		/*+		 * process the remaining bits:+		 */+		buffer[bufferPos] |= b >> bufferRem;+	} else {+		b = 0;+	}+	if (bufferRem + sourceBits < 8) {+		/*+		 * all remaining data fits on buffer[bufferPos],+		 * and there still remains some space.+		 */+		bufferBits += sourceBits;+	} else {+		/*+		 * buffer[bufferPos] is full:+		 */+		bufferPos++;+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */+		sourceBits -= 8 - bufferRem;+		/* now 0 <= sourceBits < 8;+		 * furthermore, all data (if any is left) is in source[sourcePos].+		 */+		if (bufferBits == DIGESTBITS) {+			/*+			 * process data block:+			 */+			processBuffer(ctx);+			/*+			 * reset buffer:+			 */+			bufferBits = bufferPos = 0;+		}+		buffer[bufferPos] = b << (8 - bufferRem);+		bufferBits += (int)sourceBits;+	}+	ctx->bufferBits   = bufferBits;+	ctx->bufferPos    = bufferPos;+}++/**+ * Get the hash value from the hashing state.+ * + * This method uses the invariant: bufferBits < DIGESTBITS+ */+void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result)+{+	int i;+	uint8_t *buffer    = ctx->buffer;+	uint8_t *bitLength = ctx->bitLength;+	int bufferBits     = ctx->bufferBits;+	int bufferPos      = ctx->bufferPos;+	uint8_t *digest    = result;++	/*+	 * append a '1'-bit:+	 */+	buffer[bufferPos] |= 0x80U >> (bufferBits & 7);+	bufferPos++; /* all remaining bits on the current uint8_t are set to zero. */+	/*+	 * pad with zero bits to complete (N*WBLOCKBITS - LENGTHBITS) bits:+	 */+	if (bufferPos > WBLOCKBYTES - LENGTHBYTES) {+		if (bufferPos < WBLOCKBYTES) {+			memset(&buffer[bufferPos], 0, WBLOCKBYTES - bufferPos);+		}+		/*+		 * process data block:+		 */+		processBuffer(ctx);+		/*+		 * reset buffer:+		 */+		bufferPos = 0;+	}+	if (bufferPos < WBLOCKBYTES - LENGTHBYTES) {+		memset(&buffer[bufferPos], 0, (WBLOCKBYTES - LENGTHBYTES) - bufferPos);+	}+	bufferPos = WBLOCKBYTES - LENGTHBYTES;+	/*+	 * append bit length of hashed data:+	 */+	memcpy(&buffer[WBLOCKBYTES - LENGTHBYTES], bitLength, LENGTHBYTES);+	/*+	 * process data block:+	 */+	processBuffer(ctx);+	/*+	 * return the completed message digest:+	 */+	for (i = 0; i < DIGESTBYTES/8; i++) {+		digest[0] = (uint8_t)(ctx->hash[i] >> 56);+		digest[1] = (uint8_t)(ctx->hash[i] >> 48);+		digest[2] = (uint8_t)(ctx->hash[i] >> 40);+		digest[3] = (uint8_t)(ctx->hash[i] >> 32);+		digest[4] = (uint8_t)(ctx->hash[i] >> 24);+		digest[5] = (uint8_t)(ctx->hash[i] >> 16);+		digest[6] = (uint8_t)(ctx->hash[i] >>  8);+		digest[7] = (uint8_t)(ctx->hash[i]      );+		digest += 8;+	}+	ctx->bufferBits   = bufferBits;+	ctx->bufferPos    = bufferPos;+}
+ cbits/cryptonite_whirlpool.h view
@@ -0,0 +1,31 @@+#ifndef CRYPTOHASH_WHIRLPOOL_H
+#define CRYPTOHASH_WHIRLPOOL_H
+
+#include <stdint.h>
+
+/*
+ * Whirlpool-specific definitions.
+ */
+
+#define DIGESTBYTES 64
+#define DIGESTBITS  (8*DIGESTBYTES) /* 512 */
+
+#define WBLOCKBYTES 64
+#define WBLOCKBITS  (8*WBLOCKBYTES) /* 512 */
+
+#define LENGTHBYTES 32
+#define LENGTHBITS  (8*LENGTHBYTES) /* 256 */
+
+typedef struct whirlpool_ctx {
+	uint8_t  bitLength[LENGTHBYTES]; /* global number of hashed bits (256-bit counter) */
+	uint8_t  buffer[WBLOCKBYTES];    /* buffer of data to hash */
+	uint32_t bufferBits;             /* current number of bits on the buffer */
+	uint32_t bufferPos;              /* current (possibly incomplete) byte slot on the buffer */
+	uint64_t hash[DIGESTBYTES/8];    /* the hashing state */
+} whirlpool_ctx;
+
+void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx);
+void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t len);
+void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result);
+
+#endif
+ cbits/curve25519/curve25519-donna.c view
@@ -0,0 +1,860 @@+/* Copyright 2008, Google Inc.+ * All rights reserved.+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions are+ * met:+ *+ *     * Redistributions of source code must retain the above copyright+ * notice, this list of conditions and the following disclaimer.+ *     * Redistributions in binary form must reproduce the above+ * copyright notice, this list of conditions and the following disclaimer+ * in the documentation and/or other materials provided with the+ * distribution.+ *     * Neither the name of Google Inc. nor the names of its+ * contributors may be used to endorse or promote products derived from+ * this software without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ *+ * curve25519-donna: Curve25519 elliptic curve, public key function+ *+ * http://code.google.com/p/curve25519-donna/+ *+ * Adam Langley <agl@imperialviolet.org>+ *+ * Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>+ *+ * More information about curve25519 can be found here+ *   http://cr.yp.to/ecdh.html+ *+ * djb's sample implementation of curve25519 is written in a special assembly+ * language called qhasm and uses the floating point registers.+ *+ * This is, almost, a clean room reimplementation from the curve25519 paper. It+ * uses many of the tricks described therein. Only the crecip function is taken+ * from the sample implementation. */++#include <string.h>+#include <stdint.h>++#ifdef _MSC_VER+#define inline __inline+#endif++typedef uint8_t u8;+typedef int32_t s32;+typedef int64_t limb;++/* Field element representation:+ *+ * Field elements are written as an array of signed, 64-bit limbs, least+ * significant first. The value of the field element is:+ *   x[0] + 2^26·x[1] + x^51·x[2] + 2^102·x[3] + ...+ *+ * i.e. the limbs are 26, 25, 26, 25, ... bits wide. */++/* Sum two numbers: output += in */+static void fsum(limb *output, const limb *in) {+  unsigned i;+  for (i = 0; i < 10; i += 2) {+    output[0+i] = output[0+i] + in[0+i];+    output[1+i] = output[1+i] + in[1+i];+  }+}++/* Find the difference of two numbers: output = in - output+ * (note the order of the arguments!). */+static void fdifference(limb *output, const limb *in) {+  unsigned i;+  for (i = 0; i < 10; ++i) {+    output[i] = in[i] - output[i];+  }+}++/* Multiply a number by a scalar: output = in * scalar */+static void fscalar_product(limb *output, const limb *in, const limb scalar) {+  unsigned i;+  for (i = 0; i < 10; ++i) {+    output[i] = in[i] * scalar;+  }+}++/* Multiply two numbers: output = in2 * in+ *+ * output must be distinct to both inputs. The inputs are reduced coefficient+ * form, the output is not.+ *+ * output[x] <= 14 * the largest product of the input limbs. */+static void fproduct(limb *output, const limb *in2, const limb *in) {+  output[0] =       ((limb) ((s32) in2[0])) * ((s32) in[0]);+  output[1] =       ((limb) ((s32) in2[0])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[0]);+  output[2] =  2 *  ((limb) ((s32) in2[1])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[0]);+  output[3] =       ((limb) ((s32) in2[1])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[0]);+  output[4] =       ((limb) ((s32) in2[2])) * ((s32) in[2]) ++               2 * (((limb) ((s32) in2[1])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[1])) ++                    ((limb) ((s32) in2[0])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[0]);+  output[5] =       ((limb) ((s32) in2[2])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[0]);+  output[6] =  2 * (((limb) ((s32) in2[3])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[1])) ++                    ((limb) ((s32) in2[2])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[0]);+  output[7] =       ((limb) ((s32) in2[3])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[0]);+  output[8] =       ((limb) ((s32) in2[4])) * ((s32) in[4]) ++               2 * (((limb) ((s32) in2[3])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[1])) ++                    ((limb) ((s32) in2[2])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[0]);+  output[9] =       ((limb) ((s32) in2[4])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[2]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[1]) ++                    ((limb) ((s32) in2[0])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[0]);+  output[10] = 2 * (((limb) ((s32) in2[5])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[1])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[1])) ++                    ((limb) ((s32) in2[4])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[2]);+  output[11] =      ((limb) ((s32) in2[5])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[4]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[3]) ++                    ((limb) ((s32) in2[2])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[2]);+  output[12] =      ((limb) ((s32) in2[6])) * ((s32) in[6]) ++               2 * (((limb) ((s32) in2[5])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[3])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[3])) ++                    ((limb) ((s32) in2[4])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[4]);+  output[13] =      ((limb) ((s32) in2[6])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[7])) * ((s32) in[6]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[5]) ++                    ((limb) ((s32) in2[4])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[4]);+  output[14] = 2 * (((limb) ((s32) in2[7])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[5])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[5])) ++                    ((limb) ((s32) in2[6])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[6]);+  output[15] =      ((limb) ((s32) in2[7])) * ((s32) in[8]) ++                    ((limb) ((s32) in2[8])) * ((s32) in[7]) ++                    ((limb) ((s32) in2[6])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[6]);+  output[16] =      ((limb) ((s32) in2[8])) * ((s32) in[8]) ++               2 * (((limb) ((s32) in2[7])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[7]));+  output[17] =      ((limb) ((s32) in2[8])) * ((s32) in[9]) ++                    ((limb) ((s32) in2[9])) * ((s32) in[8]);+  output[18] = 2 *  ((limb) ((s32) in2[9])) * ((s32) in[9]);+}++/* Reduce a long form to a short form by taking the input mod 2^255 - 19.+ *+ * On entry: |output[i]| < 14*2^54+ * On exit: |output[0..8]| < 280*2^54 */+static void freduce_degree(limb *output) {+  /* Each of these shifts and adds ends up multiplying the value by 19.+   *+   * For output[0..8], the absolute entry value is < 14*2^54 and we add, at+   * most, 19*14*2^54 thus, on exit, |output[0..8]| < 280*2^54. */+  output[8] += output[18] << 4;+  output[8] += output[18] << 1;+  output[8] += output[18];+  output[7] += output[17] << 4;+  output[7] += output[17] << 1;+  output[7] += output[17];+  output[6] += output[16] << 4;+  output[6] += output[16] << 1;+  output[6] += output[16];+  output[5] += output[15] << 4;+  output[5] += output[15] << 1;+  output[5] += output[15];+  output[4] += output[14] << 4;+  output[4] += output[14] << 1;+  output[4] += output[14];+  output[3] += output[13] << 4;+  output[3] += output[13] << 1;+  output[3] += output[13];+  output[2] += output[12] << 4;+  output[2] += output[12] << 1;+  output[2] += output[12];+  output[1] += output[11] << 4;+  output[1] += output[11] << 1;+  output[1] += output[11];+  output[0] += output[10] << 4;+  output[0] += output[10] << 1;+  output[0] += output[10];+}++#if (-1 & 3) != 3+#error "This code only works on a two's complement system"+#endif++/* return v / 2^26, using only shifts and adds.+ *+ * On entry: v can take any value. */+static inline limb+div_by_2_26(const limb v)+{+  /* High word of v; no shift needed. */+  const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);+  /* Set to all 1s if v was negative; else set to 0s. */+  const int32_t sign = ((int32_t) highword) >> 31;+  /* Set to 0x3ffffff if v was negative; else set to 0. */+  const int32_t roundoff = ((uint32_t) sign) >> 6;+  /* Should return v / (1<<26) */+  return (v + roundoff) >> 26;+}++/* return v / (2^25), using only shifts and adds.+ *+ * On entry: v can take any value. */+static inline limb+div_by_2_25(const limb v)+{+  /* High word of v; no shift needed*/+  const uint32_t highword = (uint32_t) (((uint64_t) v) >> 32);+  /* Set to all 1s if v was negative; else set to 0s. */+  const int32_t sign = ((int32_t) highword) >> 31;+  /* Set to 0x1ffffff if v was negative; else set to 0. */+  const int32_t roundoff = ((uint32_t) sign) >> 7;+  /* Should return v / (1<<25) */+  return (v + roundoff) >> 25;+}++/* Reduce all coefficients of the short form input so that |x| < 2^26.+ *+ * On entry: |output[i]| < 280*2^54 */+static void freduce_coefficients(limb *output) {+  unsigned i;++  output[10] = 0;++  for (i = 0; i < 10; i += 2) {+    limb over = div_by_2_26(output[i]);+    /* The entry condition (that |output[i]| < 280*2^54) means that over is, at+     * most, 280*2^28 in the first iteration of this loop. This is added to the+     * next limb and we can approximate the resulting bound of that limb by+     * 281*2^54. */+    output[i] -= over << 26;+    output[i+1] += over;++    /* For the first iteration, |output[i+1]| < 281*2^54, thus |over| <+     * 281*2^29. When this is added to the next limb, the resulting bound can+     * be approximated as 281*2^54.+     *+     * For subsequent iterations of the loop, 281*2^54 remains a conservative+     * bound and no overflow occurs. */+    over = div_by_2_25(output[i+1]);+    output[i+1] -= over << 25;+    output[i+2] += over;+  }+  /* Now |output[10]| < 281*2^29 and all other coefficients are reduced. */+  output[0] += output[10] << 4;+  output[0] += output[10] << 1;+  output[0] += output[10];++  output[10] = 0;++  /* Now output[1..9] are reduced, and |output[0]| < 2^26 + 19*281*2^29+   * So |over| will be no more than 2^16. */+  {+    limb over = div_by_2_26(output[0]);+    output[0] -= over << 26;+    output[1] += over;+  }++  /* Now output[0,2..9] are reduced, and |output[1]| < 2^25 + 2^16 < 2^26. The+   * bound on |output[1]| is sufficient to meet our needs. */+}++/* A helpful wrapper around fproduct: output = in * in2.+ *+ * On entry: |in[i]| < 2^27 and |in2[i]| < 2^27.+ *+ * output must be distinct to both inputs. The output is reduced degree+ * (indeed, one need only provide storage for 10 limbs) and |output[i]| < 2^26. */+static void+fmul(limb *output, const limb *in, const limb *in2) {+  limb t[19];+  fproduct(t, in, in2);+  /* |t[i]| < 14*2^54 */+  freduce_degree(t);+  freduce_coefficients(t);+  /* |t[i]| < 2^26 */+  memcpy(output, t, sizeof(limb) * 10);+}++/* Square a number: output = in**2+ *+ * output must be distinct from the input. The inputs are reduced coefficient+ * form, the output is not.+ *+ * output[x] <= 14 * the largest product of the input limbs. */+static void fsquare_inner(limb *output, const limb *in) {+  output[0] =       ((limb) ((s32) in[0])) * ((s32) in[0]);+  output[1] =  2 *  ((limb) ((s32) in[0])) * ((s32) in[1]);+  output[2] =  2 * (((limb) ((s32) in[1])) * ((s32) in[1]) ++                    ((limb) ((s32) in[0])) * ((s32) in[2]));+  output[3] =  2 * (((limb) ((s32) in[1])) * ((s32) in[2]) ++                    ((limb) ((s32) in[0])) * ((s32) in[3]));+  output[4] =       ((limb) ((s32) in[2])) * ((s32) in[2]) ++               4 *  ((limb) ((s32) in[1])) * ((s32) in[3]) ++               2 *  ((limb) ((s32) in[0])) * ((s32) in[4]);+  output[5] =  2 * (((limb) ((s32) in[2])) * ((s32) in[3]) ++                    ((limb) ((s32) in[1])) * ((s32) in[4]) ++                    ((limb) ((s32) in[0])) * ((s32) in[5]));+  output[6] =  2 * (((limb) ((s32) in[3])) * ((s32) in[3]) ++                    ((limb) ((s32) in[2])) * ((s32) in[4]) ++                    ((limb) ((s32) in[0])) * ((s32) in[6]) ++               2 *  ((limb) ((s32) in[1])) * ((s32) in[5]));+  output[7] =  2 * (((limb) ((s32) in[3])) * ((s32) in[4]) ++                    ((limb) ((s32) in[2])) * ((s32) in[5]) ++                    ((limb) ((s32) in[1])) * ((s32) in[6]) ++                    ((limb) ((s32) in[0])) * ((s32) in[7]));+  output[8] =       ((limb) ((s32) in[4])) * ((s32) in[4]) ++               2 * (((limb) ((s32) in[2])) * ((s32) in[6]) ++                    ((limb) ((s32) in[0])) * ((s32) in[8]) ++               2 * (((limb) ((s32) in[1])) * ((s32) in[7]) ++                    ((limb) ((s32) in[3])) * ((s32) in[5])));+  output[9] =  2 * (((limb) ((s32) in[4])) * ((s32) in[5]) ++                    ((limb) ((s32) in[3])) * ((s32) in[6]) ++                    ((limb) ((s32) in[2])) * ((s32) in[7]) ++                    ((limb) ((s32) in[1])) * ((s32) in[8]) ++                    ((limb) ((s32) in[0])) * ((s32) in[9]));+  output[10] = 2 * (((limb) ((s32) in[5])) * ((s32) in[5]) ++                    ((limb) ((s32) in[4])) * ((s32) in[6]) ++                    ((limb) ((s32) in[2])) * ((s32) in[8]) ++               2 * (((limb) ((s32) in[3])) * ((s32) in[7]) ++                    ((limb) ((s32) in[1])) * ((s32) in[9])));+  output[11] = 2 * (((limb) ((s32) in[5])) * ((s32) in[6]) ++                    ((limb) ((s32) in[4])) * ((s32) in[7]) ++                    ((limb) ((s32) in[3])) * ((s32) in[8]) ++                    ((limb) ((s32) in[2])) * ((s32) in[9]));+  output[12] =      ((limb) ((s32) in[6])) * ((s32) in[6]) ++               2 * (((limb) ((s32) in[4])) * ((s32) in[8]) ++               2 * (((limb) ((s32) in[5])) * ((s32) in[7]) ++                    ((limb) ((s32) in[3])) * ((s32) in[9])));+  output[13] = 2 * (((limb) ((s32) in[6])) * ((s32) in[7]) ++                    ((limb) ((s32) in[5])) * ((s32) in[8]) ++                    ((limb) ((s32) in[4])) * ((s32) in[9]));+  output[14] = 2 * (((limb) ((s32) in[7])) * ((s32) in[7]) ++                    ((limb) ((s32) in[6])) * ((s32) in[8]) ++               2 *  ((limb) ((s32) in[5])) * ((s32) in[9]));+  output[15] = 2 * (((limb) ((s32) in[7])) * ((s32) in[8]) ++                    ((limb) ((s32) in[6])) * ((s32) in[9]));+  output[16] =      ((limb) ((s32) in[8])) * ((s32) in[8]) ++               4 *  ((limb) ((s32) in[7])) * ((s32) in[9]);+  output[17] = 2 *  ((limb) ((s32) in[8])) * ((s32) in[9]);+  output[18] = 2 *  ((limb) ((s32) in[9])) * ((s32) in[9]);+}++/* fsquare sets output = in^2.+ *+ * On entry: The |in| argument is in reduced coefficients form and |in[i]| <+ * 2^27.+ *+ * On exit: The |output| argument is in reduced coefficients form (indeed, one+ * need only provide storage for 10 limbs) and |out[i]| < 2^26. */+static void+fsquare(limb *output, const limb *in) {+  limb t[19];+  fsquare_inner(t, in);+  /* |t[i]| < 14*2^54 because the largest product of two limbs will be <+   * 2^(27+27) and fsquare_inner adds together, at most, 14 of those+   * products. */+  freduce_degree(t);+  freduce_coefficients(t);+  /* |t[i]| < 2^26 */+  memcpy(output, t, sizeof(limb) * 10);+}++/* Take a little-endian, 32-byte number and expand it into polynomial form */+static void+fexpand(limb *output, const u8 *input) {+#define F(n,start,shift,mask) \+  output[n] = ((((limb) input[start + 0]) | \+                ((limb) input[start + 1]) << 8 | \+                ((limb) input[start + 2]) << 16 | \+                ((limb) input[start + 3]) << 24) >> shift) & mask;+  F(0, 0, 0, 0x3ffffff);+  F(1, 3, 2, 0x1ffffff);+  F(2, 6, 3, 0x3ffffff);+  F(3, 9, 5, 0x1ffffff);+  F(4, 12, 6, 0x3ffffff);+  F(5, 16, 0, 0x1ffffff);+  F(6, 19, 1, 0x3ffffff);+  F(7, 22, 3, 0x1ffffff);+  F(8, 25, 4, 0x3ffffff);+  F(9, 28, 6, 0x1ffffff);+#undef F+}++#if (-32 >> 1) != -16+#error "This code only works when >> does sign-extension on negative numbers"+#endif++/* s32_eq returns 0xffffffff iff a == b and zero otherwise. */+static s32 s32_eq(s32 a, s32 b) {+  a = ~(a ^ b);+  a &= a << 16;+  a &= a << 8;+  a &= a << 4;+  a &= a << 2;+  a &= a << 1;+  return a >> 31;+}++/* s32_gte returns 0xffffffff if a >= b and zero otherwise, where a and b are+ * both non-negative. */+static s32 s32_gte(s32 a, s32 b) {+  a -= b;+  /* a >= 0 iff a >= b. */+  return ~(a >> 31);+}++/* Take a fully reduced polynomial form number and contract it into a+ * little-endian, 32-byte array.+ *+ * On entry: |input_limbs[i]| < 2^26 */+static void+fcontract(u8 *output, limb *input_limbs) {+  int i;+  int j;+  s32 input[10];+  s32 mask;++  /* |input_limbs[i]| < 2^26, so it's valid to convert to an s32. */+  for (i = 0; i < 10; i++) {+    input[i] = input_limbs[i];+  }++  for (j = 0; j < 2; ++j) {+    for (i = 0; i < 9; ++i) {+      if ((i & 1) == 1) {+        /* This calculation is a time-invariant way to make input[i]+         * non-negative by borrowing from the next-larger limb. */+        const s32 mask = input[i] >> 31;+        const s32 carry = -((input[i] & mask) >> 25);+        input[i] = input[i] + (carry << 25);+        input[i+1] = input[i+1] - carry;+      } else {+        const s32 mask = input[i] >> 31;+        const s32 carry = -((input[i] & mask) >> 26);+        input[i] = input[i] + (carry << 26);+        input[i+1] = input[i+1] - carry;+      }+    }++    /* There's no greater limb for input[9] to borrow from, but we can multiply+     * by 19 and borrow from input[0], which is valid mod 2^255-19. */+    {+      const s32 mask = input[9] >> 31;+      const s32 carry = -((input[9] & mask) >> 25);+      input[9] = input[9] + (carry << 25);+      input[0] = input[0] - (carry * 19);+    }++    /* After the first iteration, input[1..9] are non-negative and fit within+     * 25 or 26 bits, depending on position. However, input[0] may be+     * negative. */+  }++  /* The first borrow-propagation pass above ended with every limb+     except (possibly) input[0] non-negative.++     If input[0] was negative after the first pass, then it was because of a+     carry from input[9]. On entry, input[9] < 2^26 so the carry was, at most,+     one, since (2**26-1) >> 25 = 1. Thus input[0] >= -19.++     In the second pass, each limb is decreased by at most one. Thus the second+     borrow-propagation pass could only have wrapped around to decrease+     input[0] again if the first pass left input[0] negative *and* input[1]+     through input[9] were all zero.  In that case, input[1] is now 2^25 - 1,+     and this last borrow-propagation step will leave input[1] non-negative. */+  {+    const s32 mask = input[0] >> 31;+    const s32 carry = -((input[0] & mask) >> 26);+    input[0] = input[0] + (carry << 26);+    input[1] = input[1] - carry;+  }++  /* All input[i] are now non-negative. However, there might be values between+   * 2^25 and 2^26 in a limb which is, nominally, 25 bits wide. */+  for (j = 0; j < 2; j++) {+    for (i = 0; i < 9; i++) {+      if ((i & 1) == 1) {+        const s32 carry = input[i] >> 25;+        input[i] &= 0x1ffffff;+        input[i+1] += carry;+      } else {+        const s32 carry = input[i] >> 26;+        input[i] &= 0x3ffffff;+        input[i+1] += carry;+      }+    }++    {+      const s32 carry = input[9] >> 25;+      input[9] &= 0x1ffffff;+      input[0] += 19*carry;+    }+  }++  /* If the first carry-chain pass, just above, ended up with a carry from+   * input[9], and that caused input[0] to be out-of-bounds, then input[0] was+   * < 2^26 + 2*19, because the carry was, at most, two.+   *+   * If the second pass carried from input[9] again then input[0] is < 2*19 and+   * the input[9] -> input[0] carry didn't push input[0] out of bounds. */++  /* It still remains the case that input might be between 2^255-19 and 2^255.+   * In this case, input[1..9] must take their maximum value and input[0] must+   * be >= (2^255-19) & 0x3ffffff, which is 0x3ffffed. */+  mask = s32_gte(input[0], 0x3ffffed);+  for (i = 1; i < 10; i++) {+    if ((i & 1) == 1) {+      mask &= s32_eq(input[i], 0x1ffffff);+    } else {+      mask &= s32_eq(input[i], 0x3ffffff);+    }+  }++  /* mask is either 0xffffffff (if input >= 2^255-19) and zero otherwise. Thus+   * this conditionally subtracts 2^255-19. */+  input[0] -= mask & 0x3ffffed;++  for (i = 1; i < 10; i++) {+    if ((i & 1) == 1) {+      input[i] -= mask & 0x1ffffff;+    } else {+      input[i] -= mask & 0x3ffffff;+    }+  }++  input[1] <<= 2;+  input[2] <<= 3;+  input[3] <<= 5;+  input[4] <<= 6;+  input[6] <<= 1;+  input[7] <<= 3;+  input[8] <<= 4;+  input[9] <<= 6;+#define F(i, s) \+  output[s+0] |=  input[i] & 0xff; \+  output[s+1]  = (input[i] >> 8) & 0xff; \+  output[s+2]  = (input[i] >> 16) & 0xff; \+  output[s+3]  = (input[i] >> 24) & 0xff;+  output[0] = 0;+  output[16] = 0;+  F(0,0);+  F(1,3);+  F(2,6);+  F(3,9);+  F(4,12);+  F(5,16);+  F(6,19);+  F(7,22);+  F(8,25);+  F(9,28);+#undef F+}++/* Input: Q, Q', Q-Q'+ * Output: 2Q, Q+Q'+ *+ *   x2 z3: long form+ *   x3 z3: long form+ *   x z: short form, destroyed+ *   xprime zprime: short form, destroyed+ *   qmqp: short form, preserved+ *+ * On entry and exit, the absolute value of the limbs of all inputs and outputs+ * are < 2^26. */+static void fmonty(limb *x2, limb *z2,  /* output 2Q */+                   limb *x3, limb *z3,  /* output Q + Q' */+                   limb *x, limb *z,    /* input Q */+                   limb *xprime, limb *zprime,  /* input Q' */+                   const limb *qmqp /* input Q - Q' */) {+  limb origx[10], origxprime[10], zzz[19], xx[19], zz[19], xxprime[19],+        zzprime[19], zzzprime[19], xxxprime[19];++  memcpy(origx, x, 10 * sizeof(limb));+  fsum(x, z);+  /* |x[i]| < 2^27 */+  fdifference(z, origx);  /* does x - z */+  /* |z[i]| < 2^27 */++  memcpy(origxprime, xprime, sizeof(limb) * 10);+  fsum(xprime, zprime);+  /* |xprime[i]| < 2^27 */+  fdifference(zprime, origxprime);+  /* |zprime[i]| < 2^27 */+  fproduct(xxprime, xprime, z);+  /* |xxprime[i]| < 14*2^54: the largest product of two limbs will be <+   * 2^(27+27) and fproduct adds together, at most, 14 of those products.+   * (Approximating that to 2^58 doesn't work out.) */+  fproduct(zzprime, x, zprime);+  /* |zzprime[i]| < 14*2^54 */+  freduce_degree(xxprime);+  freduce_coefficients(xxprime);+  /* |xxprime[i]| < 2^26 */+  freduce_degree(zzprime);+  freduce_coefficients(zzprime);+  /* |zzprime[i]| < 2^26 */+  memcpy(origxprime, xxprime, sizeof(limb) * 10);+  fsum(xxprime, zzprime);+  /* |xxprime[i]| < 2^27 */+  fdifference(zzprime, origxprime);+  /* |zzprime[i]| < 2^27 */+  fsquare(xxxprime, xxprime);+  /* |xxxprime[i]| < 2^26 */+  fsquare(zzzprime, zzprime);+  /* |zzzprime[i]| < 2^26 */+  fproduct(zzprime, zzzprime, qmqp);+  /* |zzprime[i]| < 14*2^52 */+  freduce_degree(zzprime);+  freduce_coefficients(zzprime);+  /* |zzprime[i]| < 2^26 */+  memcpy(x3, xxxprime, sizeof(limb) * 10);+  memcpy(z3, zzprime, sizeof(limb) * 10);++  fsquare(xx, x);+  /* |xx[i]| < 2^26 */+  fsquare(zz, z);+  /* |zz[i]| < 2^26 */+  fproduct(x2, xx, zz);+  /* |x2[i]| < 14*2^52 */+  freduce_degree(x2);+  freduce_coefficients(x2);+  /* |x2[i]| < 2^26 */+  fdifference(zz, xx);  // does zz = xx - zz+  /* |zz[i]| < 2^27 */+  memset(zzz + 10, 0, sizeof(limb) * 9);+  fscalar_product(zzz, zz, 121665);+  /* |zzz[i]| < 2^(27+17) */+  /* No need to call freduce_degree here:+     fscalar_product doesn't increase the degree of its input. */+  freduce_coefficients(zzz);+  /* |zzz[i]| < 2^26 */+  fsum(zzz, xx);+  /* |zzz[i]| < 2^27 */+  fproduct(z2, zz, zzz);+  /* |z2[i]| < 14*2^(26+27) */+  freduce_degree(z2);+  freduce_coefficients(z2);+  /* |z2|i| < 2^26 */+}++/* Conditionally swap two reduced-form limb arrays if 'iswap' is 1, but leave+ * them unchanged if 'iswap' is 0.  Runs in data-invariant time to avoid+ * side-channel attacks.+ *+ * NOTE that this function requires that 'iswap' be 1 or 0; other values give+ * wrong results.  Also, the two limb arrays must be in reduced-coefficient,+ * reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,+ * and all all values in a[0..9],b[0..9] must have magnitude less than+ * INT32_MAX. */+static void+swap_conditional(limb a[19], limb b[19], limb iswap) {+  unsigned i;+  const s32 swap = (s32) -iswap;++  for (i = 0; i < 10; ++i) {+    const s32 x = swap & ( ((s32)a[i]) ^ ((s32)b[i]) );+    a[i] = ((s32)a[i]) ^ x;+    b[i] = ((s32)b[i]) ^ x;+  }+}++/* Calculates nQ where Q is the x-coordinate of a point on the curve+ *+ *   resultx/resultz: the x coordinate of the resulting curve point (short form)+ *   n: a little endian, 32-byte number+ *   q: a point of the curve (short form) */+static void+cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {+  limb a[19] = {0}, b[19] = {1}, c[19] = {1}, d[19] = {0};+  limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;+  limb e[19] = {0}, f[19] = {1}, g[19] = {0}, h[19] = {1};+  limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;++  unsigned i, j;++  memcpy(nqpqx, q, sizeof(limb) * 10);++  for (i = 0; i < 32; ++i) {+    u8 byte = n[31 - i];+    for (j = 0; j < 8; ++j) {+      const limb bit = byte >> 7;++      swap_conditional(nqx, nqpqx, bit);+      swap_conditional(nqz, nqpqz, bit);+      fmonty(nqx2, nqz2,+             nqpqx2, nqpqz2,+             nqx, nqz,+             nqpqx, nqpqz,+             q);+      swap_conditional(nqx2, nqpqx2, bit);+      swap_conditional(nqz2, nqpqz2, bit);++      t = nqx;+      nqx = nqx2;+      nqx2 = t;+      t = nqz;+      nqz = nqz2;+      nqz2 = t;+      t = nqpqx;+      nqpqx = nqpqx2;+      nqpqx2 = t;+      t = nqpqz;+      nqpqz = nqpqz2;+      nqpqz2 = t;++      byte <<= 1;+    }+  }++  memcpy(resultx, nqx, sizeof(limb) * 10);+  memcpy(resultz, nqz, sizeof(limb) * 10);+}++// -----------------------------------------------------------------------------+// Shamelessly copied from djb's code+// -----------------------------------------------------------------------------+static void+crecip(limb *out, const limb *z) {+  limb z2[10];+  limb z9[10];+  limb z11[10];+  limb z2_5_0[10];+  limb z2_10_0[10];+  limb z2_20_0[10];+  limb z2_50_0[10];+  limb z2_100_0[10];+  limb t0[10];+  limb t1[10];+  int i;++  /* 2 */ fsquare(z2,z);+  /* 4 */ fsquare(t1,z2);+  /* 8 */ fsquare(t0,t1);+  /* 9 */ fmul(z9,t0,z);+  /* 11 */ fmul(z11,z9,z2);+  /* 22 */ fsquare(t0,z11);+  /* 2^5 - 2^0 = 31 */ fmul(z2_5_0,t0,z9);++  /* 2^6 - 2^1 */ fsquare(t0,z2_5_0);+  /* 2^7 - 2^2 */ fsquare(t1,t0);+  /* 2^8 - 2^3 */ fsquare(t0,t1);+  /* 2^9 - 2^4 */ fsquare(t1,t0);+  /* 2^10 - 2^5 */ fsquare(t0,t1);+  /* 2^10 - 2^0 */ fmul(z2_10_0,t0,z2_5_0);++  /* 2^11 - 2^1 */ fsquare(t0,z2_10_0);+  /* 2^12 - 2^2 */ fsquare(t1,t0);+  /* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }+  /* 2^20 - 2^0 */ fmul(z2_20_0,t1,z2_10_0);++  /* 2^21 - 2^1 */ fsquare(t0,z2_20_0);+  /* 2^22 - 2^2 */ fsquare(t1,t0);+  /* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }+  /* 2^40 - 2^0 */ fmul(t0,t1,z2_20_0);++  /* 2^41 - 2^1 */ fsquare(t1,t0);+  /* 2^42 - 2^2 */ fsquare(t0,t1);+  /* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }+  /* 2^50 - 2^0 */ fmul(z2_50_0,t0,z2_10_0);++  /* 2^51 - 2^1 */ fsquare(t0,z2_50_0);+  /* 2^52 - 2^2 */ fsquare(t1,t0);+  /* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }+  /* 2^100 - 2^0 */ fmul(z2_100_0,t1,z2_50_0);++  /* 2^101 - 2^1 */ fsquare(t1,z2_100_0);+  /* 2^102 - 2^2 */ fsquare(t0,t1);+  /* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { fsquare(t1,t0); fsquare(t0,t1); }+  /* 2^200 - 2^0 */ fmul(t1,t0,z2_100_0);++  /* 2^201 - 2^1 */ fsquare(t0,t1);+  /* 2^202 - 2^2 */ fsquare(t1,t0);+  /* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { fsquare(t0,t1); fsquare(t1,t0); }+  /* 2^250 - 2^0 */ fmul(t0,t1,z2_50_0);++  /* 2^251 - 2^1 */ fsquare(t1,t0);+  /* 2^252 - 2^2 */ fsquare(t0,t1);+  /* 2^253 - 2^3 */ fsquare(t1,t0);+  /* 2^254 - 2^4 */ fsquare(t0,t1);+  /* 2^255 - 2^5 */ fsquare(t1,t0);+  /* 2^255 - 21 */ fmul(out,t1,z11);+}++int+cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {+  limb bp[10], x[10], z[11], zmone[10];+  uint8_t e[32];+  int i;++  for (i = 0; i < 32; ++i) e[i] = secret[i];+  e[0] &= 248;+  e[31] &= 127;+  e[31] |= 64;++  fexpand(bp, basepoint);+  cmult(x, z, e, bp);+  crecip(zmone, z);+  fmul(z, x, zmone);+  fcontract(mypublic, z);+  return 0;+}
+ cbits/ed25519/curve25519-donna-64bit.h view
@@ -0,0 +1,413 @@+/*+	Public domain by Adam Langley <agl@imperialviolet.org> &+	                 Andrew M. <liquidsun@gmail.com>+	See: https://github.com/floodyberry/curve25519-donna++	64bit integer curve25519 implementation+*/++typedef uint64_t bignum25519[5];++static const uint64_t reduce_mask_40 = ((uint64_t)1 << 40) - 1;+static const uint64_t reduce_mask_51 = ((uint64_t)1 << 51) - 1;+static const uint64_t reduce_mask_56 = ((uint64_t)1 << 56) - 1;++/* out = in */+DONNA_INLINE static void+curve25519_copy(bignum25519 out, const bignum25519 in) {+	out[0] = in[0];+	out[1] = in[1];+	out[2] = in[2];+	out[3] = in[3];+	out[4] = in[4];+}++/* out = a + b */+DONNA_INLINE static void+curve25519_add(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	out[0] = a[0] + b[0];+	out[1] = a[1] + b[1];+	out[2] = a[2] + b[2];+	out[3] = a[3] + b[3];+	out[4] = a[4] + b[4];+}++/* out = a + b, where a and/or b are the result of a basic op (add,sub) */+DONNA_INLINE static void+curve25519_add_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	out[0] = a[0] + b[0];+	out[1] = a[1] + b[1];+	out[2] = a[2] + b[2];+	out[3] = a[3] + b[3];+	out[4] = a[4] + b[4];+}++DONNA_INLINE static void+curve25519_add_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	uint64_t c;+	out[0] = a[0] + b[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;+	out[1] = a[1] + b[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;+	out[2] = a[2] + b[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;+	out[3] = a[3] + b[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;+	out[4] = a[4] + b[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;+	out[0] += c * 19;+}++/* multiples of p */+static const uint64_t twoP0      = 0x0fffffffffffda;+static const uint64_t twoP1234   = 0x0ffffffffffffe;+static const uint64_t fourP0     = 0x1fffffffffffb4;+static const uint64_t fourP1234  = 0x1ffffffffffffc;++/* out = a - b */+DONNA_INLINE static void+curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	out[0] = a[0] + twoP0    - b[0];+	out[1] = a[1] + twoP1234 - b[1];+	out[2] = a[2] + twoP1234 - b[2];+	out[3] = a[3] + twoP1234 - b[3];+	out[4] = a[4] + twoP1234 - b[4];+}++/* out = a - b, where a and/or b are the result of a basic op (add,sub) */+DONNA_INLINE static void+curve25519_sub_after_basic(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	out[0] = a[0] + fourP0    - b[0];+	out[1] = a[1] + fourP1234 - b[1];+	out[2] = a[2] + fourP1234 - b[2];+	out[3] = a[3] + fourP1234 - b[3];+	out[4] = a[4] + fourP1234 - b[4];+}++DONNA_INLINE static void+curve25519_sub_reduce(bignum25519 out, const bignum25519 a, const bignum25519 b) {+	uint64_t c;+	out[0] = a[0] + fourP0    - b[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;+	out[1] = a[1] + fourP1234 - b[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;+	out[2] = a[2] + fourP1234 - b[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;+	out[3] = a[3] + fourP1234 - b[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;+	out[4] = a[4] + fourP1234 - b[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;+	out[0] += c * 19;+}++/* out = -a */+DONNA_INLINE static void+curve25519_neg(bignum25519 out, const bignum25519 a) {+	uint64_t c;+	out[0] = twoP0    - a[0]    ; c = (out[0] >> 51); out[0] &= reduce_mask_51;+	out[1] = twoP1234 - a[1] + c; c = (out[1] >> 51); out[1] &= reduce_mask_51;+	out[2] = twoP1234 - a[2] + c; c = (out[2] >> 51); out[2] &= reduce_mask_51;+	out[3] = twoP1234 - a[3] + c; c = (out[3] >> 51); out[3] &= reduce_mask_51;+	out[4] = twoP1234 - a[4] + c; c = (out[4] >> 51); out[4] &= reduce_mask_51;+	out[0] += c * 19;+}++/* out = a * b */+DONNA_INLINE static void+curve25519_mul(bignum25519 out, const bignum25519 in2, const bignum25519 in) {+#if !defined(HAVE_NATIVE_UINT128)+	uint128_t mul;+#endif+	uint128_t t[5];+	uint64_t r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c;++	r0 = in[0];+	r1 = in[1];+	r2 = in[2];+	r3 = in[3];+	r4 = in[4];++	s0 = in2[0];+	s1 = in2[1];+	s2 = in2[2];+	s3 = in2[3];+	s4 = in2[4];++#if defined(HAVE_NATIVE_UINT128)+	t[0]  =  ((uint128_t) r0) * s0;+	t[1]  =  ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0;+	t[2]  =  ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1;+	t[3]  =  ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1;+	t[4]  =  ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2;+#else+	mul64x64_128(t[0], r0, s0)+	mul64x64_128(t[1], r0, s1) mul64x64_128(mul, r1, s0) add128(t[1], mul)+	mul64x64_128(t[2], r0, s2) mul64x64_128(mul, r2, s0) add128(t[2], mul) mul64x64_128(mul, r1, s1) add128(t[2], mul)+	mul64x64_128(t[3], r0, s3) mul64x64_128(mul, r3, s0) add128(t[3], mul) mul64x64_128(mul, r1, s2) add128(t[3], mul) mul64x64_128(mul, r2, s1) add128(t[3], mul)+	mul64x64_128(t[4], r0, s4) mul64x64_128(mul, r4, s0) add128(t[4], mul) mul64x64_128(mul, r3, s1) add128(t[4], mul) mul64x64_128(mul, r1, s3) add128(t[4], mul) mul64x64_128(mul, r2, s2) add128(t[4], mul)+#endif++	r1 *= 19;+	r2 *= 19;+	r3 *= 19;+	r4 *= 19;++#if defined(HAVE_NATIVE_UINT128)+	t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2;+	t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3;+	t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4;+	t[3] += ((uint128_t) r4) * s4;+#else+	mul64x64_128(mul, r4, s1) add128(t[0], mul) mul64x64_128(mul, r1, s4) add128(t[0], mul) mul64x64_128(mul, r2, s3) add128(t[0], mul) mul64x64_128(mul, r3, s2) add128(t[0], mul)+	mul64x64_128(mul, r4, s2) add128(t[1], mul) mul64x64_128(mul, r2, s4) add128(t[1], mul) mul64x64_128(mul, r3, s3) add128(t[1], mul)+	mul64x64_128(mul, r4, s3) add128(t[2], mul) mul64x64_128(mul, r3, s4) add128(t[2], mul)+	mul64x64_128(mul, r4, s4) add128(t[3], mul)+#endif+++	                     r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);+	add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);+	add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);+	add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);+	add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);+	r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;+	r1 +=   c;++	out[0] = r0;+	out[1] = r1;+	out[2] = r2;+	out[3] = r3;+	out[4] = r4;+}++DONNA_NOINLINE static void+curve25519_mul_noinline(bignum25519 out, const bignum25519 in2, const bignum25519 in) {+	curve25519_mul(out, in2, in);+}++/* out = in^(2 * count) */+DONNA_NOINLINE static void+curve25519_square_times(bignum25519 out, const bignum25519 in, uint64_t count) {+#if !defined(HAVE_NATIVE_UINT128)+	uint128_t mul;+#endif+	uint128_t t[5];+	uint64_t r0,r1,r2,r3,r4,c;+	uint64_t d0,d1,d2,d4,d419;++	r0 = in[0];+	r1 = in[1];+	r2 = in[2];+	r3 = in[3];+	r4 = in[4];++	do {+		d0 = r0 * 2;+		d1 = r1 * 2;+		d2 = r2 * 2 * 19;+		d419 = r4 * 19;+		d4 = d419 * 2;++#if defined(HAVE_NATIVE_UINT128)+		t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3     ));+		t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19));+		t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3     ));+		t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419   ));+		t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2     ));+#else+		mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)+		mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)+		mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)+		mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)+		mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)+#endif++		r0 = lo128(t[0]) & reduce_mask_51;+		r1 = lo128(t[1]) & reduce_mask_51; shl128(c, t[0], 13); r1 += c;+		r2 = lo128(t[2]) & reduce_mask_51; shl128(c, t[1], 13); r2 += c;+		r3 = lo128(t[3]) & reduce_mask_51; shl128(c, t[2], 13); r3 += c;+		r4 = lo128(t[4]) & reduce_mask_51; shl128(c, t[3], 13); r4 += c; +		                                   shl128(c, t[4], 13); r0 += c * 19;+		               c = r0 >> 51; r0 &= reduce_mask_51;+		r1 += c     ;  c = r1 >> 51; r1 &= reduce_mask_51;+		r2 += c     ;  c = r2 >> 51; r2 &= reduce_mask_51;+		r3 += c     ;  c = r3 >> 51; r3 &= reduce_mask_51;+		r4 += c     ;  c = r4 >> 51; r4 &= reduce_mask_51;+		r0 += c * 19;+	} while(--count);++	out[0] = r0;+	out[1] = r1;+	out[2] = r2;+	out[3] = r3;+	out[4] = r4;+}++DONNA_INLINE static void+curve25519_square(bignum25519 out, const bignum25519 in) {+#if !defined(HAVE_NATIVE_UINT128)+	uint128_t mul;+#endif+	uint128_t t[5];+	uint64_t r0,r1,r2,r3,r4,c;+	uint64_t d0,d1,d2,d4,d419;++	r0 = in[0];+	r1 = in[1];+	r2 = in[2];+	r3 = in[3];+	r4 = in[4];++	d0 = r0 * 2;+	d1 = r1 * 2;+	d2 = r2 * 2 * 19;+	d419 = r4 * 19;+	d4 = d419 * 2;++#if defined(HAVE_NATIVE_UINT128)+	t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3     ));+	t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19));+	t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3     ));+	t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419   ));+	t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2     ));+#else+	mul64x64_128(t[0], r0, r0) mul64x64_128(mul, d4, r1) add128(t[0], mul) mul64x64_128(mul, d2,      r3) add128(t[0], mul)+	mul64x64_128(t[1], d0, r1) mul64x64_128(mul, d4, r2) add128(t[1], mul) mul64x64_128(mul, r3, r3 * 19) add128(t[1], mul)+	mul64x64_128(t[2], d0, r2) mul64x64_128(mul, r1, r1) add128(t[2], mul) mul64x64_128(mul, d4,      r3) add128(t[2], mul)+	mul64x64_128(t[3], d0, r3) mul64x64_128(mul, d1, r2) add128(t[3], mul) mul64x64_128(mul, r4,    d419) add128(t[3], mul)+	mul64x64_128(t[4], d0, r4) mul64x64_128(mul, d1, r3) add128(t[4], mul) mul64x64_128(mul, r2,      r2) add128(t[4], mul)+#endif++	                     r0 = lo128(t[0]) & reduce_mask_51; shr128(c, t[0], 51);+	add128_64(t[1], c)   r1 = lo128(t[1]) & reduce_mask_51; shr128(c, t[1], 51);+	add128_64(t[2], c)   r2 = lo128(t[2]) & reduce_mask_51; shr128(c, t[2], 51);+	add128_64(t[3], c)   r3 = lo128(t[3]) & reduce_mask_51; shr128(c, t[3], 51);+	add128_64(t[4], c)   r4 = lo128(t[4]) & reduce_mask_51; shr128(c, t[4], 51);+	r0 +=   c * 19; c = r0 >> 51; r0 = r0 & reduce_mask_51;+	r1 +=   c;++	out[0] = r0;+	out[1] = r1;+	out[2] = r2;+	out[3] = r3;+	out[4] = r4;+}++/* Take a little-endian, 32-byte number and expand it into polynomial form */+DONNA_INLINE static void+curve25519_expand(bignum25519 out, const unsigned char *in) {+	static const union { uint8_t b[2]; uint16_t s; } endian_check = {{1,0}};+	uint64_t x0,x1,x2,x3;++	if (endian_check.s == 1) {+		x0 = *(uint64_t *)(in + 0);+		x1 = *(uint64_t *)(in + 8);+		x2 = *(uint64_t *)(in + 16);+		x3 = *(uint64_t *)(in + 24);+	} else {+		#define F(s)                         \+			((((uint64_t)in[s + 0])      ) | \+			 (((uint64_t)in[s + 1]) <<  8) | \+			 (((uint64_t)in[s + 2]) << 16) | \+			 (((uint64_t)in[s + 3]) << 24) | \+			 (((uint64_t)in[s + 4]) << 32) | \+			 (((uint64_t)in[s + 5]) << 40) | \+			 (((uint64_t)in[s + 6]) << 48) | \+			 (((uint64_t)in[s + 7]) << 56))++		x0 = F(0);+		x1 = F(8);+		x2 = F(16);+		x3 = F(24);+	}++	out[0] = x0 & reduce_mask_51; x0 = (x0 >> 51) | (x1 << 13);+	out[1] = x0 & reduce_mask_51; x1 = (x1 >> 38) | (x2 << 26);+	out[2] = x1 & reduce_mask_51; x2 = (x2 >> 25) | (x3 << 39);+	out[3] = x2 & reduce_mask_51; x3 = (x3 >> 12);+	out[4] = x3 & reduce_mask_51;+}++/* Take a fully reduced polynomial form number and contract it into a+ * little-endian, 32-byte array+ */+DONNA_INLINE static void+curve25519_contract(unsigned char *out, const bignum25519 input) {+	uint64_t t[5];+	uint64_t f, i;++	t[0] = input[0];+	t[1] = input[1];+	t[2] = input[2];+	t[3] = input[3];+	t[4] = input[4];++	#define curve25519_contract_carry() \+		t[1] += t[0] >> 51; t[0] &= reduce_mask_51; \+		t[2] += t[1] >> 51; t[1] &= reduce_mask_51; \+		t[3] += t[2] >> 51; t[2] &= reduce_mask_51; \+		t[4] += t[3] >> 51; t[3] &= reduce_mask_51;++	#define curve25519_contract_carry_full() curve25519_contract_carry() \+		t[0] += 19 * (t[4] >> 51); t[4] &= reduce_mask_51;++	#define curve25519_contract_carry_final() curve25519_contract_carry() \+		t[4] &= reduce_mask_51;++	curve25519_contract_carry_full()+	curve25519_contract_carry_full()++	/* now t is between 0 and 2^255-1, properly carried. */+	/* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */+	t[0] += 19;+	curve25519_contract_carry_full()++	/* now between 19 and 2^255-1 in both cases, and offset by 19. */+	t[0] += (reduce_mask_51 + 1) - 19;+	t[1] += (reduce_mask_51 + 1) - 1;+	t[2] += (reduce_mask_51 + 1) - 1;+	t[3] += (reduce_mask_51 + 1) - 1;+	t[4] += (reduce_mask_51 + 1) - 1;++	/* now between 2^255 and 2^256-20, and offset by 2^255. */+	curve25519_contract_carry_final()++	#define write51full(n,shift) \+		f = ((t[n] >> shift) | (t[n+1] << (51 - shift))); \+		for (i = 0; i < 8; i++, f >>= 8) *out++ = (unsigned char)f;+	#define write51(n) write51full(n,13*n)+	write51(0)+	write51(1)+	write51(2)+	write51(3)+}++#if !defined(ED25519_GCC_64BIT_CHOOSE)++/* out = (flag) ? in : out */+DONNA_INLINE static void+curve25519_move_conditional_bytes(uint8_t out[96], const uint8_t in[96], uint64_t flag) {+	const uint64_t nb = flag - 1, b = ~nb;+	const uint64_t *inq = (const uint64_t *)in;+	uint64_t *outq = (uint64_t *)out;+	outq[0] = (outq[0] & nb) | (inq[0] & b);+	outq[1] = (outq[1] & nb) | (inq[1] & b);+	outq[2] = (outq[2] & nb) | (inq[2] & b);+	outq[3] = (outq[3] & nb) | (inq[3] & b);+	outq[4] = (outq[4] & nb) | (inq[4] & b);+	outq[5] = (outq[5] & nb) | (inq[5] & b);+	outq[6] = (outq[6] & nb) | (inq[6] & b);+	outq[7] = (outq[7] & nb) | (inq[7] & b);+	outq[8] = (outq[8] & nb) | (inq[8] & b);+	outq[9] = (outq[9] & nb) | (inq[9] & b);+	outq[10] = (outq[10] & nb) | (inq[10] & b);+	outq[11] = (outq[11] & nb) | (inq[11] & b);+}++/* if (iswap) swap(a, b) */+DONNA_INLINE static void+curve25519_swap_conditional(bignum25519 a, bignum25519 b, uint64_t iswap) {+	const uint64_t swap = (uint64_t)(-(int64_t)iswap);+	uint64_t x0,x1,x2,x3,x4;++	x0 = swap & (a[0] ^ b[0]); a[0] ^= x0; b[0] ^= x0;+	x1 = swap & (a[1] ^ b[1]); a[1] ^= x1; b[1] ^= x1;+	x2 = swap & (a[2] ^ b[2]); a[2] ^= x2; b[2] ^= x2;+	x3 = swap & (a[3] ^ b[3]); a[3] ^= x3; b[3] ^= x3;+	x4 = swap & (a[4] ^ b[4]); a[4] ^= x4; b[4] ^= x4;+}++#endif /* ED25519_GCC_64BIT_CHOOSE */++#define ED25519_64BIT_TABLES+
+ cbits/ed25519/curve25519-donna-helpers.h view
@@ -0,0 +1,67 @@+/*+	Public domain by Andrew M. <liquidsun@gmail.com>+	See: https://github.com/floodyberry/curve25519-donna++	Curve25519 implementation agnostic helpers+*/++/*+ * In:  b =   2^5 - 2^0+ * Out: b = 2^250 - 2^0+ */+static void+curve25519_pow_two5mtwo0_two250mtwo0(bignum25519 b) {+	bignum25519 ALIGN(16) t0,c;++	/* 2^5  - 2^0 */ /* b */+	/* 2^10 - 2^5 */ curve25519_square_times(t0, b, 5);+	/* 2^10 - 2^0 */ curve25519_mul_noinline(b, t0, b);+	/* 2^20 - 2^10 */ curve25519_square_times(t0, b, 10);+	/* 2^20 - 2^0 */ curve25519_mul_noinline(c, t0, b);+	/* 2^40 - 2^20 */ curve25519_square_times(t0, c, 20);+	/* 2^40 - 2^0 */ curve25519_mul_noinline(t0, t0, c);+	/* 2^50 - 2^10 */ curve25519_square_times(t0, t0, 10);+	/* 2^50 - 2^0 */ curve25519_mul_noinline(b, t0, b);+	/* 2^100 - 2^50 */ curve25519_square_times(t0, b, 50);+	/* 2^100 - 2^0 */ curve25519_mul_noinline(c, t0, b);+	/* 2^200 - 2^100 */ curve25519_square_times(t0, c, 100);+	/* 2^200 - 2^0 */ curve25519_mul_noinline(t0, t0, c);+	/* 2^250 - 2^50 */ curve25519_square_times(t0, t0, 50);+	/* 2^250 - 2^0 */ curve25519_mul_noinline(b, t0, b);+}++/*+ * z^(p - 2) = z(2^255 - 21)+ */+static void+curve25519_recip(bignum25519 out, const bignum25519 z) {+	bignum25519 ALIGN(16) a,t0,b;++	/* 2 */ curve25519_square_times(a, z, 1); /* a = 2 */+	/* 8 */ curve25519_square_times(t0, a, 2);+	/* 9 */ curve25519_mul_noinline(b, t0, z); /* b = 9 */+	/* 11 */ curve25519_mul_noinline(a, b, a); /* a = 11 */+	/* 22 */ curve25519_square_times(t0, a, 1);+	/* 2^5 - 2^0 = 31 */ curve25519_mul_noinline(b, t0, b);+	/* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);+	/* 2^255 - 2^5 */ curve25519_square_times(b, b, 5);+	/* 2^255 - 21 */ curve25519_mul_noinline(out, b, a);+}++/*+ * z^((p-5)/8) = z^(2^252 - 3)+ */+static void+curve25519_pow_two252m3(bignum25519 two252m3, const bignum25519 z) {+	bignum25519 ALIGN(16) b,c,t0;++	/* 2 */ curve25519_square_times(c, z, 1); /* c = 2 */+	/* 8 */ curve25519_square_times(t0, c, 2); /* t0 = 8 */+	/* 9 */ curve25519_mul_noinline(b, t0, z); /* b = 9 */+	/* 11 */ curve25519_mul_noinline(c, b, c); /* c = 11 */+	/* 22 */ curve25519_square_times(t0, c, 1);+	/* 2^5 - 2^0 = 31 */ curve25519_mul_noinline(b, t0, b);+	/* 2^250 - 2^0 */ curve25519_pow_two5mtwo0_two250mtwo0(b);+	/* 2^252 - 2^2 */ curve25519_square_times(b, b, 2);+	/* 2^252 - 3 */ curve25519_mul_noinline(two252m3, b, z);+}
+ cbits/ed25519/ed25519-donna-64bit-tables.h view
@@ -0,0 +1,53 @@+static const ge25519 ge25519_basepoint = {+	{0x00062d608f25d51a,0x000412a4b4f6592a,0x00075b7171a4b31d,0x0001ff60527118fe,0x000216936d3cd6e5},+	{0x0006666666666658,0x0004cccccccccccc,0x0001999999999999,0x0003333333333333,0x0006666666666666},+	{0x0000000000000001,0x0000000000000000,0x0000000000000000,0x0000000000000000,0x0000000000000000},+	{0x00068ab3a5b7dda3,0x00000eea2a5eadbb,0x0002af8df483c27e,0x000332b375274732,0x00067875f0fd78b7}+};++static const bignum25519 ge25519_ecd = {+	0x00034dca135978a3,0x0001a8283b156ebd,0x0005e7a26001c029,0x000739c663a03cbb,0x00052036cee2b6ff+};++static const bignum25519 ge25519_ec2d = {+	0x00069b9426b2f159,0x00035050762add7a,0x0003cf44c0038052,0x0006738cc7407977,0x0002406d9dc56dff+};++static const bignum25519 ge25519_sqrtneg1 = {+	0x00061b274a0ea0b0,0x0000d5a5fc8f189d,0x0007ef5e9cbd0c60,0x00078595a6804c9e,0x0002b8324804fc1d+};++static const ge25519_niels ge25519_niels_sliding_multiples[32] = {+	{{0x00003905d740913e,0x0000ba2817d673a2,0x00023e2827f4e67c,0x000133d2e0c21a34,0x00044fd2f9298f81},{0x000493c6f58c3b85,0x0000df7181c325f7,0x0000f50b0b3e4cb7,0x0005329385a44c32,0x00007cf9d3a33d4b},{0x00011205877aaa68,0x000479955893d579,0x00050d66309b67a0,0x0002d42d0dbee5ee,0x0006f117b689f0c6}},+	{{0x00011fe8a4fcd265,0x0007bcb8374faacc,0x00052f5af4ef4d4f,0x0005314098f98d10,0x0002ab91587555bd},{0x0005b0a84cee9730,0x00061d10c97155e4,0x0004059cc8096a10,0x00047a608da8014f,0x0007a164e1b9a80f},{0x0006933f0dd0d889,0x00044386bb4c4295,0x0003cb6d3162508c,0x00026368b872a2c6,0x0005a2826af12b9b}},+	{{0x000182c3a447d6ba,0x00022964e536eff2,0x000192821f540053,0x0002f9f19e788e5c,0x000154a7e73eb1b5},{0x0002bc4408a5bb33,0x000078ebdda05442,0x0002ffb112354123,0x000375ee8df5862d,0x0002945ccf146e20},{0x0003dbf1812a8285,0x0000fa17ba3f9797,0x0006f69cb49c3820,0x00034d5a0db3858d,0x00043aabe696b3bb}},+	{{0x00072c9aaa3221b1,0x000267774474f74d,0x000064b0e9b28085,0x0003f04ef53b27c9,0x0001d6edd5d2e531},{0x00025cd0944ea3bf,0x00075673b81a4d63,0x000150b925d1c0d4,0x00013f38d9294114,0x000461bea69283c9},{0x00036dc801b8b3a2,0x0000e0a7d4935e30,0x0001deb7cecc0d7d,0x000053a94e20dd2c,0x0007a9fbb1c6a0f9}},+	{{0x0006217e039d8064,0x0006dea408337e6d,0x00057ac112628206,0x000647cb65e30473,0x00049c05a51fadc9},{0x0006678aa6a8632f,0x0005ea3788d8b365,0x00021bd6d6994279,0x0007ace75919e4e3,0x00034b9ed338add7},{0x0004e8bf9045af1b,0x000514e33a45e0d6,0x0007533c5b8bfe0f,0x000583557b7e14c9,0x00073c172021b008}},+	{{0x00075b0249864348,0x00052ee11070262b,0x000237ae54fb5acd,0x0003bfd1d03aaab5,0x00018ab598029d5c},{0x000700848a802ade,0x0001e04605c4e5f7,0x0005c0d01b9767fb,0x0007d7889f42388b,0x0004275aae2546d8},{0x00032cc5fd6089e9,0x000426505c949b05,0x00046a18880c7ad2,0x0004a4221888ccda,0x0003dc65522b53df}},+	{{0x0007013b327fbf93,0x0001336eeded6a0d,0x0002b565a2bbf3af,0x000253ce89591955,0x0000267882d17602},{0x0000c222a2007f6d,0x000356b79bdb77ee,0x00041ee81efe12ce,0x000120a9bd07097d,0x000234fd7eec346f},{0x0000a119732ea378,0x00063bf1ba8e2a6c,0x00069f94cc90df9a,0x000431d1779bfc48,0x000497ba6fdaa097}},+	{{0x0003cd86468ccf0b,0x00048553221ac081,0x0006c9464b4e0a6e,0x00075fba84180403,0x00043b5cd4218d05},{0x0006cc0313cfeaa0,0x0001a313848da499,0x0007cb534219230a,0x00039596dedefd60,0x00061e22917f12de},{0x0002762f9bd0b516,0x0001c6e7fbddcbb3,0x00075909c3ace2bd,0x00042101972d3ec9,0x000511d61210ae4d}},+	{{0x000386484420de87,0x0002d6b25db68102,0x000650b4962873c0,0x0004081cfd271394,0x00071a7fe6fe2482},{0x000676ef950e9d81,0x0001b81ae089f258,0x00063c4922951883,0x0002f1d54d9b3237,0x0006d325924ddb85},{0x000182b8a5c8c854,0x00073fcbe5406d8e,0x0005de3430cff451,0x000554b967ac8c41,0x0004746c4b6559ee}},+	{{0x000546c864741147,0x0003a1df99092690,0x0001ca8cc9f4d6bb,0x00036b7fc9cd3b03,0x000219663497db5e},{0x00077b3c6dc69a2b,0x0004edf13ec2fa6e,0x0004e85ad77beac8,0x0007dba2b28e7bda,0x0005c9a51de34fe9},{0x0000f1cf79f10e67,0x00043ccb0a2b7ea2,0x00005089dfff776a,0x0001dd84e1d38b88,0x0004804503c60822}},+	{{0x000021d23a36d175,0x0004fd3373c6476d,0x00020e291eeed02a,0x00062f2ecf2e7210,0x000771e098858de4},{0x00049ed02ca37fc7,0x000474c2b5957884,0x0005b8388e816683,0x0004b6c454b76be4,0x000553398a516506},{0x0002f5d278451edf,0x000730b133997342,0x0006965420eb6975,0x000308a3bfa516cf,0x0005a5ed1d68ff5a}},+	{{0x0005e0c558527359,0x0003395b73afd75c,0x000072afa4e4b970,0x00062214329e0f6d,0x000019b60135fefd},{0x0005122afe150e83,0x0004afc966bb0232,0x0001c478833c8268,0x00017839c3fc148f,0x00044acb897d8bf9},{0x000068145e134b83,0x0001e4860982c3cc,0x000068fb5f13d799,0x0007c9283744547e,0x000150c49fde6ad2}},+	{{0x0001863c9cdca868,0x0003770e295a1709,0x0000d85a3720fd13,0x0005e0ff1f71ab06,0x00078a6d7791e05f},{0x0003f29509471138,0x000729eeb4ca31cf,0x00069c22b575bfbc,0x0004910857bce212,0x0006b2b5a075bb99},{0x0007704b47a0b976,0x0002ae82e91aab17,0x00050bd6429806cd,0x00068055158fd8ea,0x000725c7ffc4ad55}},+	{{0x00002bf71cd098c0,0x00049dabcc6cd230,0x00040a6533f905b2,0x000573efac2eb8a4,0x0004cd54625f855f},{0x00026715d1cf99b2,0x0002205441a69c88,0x000448427dcd4b54,0x0001d191e88abdc5,0x000794cc9277cb1f},{0x0006c426c2ac5053,0x0005a65ece4b095e,0x0000c44086f26bb6,0x0007429568197885,0x0007008357b6fcc8}},+	{{0x00039fbb82584a34,0x00047a568f257a03,0x00014d88091ead91,0x0002145b18b1ce24,0x00013a92a3669d6d},{0x0000672738773f01,0x000752bf799f6171,0x0006b4a6dae33323,0x0007b54696ead1dc,0x00006ef7e9851ad0},{0x0003771cc0577de5,0x0003ca06bb8b9952,0x00000b81c5d50390,0x00043512340780ec,0x0003c296ddf8a2af}},+	{{0x00034d2ebb1f2541,0x0000e815b723ff9d,0x000286b416e25443,0x0000bdfe38d1bee8,0x0000a892c7007477},{0x000515f9d914a713,0x00073191ff2255d5,0x00054f5cc2a4bdef,0x0003dd57fc118bcf,0x0007a99d393490c7},{0x0002ed2436bda3e8,0x00002afd00f291ea,0x0000be7381dea321,0x0003e952d4b2b193,0x000286762d28302f}},+	{{0x00058e2bce2ef5bd,0x00068ce8f78c6f8a,0x0006ee26e39261b2,0x00033d0aa50bcf9d,0x0007686f2a3d6f17},{0x000036093ce35b25,0x0003b64d7552e9cf,0x00071ee0fe0b8460,0x00069d0660c969e5,0x00032f1da046a9d9},{0x000512a66d597c6a,0x0000609a70a57551,0x000026c08a3c464c,0x0004531fc8ee39e1,0x000561305f8a9ad2}},+	{{0x0002cc28e7b0c0d5,0x00077b60eb8a6ce4,0x0004042985c277a6,0x000636657b46d3eb,0x000030a1aef2c57c},{0x0004978dec92aed1,0x000069adae7ca201,0x00011ee923290f55,0x00069641898d916c,0x00000aaec53e35d4},{0x0001f773003ad2aa,0x000005642cc10f76,0x00003b48f82cfca6,0x0002403c10ee4329,0x00020be9c1c24065}},+	{{0x0000e44ae2025e60,0x0005f97b9727041c,0x0005683472c0ecec,0x000188882eb1ce7c,0x00069764c545067e},{0x000387d8249673a6,0x0005bea8dc927c2a,0x0005bd8ed5650ef0,0x0000ef0e3fcd40e1,0x000750ab3361f0ac},{0x00023283a2f81037,0x000477aff97e23d1,0x0000b8958dbcbb68,0x0000205b97e8add6,0x00054f96b3fb7075}},+	{{0x0005afc616b11ecd,0x00039f4aec8f22ef,0x0003b39e1625d92e,0x0005f85bd4508873,0x00078e6839fbe85d},{0x0005f20429669279,0x00008fafae4941f5,0x00015d83c4eb7688,0x0001cf379eca4146,0x0003d7fe9c52bb75},{0x00032df737b8856b,0x0000608342f14e06,0x0003967889d74175,0x0001211907fba550,0x00070f268f350088}},+	{{0x0004112070dcf355,0x0007dcff9c22e464,0x00054ada60e03325,0x00025cd98eef769a,0x000404e56c039b8c},{0x00064583b1805f47,0x00022c1baf832cd0,0x000132c01bd4d717,0x0004ecf4c3a75b8f,0x0007c0d345cfad88},{0x00071f4b8c78338a,0x00062cfc16bc2b23,0x00017cf51280d9aa,0x0003bbae5e20a95a,0x00020d754762aaec}},+	{{0x0004feb135b9f543,0x00063bd192ad93ae,0x00044e2ea612cdf7,0x000670f4991583ab,0x00038b8ada8790b4},{0x0007c36fc73bb758,0x0004a6c797734bd1,0x0000ef248ab3950e,0x00063154c9a53ec8,0x0002b8f1e46f3cee},{0x00004a9cdf51f95d,0x0005d963fbd596b8,0x00022d9b68ace54a,0x0004a98e8836c599,0x000049aeb32ceba1}},+	{{0x00067d3c63dcfe7e,0x000112f0adc81aee,0x00053df04c827165,0x0002fe5b33b430f0,0x00051c665e0c8d62},{0x00007d0b75fc7931,0x00016f4ce4ba754a,0x0005ace4c03fbe49,0x00027e0ec12a159c,0x000795ee17530f67},{0x00025b0a52ecbd81,0x0005dc0695fce4a9,0x0003b928c575047d,0x00023bf3512686e5,0x0006cd19bf49dc54}},+	{{0x0007619052179ca3,0x0000c16593f0afd0,0x000265c4795c7428,0x00031c40515d5442,0x0007520f3db40b2e},{0x0006612165afc386,0x0001171aa36203ff,0x0002642ea820a8aa,0x0001f3bb7b313f10,0x0005e01b3a7429e4},{0x00050be3d39357a1,0x0003ab33d294a7b6,0x0004c479ba59edb3,0x0004c30d184d326f,0x00071092c9ccef3c}},+	{{0x0000523f0364918c,0x000687f56d638a7b,0x00020796928ad013,0x0005d38405a54f33,0x0000ea15b03d0257},{0x0003d8ac74051dcf,0x00010ab6f543d0ad,0x0005d0f3ac0fda90,0x0005ef1d2573e5e4,0x0004173a5bb7137a},{0x00056e31f0f9218a,0x0005635f88e102f8,0x0002cbc5d969a5b8,0x000533fbc98b347a,0x0005fc565614a4e3}},+	{{0x0006570dc46d7ae5,0x00018a9f1b91e26d,0x000436b6183f42ab,0x000550acaa4f8198,0x00062711c414c454},{0x0002e1e67790988e,0x0001e38b9ae44912,0x000648fbb4075654,0x00028df1d840cd72,0x0003214c7409d466},{0x0001827406651770,0x0004d144f286c265,0x00017488f0ee9281,0x00019e6cdb5c760c,0x0005bea94073ecb8}},+	{{0x0005bf0912c89be4,0x00062fadcaf38c83,0x00025ec196b3ce2c,0x00077655ff4f017b,0x0003aacd5c148f61},{0x0000ce63f343d2f8,0x0001e0a87d1e368e,0x000045edbc019eea,0x0006979aed28d0d1,0x0004ad0785944f1b},{0x00063b34c3318301,0x0000e0e62d04d0b1,0x000676a233726701,0x00029e9a042d9769,0x0003aff0cb1d9028}},+	{{0x0005c7eb3a20405e,0x0005fdb5aad930f8,0x0004a757e63b8c47,0x00028e9492972456,0x000110e7e86f4cd2},{0x0006430bf4c53505,0x000264c3e4507244,0x00074c9f19a39270,0x00073f84f799bc47,0x0002ccf9f732bd99},{0x0000d89ed603f5e4,0x00051e1604018af8,0x0000b8eedc4a2218,0x00051ba98b9384d0,0x00005c557e0b9693}},+	{{0x0001ce311fc97e6f,0x0006023f3fb5db1f,0x0007b49775e8fc98,0x0003ad70adbf5045,0x0006e154c178fe98},{0x0006bbb089c20eb0,0x0006df41fb0b9eee,0x00051087ed87e16f,0x000102db5c9fa731,0x000289fef0841861},{0x00016336fed69abf,0x0004f066b929f9ec,0x0004e9ff9e6c5b93,0x00018c89bc4bb2ba,0x0006afbf642a95ca}},+	{{0x0000de0c62f5d2c1,0x00049601cf734fb5,0x0006b5c38263f0f6,0x0004623ef5b56d06,0x0000db4b851b9503},{0x00055070f913a8cc,0x000765619eac2bbc,0x0003ab5225f47459,0x00076ced14ab5b48,0x00012c093cedb801},{0x00047f9308b8190f,0x000414235c621f82,0x00031f5ff41a5a76,0x0006736773aab96d,0x00033aa8799c6635}},+	{{0x0007f51ebd085cf2,0x00012cfa67e3f5e1,0x0001800cf1e3d46a,0x00054337615ff0a8,0x000233c6f29e8e21},{0x0000f588fc156cb1,0x000363414da4f069,0x0007296ad9b68aea,0x0004d3711316ae43,0x000212cd0c1c8d58},{0x0004d5107f18c781,0x00064a4fd3a51a5e,0x0004f4cd0448bb37,0x000671d38543151e,0x0001db7778911914}},+	{{0x000352397c6bc26f,0x00018a7aa0227bbe,0x0005e68cc1ea5f8b,0x0006fe3e3a7a1d5f,0x00031ad97ad26e2a},{0x00014769dd701ab6,0x00028339f1b4b667,0x0004ab214b8ae37b,0x00025f0aefa0b0fe,0x0007ae2ca8a017d2},{0x000017ed0920b962,0x000187e33b53b6fd,0x00055829907a1463,0x000641f248e0a792,0x0001ed1fc53a6622}}+};
+ cbits/ed25519/ed25519-donna-64bit-x86.h view
@@ -0,0 +1,351 @@+#if defined(ED25519_GCC_64BIT_X86_CHOOSE)++#define HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS++DONNA_NOINLINE static void+ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const uint8_t table[256][96], uint32_t pos, signed char b) {+	int64_t breg = (int64_t)b;+	uint64_t sign = (uint64_t)breg >> 63;+	uint64_t mask = ~(sign - 1);+	uint64_t u = (breg + mask) ^ mask;++	__asm__ __volatile__ (+		/* ysubx+xaddy+t2d */+		"movq %0, %%rax                  ;\n"+		"movd %%rax, %%xmm14             ;\n"+		"pshufd $0x00, %%xmm14, %%xmm14  ;\n"+		"pxor %%xmm0, %%xmm0             ;\n"+		"pxor %%xmm1, %%xmm1             ;\n"+		"pxor %%xmm2, %%xmm2             ;\n"+		"pxor %%xmm3, %%xmm3             ;\n"+		"pxor %%xmm4, %%xmm4             ;\n"+		"pxor %%xmm5, %%xmm5             ;\n"++		/* 0 */+		"movq $0, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movq $1, %%rax                  ;\n"+		"movd %%rax, %%xmm6              ;\n"+		"pxor %%xmm7, %%xmm7             ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm6, %%xmm2              ;\n"+		"por %%xmm7, %%xmm3              ;\n"++		/* 1 */+		"movq $1, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 0(%1), %%xmm6            ;\n"+		"movdqa 16(%1), %%xmm7           ;\n"+		"movdqa 32(%1), %%xmm8           ;\n"+		"movdqa 48(%1), %%xmm9           ;\n"+		"movdqa 64(%1), %%xmm10          ;\n"+		"movdqa 80(%1), %%xmm11          ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 2 */+		"movq $2, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 96(%1), %%xmm6           ;\n"+		"movdqa 112(%1), %%xmm7          ;\n"+		"movdqa 128(%1), %%xmm8          ;\n"+		"movdqa 144(%1), %%xmm9          ;\n"+		"movdqa 160(%1), %%xmm10         ;\n"+		"movdqa 176(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 3 */+		"movq $3, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 192(%1), %%xmm6          ;\n"+		"movdqa 208(%1), %%xmm7          ;\n"+		"movdqa 224(%1), %%xmm8          ;\n"+		"movdqa 240(%1), %%xmm9          ;\n"+		"movdqa 256(%1), %%xmm10         ;\n"+		"movdqa 272(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 4 */+		"movq $4, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 288(%1), %%xmm6          ;\n"+		"movdqa 304(%1), %%xmm7          ;\n"+		"movdqa 320(%1), %%xmm8          ;\n"+		"movdqa 336(%1), %%xmm9          ;\n"+		"movdqa 352(%1), %%xmm10         ;\n"+		"movdqa 368(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 5 */+		"movq $5, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 384(%1), %%xmm6          ;\n"+		"movdqa 400(%1), %%xmm7          ;\n"+		"movdqa 416(%1), %%xmm8          ;\n"+		"movdqa 432(%1), %%xmm9          ;\n"+		"movdqa 448(%1), %%xmm10         ;\n"+		"movdqa 464(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 6 */+		"movq $6, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 480(%1), %%xmm6          ;\n"+		"movdqa 496(%1), %%xmm7          ;\n"+		"movdqa 512(%1), %%xmm8          ;\n"+		"movdqa 528(%1), %%xmm9          ;\n"+		"movdqa 544(%1), %%xmm10         ;\n"+		"movdqa 560(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 7 */+		"movq $7, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 576(%1), %%xmm6          ;\n"+		"movdqa 592(%1), %%xmm7          ;\n"+		"movdqa 608(%1), %%xmm8          ;\n"+		"movdqa 624(%1), %%xmm9          ;\n"+		"movdqa 640(%1), %%xmm10         ;\n"+		"movdqa 656(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* 8 */+		"movq $8, %%rax                  ;\n"+		"movd %%rax, %%xmm15             ;\n"+		"pshufd $0x00, %%xmm15, %%xmm15  ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa 672(%1), %%xmm6          ;\n"+		"movdqa 688(%1), %%xmm7          ;\n"+		"movdqa 704(%1), %%xmm8          ;\n"+		"movdqa 720(%1), %%xmm9          ;\n"+		"movdqa 736(%1), %%xmm10         ;\n"+		"movdqa 752(%1), %%xmm11         ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pand %%xmm15, %%xmm8            ;\n"+		"pand %%xmm15, %%xmm9            ;\n"+		"pand %%xmm15, %%xmm10           ;\n"+		"pand %%xmm15, %%xmm11           ;\n"+		"por %%xmm6, %%xmm0              ;\n"+		"por %%xmm7, %%xmm1              ;\n"+		"por %%xmm8, %%xmm2              ;\n"+		"por %%xmm9, %%xmm3              ;\n"+		"por %%xmm10, %%xmm4             ;\n"+		"por %%xmm11, %%xmm5             ;\n"++		/* conditionally swap ysubx and xaddy */+		"movq %3, %%rax                  ;\n"+		"xorq $1, %%rax                  ;\n"+		"movd %%rax, %%xmm14             ;\n"+		"pxor %%xmm15, %%xmm15           ;\n"+		"pshufd $0x00, %%xmm14, %%xmm14  ;\n"+		"pxor %%xmm0, %%xmm2             ;\n"+		"pxor %%xmm1, %%xmm3             ;\n"+		"pcmpeqd %%xmm14, %%xmm15        ;\n"+		"movdqa %%xmm2, %%xmm6           ;\n"+		"movdqa %%xmm3, %%xmm7           ;\n"+		"pand %%xmm15, %%xmm6            ;\n"+		"pand %%xmm15, %%xmm7            ;\n"+		"pxor %%xmm6, %%xmm0             ;\n"+		"pxor %%xmm7, %%xmm1             ;\n"+		"pxor %%xmm0, %%xmm2             ;\n"+		"pxor %%xmm1, %%xmm3             ;\n"++		/* store ysubx */+		"movq $0x7ffffffffffff, %%rax    ;\n"+		"movd %%xmm0, %%rcx              ;\n"+		"movd %%xmm0, %%r8               ;\n"+		"movd %%xmm1, %%rsi              ;\n"+		"pshufd $0xee, %%xmm0, %%xmm0    ;\n"+		"pshufd $0xee, %%xmm1, %%xmm1    ;\n"+		"movd %%xmm0, %%rdx              ;\n"+		"movd %%xmm1, %%rdi              ;\n"+		"shrdq $51, %%rdx, %%r8          ;\n"+		"shrdq $38, %%rsi, %%rdx         ;\n"+		"shrdq $25, %%rdi, %%rsi         ;\n"+		"shrq $12, %%rdi                 ;\n"+		"andq %%rax, %%rcx               ;\n"+		"andq %%rax, %%r8                ;\n"+		"andq %%rax, %%rdx               ;\n"+		"andq %%rax, %%rsi               ;\n"+		"andq %%rax, %%rdi               ;\n"+		"movq %%rcx, 0(%2)               ;\n"+		"movq %%r8, 8(%2)                ;\n"+		"movq %%rdx, 16(%2)              ;\n"+		"movq %%rsi, 24(%2)              ;\n"+		"movq %%rdi, 32(%2)              ;\n"++		/* store xaddy */+		"movq $0x7ffffffffffff, %%rax    ;\n"+		"movd %%xmm2, %%rcx              ;\n"+		"movd %%xmm2, %%r8               ;\n"+		"movd %%xmm3, %%rsi              ;\n"+		"pshufd $0xee, %%xmm2, %%xmm2    ;\n"+		"pshufd $0xee, %%xmm3, %%xmm3    ;\n"+		"movd %%xmm2, %%rdx              ;\n"+		"movd %%xmm3, %%rdi              ;\n"+		"shrdq $51, %%rdx, %%r8          ;\n"+		"shrdq $38, %%rsi, %%rdx         ;\n"+		"shrdq $25, %%rdi, %%rsi         ;\n"+		"shrq $12, %%rdi                 ;\n"+		"andq %%rax, %%rcx               ;\n"+		"andq %%rax, %%r8                ;\n"+		"andq %%rax, %%rdx               ;\n"+		"andq %%rax, %%rsi               ;\n"+		"andq %%rax, %%rdi               ;\n"+		"movq %%rcx, 40(%2)              ;\n"+		"movq %%r8, 48(%2)               ;\n"+		"movq %%rdx, 56(%2)              ;\n"+		"movq %%rsi, 64(%2)              ;\n"+		"movq %%rdi, 72(%2)              ;\n"++		/* extract t2d */+		"movq $0x7ffffffffffff, %%rax    ;\n"+		"movd %%xmm4, %%rcx              ;\n"+		"movd %%xmm4, %%r8               ;\n"+		"movd %%xmm5, %%rsi              ;\n"+		"pshufd $0xee, %%xmm4, %%xmm4    ;\n"+		"pshufd $0xee, %%xmm5, %%xmm5    ;\n"+		"movd %%xmm4, %%rdx              ;\n"+		"movd %%xmm5, %%rdi              ;\n"+		"shrdq $51, %%rdx, %%r8          ;\n"+		"shrdq $38, %%rsi, %%rdx         ;\n"+		"shrdq $25, %%rdi, %%rsi         ;\n"+		"shrq $12, %%rdi                 ;\n"+		"andq %%rax, %%rcx               ;\n"+		"andq %%rax, %%r8                ;\n"+		"andq %%rax, %%rdx               ;\n"+		"andq %%rax, %%rsi               ;\n"+		"andq %%rax, %%rdi               ;\n"++		/* conditionally negate t2d */+		"movq %3, %%rax                  ;\n"+		"movq $0xfffffffffffda, %%r9     ;\n"+		"movq $0xffffffffffffe, %%r10    ;\n"+		"movq %%r10, %%r11               ;\n"+		"movq %%r10, %%r12               ;\n"+		"movq %%r10, %%r13               ;\n"+		"subq %%rcx, %%r9                ;\n"+		"subq %%r8, %%r10                ;\n"+		"subq %%rdx, %%r11               ;\n"+		"subq %%rsi, %%r12               ;\n"+		"subq %%rdi, %%r13               ;\n"+		"cmpq $1, %%rax                  ;\n"+		"cmove %%r9, %%rcx               ;\n"+		"cmove %%r10, %%r8               ;\n"+		"cmove %%r11, %%rdx              ;\n"+		"cmove %%r12, %%rsi              ;\n"+		"cmove %%r13, %%rdi              ;\n"++		/* store t2d */+		"movq %%rcx, 80(%2)              ;\n"+		"movq %%r8, 88(%2)               ;\n"+		"movq %%rdx, 96(%2)              ;\n"+		"movq %%rsi, 104(%2)             ;\n"+		"movq %%rdi, 112(%2)             ;\n"+		:+		: "m"(u), "r"(&table[pos * 8]), "r"(t), "m"(sign) /* %0 = u, %1 = table, %2 = t, %3 = sign */+		:+			"%rax", "%rcx", "%rdx", "%rdi", "%rsi", "%r8", "%r9", "%r10", "%r11", "%r12", "%r13", +			"%xmm0", "%xmm1", "%xmm2", "%xmm3", "%xmm4", "%xmm5", "%xmm6", "%xmm7", "%xmm8", "%xmm9", "%xmm10", "%xmm11", "%xmm14", "%xmm14",+			"cc", "memory"+	);+}++#endif /* defined(ED25519_GCC_64BIT_X86_CHOOSE) */+
+ cbits/ed25519/ed25519-donna-basepoint-table.h view
@@ -0,0 +1,259 @@+/* multiples of the base point in packed {ysubx, xaddy, t2d} form */+static const uint8_t ALIGN(16) ge25519_niels_base_multiples[256][96] = {+	{0x3e,0x91,0x40,0xd7,0x05,0x39,0x10,0x9d,0xb3,0xbe,0x40,0xd1,0x05,0x9f,0x39,0xfd,0x09,0x8a,0x8f,0x68,0x34,0x84,0xc1,0xa5,0x67,0x12,0xf8,0x98,0x92,0x2f,0xfd,0x44,0x85,0x3b,0x8c,0xf5,0xc6,0x93,0xbc,0x2f,0x19,0x0e,0x8c,0xfb,0xc6,0x2d,0x93,0xcf,0xc2,0x42,0x3d,0x64,0x98,0x48,0x0b,0x27,0x65,0xba,0xd4,0x33,0x3a,0x9d,0xcf,0x07,0x59,0xbb,0x6f,0x4b,0x67,0x15,0xbd,0xdb,0xea,0xa5,0xa2,0xee,0x00,0x3f,0xe1,0x41,0xfa,0xc6,0x57,0xc9,0x1c,0x9d,0xd4,0xcd,0xca,0xec,0x16,0xaf,0x1f,0xbe,0x0e,0x4f},+	{0xa8,0xd5,0xb4,0x42,0x60,0xa5,0x99,0x8a,0xf6,0xac,0x60,0x4e,0x0c,0x81,0x2b,0x8f,0xaa,0x37,0x6e,0xb1,0x6b,0x23,0x9e,0xe0,0x55,0x25,0xc9,0x69,0xa6,0x95,0xb5,0x6b,0xd7,0x71,0x3c,0x93,0xfc,0xe7,0x24,0x92,0xb5,0xf5,0x0f,0x7a,0x96,0x9d,0x46,0x9f,0x02,0x07,0xd6,0xe1,0x65,0x9a,0xa6,0x5a,0x2e,0x2e,0x7d,0xa8,0x3f,0x06,0x0c,0x59,0x02,0x68,0xd3,0xda,0xaa,0x7e,0x34,0x6e,0x05,0x48,0xee,0x83,0x93,0x59,0xf3,0xba,0x26,0x68,0x07,0xe6,0x10,0xbe,0xca,0x3b,0xb8,0xd1,0x5e,0x16,0x0a,0x4f,0x31,0x49},+	{0x65,0xd2,0xfc,0xa4,0xe8,0x1f,0x61,0x56,0x7d,0xba,0xc1,0xe5,0xfd,0x53,0xd3,0x3b,0xbd,0xd6,0x4b,0x21,0x1a,0xf3,0x31,0x81,0x62,0xda,0x5b,0x55,0x87,0x15,0xb9,0x2a,0x30,0x97,0xee,0x4c,0xa8,0xb0,0x25,0xaf,0x8a,0x4b,0x86,0xe8,0x30,0x84,0x5a,0x02,0x32,0x67,0x01,0x9f,0x02,0x50,0x1b,0xc1,0xf4,0xf8,0x80,0x9a,0x1b,0x4e,0x16,0x7a,0x34,0x48,0x67,0xf1,0xf4,0x11,0xf2,0x9b,0x95,0xf8,0x2d,0xf6,0x17,0x6b,0x4e,0xb8,0x4e,0x2a,0x72,0x5b,0x07,0x6f,0xde,0xd7,0x21,0x2a,0xbb,0x63,0xb9,0x04,0x9a,0x54},+	{0xbf,0x18,0x68,0x05,0x0a,0x05,0xfe,0x95,0xa9,0xfa,0x60,0x56,0x71,0x89,0x7e,0x32,0x73,0x50,0xa0,0x06,0xcd,0xe3,0xe8,0xc3,0x9a,0xa4,0x45,0x74,0x4c,0x3f,0x93,0x27,0x9f,0x09,0xfc,0x8e,0xb9,0x51,0x73,0x28,0x38,0x25,0xfd,0x7d,0xf4,0xc6,0x65,0x67,0x65,0x92,0x0a,0xfb,0x3d,0x8d,0x34,0xca,0x27,0x87,0xe5,0x21,0x03,0x91,0x0e,0x68,0xb0,0x26,0x14,0xe5,0xec,0x45,0x1e,0xbf,0x94,0x0f,0xba,0x6d,0x3d,0xc6,0x2b,0xe3,0xc0,0x52,0xf8,0x8c,0xd5,0x74,0x29,0xe4,0x18,0x4c,0xe6,0xb0,0xb1,0x79,0xf0,0x44},+	{0xba,0xd6,0x47,0xa4,0xc3,0x82,0x91,0x7f,0xb7,0x29,0x27,0x4b,0xd1,0x14,0x00,0xd5,0x87,0xa0,0x64,0xb8,0x1c,0xf1,0x3c,0xe3,0xf3,0x55,0x1b,0xeb,0x73,0x7e,0x4a,0x15,0x33,0xbb,0xa5,0x08,0x44,0xbc,0x12,0xa2,0x02,0xed,0x5e,0xc7,0xc3,0x48,0x50,0x8d,0x44,0xec,0xbf,0x5a,0x0c,0xeb,0x1b,0xdd,0xeb,0x06,0xe2,0x46,0xf1,0xcc,0x45,0x29,0xb3,0x03,0xd0,0xe7,0x79,0xa1,0x32,0xc8,0x7e,0x4d,0x12,0x00,0x0a,0x9d,0x72,0x5f,0xf3,0x8f,0x6d,0x0e,0xa1,0xd4,0xc1,0x62,0x98,0x7a,0xb2,0x38,0x59,0xac,0xb8,0x68},+	{0xa4,0x8c,0x7d,0x7b,0xb6,0x06,0x98,0x49,0x39,0x27,0xd2,0x27,0x84,0xe2,0x5b,0x57,0xb9,0x53,0x45,0x20,0xe7,0x5c,0x08,0xbb,0x84,0x78,0x41,0xae,0x41,0x4c,0xb6,0x38,0x31,0x71,0x15,0x77,0xeb,0xee,0x0c,0x3a,0x88,0xaf,0xc8,0x00,0x89,0x15,0x27,0x9b,0x36,0xa7,0x59,0xda,0x68,0xb6,0x65,0x80,0xbd,0x38,0xcc,0xa2,0xb6,0x7b,0xe5,0x51,0xa4,0xe3,0x9d,0x68,0x91,0xad,0x9d,0x8f,0x37,0x91,0xfb,0xf8,0x28,0x24,0x5f,0x17,0x88,0xb9,0xcf,0x9f,0x32,0xb5,0x0a,0x05,0x9f,0xc0,0x54,0x13,0xa2,0xdf,0x65,0x78},+	{0xb1,0x21,0x32,0xaa,0x9a,0x2c,0x6f,0xba,0xa7,0x23,0xba,0x3b,0x53,0x21,0xa0,0x6c,0x3a,0x2c,0x19,0x92,0x4f,0x76,0xea,0x9d,0xe0,0x17,0x53,0x2e,0x5d,0xdd,0x6e,0x1d,0xbf,0xa3,0x4e,0x94,0xd0,0x5c,0x1a,0x6b,0xd2,0xc0,0x9d,0xb3,0x3a,0x35,0x70,0x74,0x49,0x2e,0x54,0x28,0x82,0x52,0xb2,0x71,0x7e,0x92,0x3c,0x28,0x69,0xea,0x1b,0x46,0x36,0xda,0x0f,0xab,0xac,0x8a,0x7a,0x21,0xc8,0x49,0x35,0x3d,0x54,0xc6,0x28,0xa5,0x68,0x75,0xab,0x13,0x8b,0x5b,0xd0,0x37,0x37,0xbc,0x2c,0x3a,0x62,0xef,0x3c,0x23},+	{0xd9,0x34,0x92,0xf3,0xed,0x5d,0xa7,0xe2,0xf9,0x58,0xb5,0xe1,0x80,0x76,0x3d,0x96,0xfb,0x23,0x3c,0x6e,0xac,0x41,0x27,0x2c,0xc3,0x01,0x0e,0x32,0xa1,0x24,0x90,0x3a,0x8f,0x3e,0xdd,0x04,0x66,0x59,0xb7,0x59,0x2c,0x70,0x88,0xe2,0x77,0x03,0xb3,0x6c,0x23,0xc3,0xd9,0x5e,0x66,0x9c,0x33,0xb1,0x2f,0xe5,0xbc,0x61,0x60,0xe7,0x15,0x09,0x7e,0xa3,0x34,0xa8,0x35,0xe8,0x7d,0xdf,0xea,0x57,0x98,0x68,0xda,0x9c,0xe1,0x8b,0x26,0xb3,0x67,0x71,0x36,0x85,0x11,0x2c,0xc2,0xd5,0xef,0xdb,0xd9,0xb3,0x9e,0x58},+	{0x5e,0x51,0xaa,0x49,0x54,0x63,0x5b,0xed,0x3a,0x82,0xc6,0x0b,0x9f,0xc4,0x65,0xa8,0xc4,0xd1,0x42,0x5b,0xe9,0x1f,0x0c,0x85,0xb9,0x15,0xd3,0x03,0x6f,0x6d,0xd7,0x30,0x1d,0x9c,0x2f,0x63,0x0e,0xdd,0xcc,0x2e,0x15,0x31,0x89,0x76,0x96,0xb6,0xd0,0x51,0x58,0x7a,0x63,0xa8,0x6b,0xb7,0xdf,0x52,0x39,0xef,0x0e,0xa0,0x49,0x7d,0xd3,0x6d,0xc7,0xe4,0x06,0x21,0x17,0x44,0x44,0x6c,0x69,0x7f,0x8d,0x92,0x80,0xd6,0x53,0xfb,0x26,0x3f,0x4d,0x69,0xa4,0x9e,0x73,0xb4,0xb0,0x4b,0x86,0x2e,0x11,0x97,0xc6,0x10},+	{0xde,0x5f,0xbe,0x7d,0x27,0xc4,0x93,0x64,0xa2,0x7e,0xad,0x19,0xad,0x4f,0x5d,0x26,0x90,0x45,0x30,0x46,0xc8,0xdf,0x00,0x0e,0x09,0xfe,0x66,0xed,0xab,0x1c,0xe6,0x25,0x05,0xc8,0x58,0x83,0xa0,0x2a,0xa6,0x0c,0x47,0x42,0x20,0x7a,0xe3,0x4a,0x3d,0x6a,0xdc,0xed,0x11,0x3b,0xa6,0xd3,0x64,0x74,0xef,0x06,0x08,0x55,0xaf,0x9b,0xbf,0x03,0x04,0x66,0x58,0xcc,0x28,0xe1,0x13,0x3f,0x7e,0x74,0x59,0xb4,0xec,0x73,0x58,0x6f,0xf5,0x68,0x12,0xcc,0xed,0x3d,0xb6,0xa0,0x2c,0xe2,0x86,0x45,0x63,0x78,0x6d,0x56},+	{0x34,0x08,0xc1,0x9c,0x9f,0xa4,0x37,0x16,0x51,0xc4,0x9b,0xa8,0xd5,0x56,0x8e,0xbc,0xdb,0xd2,0x7f,0x7f,0x0f,0xec,0xb5,0x1c,0xd9,0x35,0xcc,0x5e,0xca,0x5b,0x97,0x33,0xd0,0x2f,0x5a,0xc6,0x85,0x42,0x05,0xa1,0xc3,0x67,0x16,0xf3,0x2a,0x11,0x64,0x6c,0x58,0xee,0x1a,0x73,0x40,0xe2,0x0a,0x68,0x2a,0xb2,0x93,0x47,0xf3,0xa5,0xfb,0x14,0xd4,0xf7,0x85,0x69,0x16,0x46,0xd7,0x3c,0x57,0x00,0xc8,0xc9,0x84,0x5e,0x3e,0x59,0x1e,0x13,0x61,0x7b,0xb6,0xf2,0xc3,0x2f,0x6c,0x52,0xfc,0x83,0xea,0x9c,0x82,0x14},+	{0xc2,0x95,0xdd,0x97,0x84,0x7b,0x43,0xff,0xa7,0xb5,0x4e,0xaa,0x30,0x4e,0x74,0x6c,0x8b,0xe8,0x85,0x3c,0x61,0x5d,0x0c,0x9e,0x73,0x81,0x75,0x5f,0x1e,0xc7,0xd9,0x2f,0xb8,0xec,0x71,0x4e,0x2f,0x0b,0xe7,0x21,0xe3,0x77,0xa4,0x40,0xb9,0xdd,0x56,0xe6,0x80,0x4f,0x1d,0xce,0xce,0x56,0x65,0xbf,0x7e,0x7b,0x5d,0x53,0xc4,0x3b,0xfc,0x05,0xdd,0xde,0xaf,0x52,0xae,0xb3,0xb8,0x24,0xcf,0x30,0x3b,0xed,0x8c,0x63,0x95,0x34,0x95,0x81,0xbe,0xa9,0x83,0xbc,0xa4,0x33,0x04,0x1f,0x65,0x5c,0x47,0x67,0x37,0x37},+	{0xd9,0xad,0xd1,0x40,0xfd,0x99,0xba,0x2f,0x27,0xd0,0xf4,0x96,0x6f,0x16,0x07,0xb3,0xae,0x3b,0xf0,0x15,0x52,0xf0,0x63,0x43,0x99,0xf9,0x18,0x3b,0x6c,0xa5,0xbe,0x1f,0x90,0x65,0x24,0x14,0xcb,0x95,0x40,0x63,0x35,0x55,0xc1,0x16,0x40,0x14,0x12,0xef,0x60,0xbc,0x10,0x89,0x0c,0x14,0x38,0x9e,0x8c,0x7c,0x90,0x30,0x57,0x90,0xf5,0x6b,0x8a,0x5b,0x41,0xe1,0xf1,0x78,0xa7,0x0f,0x7e,0xa7,0xc3,0xba,0xf7,0x9f,0x40,0x06,0x50,0x9a,0xa2,0x9a,0xb8,0xd7,0x52,0x6f,0x56,0x5a,0x63,0x7a,0xf6,0x1c,0x52,0x02},+	{0x94,0x52,0x9d,0x0a,0x0b,0xee,0x3f,0x51,0x66,0x5a,0xdf,0x0f,0x5c,0xe7,0x98,0x8f,0xce,0x07,0xe1,0xbf,0x88,0x86,0x61,0xd4,0xed,0x2c,0x38,0x71,0x7e,0x0a,0xa0,0x3f,0xe4,0x5e,0x2f,0x77,0x20,0x67,0x14,0xb1,0xce,0x9a,0x07,0x96,0xb1,0x94,0xf8,0xe8,0x4a,0x82,0xac,0x00,0x4d,0x22,0xf8,0x4a,0xc4,0x6c,0xcd,0xf7,0xd9,0x53,0x17,0x00,0x34,0xdb,0x3d,0x96,0x2d,0x23,0x69,0x3c,0x58,0x38,0x97,0xb4,0xda,0x87,0xde,0x1d,0x85,0xf2,0x91,0xa0,0xf9,0xd1,0xd7,0xaa,0xb6,0xed,0x48,0xa0,0x2f,0xfe,0xb5,0x12},+	{0x4d,0xe3,0xfc,0x96,0xc4,0xfb,0xf0,0x71,0xed,0x5b,0xf3,0xad,0x6b,0x82,0xb9,0x73,0x61,0xc5,0x28,0xff,0x61,0x72,0x04,0xd2,0x6f,0x20,0xb1,0x6f,0xf9,0x76,0x9b,0x74,0x92,0x1e,0x6f,0xad,0x26,0x7c,0x2b,0xdf,0x13,0x89,0x4b,0x50,0x23,0xd3,0x66,0x4b,0xc3,0x8b,0x1c,0x75,0xc0,0x9d,0x40,0x8c,0xb8,0xc7,0x96,0x07,0xc2,0x93,0x7e,0x6f,0x05,0xae,0xa6,0xae,0x04,0xf6,0x5a,0x1f,0x99,0x9c,0xe4,0xbe,0xf1,0x51,0x23,0xc1,0x66,0x6b,0xff,0xee,0xb5,0x08,0xa8,0x61,0x51,0x21,0xe0,0x01,0x0f,0xc1,0xce,0x0f},+	{0x44,0x1e,0xfe,0x49,0xa6,0x58,0x4d,0x64,0x7e,0x77,0xad,0x31,0xa2,0xae,0xfc,0x21,0xd2,0xd0,0x7f,0x88,0x5a,0x1c,0x44,0x02,0xf3,0x11,0xc5,0x83,0x71,0xaa,0x01,0x49,0x45,0x4e,0x24,0xc4,0x9d,0xd2,0xf2,0x3d,0x0a,0xde,0xd8,0x93,0x74,0x0e,0x02,0x2b,0x4d,0x21,0x0c,0x82,0x7e,0x06,0xc8,0x6c,0x0a,0xb9,0xea,0x6f,0x16,0x79,0x37,0x41,0xf0,0xf8,0x1a,0x8c,0x54,0xb7,0xb1,0x08,0xb4,0x99,0x62,0x24,0x7c,0x7a,0x0f,0xce,0x39,0xd9,0x06,0x1e,0xf9,0xb0,0x60,0xf7,0x13,0x12,0x6d,0x72,0x7b,0x88,0xbb,0x41},+	{0xbe,0x46,0x43,0x74,0x44,0x7d,0xe8,0x40,0x25,0x2b,0xb5,0x15,0xd4,0xda,0x48,0x1d,0x3e,0x60,0x3b,0xa1,0x18,0x8a,0x3a,0x7c,0xf7,0xbd,0xcd,0x2f,0xc1,0x28,0xb7,0x4e,0xae,0x91,0x66,0x7c,0x59,0x4c,0x23,0x7e,0xc8,0xb4,0x85,0x0a,0x3d,0x9d,0x88,0x64,0xe7,0xfa,0x4a,0x35,0x0c,0xc9,0xe2,0xda,0x1d,0x9e,0x6a,0x0c,0x07,0x1e,0x87,0x0a,0x89,0x89,0xbc,0x4b,0x99,0xb5,0x01,0x33,0x60,0x42,0xdd,0x5b,0x3a,0xae,0x6b,0x73,0x3c,0x9e,0xd5,0x19,0xe2,0xad,0x61,0x0d,0x64,0xd4,0x85,0x26,0x0f,0x30,0xe7,0x3e},+	{0xb7,0xd6,0x7d,0x9e,0xe4,0x55,0xd2,0xf5,0xac,0x1e,0x0b,0x61,0x5c,0x11,0x16,0x80,0xca,0x87,0xe1,0x92,0x5d,0x97,0x99,0x3c,0xc2,0x25,0x91,0x97,0x62,0x57,0x81,0x13,0x18,0x75,0x1e,0x84,0x47,0x79,0xfa,0x43,0xd7,0x46,0x9c,0x63,0x59,0xfa,0xc6,0xe5,0x74,0x2b,0x05,0xe3,0x1d,0x5e,0x06,0xa1,0x30,0x90,0xb8,0xcf,0xa2,0xc6,0x47,0x7d,0xe0,0xd6,0xf0,0x8e,0x14,0xd0,0xda,0x3f,0x3c,0x6f,0x54,0x91,0x9a,0x74,0x3e,0x9d,0x57,0x81,0xbb,0x26,0x10,0x62,0xec,0x71,0x80,0xec,0xc9,0x34,0x8d,0xf5,0x8c,0x14},+	{0x27,0xf0,0x34,0x79,0xf6,0x92,0xa4,0x46,0xa9,0x0a,0x84,0xf6,0xbe,0x84,0x99,0x46,0x54,0x18,0x61,0x89,0x2a,0xbc,0xa1,0x5c,0xd4,0xbb,0x5d,0xbd,0x1e,0xfa,0xf2,0x3f,0x6d,0x75,0xe4,0x9a,0x7d,0x2f,0x57,0xe2,0x7f,0x48,0xf3,0x88,0xbb,0x45,0xc3,0x56,0x8d,0xa8,0x60,0x69,0x6d,0x0b,0xd1,0x9f,0xb9,0xa1,0xae,0x4e,0xad,0xeb,0x8f,0x27,0x66,0x39,0x93,0x8c,0x1f,0x68,0xaa,0xb1,0x98,0x0c,0x29,0x20,0x9c,0x94,0x21,0x8c,0x52,0x3c,0x9d,0x21,0x91,0x52,0x11,0x39,0x7b,0x67,0x9c,0xfe,0x02,0xdd,0x04,0x41},+	{0x2a,0x42,0x24,0x11,0x5e,0xbf,0xb2,0x72,0xb5,0x3a,0xa3,0x98,0x33,0x0c,0xfa,0xa1,0x66,0xb6,0x52,0xfa,0x01,0x61,0xcb,0x94,0xd5,0x53,0xaf,0xaf,0x00,0x3b,0x86,0x2c,0xb8,0x6a,0x09,0xdb,0x06,0x4e,0x21,0x81,0x35,0x4f,0xe4,0x0c,0xc9,0xb6,0xa8,0x21,0xf5,0x2a,0x9e,0x40,0x2a,0xc1,0x24,0x65,0x81,0xa4,0xfc,0x8e,0xa4,0xb5,0x65,0x01,0x76,0x6a,0x84,0xa0,0x74,0xa4,0x90,0xf1,0xc0,0x7c,0x2f,0xcd,0x84,0xf9,0xef,0x12,0x8f,0x2b,0xaa,0x58,0x06,0x29,0x5e,0x69,0xb8,0xc8,0xfe,0xbf,0xd9,0x67,0x1b,0x59},+	{0xfa,0x9b,0xb4,0x80,0x1c,0x0d,0x2f,0x31,0x8a,0xec,0xf3,0xab,0x5e,0x51,0x79,0x59,0x88,0x1c,0xf0,0x9e,0xc0,0x33,0x70,0x72,0xcb,0x7b,0x8f,0xca,0xc7,0x2e,0xe0,0x3d,0x5d,0xb5,0x18,0x9f,0x71,0xb3,0xb9,0x99,0x1e,0x64,0x8c,0xa1,0xfa,0xe5,0x65,0xe4,0xed,0x05,0x9f,0xc2,0x36,0x11,0x08,0x61,0x8b,0x12,0x30,0x70,0x86,0x4f,0x9b,0x48,0xef,0x92,0xeb,0x3a,0x2d,0x10,0x32,0xd2,0x61,0xa8,0x16,0x61,0xb4,0x53,0x62,0xe1,0x24,0xaa,0x0b,0x19,0xe7,0xab,0x7e,0x3d,0xbf,0xbe,0x6c,0x49,0xba,0xfb,0xf5,0x49},+	{0xd4,0xcf,0x5b,0x8a,0x10,0x9a,0x94,0x30,0xeb,0x73,0x64,0xbc,0x70,0xdd,0x40,0xdc,0x1c,0x0d,0x7c,0x30,0xc1,0x94,0xc2,0x92,0x74,0x6e,0xfa,0xcb,0x6d,0xa8,0x04,0x56,0x2e,0x57,0x9c,0x1e,0x8c,0x62,0x5d,0x15,0x41,0x47,0x88,0xc5,0xac,0x86,0x4d,0x8a,0xeb,0x63,0x57,0x51,0xf6,0x52,0xa3,0x91,0x5b,0x51,0x67,0x88,0xc2,0xa6,0xa1,0x06,0xb6,0x64,0x17,0x7c,0xd4,0xd1,0x88,0x72,0x51,0x8b,0x41,0xe0,0x40,0x11,0x54,0x72,0xd1,0xf6,0xac,0x18,0x60,0x1a,0x03,0x9f,0xc6,0x42,0x27,0xfe,0x89,0x9e,0x98,0x20},+	{0x7f,0xcc,0x2d,0x3a,0xfd,0x77,0x97,0x49,0x92,0xd8,0x4f,0xa5,0x2c,0x7c,0x85,0x32,0xa0,0xe3,0x07,0xd2,0x64,0xd8,0x79,0xa2,0x29,0x7e,0xa6,0x0c,0x1d,0xed,0x03,0x04,0x2e,0xec,0xea,0x85,0x8b,0x27,0x74,0x16,0xdf,0x2b,0xcb,0x7a,0x07,0xdc,0x21,0x56,0x5a,0xf4,0xcb,0x61,0x16,0x4c,0x0a,0x64,0xd3,0x95,0x05,0xf7,0x50,0x99,0x0b,0x73,0x52,0xc5,0x4e,0x87,0x35,0x2d,0x4b,0xc9,0x8d,0x6f,0x24,0x98,0xcf,0xc8,0xe6,0xc5,0xce,0x35,0xc0,0x16,0xfa,0x46,0xcb,0xf7,0xcc,0x3d,0x30,0x08,0x43,0x45,0xd7,0x5b},+	{0xc2,0x4c,0xb2,0x28,0x95,0xd1,0x9a,0x7f,0x81,0xc1,0x35,0x63,0x65,0x54,0x6b,0x7f,0x36,0x72,0xc0,0x4f,0x6e,0xb6,0xb8,0x66,0x83,0xad,0x80,0x73,0x00,0x78,0x3a,0x13,0x2a,0x79,0xe7,0x15,0x21,0x93,0xc4,0x85,0xc9,0xdd,0xcd,0xbd,0xa2,0x89,0x4c,0xc6,0x62,0xd7,0xa3,0xad,0xa8,0x3d,0x1e,0x9d,0x2c,0xf8,0x67,0x30,0x12,0xdb,0xb7,0x5b,0xbe,0x62,0xca,0xc6,0x67,0xf4,0x61,0x09,0xee,0x52,0x19,0x21,0xd6,0x21,0xec,0x04,0x70,0x47,0xd5,0x9b,0x77,0x60,0x23,0x18,0xd2,0xe0,0xf0,0x58,0x6d,0xca,0x0d,0x74},+	{0x4e,0xce,0xcf,0x52,0x07,0xee,0x48,0xdf,0xb7,0x08,0xec,0x06,0xf3,0xfa,0xff,0xc3,0xc4,0x59,0x54,0xb9,0x2a,0x0b,0x71,0x05,0x8d,0xa3,0x3e,0x96,0xfa,0x25,0x1d,0x16,0x3c,0x43,0x78,0x04,0x57,0x8c,0x1a,0x23,0x9d,0x43,0x81,0xc2,0x0e,0x27,0xb5,0xb7,0x9f,0x07,0xd9,0xe3,0xea,0x99,0xaa,0xdb,0xd9,0x03,0x2b,0x6c,0x25,0xf5,0x03,0x2c,0x7d,0xa4,0x53,0x7b,0x75,0x18,0x0f,0x79,0x79,0x58,0x0c,0xcf,0x30,0x01,0x7b,0x30,0xf9,0xf7,0x7e,0x25,0x77,0x3d,0x90,0x31,0xaf,0xbb,0x96,0xbd,0xbd,0x68,0x94,0x69},+	{0xcf,0xfe,0xda,0xf4,0x46,0x2f,0x1f,0xbd,0xf7,0xd6,0x7f,0xa4,0x14,0x01,0xef,0x7c,0x7f,0xb3,0x47,0x4a,0xda,0xfd,0x1f,0xd3,0x85,0x57,0x90,0x73,0xa4,0x19,0x52,0x52,0x48,0x19,0xa9,0x6a,0xe6,0x3d,0xdd,0xd8,0xcc,0xd2,0xc0,0x2f,0xc2,0x64,0x50,0x48,0x2f,0xea,0xfd,0x34,0x66,0x24,0x48,0x9b,0x3a,0x2e,0x4a,0x6c,0x4e,0x1c,0x3e,0x29,0xe1,0x12,0x51,0x92,0x4b,0x13,0x6e,0x37,0xa0,0x5d,0xa1,0xdc,0xb5,0x78,0x37,0x70,0x11,0x31,0x1c,0x46,0xaf,0x89,0x45,0xb0,0x23,0x28,0x03,0x7f,0x44,0x5c,0x60,0x5b},+	{0x89,0x7c,0xc4,0x20,0x59,0x80,0x65,0xb9,0xcc,0x8f,0x3b,0x92,0x0c,0x10,0xf0,0xe7,0x77,0xef,0xe2,0x02,0x65,0x25,0x01,0x00,0xee,0xb3,0xae,0xa8,0xce,0x6d,0xa7,0x24,0x4c,0xf0,0xe7,0xf0,0xc6,0xfe,0xe9,0x3b,0x62,0x49,0xe3,0x75,0x9e,0x57,0x6a,0x86,0x1a,0xe6,0x1d,0x1e,0x16,0xef,0x42,0x55,0xd5,0xbd,0x5a,0xcc,0xf4,0xfe,0x12,0x2f,0x40,0xc7,0xc0,0xdf,0xb2,0x22,0x45,0x0a,0x07,0xa4,0xc9,0x40,0x7f,0x6e,0xd0,0x10,0x68,0xf6,0xcf,0x78,0x41,0x14,0xcf,0xc6,0x90,0x37,0xa4,0x18,0x25,0x7b,0x60,0x5e},+	{0x18,0x18,0xdf,0x6c,0x8f,0x1d,0xb3,0x58,0xa2,0x58,0x62,0xc3,0x4f,0xa7,0xcf,0x35,0x6e,0x1d,0xe6,0x66,0x4f,0xff,0xb3,0xe1,0xf7,0xd5,0xcd,0x6c,0xab,0xac,0x67,0x50,0x14,0xcf,0x96,0xa5,0x1c,0x43,0x2c,0xa0,0x00,0xe4,0xd3,0xae,0x40,0x2d,0xc4,0xe3,0xdb,0x26,0x0f,0x2e,0x80,0x26,0x45,0xd2,0x68,0x70,0x45,0x9e,0x13,0x33,0x1f,0x20,0x51,0x9d,0x03,0x08,0x6b,0x7f,0x52,0xfd,0x06,0x00,0x7c,0x01,0x64,0x49,0xb1,0x18,0xa8,0xa4,0x25,0x2e,0xb0,0x0e,0x22,0xd5,0x75,0x03,0x46,0x62,0x88,0xba,0x7c,0x39},+	{0xb2,0x59,0x59,0xf0,0x93,0x30,0xc1,0x30,0x76,0x79,0xa9,0xe9,0x8d,0xa1,0x3a,0xe2,0x26,0x5e,0x1d,0x72,0x91,0xd4,0x2f,0x22,0x3a,0x6c,0x6e,0x76,0x20,0xd3,0x39,0x23,0xe7,0x79,0x13,0xc8,0xfb,0xc3,0x15,0x78,0xf1,0x2a,0xe1,0xdd,0x20,0x94,0x61,0xa6,0xd5,0xfd,0xa8,0x85,0xf8,0xc0,0xa9,0xff,0x52,0xc2,0xe1,0xc1,0x22,0x40,0x1b,0x77,0xa7,0x2f,0x3a,0x51,0x86,0xd9,0x7d,0xd8,0x08,0xcf,0xd4,0xf9,0x71,0x9b,0xac,0xf5,0xb3,0x83,0xa2,0x1e,0x1b,0xc3,0x6b,0xd0,0x76,0x1a,0x97,0x19,0x92,0x18,0x1a,0x33},+	{0xc6,0x80,0x4f,0xfb,0x45,0x6f,0x16,0xf5,0xcf,0x75,0xc7,0x61,0xde,0xc7,0x36,0x9c,0x1c,0xd9,0x41,0x90,0x1b,0xe8,0xd4,0xe3,0x21,0xfe,0xbd,0x83,0x6b,0x7c,0x16,0x31,0xaf,0x72,0x75,0x9d,0x3a,0x2f,0x51,0x26,0x9e,0x4a,0x07,0x68,0x88,0xe2,0xcb,0x5b,0xc4,0xf7,0x80,0x11,0xc1,0xc1,0xed,0x84,0x7b,0xa6,0x49,0xf6,0x9f,0x61,0xc9,0x1a,0x68,0x10,0x4b,0x52,0x42,0x38,0x2b,0xf2,0x87,0xe9,0x9c,0xee,0x3b,0x34,0x68,0x50,0xc8,0x50,0x62,0x4a,0x84,0x71,0x9d,0xfc,0x11,0xb1,0x08,0x1f,0x34,0x36,0x24,0x61},+	{0x8d,0x89,0x4e,0x87,0xdb,0x41,0x9d,0xd9,0x20,0xdc,0x07,0x6c,0xf1,0xa5,0xfe,0x09,0xbc,0x9b,0x0f,0xd0,0x67,0x2c,0x3d,0x79,0x40,0xff,0x5e,0x9e,0x30,0xe2,0xeb,0x46,0x38,0x26,0x2d,0x1a,0xe3,0x49,0x63,0x8b,0x35,0xfd,0xd3,0x9b,0x00,0xb7,0xdf,0x9d,0xa4,0x6b,0xa0,0xa3,0xb8,0xf1,0x8b,0x7f,0x45,0x04,0xd9,0x78,0x31,0xaa,0x22,0x15,0x38,0x49,0x61,0x69,0x53,0x2f,0x38,0x2c,0x10,0x6d,0x2d,0xb7,0x9a,0x40,0xfe,0xda,0x27,0xf2,0x46,0xb6,0x91,0x33,0xc8,0xe8,0x6c,0x30,0x24,0x05,0xf5,0x70,0xfe,0x45},+	{0x8c,0x0b,0x0c,0x96,0xa6,0x75,0x48,0xda,0x20,0x2f,0x0e,0xef,0x76,0xd0,0x68,0x5b,0xd4,0x8f,0x0b,0x3d,0xcf,0x51,0xfb,0x07,0xd4,0x92,0xe3,0xa0,0x23,0x16,0x8d,0x42,0x91,0x14,0x95,0xc8,0x20,0x49,0xf2,0x62,0xa2,0x0c,0x63,0x3f,0xc8,0x07,0xf0,0x05,0xb8,0xd4,0xc9,0xf5,0xd2,0x45,0xbb,0x6f,0x45,0x22,0x7a,0xb5,0x6d,0x9f,0x61,0x16,0xfd,0x08,0xa3,0x01,0x44,0x4a,0x4f,0x08,0xac,0xca,0xa5,0x76,0xc3,0x19,0x22,0xa8,0x7d,0xbc,0xd1,0x43,0x46,0xde,0xb8,0xde,0xc6,0x38,0xbd,0x60,0x2d,0x59,0x81,0x1d},+	{0x5f,0xac,0x0d,0xa6,0x56,0x87,0x36,0x61,0x57,0xdc,0xab,0xeb,0x6a,0x2f,0xe0,0x17,0x7d,0x0f,0xce,0x4c,0x2d,0x3f,0x19,0x7f,0xf0,0xdc,0xec,0x89,0x77,0x4a,0x23,0x20,0xe8,0xc5,0x85,0x7b,0x9f,0xb6,0x65,0x87,0xb2,0xba,0x68,0xd1,0x8b,0x67,0xf0,0x6f,0x9b,0x0f,0x33,0x1d,0x7c,0xe7,0x70,0x3a,0x7c,0x8e,0xaf,0xb0,0x51,0x6d,0x5f,0x3a,0x52,0xb2,0x78,0x71,0xb6,0x0d,0xd2,0x76,0x60,0xd1,0x1e,0xd5,0xf9,0x34,0x1c,0x07,0x70,0x11,0xe4,0xb3,0x20,0x4a,0x2a,0xf6,0x66,0xe3,0xff,0x3c,0x35,0x82,0xd6,0x7c},+	{0xb6,0xfa,0x87,0xd8,0x5b,0xa4,0xe1,0x0b,0x6e,0x3b,0x40,0xba,0x32,0x6a,0x84,0x2a,0x00,0x60,0x6e,0xe9,0x12,0x10,0x92,0xd9,0x43,0x09,0xdc,0x3b,0x86,0xc8,0x38,0x28,0xf3,0xf4,0xac,0x68,0x60,0xcd,0x65,0xa6,0xd3,0xe3,0xd7,0x3c,0x18,0x2d,0xd9,0x42,0xd9,0x25,0x60,0x33,0x9d,0x38,0x59,0x57,0xff,0xd8,0x2c,0x2b,0x3b,0x25,0xf0,0x3e,0x30,0x50,0x46,0x4a,0xcf,0xb0,0x6b,0xd1,0xab,0x77,0xc5,0x15,0x41,0x6b,0x49,0xfa,0x9d,0x41,0xab,0xf4,0x8a,0xae,0xcf,0x82,0x12,0x28,0xa8,0x06,0xa6,0xb8,0xdc,0x21},+	{0xc8,0x9f,0x9d,0x8c,0x46,0x04,0x60,0x5c,0xcb,0xa3,0x2a,0xd4,0x6e,0x09,0x40,0x25,0x9c,0x2f,0xee,0x12,0x4c,0x4d,0x5b,0x12,0xab,0x1d,0xa3,0x94,0x81,0xd0,0xc3,0x0b,0xba,0x31,0x77,0xbe,0xfa,0x00,0x8d,0x9a,0x89,0x18,0x9e,0x62,0x7e,0x60,0x03,0x82,0x7f,0xd9,0xf3,0x43,0x37,0x02,0xcc,0xb2,0x8b,0x67,0x6f,0x6c,0xbf,0x0d,0x84,0x5d,0x8b,0xe1,0x9f,0x30,0x0d,0x38,0x6e,0x70,0xc7,0x65,0xe1,0xb9,0xa6,0x2d,0xb0,0x6e,0xab,0x20,0xae,0x7d,0x99,0xba,0xbb,0x57,0xdd,0x96,0xc1,0x2a,0x23,0x76,0x42,0x3a},+	{0xfa,0x84,0x70,0x8a,0x2c,0x43,0x42,0x4b,0x45,0xe5,0xb9,0xdf,0xe3,0x19,0x8a,0x89,0x5d,0xe4,0x58,0x9c,0x21,0x00,0x9f,0xbe,0xd1,0xeb,0x6d,0xa1,0xce,0x77,0xf1,0x1f,0xcb,0x7e,0x44,0xdb,0x72,0xc1,0xf8,0x3b,0xbd,0x2d,0x28,0xc6,0x1f,0xc4,0xcf,0x5f,0xfe,0x15,0xaa,0x75,0xc0,0xff,0xac,0x80,0xf9,0xa9,0xe1,0x24,0xe8,0xc9,0x70,0x07,0xfd,0xb5,0xb5,0x45,0x9a,0xd9,0x61,0xcf,0x24,0x79,0x3a,0x1b,0xe9,0x84,0x09,0x86,0x89,0x3e,0x3e,0x30,0x19,0x09,0x30,0xe7,0x1e,0x0b,0x50,0x41,0xfd,0x64,0xf2,0x39},+	{0x9c,0xe2,0xe7,0xdb,0x17,0x34,0xad,0xa7,0x9c,0x13,0x9c,0x2b,0x6a,0x37,0x94,0xbd,0xa9,0x7b,0x59,0x93,0x8e,0x1b,0xe9,0xa0,0x40,0x98,0x88,0x68,0x34,0xd7,0x12,0x17,0xe1,0x7b,0x09,0xfe,0xab,0x4a,0x9b,0xd1,0x29,0x19,0xe0,0xdf,0xe1,0xfc,0x6d,0xa4,0xff,0xf1,0xa6,0x2c,0x94,0x08,0xc9,0xc3,0x4e,0xf1,0x35,0x2c,0x27,0x21,0xc6,0x65,0xdd,0x93,0x31,0xce,0xf8,0x89,0x2b,0xe7,0xbb,0xc0,0x25,0xa1,0x56,0x33,0x10,0x4d,0x83,0xfe,0x1c,0x2e,0x3d,0xa9,0x19,0x04,0x72,0xe2,0x9c,0xb1,0x0a,0x80,0xf9,0x22},+	{0xcb,0xf8,0x9e,0x3e,0x8a,0x36,0x5a,0x60,0x15,0x47,0x50,0xa5,0x22,0xc0,0xe9,0xe3,0x8f,0x24,0x24,0x5f,0xb0,0x48,0x3d,0x55,0xe5,0x26,0x76,0x64,0xcd,0x16,0xf4,0x13,0xac,0xfd,0x6e,0x9a,0xdd,0x9f,0x02,0x42,0x41,0x49,0xa5,0x34,0xbe,0xce,0x12,0xb9,0x7b,0xf3,0xbd,0x87,0xb9,0x64,0x0f,0x64,0xb4,0xca,0x98,0x85,0xd3,0xa4,0x71,0x41,0x8c,0x4c,0xc9,0x99,0xaa,0x58,0x27,0xfa,0x07,0xb8,0x00,0xb0,0x6f,0x6f,0x00,0x23,0x92,0x53,0xda,0xad,0xdd,0x91,0xd2,0xfb,0xab,0xd1,0x4b,0x57,0xfa,0x14,0x82,0x50},+	{0x4b,0xfe,0xd6,0x3e,0x15,0x69,0x02,0xc2,0xc4,0x77,0x1d,0x51,0x39,0x67,0x5a,0xa6,0x94,0xaf,0x14,0x2c,0x46,0x26,0xde,0xcb,0x4b,0xa7,0xab,0x6f,0xec,0x60,0xf9,0x22,0xd6,0x03,0xd0,0x53,0xbb,0x15,0x1a,0x46,0x65,0xc9,0xf3,0xbc,0x88,0x28,0x10,0xb2,0x5a,0x3a,0x68,0x6c,0x75,0x76,0xc5,0x27,0x47,0xb4,0x6c,0xc8,0xa4,0x58,0x77,0x3a,0x76,0x50,0xae,0x93,0xf6,0x11,0x81,0x54,0xa6,0x54,0xfd,0x1d,0xdf,0x21,0xae,0x1d,0x65,0x5e,0x11,0xf3,0x90,0x8c,0x24,0x12,0x94,0xf4,0xe7,0x8d,0x5f,0xd1,0x9f,0x5d},+	{0x7f,0x72,0x63,0x6d,0xd3,0x08,0x14,0x03,0x33,0xb5,0xc7,0xd7,0xef,0x9a,0x37,0x6a,0x4b,0xe2,0xae,0xcc,0xc5,0x8f,0xe1,0xa9,0xd3,0xbe,0x8f,0x4f,0x91,0x35,0x2f,0x33,0x1e,0x52,0xd7,0xee,0x2a,0x4d,0x24,0x3f,0x15,0x96,0x2e,0x43,0x28,0x90,0x3a,0x8e,0xd4,0x16,0x9c,0x2e,0x77,0xba,0x64,0xe1,0xd8,0x98,0xeb,0x47,0xfa,0x87,0xc1,0x3b,0x0c,0xc2,0x86,0xea,0x15,0x01,0x47,0x6d,0x25,0xd1,0x46,0x6c,0xcb,0xb7,0x8a,0x99,0x88,0x01,0x66,0x3a,0xb5,0x32,0x78,0xd7,0x03,0xba,0x6f,0x90,0xce,0x81,0x0d,0x45},+	{0x75,0x52,0x20,0xa6,0xa1,0xb6,0x7b,0x6e,0x83,0x8e,0x3c,0x41,0xd7,0x21,0x4f,0xaa,0xb2,0x5c,0x8f,0xe8,0x55,0xd1,0x56,0x6f,0xe1,0x5b,0x34,0xa6,0x4b,0x5d,0xe2,0x2d,0x3f,0x74,0xae,0x1c,0x96,0xd8,0x74,0xd0,0xed,0x63,0x1c,0xee,0xf5,0x18,0x6d,0xf8,0x29,0xed,0xf4,0xe7,0x5b,0xc5,0xbd,0x97,0x08,0xb1,0x3a,0x66,0x79,0xd2,0xba,0x4c,0xcd,0x1f,0xd7,0xa0,0x24,0x90,0xd1,0x80,0xf8,0x8a,0x28,0xfb,0x0a,0xc2,0x25,0xc5,0x19,0x64,0x3a,0x5f,0x4b,0x97,0xa3,0xb1,0x33,0x72,0x00,0xe2,0xef,0xbc,0x7f,0x7d},+	{0x01,0x28,0x6b,0x26,0x6a,0x1e,0xef,0xfa,0x16,0x9f,0x73,0xd5,0xc4,0x68,0x6c,0x86,0x2c,0x76,0x03,0x1b,0xbc,0x2f,0x8a,0xf6,0x8d,0x5a,0xb7,0x87,0x5e,0x43,0x75,0x59,0x94,0x90,0xc2,0xf3,0xc5,0x5d,0x7c,0xcd,0xab,0x05,0x91,0x2a,0x9a,0xa2,0x81,0xc7,0x58,0x30,0x1c,0x42,0x36,0x1d,0xc6,0x80,0xd7,0xd4,0xd8,0xdc,0x96,0xd1,0x9c,0x4f,0x68,0x37,0x7b,0x6a,0xd8,0x97,0x92,0x19,0x63,0x7a,0xd1,0x1a,0x24,0x58,0xd0,0xd0,0x17,0x0c,0x1c,0x5c,0xad,0x9c,0x02,0xba,0x07,0x03,0x7a,0x38,0x84,0xd0,0xcd,0x7c},+	{0x17,0x04,0x26,0x6d,0x2c,0x42,0xa6,0xdc,0xbd,0x40,0x82,0x94,0x50,0x3d,0x15,0xae,0x77,0xc6,0x68,0xfb,0xb4,0xc1,0xc0,0xa9,0x53,0xcf,0xd0,0x61,0xed,0xd0,0x8b,0x42,0x93,0xcc,0x60,0x67,0x18,0x84,0x0c,0x9b,0x99,0x2a,0xb3,0x1a,0x7a,0x00,0xae,0xcd,0x18,0xda,0x0b,0x62,0x86,0xec,0x8d,0xa8,0x44,0xca,0x90,0x81,0x84,0xca,0x93,0x35,0xa7,0x9a,0x84,0x5e,0x9a,0x18,0x13,0x92,0xcd,0xfa,0xd8,0x65,0x35,0xc3,0xd8,0xd4,0xd1,0xbb,0xfd,0x53,0x5b,0x54,0x52,0x8c,0xe6,0x63,0x2d,0xda,0x08,0x83,0x39,0x27},+	{0x13,0xd4,0x5e,0x43,0x28,0x8d,0xc3,0x42,0xc9,0xcc,0x78,0x32,0x60,0xf3,0x50,0xbd,0xef,0x03,0xda,0x79,0x1a,0xab,0x07,0xbb,0x55,0x33,0x8c,0xbe,0xae,0x97,0x95,0x26,0x53,0x24,0x70,0x0a,0x4c,0x0e,0xa1,0xb9,0xde,0x1b,0x7d,0xd5,0x66,0x58,0xa2,0x0f,0xf7,0xda,0x27,0xcd,0xb5,0xd9,0xb9,0xff,0xfd,0x33,0x2c,0x49,0x45,0x29,0x2c,0x57,0xbe,0x30,0xcd,0xd6,0x45,0xc7,0x7f,0xc7,0xfb,0xae,0xba,0xe3,0xd3,0xe8,0xdf,0xe4,0x0c,0xda,0x5d,0xaa,0x30,0x88,0x2c,0xa2,0x80,0xca,0x5b,0xc0,0x98,0x54,0x98,0x7f},+	{0x17,0xe1,0x0b,0x9f,0x88,0xce,0x49,0x38,0x88,0xa2,0x54,0x7b,0x1b,0xad,0x05,0x80,0x1c,0x92,0xfc,0x23,0x9f,0xc3,0xa3,0x3d,0x04,0xf3,0x31,0x0a,0x47,0xec,0xc2,0x76,0x63,0x63,0xbf,0x0f,0x52,0x15,0x56,0xd3,0xa6,0xfb,0x4d,0xcf,0x45,0x5a,0x04,0x08,0xc2,0xa0,0x3f,0x87,0xbc,0x4f,0xc2,0xee,0xe7,0x12,0x9b,0xd6,0x3c,0x65,0xf2,0x30,0x85,0x0c,0xc1,0xaa,0x38,0xc9,0x08,0x8a,0xcb,0x6b,0x27,0xdb,0x60,0x9b,0x17,0x46,0x70,0xac,0x6f,0x0e,0x1e,0xc0,0x20,0xa9,0xda,0x73,0x64,0x59,0xf1,0x73,0x12,0x2f},+	{0x11,0x1e,0xe0,0x8a,0x7c,0xfc,0x39,0x47,0x9f,0xab,0x6a,0x4a,0x90,0x74,0x52,0xfd,0x2e,0x8f,0x72,0x87,0x82,0x8a,0xd9,0x41,0xf2,0x69,0x5b,0xd8,0x2a,0x57,0x9e,0x5d,0xc0,0x0b,0xa7,0x55,0xd7,0x8b,0x48,0x30,0xe7,0x42,0xd4,0xf1,0xa4,0xb5,0xd6,0x06,0x62,0x61,0x59,0xbc,0x9e,0xa6,0xd1,0xea,0x84,0xf7,0xc5,0xed,0x97,0x19,0xac,0x38,0x3b,0xb1,0x51,0xa7,0x17,0xb5,0x66,0x06,0x8c,0x85,0x9b,0x7e,0x86,0x06,0x7d,0x74,0x49,0xde,0x4d,0x45,0x11,0xc0,0xac,0xac,0x9c,0xe6,0xe9,0xbf,0x9c,0xcd,0xdf,0x22},+	{0xd9,0x0c,0x0d,0xc3,0xe0,0xd2,0xdb,0x8d,0x33,0x43,0xbb,0xac,0x5f,0x66,0x8e,0xad,0x1f,0x96,0x2a,0x32,0x8c,0x25,0x6b,0x8f,0xc7,0xc1,0x48,0x54,0xc0,0x16,0x29,0x6b,0xa1,0xe0,0x3b,0x10,0xb4,0x59,0xec,0x56,0x69,0xf9,0x59,0xd2,0xec,0xba,0xe3,0x2e,0x32,0xcd,0xf5,0x13,0x94,0xb2,0x7c,0x79,0x72,0xe4,0xcd,0x24,0x78,0x87,0xe9,0x0f,0x3b,0x91,0xba,0x0a,0xd1,0x34,0xdb,0x7e,0x0e,0xac,0x6d,0x2e,0x82,0xcd,0xa3,0x4e,0x15,0xf8,0x78,0x65,0xff,0x3d,0x08,0x66,0x17,0x0a,0xf0,0x7f,0x30,0x3f,0x30,0x4c},+	{0x85,0x8c,0xb2,0x17,0xd6,0x3b,0x0a,0xd3,0xea,0x3b,0x77,0x39,0xb7,0x77,0xd3,0xc5,0xbf,0x5c,0x6a,0x1e,0x8c,0xe7,0xc6,0xc6,0xc4,0xb7,0x2a,0x8b,0xf7,0xb8,0x61,0x0d,0x00,0x45,0xd9,0x0d,0x58,0x03,0xfc,0x29,0x93,0xec,0xbb,0x6f,0xa4,0x7a,0xd2,0xec,0xf8,0xa7,0xe2,0xc2,0x5f,0x15,0x0a,0x13,0xd5,0xa1,0x06,0xb7,0x1a,0x15,0x6b,0x41,0xb0,0x36,0xc1,0xe9,0xef,0xd7,0xa8,0x56,0x20,0x4b,0xe4,0x58,0xcd,0xe5,0x07,0xbd,0xab,0xe0,0x57,0x1b,0xda,0x2f,0xe6,0xaf,0xd2,0xe8,0x77,0x42,0xf7,0x2a,0x1a,0x19},+	{0x31,0x14,0x3c,0xc5,0x4b,0xf7,0x16,0xce,0xde,0xed,0x72,0x20,0xce,0x25,0x97,0x2b,0xe7,0x3e,0xb2,0xb5,0x6f,0xc3,0xb9,0xb8,0x08,0xc9,0x5c,0x0b,0x45,0x0e,0x2e,0x7e,0xfb,0x0e,0x46,0x4f,0x43,0x2b,0xe6,0x9f,0xd6,0x07,0x36,0xa6,0xd4,0x03,0xd3,0xde,0x24,0xda,0xa0,0xb7,0x0e,0x21,0x52,0xf0,0x93,0x5b,0x54,0x00,0xbe,0x7d,0x7e,0x23,0x30,0xb4,0x01,0x67,0xed,0x75,0x35,0x01,0x10,0xfd,0x0b,0x9f,0xe6,0x94,0x10,0x23,0x22,0x7f,0xe4,0x83,0x15,0x0f,0x32,0x75,0xe3,0x55,0x11,0xb1,0x99,0xa6,0xaf,0x71},+	{0x1d,0xb6,0x53,0x39,0x9b,0x6f,0xce,0x65,0xe6,0x41,0xa1,0xaf,0xea,0x39,0x58,0xc6,0xfe,0x59,0xf7,0xa9,0xfd,0x5f,0x43,0x0f,0x8e,0xc2,0xb1,0xc2,0xe9,0x42,0x11,0x02,0xd6,0x50,0x3b,0x47,0x1c,0x3c,0x42,0xea,0x10,0xef,0x38,0x3b,0x1f,0x7a,0xe8,0x51,0x95,0xbe,0xc9,0xb2,0x5f,0xbf,0x84,0x9b,0x1c,0x9a,0xf8,0x78,0xbc,0x1f,0x73,0x00,0x80,0x18,0xf8,0x48,0x18,0xc7,0x30,0xe4,0x19,0xc1,0xce,0x5e,0x22,0x0c,0x96,0xbf,0xe3,0x15,0xba,0x6b,0x83,0xe0,0xda,0xb6,0x08,0x58,0xe1,0x47,0x33,0x6f,0x4d,0x4c},+	{0xc9,0x1f,0x7d,0xc1,0xcf,0xec,0xf7,0x18,0x14,0x3c,0x40,0x51,0xa6,0xf5,0x75,0x6c,0xdf,0x0c,0xee,0xf7,0x2b,0x71,0xde,0xdb,0x22,0x7a,0xe4,0xa7,0xaa,0xdd,0x3f,0x19,0x70,0x19,0x8f,0x98,0xfc,0xdd,0x0c,0x2f,0x1b,0xf5,0xb9,0xb0,0x27,0x62,0x91,0x6b,0xbe,0x76,0x91,0x77,0xc4,0xb6,0xc7,0x6e,0xa8,0x9f,0x8f,0xa8,0x00,0x95,0xbf,0x38,0x6f,0x87,0xe8,0x37,0x3c,0xc9,0xd2,0x1f,0x2c,0x46,0xd1,0x18,0x5a,0x1e,0xf6,0xa2,0x76,0x12,0x24,0x39,0x82,0xf5,0x80,0x50,0x69,0x49,0x0d,0xbf,0x9e,0xb9,0x6f,0x6a},+	{0xeb,0x55,0x08,0x56,0xbb,0xc1,0x46,0x6a,0x9d,0xf0,0x93,0xf8,0x38,0xbb,0x16,0x24,0xc1,0xac,0x71,0x8f,0x37,0x11,0x1d,0xd7,0xea,0x96,0x18,0xa3,0x14,0x69,0xf7,0x75,0xc6,0x23,0xe4,0xb6,0xb5,0x22,0xb1,0xee,0x8e,0xff,0x86,0xf2,0x10,0x70,0x9d,0x93,0x8c,0x5d,0xcf,0x1d,0x83,0x2a,0xa9,0x90,0x10,0xeb,0xc5,0x42,0x9f,0xda,0x6f,0x13,0xd1,0xbd,0x05,0xa3,0xb1,0xdf,0x4c,0xf9,0x08,0x2c,0xf8,0x9f,0x9d,0x4b,0x36,0x0f,0x8a,0x58,0xbb,0xc3,0xa5,0xd8,0x87,0x2a,0xba,0xdc,0xe8,0x0b,0x51,0x83,0x21,0x02},+	{0x14,0x2d,0xad,0x5e,0x38,0x66,0xf7,0x4a,0x30,0x58,0x7c,0xca,0x80,0xd8,0x8e,0xa0,0x3d,0x1e,0x21,0x10,0xe6,0xa6,0x13,0x0d,0x03,0x6c,0x80,0x7b,0xe1,0x1c,0x07,0x6a,0x7f,0x7a,0x30,0x43,0x01,0x71,0x5a,0x9d,0x5f,0xa4,0x7d,0xc4,0x9e,0xde,0x63,0xb0,0xd3,0x7a,0x92,0xbe,0x52,0xfe,0xbb,0x22,0x6c,0x42,0x40,0xfd,0x41,0xc4,0x87,0x13,0xf8,0x8a,0x97,0x87,0xd1,0xc3,0xd3,0xb5,0x13,0x44,0x0e,0x7f,0x3d,0x5a,0x2b,0x72,0xa0,0x7c,0x47,0xbb,0x48,0x48,0x7b,0x0d,0x92,0xdc,0x1e,0xaf,0x6a,0xb2,0x71,0x31},+	{0xa8,0x4c,0x56,0x97,0x90,0x31,0x2f,0xa9,0x19,0xe1,0x75,0x22,0x4c,0xb8,0x7b,0xff,0x50,0x51,0x87,0xa4,0x37,0xfe,0x55,0x4f,0x5a,0x83,0xf0,0x3c,0x87,0xd4,0x1f,0x22,0xd1,0x47,0x8a,0xb2,0xd8,0xb7,0x0d,0xa6,0xf1,0xa4,0x70,0x17,0xd6,0x14,0xbf,0xa6,0x58,0xbd,0xdd,0x53,0x93,0xf8,0xa1,0xd4,0xe9,0x43,0x42,0x34,0x63,0x4a,0x51,0x6c,0x41,0x63,0x15,0x3a,0x4f,0x20,0x22,0x23,0x2d,0x03,0x0a,0xba,0xe9,0xe0,0x73,0xfb,0x0e,0x03,0x0f,0x41,0x4c,0xdd,0xe0,0xfc,0xaa,0x4a,0x92,0xfb,0x96,0xa5,0xda,0x48},+	{0xc7,0x9c,0xa5,0x5c,0x66,0x8e,0xca,0x6e,0xa0,0xac,0x38,0x2e,0x4b,0x25,0x47,0xa8,0xce,0x17,0x1e,0xd2,0x08,0xc7,0xaf,0x31,0xf7,0x4a,0xd8,0xca,0xfc,0xd6,0x6d,0x67,0x93,0x97,0x4c,0xc8,0x5d,0x1d,0xf6,0x14,0x06,0x82,0x41,0xef,0xe3,0xf9,0x41,0x99,0xac,0x77,0x62,0x34,0x8f,0xb8,0xf5,0xcd,0xa9,0x79,0x8a,0x0e,0xfa,0x37,0xc8,0x58,0x58,0x90,0xfc,0x96,0x85,0x68,0xf9,0x0c,0x1b,0xa0,0x56,0x7b,0xf3,0xbb,0xdc,0x1d,0x6a,0xd6,0x35,0x49,0x7d,0xe7,0xc2,0xdc,0x0a,0x7f,0xa5,0xc6,0xf2,0x73,0x4f,0x1c},+	{0xbb,0xa0,0x5f,0x30,0xbd,0x4f,0x7a,0x0e,0xad,0x63,0xc6,0x54,0xe0,0x4c,0x9d,0x82,0x48,0x38,0xe3,0x2f,0x83,0xc3,0x21,0xf4,0x42,0x4c,0xf6,0x1b,0x0d,0xc8,0x5a,0x79,0x84,0x34,0x7c,0xfc,0x6e,0x70,0x6e,0xb3,0x61,0xcf,0xc1,0xc3,0xb4,0xc9,0xdf,0x73,0xe5,0xc7,0x1c,0x78,0xc9,0x79,0x1d,0xeb,0x5c,0x67,0xaf,0x7d,0xdb,0x9a,0x45,0x70,0xb3,0x2b,0xb4,0x91,0x49,0xdb,0x91,0x1b,0xca,0xdc,0x02,0x4b,0x23,0x96,0x26,0x57,0xdc,0x78,0x8c,0x1f,0xe5,0x9e,0xdf,0x9f,0xd3,0x1f,0xe2,0x8c,0x84,0x62,0xe1,0x5f},+	{0x1a,0x96,0x94,0xe1,0x4f,0x21,0x59,0x4e,0x4f,0xcd,0x71,0x0d,0xc7,0x7d,0xbe,0x49,0x2d,0xf2,0x50,0x3b,0xd2,0xcf,0x00,0x93,0x32,0x72,0x91,0xfc,0x46,0xd4,0x89,0x47,0x08,0xb2,0x7c,0x5d,0x2d,0x85,0x79,0x28,0xe7,0xf2,0x7d,0x68,0x70,0xdd,0xde,0xb8,0x91,0x78,0x68,0x21,0xab,0xff,0x0b,0xdc,0x35,0xaa,0x7d,0x67,0x43,0xc0,0x44,0x2b,0x8e,0xb7,0x4e,0x07,0xab,0x87,0x1c,0x1a,0x67,0xf4,0xda,0x99,0x8e,0xd1,0xc6,0xfa,0x67,0x90,0x4f,0x48,0xcd,0xbb,0xac,0x3e,0xe4,0xa4,0xb9,0x2b,0xef,0x2e,0xc5,0x60},+	{0xf1,0x8b,0xfd,0x3b,0xbc,0x89,0x5d,0x0b,0x1a,0x55,0xf3,0xc9,0x37,0x92,0x6b,0xb0,0xf5,0x28,0x30,0xd5,0xb0,0x16,0x4c,0x0e,0xab,0xca,0xcf,0x2c,0x31,0x9c,0xbc,0x10,0x11,0x6d,0xae,0x7c,0xc2,0xc5,0x2b,0x70,0xab,0x8c,0xa4,0x54,0x9b,0x69,0xc7,0x44,0xb2,0x2e,0x49,0xba,0x56,0x40,0xbc,0xef,0x6d,0x67,0xb6,0xd9,0x48,0x72,0xd7,0x70,0x5b,0xa0,0xc2,0x3e,0x4b,0xe8,0x8a,0xaa,0xe0,0x81,0x17,0xed,0xf4,0x9e,0x69,0x98,0xd1,0x85,0x8e,0x70,0xe4,0x13,0x45,0x79,0x13,0xf4,0x76,0xa9,0xd3,0x5b,0x75,0x63},+	{0x53,0x08,0xd1,0x2a,0x3e,0xa0,0x5f,0xb5,0x69,0x35,0xe6,0x9e,0x90,0x75,0x6f,0x35,0x90,0xb8,0x69,0xbe,0xfd,0xf1,0xf9,0x9f,0x84,0x6f,0xc1,0x8b,0xc4,0xc1,0x8c,0x0d,0xb7,0xac,0xf1,0x97,0x18,0x10,0xc7,0x3d,0xd8,0xbb,0x65,0xc1,0x5e,0x7d,0xda,0x5d,0x0f,0x02,0xa1,0x0f,0x9c,0x5b,0x8e,0x50,0x56,0x2a,0xc5,0x37,0x17,0x75,0x63,0x27,0xa9,0x19,0xb4,0x6e,0xd3,0x02,0x94,0x02,0xa5,0x60,0xb4,0x77,0x7e,0x4e,0xb4,0xf0,0x56,0x49,0x3c,0xd4,0x30,0x62,0xa8,0xcf,0xe7,0x66,0xd1,0x7a,0x8a,0xdd,0xc2,0x70},+	{0x0e,0xec,0x6f,0x9f,0x50,0x94,0x61,0x65,0x8d,0x51,0xc6,0x46,0xa9,0x7e,0x2e,0xee,0x5c,0x9b,0xe0,0x67,0xf3,0xc1,0x33,0x97,0x95,0x84,0x94,0x63,0x63,0xac,0x0f,0x2e,0x13,0x7e,0xed,0xb8,0x7d,0x96,0xd4,0x91,0x7a,0x81,0x76,0xd7,0x0a,0x2f,0x25,0x74,0x64,0x25,0x85,0x0d,0xe0,0x82,0x09,0xe4,0xe5,0x3c,0xa5,0x16,0x38,0x61,0xb8,0x32,0x64,0xcd,0x48,0xe4,0xbe,0xf7,0xe7,0x79,0xd0,0x86,0x78,0x08,0x67,0x3a,0xc8,0x6a,0x2e,0xdb,0xe4,0xa0,0xd9,0xd4,0x9f,0xf8,0x41,0x4f,0x5a,0x73,0x5c,0x21,0x79,0x41},+	{0x2a,0xed,0xdc,0xd7,0xe7,0x94,0x70,0x8c,0x70,0x9c,0xd3,0x47,0xc3,0x8a,0xfb,0x97,0x02,0xd9,0x06,0xa9,0x33,0xe0,0x3b,0xe1,0x76,0x9d,0xd9,0x0c,0xa3,0x44,0x03,0x70,0x34,0xcd,0x6b,0x28,0xb9,0x33,0xae,0xe4,0xdc,0xd6,0x9d,0x55,0xb6,0x7e,0xef,0xb7,0x1f,0x8e,0xd3,0xb3,0x1f,0x14,0x8b,0x27,0x86,0xc2,0x41,0x22,0x66,0x85,0xfa,0x31,0xf4,0x22,0x36,0x2e,0x42,0x6c,0x82,0xaf,0x2d,0x50,0x33,0x98,0x87,0x29,0x20,0xc1,0x23,0x91,0x38,0x2b,0xe1,0xb7,0xc1,0x9b,0x89,0x24,0x95,0xa9,0x12,0x23,0xbb,0x24},+	{0xc3,0x67,0xde,0x32,0x17,0xed,0xa8,0xb1,0x48,0x49,0x1b,0x46,0x18,0x94,0xb4,0x3c,0xd2,0xbc,0xcf,0x76,0x43,0x43,0xbd,0x8e,0x08,0x80,0x18,0x1e,0x87,0x3e,0xee,0x0f,0x6b,0x5c,0xf8,0xf5,0x2a,0x0c,0xf8,0x41,0x94,0x67,0xfa,0x04,0xc3,0x84,0x72,0x68,0xad,0x1b,0xba,0xa3,0x99,0xdf,0x45,0x89,0x16,0x5d,0xeb,0xff,0xf9,0x2a,0x1d,0x0d,0xdf,0x1e,0x62,0x32,0xa1,0x8a,0xda,0xa9,0x79,0x65,0x22,0x59,0xa1,0x22,0xb8,0x30,0x93,0xc1,0x9a,0xa7,0x7b,0x19,0x04,0x40,0x76,0x1d,0x53,0x18,0x97,0xd7,0xac,0x16},+	{0x3d,0x1d,0x9b,0x2d,0xaf,0x72,0xdf,0x72,0x5a,0x24,0x32,0xa4,0x36,0x2a,0x46,0x63,0x37,0x96,0xb3,0x16,0x79,0xa0,0xce,0x3e,0x09,0x23,0x30,0xb9,0xf6,0x0e,0x3e,0x12,0xad,0xb6,0x87,0x78,0xc5,0xc6,0x59,0xc9,0xba,0xfe,0x90,0x5f,0xad,0x9e,0xe1,0x94,0x04,0xf5,0x42,0xa3,0x62,0x4e,0xe2,0x16,0x00,0x17,0x16,0x18,0x4b,0xd3,0x4e,0x16,0x9a,0xe6,0x2f,0x19,0x4c,0xd9,0x7e,0x48,0x13,0x15,0x91,0x3a,0xea,0x2c,0xae,0x61,0x27,0xde,0xa4,0xb9,0xd3,0xf6,0x7b,0x87,0xeb,0xf3,0x73,0x10,0xc6,0x0f,0xda,0x78},+	{0x6a,0xc6,0x2b,0xe5,0x28,0x5d,0xf1,0x5b,0x8e,0x1a,0xf0,0x70,0x18,0xe3,0x47,0x2c,0xdd,0x8b,0xc2,0x06,0xbc,0xaf,0x19,0x24,0x3a,0x17,0x6b,0x25,0xeb,0xde,0x25,0x2d,0x94,0x3a,0x0c,0x68,0xf1,0x80,0x9f,0xa2,0xe6,0xe7,0xe9,0x1a,0x15,0x7e,0xf7,0x71,0x73,0x79,0x01,0x48,0x58,0xf1,0x00,0x11,0xdd,0x8d,0xb3,0x16,0xb3,0xa4,0x4a,0x05,0xb8,0x7c,0x26,0x19,0x8d,0x46,0xc8,0xdf,0xaf,0x4d,0xe5,0x66,0x9c,0x78,0x28,0x0b,0x17,0xec,0x6e,0x66,0x2a,0x1d,0xeb,0x2a,0x60,0xa7,0x7d,0xab,0xa6,0x10,0x46,0x13},+	{0xfe,0xb0,0xf6,0x8d,0xc7,0x8e,0x13,0x51,0x1b,0xf5,0x75,0xe5,0x89,0xda,0x97,0x53,0xb9,0xf1,0x7a,0x71,0x1d,0x7a,0x20,0x09,0x50,0xd6,0x20,0x2b,0xba,0xfd,0x02,0x21,0x15,0xf5,0xd1,0x77,0xe7,0x65,0x2a,0xcd,0xf1,0x60,0xaa,0x8f,0x87,0x91,0x89,0x54,0xe5,0x06,0xbc,0xda,0xbc,0x3b,0xb7,0xb1,0xfb,0xc9,0x7c,0xa9,0xcb,0x78,0x48,0x65,0xa1,0xe6,0x5c,0x05,0x05,0xe4,0x9e,0x96,0x29,0xad,0x51,0x12,0x68,0xa7,0xbc,0x36,0x15,0xa4,0x7d,0xaa,0x17,0xf5,0x1a,0x3a,0xba,0xb2,0xec,0x29,0xdb,0x25,0xd7,0x0a},+	{0x57,0x24,0x4e,0x83,0xb1,0x67,0x42,0xdc,0xc5,0x1b,0xce,0x70,0xb5,0x44,0x75,0xb6,0xd7,0x5e,0xd1,0xf7,0x0b,0x7a,0xf0,0x1a,0x50,0x36,0xa0,0x71,0xfb,0xcf,0xef,0x4a,0x85,0x6f,0x05,0x9b,0x0c,0xbc,0xc7,0xfe,0xd7,0xff,0xf5,0xe7,0x68,0x52,0x7d,0x53,0xfa,0xae,0x12,0x43,0x62,0xc6,0xaf,0x77,0xd9,0x9f,0x39,0x02,0x53,0x5f,0x67,0x4f,0x1e,0x17,0x15,0x04,0x36,0x36,0x2d,0xc3,0x3b,0x48,0x98,0x89,0x11,0xef,0x2b,0xcd,0x10,0x51,0x94,0xd0,0xad,0x6e,0x0a,0x87,0x61,0x65,0xa8,0xa2,0x72,0xbb,0xcc,0x0b},+	{0xc8,0xa9,0xb1,0xea,0x2f,0x96,0x5e,0x18,0xcd,0x7d,0x14,0x65,0x35,0xe6,0xe7,0x86,0xf2,0x6d,0x5b,0xbb,0x31,0xe0,0x92,0xb0,0x3e,0xb7,0xd6,0x59,0xab,0xf0,0x24,0x40,0x96,0x12,0xfe,0x50,0x4c,0x5e,0x6d,0x18,0x7e,0x9f,0xe8,0xfe,0x82,0x7b,0x39,0xe0,0xb0,0x31,0x70,0x50,0xc5,0xf6,0xc7,0x3b,0xc2,0x37,0x8f,0x10,0x69,0xfd,0x78,0x66,0xc2,0x63,0x68,0x63,0x31,0xfa,0x86,0x15,0xf2,0x33,0x2d,0x57,0x48,0x8c,0xf6,0x07,0xfc,0xae,0x9e,0x78,0x9f,0xcc,0x73,0x4f,0x01,0x47,0xad,0x8e,0x10,0xe2,0x42,0x2d},+	{0x9b,0xd2,0xdf,0x94,0x15,0x13,0xf5,0x97,0x6a,0x4c,0x3f,0x31,0x5d,0x98,0x55,0x61,0x10,0x50,0x45,0x08,0x07,0x3f,0xa1,0xeb,0x22,0xd3,0xd2,0xb8,0x08,0x26,0x6b,0x67,0x93,0x75,0x53,0x0f,0x0d,0x7b,0x71,0x21,0x4c,0x06,0x1e,0x13,0x0b,0x69,0x4e,0x91,0x9f,0xe0,0x2a,0x75,0xae,0x87,0xb6,0x1b,0x6e,0x3c,0x42,0x9b,0xa7,0xf3,0x0b,0x42,0x47,0x2b,0x5b,0x1c,0x65,0xba,0x38,0x81,0x80,0x1b,0x1b,0x31,0xec,0xb6,0x71,0x86,0xb0,0x35,0x31,0xbc,0xb1,0x0c,0xff,0x7b,0xe0,0xf1,0x0c,0x9c,0xfa,0x2f,0x5d,0x74},+	{0xbd,0xc8,0xc9,0x2b,0x1e,0x5a,0x52,0xbf,0x81,0x9d,0x47,0x26,0x08,0x26,0x5b,0xea,0xdb,0x55,0x01,0xdf,0x0e,0xc7,0x11,0xd5,0xd0,0xf5,0x0c,0x96,0xeb,0x3c,0xe2,0x1a,0x6a,0x4e,0xd3,0x21,0x57,0xdf,0x36,0x60,0xd0,0xb3,0x7b,0x99,0x27,0x88,0xdb,0xb1,0xfa,0x6a,0x75,0xc8,0xc3,0x09,0xc2,0xd3,0x39,0xc8,0x1d,0x4c,0xe5,0x5b,0xe1,0x06,0x4a,0x99,0x32,0x19,0x87,0x5d,0x72,0x5b,0xb0,0xda,0xb1,0xce,0xb5,0x1c,0x35,0x32,0x05,0xca,0xb7,0xda,0x49,0x15,0xc4,0x7d,0xf7,0xc1,0x8e,0x27,0x61,0xd8,0xde,0x58},+	{0x5c,0xc5,0x66,0xf2,0x93,0x37,0x17,0xd8,0x49,0x4e,0x45,0xcc,0xc5,0x76,0xc9,0xc8,0xa8,0xc3,0x26,0xbc,0xf8,0x82,0xe3,0x5c,0xf9,0xf6,0x85,0x54,0xe8,0x9d,0xf3,0x2f,0xa8,0xc9,0xc2,0xb6,0xa8,0x5b,0xfb,0x2d,0x8c,0x59,0x2c,0xf5,0x8e,0xef,0xee,0x48,0x73,0x15,0x2d,0xf1,0x07,0x91,0x80,0x33,0xd8,0x5b,0x1d,0x53,0x6b,0x69,0xba,0x08,0x7a,0xc5,0xef,0xc3,0xee,0x3e,0xed,0x77,0x11,0x48,0xff,0xd4,0x17,0x55,0xe0,0x04,0xcb,0x71,0xa6,0xf1,0x3f,0x7a,0x3d,0xea,0x54,0xfe,0x7c,0x94,0xb4,0x33,0x06,0x12},+	{0x42,0x00,0x61,0x91,0x78,0x98,0x94,0x0b,0xe8,0xfa,0xeb,0xec,0x3c,0xb1,0xe7,0x4e,0xc0,0xa4,0xf0,0x94,0x95,0x73,0xbe,0x70,0x85,0x91,0xd5,0xb4,0x99,0x0a,0xd3,0x35,0x0a,0x10,0x12,0x49,0x47,0x31,0xbd,0x82,0x06,0xbe,0x6f,0x7e,0x6d,0x7b,0x23,0xde,0xc6,0x79,0xea,0x11,0x19,0x76,0x1e,0xe1,0xde,0x3b,0x39,0xcb,0xe3,0x3b,0x43,0x07,0xf4,0x97,0xe9,0x5c,0xc0,0x44,0x79,0xff,0xa3,0x51,0x5c,0xb0,0xe4,0x3d,0x5d,0x57,0x7c,0x84,0x76,0x5a,0xfd,0x81,0x33,0x58,0x9f,0xda,0xf6,0x7a,0xde,0x3e,0x87,0x2d},+	{0x09,0x34,0x37,0x43,0x64,0x31,0x7a,0x15,0xd9,0x81,0xaa,0xf4,0xee,0xb7,0xb8,0xfa,0x06,0x48,0xa6,0xf5,0xe6,0xfe,0x93,0xb0,0xb6,0xa7,0x7f,0x70,0x54,0x36,0x77,0x2e,0x81,0xf9,0x5d,0x4e,0xe1,0x02,0x62,0xaa,0xf5,0xe1,0x15,0x50,0x17,0x59,0x0d,0xa2,0x6c,0x1d,0xe2,0xba,0xd3,0x75,0xa2,0x18,0x53,0x02,0x60,0x01,0x8a,0x61,0x43,0x05,0xc1,0x23,0x4c,0x97,0xf4,0xbd,0xea,0x0d,0x93,0x46,0xce,0x9d,0x25,0x0a,0x6f,0xaa,0x2c,0xba,0x9a,0xa2,0xb8,0x2c,0x20,0x04,0x0d,0x96,0x07,0x2d,0x36,0x43,0x14,0x4b},+	{0x7a,0x1f,0x6e,0xb6,0xc7,0xb7,0xc4,0xcc,0x7e,0x2f,0x0c,0xf5,0x25,0x7e,0x15,0x44,0x1c,0xaf,0x3e,0x71,0xfc,0x6d,0xf0,0x3e,0xf7,0x63,0xda,0x52,0x67,0x44,0x2f,0x58,0xcb,0x9c,0x52,0x1c,0xe9,0x54,0x7c,0x96,0xfb,0x35,0xc6,0x64,0x92,0x26,0xf6,0x30,0x65,0x19,0x12,0x78,0xf4,0xaf,0x47,0x27,0x5c,0x6f,0xf6,0xea,0x18,0x84,0x03,0x17,0xe4,0x4c,0x32,0x20,0xd3,0x7b,0x31,0xc6,0xc4,0x8b,0x48,0xa4,0xe8,0x42,0x10,0xa8,0x64,0x13,0x5a,0x4e,0x8b,0xf1,0x1e,0xb2,0xc9,0x8d,0xa2,0xcd,0x4b,0x1c,0x2a,0x0c},+	{0x47,0x04,0x1f,0x6f,0xd0,0xc7,0x4d,0xd2,0x59,0xc0,0x87,0xdb,0x3e,0x9e,0x26,0xb2,0x8f,0xd2,0xb2,0xfb,0x72,0x02,0x5b,0xd1,0x77,0x48,0xf6,0xc6,0xd1,0x8b,0x55,0x7c,0x45,0x69,0xbd,0x69,0x48,0x81,0xc4,0xed,0x22,0x8d,0x1c,0xbe,0x7d,0x90,0x6d,0x0d,0xab,0xc5,0x5c,0xd5,0x12,0xd2,0x3b,0xc6,0x83,0xdc,0x14,0xa3,0x30,0x9b,0x6a,0x5a,0x3d,0x46,0x96,0xd3,0x24,0x15,0xec,0xd0,0xf0,0x24,0x5a,0xc3,0x8a,0x62,0xbb,0x12,0xa4,0x5f,0xbc,0x1c,0x79,0x3a,0x0c,0xa5,0xc3,0xaf,0xfb,0x0a,0xca,0xa5,0x04,0x04},+	{0xd6,0x43,0xa7,0x0a,0x07,0x40,0x1f,0x8c,0xe8,0x5e,0x26,0x5b,0xcb,0xd0,0xba,0xcc,0xde,0xd2,0x8f,0x66,0x6b,0x04,0x4b,0x57,0x33,0x96,0xdd,0xca,0xfd,0x5b,0x39,0x46,0xd1,0x6f,0x41,0x2a,0x1b,0x9e,0xbc,0x62,0x8b,0x59,0x50,0xe3,0x28,0xf7,0xc6,0xb5,0x67,0x69,0x5d,0x3d,0xd8,0x3f,0x34,0x04,0x98,0xee,0xf8,0xe7,0x16,0x75,0x52,0x39,0x9c,0x9a,0x5d,0x1a,0x2d,0xdb,0x7f,0x11,0x2a,0x5c,0x00,0xd1,0xbc,0x45,0x77,0x9c,0xea,0x6f,0xd5,0x54,0xf1,0xbe,0xd4,0xef,0x16,0xd0,0x22,0xe8,0x29,0x9a,0x57,0x76},+	{0x17,0x2a,0xc0,0x49,0x7e,0x8e,0xb6,0x45,0x7f,0xa3,0xa9,0xbc,0xa2,0x51,0xcd,0x23,0x1b,0x4c,0x22,0xec,0x11,0x5f,0xd6,0x3e,0xb1,0xbd,0x05,0x9e,0xdc,0x84,0xa3,0x43,0xf2,0x34,0xb4,0x52,0x13,0xb5,0x3c,0x33,0xe1,0x80,0xde,0x93,0x49,0x28,0x32,0xd8,0xce,0x35,0x0d,0x75,0x87,0x28,0x51,0xb5,0xc1,0x77,0x27,0x2a,0xbb,0x14,0xc5,0x02,0x45,0xb6,0xf1,0x8b,0xda,0xd5,0x4b,0x68,0x53,0x4b,0xb5,0xf6,0x7e,0xd3,0x8b,0xfb,0x53,0xd2,0xb0,0xa9,0xd7,0x16,0x39,0x31,0x59,0x80,0x54,0x61,0x09,0x92,0x60,0x11},+	{0xaa,0xcf,0xda,0x29,0x69,0x16,0x4d,0xb4,0x8f,0x59,0x13,0x84,0x4c,0x9f,0x52,0xda,0x59,0x55,0x3d,0x45,0xca,0x63,0xef,0xe9,0x0b,0x8e,0x69,0xc5,0x5b,0x12,0x1e,0x35,0xcd,0x4d,0x9b,0x36,0x16,0x56,0x38,0x7a,0x63,0x35,0x5c,0x65,0xa7,0x2c,0xc0,0x75,0x21,0x80,0xf1,0xd4,0xf9,0x1b,0xc2,0x7d,0x42,0xe0,0xe6,0x91,0x74,0x7d,0x63,0x2f,0xbe,0x7b,0xf6,0x1a,0x46,0x9b,0xb4,0xd4,0x61,0x89,0xab,0xc8,0x7a,0x03,0x03,0xd6,0xfb,0x99,0xa6,0xf9,0x9f,0xe1,0xde,0x71,0x9a,0x2a,0xce,0xe7,0x06,0x2d,0x18,0x7f},+	{0xec,0x68,0x01,0xab,0x64,0x8e,0x7c,0x7a,0x43,0xc5,0xed,0x15,0x55,0x4a,0x5a,0xcb,0xda,0x0e,0xcd,0x47,0xd3,0x19,0x55,0x09,0xb0,0x93,0x3e,0x34,0x8c,0xac,0xd4,0x67,0x22,0x75,0x21,0x8e,0x72,0x4b,0x45,0x09,0xd8,0xb8,0x84,0xd4,0xf4,0xe8,0x58,0xaa,0x3c,0x90,0x46,0x7f,0x4d,0x25,0x58,0xd3,0x17,0x52,0x1c,0x24,0x43,0xc0,0xac,0x44,0x77,0x57,0x7a,0x4f,0xbb,0x6b,0x7d,0x1c,0xe1,0x13,0x83,0x91,0xd4,0xfe,0x35,0x8b,0x84,0x46,0x6b,0xc9,0xc6,0xa1,0xdc,0x4a,0xbd,0x71,0xad,0x12,0x83,0x1c,0x6d,0x55},+	{0x82,0x39,0x8d,0x0c,0xe3,0x40,0xef,0x17,0x34,0xfa,0xa3,0x15,0x3e,0x07,0xf7,0x31,0x6e,0x64,0x73,0x07,0xcb,0xf3,0x21,0x4f,0xff,0x4e,0x82,0x1d,0x6d,0x6c,0x6c,0x74,0x21,0xe8,0x1b,0xb1,0x56,0x67,0xf0,0x81,0xdd,0xf3,0xa3,0x10,0x23,0xf8,0xaf,0x0f,0x5d,0x46,0x99,0x6a,0x55,0xd0,0xb2,0xf8,0x05,0x7f,0x8c,0xcc,0x38,0xbe,0x7a,0x09,0xa4,0x2d,0xa5,0x7e,0x87,0xc9,0x49,0x0c,0x43,0x1d,0xdc,0x9b,0x55,0x69,0x43,0x4c,0xd2,0xeb,0xcc,0xf7,0x09,0x38,0x2c,0x02,0xbd,0x84,0xee,0x4b,0xa3,0x14,0x7e,0x57},+	{0x0a,0x3b,0xa7,0x61,0xac,0x68,0xe2,0xf0,0xf5,0xa5,0x91,0x37,0x10,0xfa,0xfa,0xf2,0xe9,0x00,0x6d,0x6b,0x82,0x3e,0xe1,0xc1,0x42,0x8f,0xd7,0x6f,0xe9,0x7e,0xfa,0x60,0x2b,0xd7,0x4d,0xbd,0xbe,0xce,0xfe,0x94,0x11,0x22,0x0f,0x06,0xda,0x4f,0x6a,0xf4,0xff,0xd1,0xc8,0xc0,0x77,0x59,0x4a,0x12,0x95,0x92,0x00,0xfb,0xb8,0x04,0x53,0x70,0xc6,0x6e,0x29,0x4d,0x35,0x1d,0x3d,0xb6,0xd8,0x31,0xad,0x5f,0x3e,0x05,0xc3,0xf3,0xec,0x42,0xbd,0xb4,0x8c,0x95,0x0b,0x67,0xfd,0x53,0x63,0xa1,0x0c,0x8e,0x39,0x21},+	{0xf3,0x33,0x2b,0x38,0x8a,0x05,0xf5,0x89,0xb4,0xc0,0x48,0xad,0x0b,0xba,0xe2,0x5a,0x6e,0xb3,0x3d,0xa5,0x03,0xb5,0x93,0x8f,0xe6,0x32,0xa2,0x95,0x9d,0xed,0xa3,0x5a,0x01,0x56,0xb7,0xb4,0xf9,0xaa,0x98,0x27,0x72,0xad,0x8d,0x5c,0x13,0x72,0xac,0x5e,0x23,0xa0,0xb7,0x61,0x61,0xaa,0xce,0xd2,0x4e,0x7d,0x8f,0xe9,0x84,0xb2,0xbf,0x1b,0x61,0x65,0xd9,0xc7,0xe9,0x77,0x67,0x65,0x36,0x80,0xc7,0x72,0x54,0x12,0x2b,0xcb,0xee,0x6e,0x50,0xd9,0x99,0x32,0x05,0x65,0xcc,0x57,0x89,0x5e,0x4e,0xe1,0x07,0x4a},+	{0x99,0xf9,0x0d,0x98,0xcb,0x12,0xe4,0x4e,0x71,0xc7,0x6e,0x3c,0x6f,0xd7,0x15,0xa3,0xfd,0x77,0x5c,0x92,0xde,0xed,0xa5,0xbb,0x02,0x34,0x31,0x1d,0x39,0xac,0x0b,0x3f,0x9b,0xa4,0x77,0xc4,0xcd,0x58,0x0b,0x24,0x17,0xf0,0x47,0x64,0xde,0xda,0x38,0xfd,0xad,0x6a,0xc8,0xa7,0x32,0x8d,0x92,0x19,0x81,0xa0,0xaf,0x84,0xed,0x7a,0xaf,0x50,0xe5,0x5b,0xf6,0x15,0x01,0xde,0x4f,0x6e,0xb2,0x09,0x61,0x21,0x21,0x26,0x98,0x29,0xd9,0xd6,0xad,0x0b,0x81,0x05,0x02,0x78,0x06,0xd0,0xeb,0xba,0x16,0xa3,0x21,0x19},+	{0xfc,0x70,0xb8,0xdf,0x7e,0x2f,0x42,0x89,0xbd,0xb3,0x76,0x4f,0xeb,0x6b,0x29,0x2c,0xf7,0x4d,0xc2,0x36,0xd4,0xf1,0x38,0x07,0xb0,0xae,0x73,0xe2,0x41,0xdf,0x58,0x64,0x8b,0xc1,0xf3,0xd9,0x9a,0xad,0x5a,0xd7,0x9c,0xc1,0xb1,0x60,0xef,0x0e,0x6a,0x56,0xd9,0x0e,0x5c,0x25,0xac,0x0b,0x9a,0x3e,0xf5,0xc7,0x62,0xa0,0xec,0x9d,0x04,0x7b,0x83,0x44,0x44,0x35,0x7a,0xe3,0xcb,0xdc,0x93,0xbe,0xed,0x0f,0x33,0x79,0x88,0x75,0x87,0xdd,0xc5,0x12,0xc3,0x04,0x60,0x78,0x64,0x0e,0x95,0xc2,0xcb,0xdc,0x93,0x60},+	{0x6d,0x70,0xe0,0x85,0x85,0x9a,0xf3,0x1f,0x33,0x39,0xe7,0xb3,0xd8,0xa5,0xd0,0x36,0x3b,0x45,0x8f,0x71,0xe1,0xf2,0xb9,0x43,0x7c,0xa9,0x27,0x48,0x08,0xea,0xd1,0x57,0x4b,0x03,0x84,0x60,0xbe,0xee,0xde,0x6b,0x54,0xb8,0x0f,0x78,0xb6,0xc2,0x99,0x31,0x95,0x06,0x2d,0xb6,0xab,0x76,0x33,0x97,0x90,0x7d,0x64,0x8b,0xc9,0x80,0x31,0x6e,0x71,0xb0,0x28,0xa1,0xe7,0xb6,0x7a,0xee,0xaa,0x8b,0xa8,0x93,0x6d,0x59,0xc1,0xa4,0x30,0x61,0x21,0xb2,0x82,0xde,0xb4,0xf7,0x18,0xbd,0x97,0xdd,0x9d,0x99,0x3e,0x36},+	{0xc4,0x1f,0xee,0x35,0xc1,0x43,0xa8,0x96,0xcf,0xc8,0xe4,0x08,0x55,0xb3,0x6e,0x97,0x30,0xd3,0x8c,0xb5,0x01,0x68,0x2f,0xb4,0x2b,0x05,0x3a,0x69,0x78,0x9b,0xee,0x48,0xc6,0xae,0x4b,0xe2,0xdc,0x48,0x18,0x2f,0x60,0xaf,0xbc,0xba,0x55,0x72,0x9b,0x76,0x31,0xe9,0xef,0x3c,0x6e,0x3c,0xcb,0x90,0x55,0xb3,0xf9,0xc6,0x9b,0x97,0x1f,0x23,0xc6,0xf3,0x2a,0xcc,0x4b,0xde,0x31,0x5c,0x1f,0x8d,0x20,0xfe,0x30,0xb0,0x4b,0xb0,0x66,0xb4,0x4f,0xc1,0x09,0x70,0x8d,0xb7,0x13,0x24,0x79,0x08,0x9b,0xfa,0x9b,0x07},+	{0xf4,0x0d,0x30,0xda,0x51,0x3a,0x90,0xe3,0xb0,0x5a,0xa9,0x3d,0x23,0x64,0x39,0x84,0x80,0x64,0x35,0x0b,0x2d,0xf1,0x3c,0xed,0x94,0x71,0x81,0x84,0xf6,0x77,0x8c,0x03,0x45,0x42,0xd5,0xa2,0x80,0xed,0xc9,0xf3,0x52,0x39,0xf6,0x77,0x78,0x8b,0xa0,0x0a,0x75,0x54,0x08,0xd1,0x63,0xac,0x6d,0xd7,0x6b,0x63,0x70,0x94,0x15,0xfb,0xf4,0x1e,0xec,0x7b,0x16,0x5b,0xe6,0x5e,0x4e,0x85,0xc2,0xcd,0xd0,0x96,0x42,0x0a,0x59,0x59,0x99,0x21,0x10,0x98,0x34,0xdf,0xb2,0x72,0x56,0xff,0x0b,0x4a,0x2a,0xe9,0x5e,0x57},+	{0xcf,0x2f,0x18,0x8a,0x90,0x80,0xc0,0xd4,0xbd,0x9d,0x48,0x99,0xc2,0x70,0xe1,0x30,0xde,0x33,0xf7,0x52,0x57,0xbd,0xba,0x05,0x00,0xfd,0xd3,0x2c,0x11,0xe7,0xd4,0x43,0x01,0xd8,0xa4,0x0a,0x45,0xbc,0x46,0x5d,0xd8,0xb9,0x33,0xa5,0x27,0x12,0xaf,0xc3,0xc2,0x06,0x89,0x2b,0x26,0x3b,0x9e,0x38,0x1b,0x58,0x2f,0x38,0x7e,0x1e,0x0a,0x20,0xc5,0x3a,0xf9,0xea,0x67,0xb9,0x8d,0x51,0xc0,0x52,0x66,0x05,0x9b,0x98,0xbc,0x71,0xf5,0x97,0x71,0x56,0xd9,0x85,0x2b,0xfe,0x38,0x4e,0x1e,0x65,0x52,0xca,0x0e,0x05},+	{0x9c,0x0c,0x3f,0x45,0xde,0x1a,0x43,0xc3,0x9b,0x3b,0x70,0xff,0x5e,0x04,0xf5,0xe9,0x3d,0x7b,0x84,0xed,0xc9,0x7a,0xd9,0xfc,0xc6,0xf4,0x58,0x1c,0xc2,0xe6,0x0e,0x4b,0xea,0x68,0xe6,0x60,0x76,0x39,0xac,0x97,0x97,0xb4,0x3a,0x15,0xfe,0xbb,0x19,0x9b,0x9f,0xa7,0xec,0x34,0xb5,0x79,0xb1,0x4c,0x57,0xae,0x31,0xa1,0x9f,0xc0,0x51,0x61,0x96,0x5d,0xf0,0xfd,0x0d,0x5c,0xf5,0x3a,0x7a,0xee,0xb4,0x2a,0xe0,0x2e,0x26,0xdd,0x09,0x17,0x17,0x12,0x87,0xbb,0xb2,0x11,0x0b,0x03,0x0f,0x80,0xfa,0x24,0xef,0x1f},+	{0x96,0x31,0xa7,0x1a,0xfb,0x53,0xd6,0x37,0x18,0x64,0xd7,0x3f,0x30,0x95,0x94,0x0f,0xb2,0x17,0x3a,0xfb,0x09,0x0b,0x20,0xad,0x3e,0x61,0xc8,0x2f,0x29,0x49,0x4d,0x54,0x86,0x6b,0x97,0x30,0xf5,0xaf,0xd2,0x22,0x04,0x46,0xd2,0xc2,0x06,0xb8,0x90,0x8d,0xe5,0xba,0xe5,0x4d,0x6c,0x89,0xa1,0xdc,0x17,0x0c,0x34,0xc8,0xe6,0x5f,0x00,0x28,0x88,0x86,0x52,0x34,0x9f,0xba,0xef,0x6a,0xa1,0x7d,0x10,0x25,0x94,0xff,0x1b,0x5c,0x36,0x4b,0xd9,0x66,0xcd,0xbb,0x5b,0xf7,0xfa,0x6d,0x31,0x0f,0x93,0x72,0xe4,0x72},+	{0x4f,0x08,0x81,0x97,0x8c,0x20,0x95,0x26,0xe1,0x0e,0x45,0x23,0x0b,0x2a,0x50,0xb1,0x02,0xde,0xef,0x03,0xa6,0xae,0x9d,0xfd,0x4c,0xa3,0x33,0x27,0x8c,0x2e,0x9d,0x5a,0x27,0x76,0x2a,0xd3,0x35,0xf6,0xf3,0x07,0xf0,0x66,0x65,0x5f,0x86,0x4d,0xaa,0x7a,0x50,0x44,0xd0,0x28,0x97,0xe7,0x85,0x3c,0x38,0x64,0xe0,0x0f,0x00,0x7f,0xee,0x1f,0xe5,0xf7,0xdb,0x03,0xda,0x05,0x53,0x76,0xbd,0xcd,0x34,0x14,0x49,0xf2,0xda,0xa4,0xec,0x88,0x4a,0xd2,0xcd,0xd5,0x4a,0x7b,0x43,0x05,0x04,0xee,0x51,0x40,0xf9,0x00},+	{0xb2,0x30,0xd3,0xc3,0x23,0x6b,0x35,0x8d,0x06,0x1b,0x47,0xb0,0x9b,0x8b,0x1c,0xf2,0x3c,0xb8,0x42,0x6e,0x6c,0x31,0x6c,0xb3,0x0d,0xb1,0xea,0x8b,0x7e,0x9c,0xd7,0x07,0x53,0x97,0xaf,0x07,0xbb,0x93,0xef,0xd7,0xa7,0x66,0xb7,0x3d,0xcf,0xd0,0x3e,0x58,0xc5,0x1e,0x0b,0x6e,0xbf,0x98,0x69,0xce,0x52,0x04,0xd4,0x5d,0xd2,0xff,0xb7,0x47,0x12,0xdd,0x08,0xbc,0x9c,0xfb,0xfb,0x87,0x9b,0xc2,0xee,0xe1,0x3a,0x6b,0x06,0x8a,0xbf,0xc1,0x1f,0xdb,0x2b,0x24,0x57,0x0d,0xb6,0x4b,0xa6,0x5e,0xa3,0x20,0x35,0x1c},+	{0x4a,0xa3,0xcb,0xbc,0xa6,0x53,0xd2,0x80,0x9b,0x21,0x38,0x38,0xa1,0xc3,0x61,0x3e,0x96,0xe3,0x82,0x98,0x01,0xb6,0xc3,0x90,0x6f,0xe6,0x0e,0x5d,0x77,0x05,0x3d,0x1c,0x59,0xc0,0x6b,0x21,0x40,0x6f,0xa8,0xcd,0x7e,0xd8,0xbc,0x12,0x1d,0x23,0xbb,0x1f,0x90,0x09,0xc7,0x17,0x9e,0x6a,0x95,0xb4,0x55,0x2e,0xd1,0x66,0x3b,0x0c,0x75,0x38,0x1a,0xe5,0x22,0x94,0x40,0xf1,0x2e,0x69,0x71,0xf6,0x5d,0x2b,0x3c,0xc7,0xc0,0xcb,0x29,0xe0,0x4c,0x74,0xe7,0x4f,0x01,0x21,0x7c,0x48,0x30,0xd3,0xc7,0xe2,0x21,0x06},+	{0x8d,0x83,0x59,0x82,0xcc,0x60,0x98,0xaf,0xdc,0x9a,0x9f,0xc6,0xc1,0x48,0xea,0x90,0x30,0x1e,0x58,0x65,0x37,0x48,0x26,0x65,0xbc,0xa5,0xd3,0x7b,0x09,0xd6,0x07,0x00,0xf3,0xf0,0xdb,0xb0,0x96,0x17,0xae,0xb7,0x96,0xe1,0x7c,0xe1,0xb9,0xaf,0xdf,0x54,0xb4,0xa3,0xaa,0xe9,0x71,0x30,0x92,0x25,0x9d,0x2e,0x00,0xa1,0x9c,0x58,0x8e,0x5d,0x4b,0xa9,0x42,0x08,0x95,0x1d,0xbf,0xc0,0x3e,0x2e,0x8f,0x58,0x63,0xc3,0xd3,0xb2,0xef,0xe2,0x51,0xbb,0x38,0x14,0x96,0x0a,0x86,0xbf,0x1c,0x3c,0x78,0xd7,0x83,0x15},+	{0xe1,0x7a,0xa2,0x5d,0xef,0xa2,0xee,0xec,0x74,0x01,0x67,0x55,0x14,0x3a,0x7c,0x59,0x7a,0x16,0x09,0x66,0x12,0x2a,0xa6,0xc9,0x70,0x8f,0xed,0x81,0x2e,0x5f,0x2a,0x25,0xc7,0x28,0x9d,0xcc,0x04,0x47,0x03,0x90,0x8f,0xc5,0x2c,0xf7,0x9e,0x67,0x1b,0x1d,0x26,0x87,0x5b,0xbe,0x5f,0x2b,0xe1,0x16,0x0a,0x58,0xc5,0x83,0x4e,0x06,0x58,0x49,0x0d,0xe8,0x66,0x50,0x26,0x94,0x28,0x0d,0x6b,0x8c,0x7c,0x30,0x85,0xf7,0xc3,0xfc,0xfd,0x12,0x11,0x0c,0x78,0xda,0x53,0x1b,0x88,0xb3,0x43,0xd8,0x0b,0x17,0x9c,0x07},+	{0xff,0x6f,0xfa,0x64,0xe4,0xec,0x06,0x05,0x23,0xe5,0x05,0x62,0x1e,0x43,0xe3,0xbe,0x42,0xea,0xb8,0x51,0x24,0x42,0x79,0x35,0x00,0xfb,0xc9,0x4a,0xe3,0x05,0xec,0x6d,0x56,0xd0,0xd5,0xc0,0x50,0xcd,0xd6,0xcd,0x3b,0x57,0x03,0xbb,0x6d,0x68,0xf7,0x9a,0x48,0xef,0xc3,0xf3,0x3f,0x72,0xa6,0x3c,0xcc,0x8a,0x7b,0x31,0xd7,0xc0,0x68,0x67,0xb3,0xc1,0x55,0xf1,0xe5,0x25,0xb6,0x94,0x91,0x7b,0x7b,0x99,0xa7,0xf3,0x7b,0x41,0x00,0x26,0x6b,0x6d,0xdc,0xbd,0x2c,0xc2,0xf4,0x52,0xcd,0xdd,0x14,0x5e,0x44,0x51},+	{0x51,0x49,0x14,0x3b,0x4b,0x2b,0x50,0x57,0xb3,0xbc,0x4b,0x44,0x6b,0xff,0x67,0x8e,0xdb,0x85,0x63,0x16,0x27,0x69,0xbd,0xb8,0xc8,0x95,0x92,0xe3,0x31,0x6f,0x18,0x13,0x55,0xa4,0xbe,0x2b,0xab,0x47,0x31,0x89,0x29,0x91,0x07,0x92,0x4f,0xa2,0x53,0x8c,0xa7,0xf7,0x30,0xbe,0x48,0xf9,0x49,0x4b,0x3d,0xd4,0x4f,0x6e,0x08,0x90,0xe9,0x12,0x2e,0xbb,0xdf,0x7f,0xb3,0x96,0x0c,0xf1,0xf9,0xea,0x1c,0x12,0x5e,0x93,0x9a,0x9f,0x3f,0x98,0x5b,0x3a,0xc4,0x36,0x11,0xdf,0xaf,0x99,0x3e,0x5d,0xf0,0xe3,0xb2,0x77},+	{0xde,0xc4,0x2e,0x9c,0xc5,0xa9,0x6f,0x29,0xcb,0xf3,0x84,0x4f,0xbf,0x61,0x8b,0xbc,0x08,0xf9,0xa8,0x17,0xd9,0x06,0x77,0x1c,0x5d,0x25,0xd3,0x7a,0xfc,0x95,0xb7,0x63,0xa4,0xb0,0xdd,0x12,0x9c,0x63,0x98,0xd5,0x6b,0x86,0x24,0xc0,0x30,0x9f,0xd1,0xa5,0x60,0xe4,0xfc,0x58,0x03,0x2f,0x7c,0xd1,0x8a,0x5e,0x09,0x2e,0x15,0x95,0xa1,0x07,0xc8,0x5f,0x9e,0x38,0x02,0x8f,0x36,0xa8,0x3b,0xe4,0x8d,0xcf,0x02,0x3b,0x43,0x90,0x43,0x26,0x41,0xc5,0x5d,0xfd,0xa1,0xaf,0x37,0x01,0x2f,0x03,0x3d,0xe8,0x8f,0x3e},+	{0x94,0xa2,0x70,0x05,0xb9,0x15,0x8b,0x2f,0x49,0x45,0x08,0x67,0x70,0x42,0xf2,0x94,0x84,0xfd,0xbb,0x61,0xe1,0x5a,0x1c,0xde,0x07,0x40,0xac,0x7f,0x79,0x3b,0xba,0x75,0x3c,0xd1,0xef,0xe8,0x8d,0x4c,0x70,0x08,0x31,0x37,0xe0,0x33,0x8e,0x1a,0xc5,0xdf,0xe3,0xcd,0x60,0x12,0xa5,0x5d,0x9d,0xa5,0x86,0x8c,0x25,0xa6,0x99,0x08,0xd6,0x22,0x96,0xd1,0xcd,0x70,0xc0,0xdb,0x39,0x62,0x9a,0x8a,0x7d,0x6c,0x8b,0x8a,0xfe,0x60,0x60,0x12,0x40,0xeb,0xbc,0x47,0x88,0xb3,0x5e,0x9e,0x77,0x87,0x7b,0xd0,0x04,0x09},+	{0x9c,0x91,0xba,0xdd,0xd4,0x1f,0xce,0xb4,0xaa,0x8d,0x4c,0xc7,0x3e,0xdb,0x31,0xcf,0x51,0xcc,0x86,0xad,0x63,0xcc,0x63,0x2c,0x07,0xde,0x1d,0xbc,0x3f,0x14,0xe2,0x43,0xb9,0x40,0xf9,0x48,0x66,0x2d,0x32,0xf4,0x39,0x0c,0x2d,0xbd,0x0c,0x2f,0x95,0x06,0x31,0xf9,0x81,0xa0,0xad,0x97,0x76,0x16,0x6c,0x2a,0xf7,0xba,0xce,0xaa,0x40,0x62,0xa0,0x95,0xa2,0x5b,0x9c,0x74,0x34,0xf8,0x5a,0xd2,0x37,0xca,0x5b,0x7c,0x94,0xd6,0x6a,0x31,0xc9,0xe7,0xa7,0x3b,0xf1,0x66,0xac,0x0c,0xb4,0x8d,0x23,0xaf,0xbd,0x56},+	{0xeb,0x33,0x35,0xf5,0xe3,0xb9,0x2a,0x36,0x40,0x3d,0xb9,0x6e,0xd5,0x68,0x85,0x33,0x72,0x55,0x5a,0x1d,0x52,0x14,0x0e,0x9e,0x18,0x13,0x74,0x83,0x6d,0xa8,0x24,0x1d,0xb2,0x3b,0x9d,0xc1,0x6c,0xd3,0x10,0x13,0xb9,0x86,0x23,0x62,0xb7,0x6b,0x2a,0x06,0x5c,0x4f,0xa1,0xd7,0x91,0x85,0x9b,0x7c,0x54,0x57,0x1e,0x7e,0x50,0x31,0xaa,0x03,0x1f,0xce,0xd4,0xff,0x48,0x76,0xec,0xf4,0x1c,0x8c,0xac,0x54,0xf0,0xea,0x45,0xe0,0x7c,0x35,0x09,0x1d,0x82,0x25,0xd2,0x88,0x59,0x48,0xeb,0x9a,0xdc,0x61,0xb2,0x43},+	{0xbb,0x79,0xbb,0x88,0x19,0x1e,0x5b,0xe5,0x9d,0x35,0x7a,0xc1,0x7d,0xd0,0x9e,0xa0,0x33,0xea,0x3d,0x60,0xe2,0x2e,0x2c,0xb0,0xc2,0x6b,0x27,0x5b,0xcf,0x55,0x60,0x32,0x64,0x13,0x95,0x6c,0x8b,0x3d,0x51,0x19,0x7b,0xf4,0x0b,0x00,0x26,0x71,0xfe,0x94,0x67,0x95,0x4f,0xd5,0xdd,0x10,0x8d,0x02,0x64,0x09,0x94,0x42,0xe2,0xd5,0xb4,0x02,0xf2,0x8d,0xd1,0x28,0xcb,0x55,0xa1,0xb4,0x08,0xe5,0x6c,0x18,0x46,0x46,0xcc,0xea,0x89,0x43,0x82,0x6c,0x93,0xf4,0x9c,0xc4,0x10,0x34,0x5d,0xae,0x09,0xc8,0xa6,0x27},+	{0x88,0xb1,0x0d,0x1f,0xcd,0xeb,0xa6,0x8b,0xe8,0x5b,0x5a,0x67,0x3a,0xd7,0xd3,0x37,0x5a,0x58,0xf5,0x15,0xa3,0xdf,0x2e,0xf2,0x7e,0xa1,0x60,0xff,0x74,0x71,0xb6,0x2c,0x54,0x69,0x3d,0xc4,0x0a,0x27,0x2c,0xcd,0xb2,0xca,0x66,0x6a,0x57,0x3e,0x4a,0xdd,0x6c,0x03,0xd7,0x69,0x24,0x59,0xfa,0x79,0x99,0x25,0x8c,0x3d,0x60,0x03,0x15,0x22,0xd0,0xe1,0x0b,0x39,0xf9,0xcd,0xee,0x59,0xf1,0xe3,0x8c,0x72,0x44,0x20,0x42,0xa9,0xf4,0xf0,0x94,0x7a,0x66,0x1c,0x89,0x82,0x36,0xf4,0x90,0x38,0xb7,0xf4,0x1d,0x7b},+	{0x24,0xa2,0xb2,0xb3,0xe0,0xf2,0x92,0xe4,0x60,0x11,0x55,0x2b,0x06,0x9e,0x6c,0x7c,0x0e,0x7b,0x7f,0x0d,0xe2,0x8f,0xeb,0x15,0x92,0x59,0xfc,0x58,0x26,0xef,0xfc,0x61,0x8c,0xf5,0xf8,0x07,0x18,0x22,0x2e,0x5f,0xd4,0x09,0x94,0xd4,0x9f,0x5c,0x55,0xe3,0x30,0xa6,0xb6,0x1f,0x8d,0xa8,0xaa,0xb2,0x3d,0xe0,0x52,0xd3,0x45,0x82,0x69,0x68,0x7a,0x18,0x18,0x2a,0x85,0x5d,0xb1,0xdb,0xd7,0xac,0xdd,0x86,0xd3,0xaa,0xe4,0xf3,0x82,0xc4,0xf6,0x0f,0x81,0xe2,0xba,0x44,0xcf,0x01,0xaf,0x3d,0x47,0x4c,0xcf,0x46},+	{0xf9,0xe5,0xc4,0x9e,0xed,0x25,0x65,0x42,0x03,0x33,0x90,0x16,0x01,0xda,0x5e,0x0e,0xdc,0xca,0xe5,0xcb,0xf2,0xa7,0xb1,0x72,0x40,0x5f,0xeb,0x14,0xcd,0x7b,0x38,0x29,0x40,0x81,0x49,0xf1,0xa7,0x6e,0x3c,0x21,0x54,0x48,0x2b,0x39,0xf8,0x7e,0x1e,0x7c,0xba,0xce,0x29,0x56,0x8c,0xc3,0x88,0x24,0xbb,0xc5,0x8c,0x0d,0xe5,0xaa,0x65,0x10,0x57,0x0d,0x20,0xdf,0x25,0x45,0x2c,0x1c,0x4a,0x67,0xca,0xbf,0xd6,0x2d,0x3b,0x5c,0x30,0x40,0x83,0xe1,0xb1,0xe7,0x07,0x0a,0x16,0xe7,0x1c,0x4f,0xe6,0x98,0xa1,0x69},+	{0xbc,0x78,0x1a,0xd9,0xe0,0xb2,0x62,0x90,0x67,0x96,0x50,0xc8,0x9c,0x88,0xc9,0x47,0xb8,0x70,0x50,0x40,0x66,0x4a,0xf5,0x9d,0xbf,0xa1,0x93,0x24,0xa9,0xe6,0x69,0x73,0xed,0xca,0xc5,0xdc,0x34,0x44,0x01,0xe1,0x33,0xfb,0x84,0x3c,0x96,0x5d,0xed,0x47,0xe7,0xa0,0x86,0xed,0x76,0x95,0x01,0x70,0xe4,0xf9,0x67,0xd2,0x7b,0x69,0xb2,0x25,0x64,0x68,0x98,0x13,0xfb,0x3f,0x67,0x9d,0xb8,0xc7,0x5d,0x41,0xd9,0xfb,0xa5,0x3c,0x5e,0x3b,0x27,0xdf,0x3b,0xcc,0x4e,0xe0,0xd2,0x4c,0x4e,0xb5,0x3d,0x68,0x20,0x14},+	{0x97,0xd1,0x9d,0x24,0x1e,0xbd,0x78,0xb4,0x02,0xc1,0x58,0x5e,0x00,0x35,0x0c,0x62,0x5c,0xac,0xba,0xcc,0x2f,0xd3,0x02,0xfb,0x2d,0xa7,0x08,0xf5,0xeb,0x3b,0xb6,0x60,0xd0,0x5a,0xcc,0xc1,0x6f,0xbb,0xee,0x34,0x8b,0xac,0x46,0x96,0xe9,0x0c,0x1b,0x6a,0x53,0xde,0x6b,0xa6,0x49,0xda,0xb0,0xd3,0xc1,0x81,0xd0,0x61,0x41,0x3b,0xe8,0x31,0x4f,0x2b,0x06,0x9e,0x12,0xc7,0xe8,0x97,0xd8,0x0a,0x32,0x29,0x4f,0x8f,0xe4,0x49,0x3f,0x68,0x18,0x6f,0x4b,0xe1,0xec,0x5b,0x17,0x03,0x55,0x2d,0xb6,0x1e,0xcf,0x55},+	{0x58,0x3d,0xc2,0x65,0x10,0x10,0x79,0x58,0x9c,0x81,0x94,0x50,0x6d,0x08,0x9d,0x8b,0xa7,0x5f,0xc5,0x12,0xa9,0x2f,0x40,0xe2,0xd4,0x91,0x08,0x57,0x64,0x65,0x9a,0x66,0x52,0x8c,0xf5,0x7d,0xe3,0xb5,0x76,0x30,0x36,0xcc,0x99,0xe7,0xdd,0xb9,0x3a,0xd7,0x20,0xee,0x13,0x49,0xe3,0x1c,0x83,0xbd,0x33,0x01,0xba,0x62,0xaa,0xfb,0x56,0x1a,0xec,0xc9,0x9d,0x5c,0x50,0x6b,0x3e,0x94,0x1a,0x37,0x7c,0xa7,0xbb,0x57,0x25,0x30,0x51,0x76,0x34,0x41,0x56,0xae,0x73,0x98,0x5c,0x8a,0xc5,0x99,0x67,0x83,0xc4,0x13},+	{0xb9,0xe1,0xb3,0x5a,0x46,0x5d,0x3a,0x42,0x61,0x3f,0xf1,0xc7,0x87,0xc1,0x13,0xfc,0xb6,0xb9,0xb5,0xec,0x64,0x36,0xf8,0x19,0x07,0xb6,0x37,0xa6,0x93,0x0c,0xf8,0x66,0x80,0xd0,0x8b,0x5d,0x6a,0xfb,0xdc,0xc4,0x42,0x48,0x1a,0x57,0xec,0xc4,0xeb,0xde,0x65,0x53,0xe5,0xb8,0x83,0xe8,0xb2,0xd4,0x27,0xb8,0xe5,0xc8,0x7d,0xc8,0xbd,0x50,0x11,0xe1,0xdf,0x6e,0x83,0x37,0x6d,0x60,0xd9,0xab,0x11,0xf0,0x15,0x3e,0x35,0x32,0x96,0x3b,0xb7,0x25,0xc3,0x3a,0xb0,0x64,0xae,0xd5,0x5f,0x72,0x44,0x64,0xd5,0x1d},+	{0x7d,0x12,0x62,0x33,0xf8,0x7f,0xa4,0x8f,0x15,0x7c,0xcd,0x71,0xc4,0x6a,0x9f,0xbc,0x8b,0x0c,0x22,0x49,0x43,0x45,0x71,0x6e,0x2e,0x73,0x9f,0x21,0x12,0x59,0x64,0x0e,0x9a,0xc8,0xba,0x08,0x00,0xe6,0x97,0xc2,0xe0,0xc3,0xe1,0xea,0x11,0xea,0x4c,0x7d,0x7c,0x97,0xe7,0x9f,0xe1,0x8b,0xe3,0xf3,0xcd,0x05,0xa3,0x63,0x0f,0x45,0x3a,0x3a,0x27,0x46,0x39,0xd8,0x31,0x2f,0x8f,0x07,0x10,0xa5,0x94,0xde,0x83,0x31,0x9d,0x38,0x80,0x6f,0x99,0x17,0x6d,0x6c,0xe3,0xd1,0x7b,0xa8,0xa9,0x93,0x93,0x8d,0x8c,0x31},+	{0x19,0xfe,0xff,0x2a,0x03,0x5d,0x74,0xf2,0x66,0xdb,0x24,0x7f,0x49,0x3c,0x9f,0x0c,0xef,0x98,0x85,0xba,0xe3,0xd3,0x98,0xbc,0x14,0x53,0x1d,0x9a,0x67,0x7c,0x4c,0x22,0x98,0xd3,0x1d,0xab,0x29,0x9e,0x66,0x5d,0x3b,0x9e,0x2d,0x34,0x58,0x16,0x92,0xfc,0xcd,0x73,0x59,0xf3,0xfd,0x1d,0x85,0x55,0xf6,0x0a,0x95,0x25,0xc3,0x41,0x9a,0x50,0xe9,0x25,0xf9,0xa6,0xdc,0x6e,0xc0,0xbd,0x33,0x1f,0x1b,0x64,0xf4,0xf3,0x3e,0x79,0x89,0x3e,0x83,0x9d,0x80,0x12,0xec,0x82,0x89,0x13,0xa1,0x28,0x23,0xf0,0xbf,0x05},+	{0x0b,0xe0,0xca,0x23,0x70,0x13,0x32,0x36,0x59,0xcf,0xac,0xd1,0x0a,0xcf,0x4a,0x54,0x88,0x1c,0x1a,0xd2,0x49,0x10,0x74,0x96,0xa7,0x44,0x2a,0xfa,0xc3,0x8c,0x0b,0x78,0xe4,0x12,0xc5,0x0d,0xdd,0xa0,0x81,0x68,0xfe,0xfa,0xa5,0x44,0xc8,0x0d,0xe7,0x4f,0x40,0x52,0x4a,0x8f,0x6b,0x8e,0x74,0x1f,0xea,0xa3,0x01,0xee,0xcd,0x77,0x62,0x57,0x5f,0x30,0x4f,0x23,0xbc,0x8a,0xf3,0x1e,0x08,0xde,0x05,0x14,0xbd,0x7f,0x57,0x9a,0x0d,0x2a,0xe6,0x34,0x14,0xa5,0x82,0x5e,0xa1,0xb7,0x71,0x62,0x72,0x18,0xf4,0x5f},+	{0x9d,0xdb,0x89,0x17,0x0c,0x08,0x8e,0x39,0xf5,0x78,0xe7,0xf3,0x25,0x20,0x60,0xa7,0x5d,0x03,0xbd,0x06,0x4c,0x89,0x98,0xfa,0xbe,0x66,0xa9,0x25,0xdc,0x03,0x6a,0x10,0x40,0x95,0xb6,0x13,0xe8,0x47,0xdb,0xe5,0xe1,0x10,0x26,0x43,0x3b,0x2a,0x5d,0xf3,0x76,0x12,0x78,0x38,0xe9,0x26,0x1f,0xac,0x69,0xcb,0xa0,0xa0,0x8c,0xdb,0xd4,0x29,0xd0,0x53,0x33,0x33,0xaf,0x0a,0xad,0xd9,0xe5,0x09,0xd3,0xac,0xa5,0x9d,0x66,0x38,0xf0,0xf7,0x88,0xc8,0x8a,0x65,0x57,0x3c,0xfa,0xbe,0x2c,0x05,0x51,0x8a,0xb3,0x4a},+	{0x93,0xd5,0x68,0x67,0x25,0x2b,0x7c,0xda,0x13,0xca,0x22,0x44,0x57,0xc0,0xc1,0x98,0x1d,0xce,0x0a,0xca,0xd5,0x0b,0xa8,0xf1,0x90,0xa6,0x88,0xc0,0xad,0xd1,0xcd,0x29,0x9c,0xc0,0xdd,0x5f,0xef,0xd1,0xcf,0xd6,0xce,0x5d,0x57,0xf7,0xfd,0x3e,0x2b,0xe8,0xc2,0x34,0x16,0x20,0x5d,0x6b,0xd5,0x25,0x9b,0x2b,0xed,0x04,0xbb,0xc6,0x41,0x30,0x48,0xe1,0x56,0xd9,0xf9,0xf2,0xf2,0x0f,0x2e,0x6b,0x35,0x9f,0x75,0x97,0xe7,0xad,0x5c,0x02,0x6c,0x5f,0xbb,0x98,0x46,0x1a,0x7b,0x9a,0x04,0x14,0x68,0xbd,0x4b,0x10},+	{0x67,0xed,0xf1,0x68,0x31,0xfd,0xf0,0x51,0xc2,0x3b,0x6f,0xd8,0xcd,0x1d,0x81,0x2c,0xde,0xf2,0xd2,0x04,0x43,0x5c,0xdc,0x44,0x49,0x71,0x2a,0x09,0x57,0xcc,0xe8,0x5b,0x63,0xf1,0x7f,0xd6,0x5f,0x9a,0x5d,0xa9,0x81,0x56,0xc7,0x4c,0x9d,0xe6,0x2b,0xe9,0x57,0xf2,0x20,0xde,0x4c,0x02,0xf8,0xb7,0xf5,0x2d,0x07,0xfb,0x20,0x2a,0x4f,0x20,0x79,0xb0,0xeb,0x30,0x3d,0x3b,0x14,0xc8,0x30,0x2e,0x65,0xbd,0x5a,0x15,0x89,0x75,0x31,0x5c,0x6d,0x8f,0x31,0x3c,0x3c,0x65,0x1f,0x16,0x79,0xc2,0x17,0xfb,0x70,0x25},+	{0x75,0x15,0xb6,0x2c,0x7f,0x36,0xfa,0x3e,0x6c,0x02,0xd6,0x1c,0x76,0x6f,0xf9,0xf5,0x62,0x25,0xb5,0x65,0x2a,0x14,0xc7,0xe8,0xcd,0x0a,0x03,0x53,0xea,0x65,0xcb,0x3d,0x5a,0x24,0xb8,0x0b,0x55,0xa9,0x2e,0x19,0xd1,0x50,0x90,0x8f,0xa8,0xfb,0xe6,0xc8,0x35,0xc9,0xa4,0x88,0x2d,0xea,0x86,0x79,0x68,0x86,0x01,0xde,0x91,0x5f,0x1c,0x24,0xaa,0x6c,0xde,0x40,0x29,0x17,0xd8,0x28,0x3a,0x73,0xd9,0x22,0xf0,0x2c,0xbf,0x8f,0xd1,0x01,0x5b,0x23,0xdd,0xfc,0xd7,0x16,0xe5,0xf0,0xcd,0x5f,0xdd,0x0e,0x42,0x08},+	{0x4a,0xfa,0x62,0x83,0xab,0x20,0xff,0xcd,0x6e,0x3e,0x1a,0xe2,0xd4,0x18,0xe1,0x57,0x2b,0xe6,0x39,0xfc,0x17,0x96,0x17,0xe3,0xfd,0x69,0x17,0xbc,0xef,0x53,0x9a,0x0d,0xce,0x10,0xf4,0x04,0x4e,0xc3,0x58,0x03,0x85,0x06,0x6e,0x27,0x5a,0x5b,0x13,0xb6,0x21,0x15,0xb9,0xeb,0xc7,0x70,0x96,0x5d,0x9c,0x88,0xdb,0x21,0xf3,0x54,0xd6,0x04,0xd5,0xb5,0xbd,0xdd,0x16,0xc1,0x7d,0x5e,0x2d,0xdd,0xa5,0x8d,0xb6,0xde,0x54,0x29,0x92,0xa2,0x34,0x33,0x17,0x08,0xb6,0x1c,0xd7,0x1a,0x99,0x18,0x26,0x4f,0x7a,0x4a},+	{0x95,0x5f,0xb1,0x5f,0x02,0x18,0xa7,0xf4,0x8f,0x1b,0x5c,0x6b,0x34,0x5f,0xf6,0x3d,0x12,0x11,0xe0,0x00,0x85,0xf0,0xfc,0xcd,0x48,0x18,0xd3,0xdd,0x4c,0x0c,0xb5,0x11,0x4b,0x2a,0x37,0xaf,0x91,0xb2,0xc3,0x24,0xf2,0x47,0x81,0x71,0x70,0x82,0xda,0x93,0xf2,0x9e,0x89,0x86,0x64,0x85,0x84,0xdd,0x33,0xee,0xe0,0x23,0x42,0x31,0x96,0x4a,0xd6,0xff,0xa4,0x08,0x44,0x27,0xe8,0xa6,0xd9,0x76,0x15,0x9c,0x7e,0x17,0x8e,0x73,0xf2,0xb3,0x02,0x3d,0xb6,0x48,0x33,0x77,0x51,0xcc,0x6b,0xce,0x4d,0xce,0x4b,0x4f},+	{0x84,0x25,0x24,0xe2,0x5a,0xce,0x1f,0xa7,0x9e,0x8a,0xf5,0x92,0x56,0x72,0xea,0x26,0xf4,0x3c,0xea,0x1c,0xd7,0x09,0x1a,0xd2,0xe6,0x01,0x1c,0xb7,0x14,0xdd,0xfc,0x73,0x6f,0x0b,0x9d,0xc4,0x6e,0x61,0xe2,0x30,0x17,0x23,0xec,0xca,0x8f,0x71,0x56,0xe4,0xa6,0x4f,0x6b,0xf2,0x9b,0x40,0xeb,0x48,0x37,0x5f,0x59,0x61,0xe5,0xce,0x42,0x30,0x41,0xac,0x9b,0x44,0x79,0x70,0x7e,0x42,0x0a,0x31,0xe2,0xbc,0x6d,0xe3,0x5a,0x85,0x7c,0x1a,0x84,0x5f,0x21,0x76,0xae,0x4c,0xd6,0xe1,0x9c,0x9a,0x0c,0x74,0x9e,0x38},+	{0xce,0xb9,0xdc,0x34,0xae,0xb3,0xfc,0x64,0xad,0xd0,0x48,0xe3,0x23,0x03,0x50,0x97,0x1b,0x38,0xc6,0x62,0x7d,0xf0,0xb3,0x45,0x88,0x67,0x5a,0x46,0x79,0x53,0x54,0x61,0x28,0xac,0x0e,0x57,0xf6,0x78,0xbd,0xc9,0xe1,0x9c,0x91,0x27,0x32,0x0b,0x5b,0xe5,0xed,0x91,0x9b,0xa1,0xab,0x3e,0xfc,0x65,0x90,0x36,0x26,0xd6,0xe5,0x25,0xc4,0x25,0x6e,0xde,0xd7,0xf1,0xa6,0x06,0x3e,0x3f,0x08,0x23,0x06,0x8e,0x27,0x76,0xf9,0x3e,0x77,0x6c,0x8a,0x4e,0x26,0xf6,0x14,0x8c,0x59,0x47,0x48,0x15,0x89,0xa0,0x39,0x65},+	{0x73,0xf7,0xd2,0xc3,0x74,0x1f,0xd2,0xe9,0x45,0x68,0xc4,0x25,0x41,0x54,0x50,0xc1,0x33,0x9e,0xb9,0xf9,0xe8,0x5c,0x4e,0x62,0x6c,0x18,0xcd,0xc5,0xaa,0xe4,0xc5,0x11,0x19,0x4a,0xbb,0x14,0xd4,0xdb,0xc4,0xdd,0x8e,0x4f,0x42,0x98,0x3c,0xbc,0xb2,0x19,0x69,0x71,0xca,0x36,0xd7,0x9f,0xa8,0x48,0x90,0xbd,0x19,0xf0,0x0e,0x32,0x65,0x0f,0xc6,0xe0,0xfd,0xca,0xb1,0xd1,0x86,0xd4,0x81,0x51,0x3b,0x16,0xe3,0xe6,0x3f,0x4f,0x9a,0x93,0xf2,0xfa,0x0d,0xaf,0xa8,0x59,0x2a,0x07,0x33,0xec,0xbd,0xc7,0xab,0x4c},+	{0x2e,0x0a,0x9c,0x08,0x24,0x96,0x9e,0x23,0x38,0x47,0xfe,0x3a,0xc0,0xc4,0x48,0xc7,0x2a,0xa1,0x4f,0x76,0x2a,0xed,0xdb,0x17,0x82,0x85,0x1c,0x32,0xf0,0x93,0x9b,0x63,0x89,0xd2,0x78,0x3f,0x8f,0x78,0x8f,0xc0,0x9f,0x4d,0x40,0xa1,0x2c,0xa7,0x30,0xfe,0x9d,0xcc,0x65,0xcf,0xfc,0x8b,0x77,0xf2,0x21,0x20,0xcb,0x5a,0x16,0x98,0xe4,0x7e,0xc3,0xa1,0x11,0x91,0xe3,0x08,0xd5,0x7b,0x89,0x74,0x90,0x80,0xd4,0x90,0x2b,0x2b,0x19,0xfd,0x72,0xae,0xc2,0xae,0xd2,0xe7,0xa6,0x02,0xb6,0x85,0x3c,0x49,0xdf,0x0e},+	{0x68,0x5a,0x9b,0x59,0x58,0x81,0xcc,0xae,0x0e,0xe2,0xad,0xeb,0x0f,0x4f,0x57,0xea,0x07,0x7f,0xb6,0x22,0x74,0x1d,0xe4,0x4f,0xb4,0x4f,0x9d,0x01,0xe3,0x92,0x3b,0x40,0x13,0x41,0x76,0x84,0xd2,0xc4,0x67,0x67,0x35,0xf8,0xf5,0xf7,0x3f,0x40,0x90,0xa0,0xde,0xbe,0xe6,0xca,0xfa,0xcf,0x8f,0x1c,0x69,0xa3,0xdf,0xd1,0x54,0x0c,0xc0,0x04,0xf8,0x5c,0x46,0x8b,0x81,0x2f,0xc2,0x4d,0xf8,0xef,0x80,0x14,0x5a,0xf3,0xa0,0x71,0x57,0xd6,0xc7,0x04,0xad,0xbf,0xe8,0xae,0xf4,0x76,0x61,0xb2,0x2a,0xb1,0x5b,0x35},+	{0xf4,0xbb,0x93,0x74,0xcc,0x64,0x1e,0xa7,0xc3,0xb0,0xa3,0xec,0xd9,0x84,0xbd,0xe5,0x85,0xe7,0x05,0xfa,0x0c,0xc5,0x6b,0x0a,0x12,0xc3,0x2e,0x18,0x32,0x81,0x9b,0x0f,0x18,0x73,0x8c,0x5a,0xc7,0xda,0x01,0xa3,0x11,0xaa,0xce,0xb3,0x9d,0x03,0x90,0xed,0x2d,0x3f,0xae,0x3b,0xbf,0x7c,0x07,0x6f,0x8e,0xad,0x52,0xe0,0xf8,0xea,0x18,0x75,0x32,0x6c,0x7f,0x1b,0xc4,0x59,0x88,0xa4,0x98,0x32,0x38,0xf4,0xbc,0x60,0x2d,0x0f,0xd9,0xd1,0xb1,0xc9,0x29,0xa9,0x15,0x18,0xc4,0x55,0x17,0xbb,0x1b,0x87,0xc3,0x47},+	{0x48,0x4f,0xec,0x71,0x97,0x53,0x44,0x51,0x6e,0x5d,0x8c,0xc9,0x7d,0xb1,0x05,0xf8,0x6b,0xc6,0xc3,0x47,0x1a,0xc1,0x62,0xf7,0xdc,0x99,0x46,0x76,0x85,0x9b,0xb8,0x00,0xb0,0x66,0x50,0xc8,0x50,0x5d,0xe6,0xfb,0xb0,0x99,0xa2,0xb3,0xb0,0xc4,0xec,0x62,0xe0,0xe8,0x1a,0x44,0xea,0x54,0x37,0xe5,0x5f,0x8d,0xd4,0xe8,0x2c,0xa0,0xfe,0x08,0xd0,0xea,0xde,0x68,0x76,0xdd,0x4d,0x82,0x23,0x5d,0x68,0x4b,0x20,0x45,0x64,0xc8,0x65,0xd6,0x89,0x5d,0xcd,0xcf,0x14,0xb5,0x37,0xd5,0x75,0x4f,0xa7,0x29,0x38,0x47},+	{0x18,0xc4,0x79,0x46,0x75,0xda,0xd2,0x82,0xf0,0x8d,0x61,0xb2,0xd8,0xd7,0x3b,0xe6,0x0a,0xeb,0x47,0xac,0x24,0xef,0x5e,0x35,0xb4,0xc6,0x33,0x48,0x4c,0x68,0x78,0x20,0xc9,0x02,0x39,0xad,0x3a,0x53,0xd9,0x23,0x8f,0x58,0x03,0xef,0xce,0xdd,0xc2,0x64,0xb4,0x2f,0xe1,0xcf,0x90,0x73,0x25,0x15,0x90,0xd3,0xe4,0x44,0x4d,0x8b,0x66,0x6c,0x0c,0x82,0x78,0x7a,0x21,0xcf,0x48,0x3b,0x97,0x3e,0x27,0x81,0xb2,0x0a,0x6a,0xf7,0x7b,0xed,0x8e,0x8c,0xa7,0x65,0x6c,0xa9,0x3f,0x43,0x8a,0x4f,0x05,0xa6,0x11,0x74},+	{0x6d,0xc8,0x9d,0xb9,0x32,0x9d,0x65,0x4d,0x15,0xf1,0x3a,0x60,0x75,0xdc,0x4c,0x04,0x88,0xe4,0xc2,0xdc,0x2c,0x71,0x4c,0xb3,0xff,0x34,0x81,0xfb,0x74,0x65,0x13,0x7c,0xb4,0x75,0xb1,0x18,0x3d,0xe5,0x9a,0x57,0x02,0xa1,0x92,0xf3,0x59,0x31,0x71,0x68,0xf5,0x35,0xef,0x1e,0xba,0xec,0x55,0x84,0x8f,0x39,0x8c,0x45,0x72,0xa8,0xc9,0x1e,0x9b,0x50,0xa2,0x00,0xd4,0xa4,0xe6,0xb8,0xb4,0x82,0xc8,0x0b,0x02,0xd7,0x81,0x9b,0x61,0x75,0x95,0xf1,0x9b,0xcc,0xe7,0x57,0x60,0x64,0xcd,0xc7,0xa5,0x88,0xdd,0x3a},+	{0xf2,0xdc,0x35,0xb6,0x70,0x57,0x89,0xab,0xbc,0x1f,0x6c,0xf6,0x6c,0xef,0xdf,0x02,0x87,0xd1,0xb6,0xbe,0x68,0x02,0x53,0x85,0x74,0x9e,0x87,0xcc,0xfc,0x29,0x99,0x24,0x46,0x30,0x39,0x59,0xd4,0x98,0xc2,0x85,0xec,0x59,0xf6,0x5f,0x98,0x35,0x7e,0x8f,0x3a,0x6e,0xf6,0xf2,0x2a,0xa2,0x2c,0x1d,0x20,0xa7,0x06,0xa4,0x31,0x11,0xba,0x61,0x29,0x90,0x95,0x16,0xf1,0xa0,0xd0,0xa3,0x89,0xbd,0x7e,0xba,0x6c,0x6b,0x3b,0x02,0x07,0x33,0x78,0x26,0x3e,0x5a,0xf1,0x7b,0xe7,0xec,0xd8,0xbb,0x0c,0x31,0x20,0x56},+	{0x43,0xd6,0x34,0x49,0x43,0x93,0x89,0x52,0xf5,0x22,0x12,0xa5,0x06,0xf8,0xdb,0xb9,0x22,0x1c,0xf4,0xc3,0x8f,0x87,0x6d,0x8f,0x30,0x97,0x9d,0x4d,0x2a,0x6a,0x67,0x37,0xd6,0x85,0xe2,0x77,0xf4,0xb5,0x46,0x66,0x93,0x61,0x8f,0x6c,0x67,0xff,0xe8,0x40,0xdd,0x94,0xb5,0xab,0x11,0x73,0xec,0xa6,0x4d,0xec,0x8c,0x65,0xf3,0x46,0xc8,0x7e,0xc7,0x2e,0xa2,0x1d,0x3f,0x8f,0x5e,0x9b,0x13,0xcd,0x01,0x6c,0x77,0x1d,0x0f,0x13,0xb8,0x9f,0x98,0xa2,0xcf,0x8f,0x4c,0x21,0xd5,0x9d,0x9b,0x39,0x23,0xf7,0xaa,0x6d},+	{0x47,0xbe,0x3d,0xeb,0x62,0x75,0x3a,0x5f,0xb8,0xa0,0xbd,0x8e,0x54,0x38,0xea,0xf7,0x99,0x72,0x74,0x45,0x31,0xe5,0xc3,0x00,0x51,0xd5,0x27,0x16,0xe7,0xe9,0x04,0x13,0xa2,0x8e,0xad,0xac,0xbf,0x04,0x3b,0x58,0x84,0xe8,0x8b,0x14,0xe8,0x43,0xb7,0x29,0xdb,0xc5,0x10,0x08,0x3b,0x58,0x1e,0x2b,0xaa,0xbb,0xb3,0x8e,0xe5,0x49,0x54,0x2b,0xfe,0x9c,0xdc,0x6a,0xd2,0x14,0x98,0x78,0x0b,0xdd,0x48,0x8b,0x3f,0xab,0x1b,0x3c,0x0a,0xc6,0x79,0xf9,0xff,0xe1,0x0f,0xda,0x93,0xd6,0x2d,0x7c,0x2d,0xde,0x68,0x44},+	{0x9e,0x46,0x19,0x94,0x5e,0x35,0xbb,0x51,0x54,0xc7,0xdd,0x23,0x4c,0xdc,0xe6,0x33,0x62,0x99,0x7f,0x44,0xd6,0xb6,0xa5,0x93,0x63,0xbd,0x44,0xfb,0x6f,0x7c,0xce,0x6c,0xce,0x07,0x63,0xf8,0xc6,0xd8,0x9a,0x4b,0x28,0x0c,0x5d,0x43,0x31,0x35,0x11,0x21,0x2c,0x77,0x7a,0x65,0xc5,0x66,0xa8,0xd4,0x52,0x73,0x24,0x63,0x7e,0x42,0xa6,0x5d,0xca,0x22,0xac,0xde,0x88,0xc6,0x94,0x1a,0xf8,0x1f,0xae,0xbb,0xf7,0x6e,0x06,0xb9,0x0f,0x58,0x59,0x8d,0x38,0x8c,0xad,0x88,0xa8,0x2c,0x9f,0xe7,0xbf,0x9a,0xf2,0x58},+	{0x68,0x3e,0xe7,0x8d,0xab,0xcf,0x0e,0xe9,0xa5,0x76,0x7e,0x37,0x9f,0x6f,0x03,0x54,0x82,0x59,0x01,0xbe,0x0b,0x5b,0x49,0xf0,0x36,0x1e,0xf4,0xa7,0xc4,0x29,0x76,0x57,0xf6,0xcd,0x0e,0x71,0xbf,0x64,0x5a,0x4b,0x3c,0x29,0x2c,0x46,0x38,0xe5,0x4c,0xb1,0xb9,0x3a,0x0b,0xd5,0x56,0xd0,0x43,0x36,0x70,0x48,0x5b,0x18,0x24,0x37,0xf9,0x6a,0x88,0xa8,0xc6,0x09,0x45,0x02,0x20,0x32,0x73,0x89,0x55,0x4b,0x13,0x36,0xe0,0xd2,0x9f,0x28,0x33,0x3c,0x23,0x36,0xe2,0x83,0x8f,0xc1,0xae,0x0c,0xbb,0x25,0x1f,0x70},+	{0xed,0x6c,0x61,0xe4,0xf8,0xb0,0xa8,0xc3,0x7d,0xa8,0x25,0x9e,0x0e,0x66,0x00,0xf7,0x9c,0xa5,0xbc,0xf4,0x1f,0x06,0xe3,0x61,0xe9,0x0b,0xc4,0xbd,0xbf,0x92,0x0c,0x2e,0x13,0xc1,0xbe,0x7c,0xd9,0xf6,0x18,0x9d,0xe4,0xdb,0xbf,0x74,0xe6,0x06,0x4a,0x84,0xd6,0x60,0x4e,0xac,0x22,0xb5,0xf5,0x20,0x51,0x5e,0x95,0x50,0xc0,0x5b,0x0a,0x72,0x35,0x5a,0x80,0x9b,0x43,0x09,0x3f,0x0c,0xfc,0xab,0x42,0x62,0x37,0x8b,0x4e,0xe8,0x46,0x93,0x22,0x5c,0xf3,0x17,0x14,0x69,0xec,0xf0,0x4e,0x14,0xbb,0x9c,0x9b,0x0e},+	{0xad,0x20,0x57,0xfb,0x8f,0xd4,0xba,0xfb,0x0e,0x0d,0xf9,0xdb,0x6b,0x91,0x81,0xee,0xbf,0x43,0x55,0x63,0x52,0x31,0x81,0xd4,0xd8,0x7b,0x33,0x3f,0xeb,0x04,0x11,0x22,0xee,0xbe,0xb1,0x5d,0xd5,0x9b,0xee,0x8d,0xb9,0x3f,0x72,0x0a,0x37,0xab,0xc3,0xc9,0x91,0xd7,0x68,0x1c,0xbf,0xf1,0xa8,0x44,0xde,0x3c,0xfd,0x1c,0x19,0x44,0x6d,0x36,0x14,0x8c,0xbc,0xf2,0x43,0x17,0x3c,0x9e,0x3b,0x6c,0x85,0xb5,0xfc,0x26,0xda,0x2e,0x97,0xfb,0xa7,0x68,0x0e,0x2f,0xb8,0xcc,0x44,0x32,0x59,0xbc,0xe6,0xa4,0x67,0x41},+	{0x00,0x27,0xf6,0x76,0x28,0x9d,0x3b,0x64,0xeb,0x68,0x76,0x0e,0x40,0x9d,0x1d,0x5d,0x84,0x06,0xfc,0x21,0x03,0x43,0x4b,0x1b,0x6a,0x24,0x55,0x22,0x7e,0xbb,0x38,0x79,0xee,0x8f,0xce,0xf8,0x65,0x26,0xbe,0xc2,0x2c,0xd6,0x80,0xe8,0x14,0xff,0x67,0xe9,0xee,0x4e,0x36,0x2f,0x7e,0x6e,0x2e,0xf1,0xf6,0xd2,0x7e,0xcb,0x70,0x33,0xb3,0x34,0xcc,0xd6,0x81,0x86,0xee,0x91,0xc5,0xcd,0x53,0xa7,0x85,0xed,0x9c,0x10,0x02,0xce,0x83,0x88,0x80,0x58,0xc1,0x85,0x74,0xed,0xe4,0x65,0xfe,0x2d,0x6e,0xfc,0x76,0x11},+	{0x9b,0x61,0x9c,0x5b,0xd0,0x6c,0xaf,0xb4,0x80,0x84,0xa5,0xb2,0xf4,0xc9,0xdf,0x2d,0xc4,0x4d,0xe9,0xeb,0x02,0xa5,0x4f,0x3d,0x34,0x5f,0x7d,0x67,0x4c,0x3a,0xfc,0x08,0xb8,0x0e,0x77,0x49,0x89,0xe2,0x90,0xdb,0xa3,0x40,0xf4,0xac,0x2a,0xcc,0xfb,0x98,0x9b,0x87,0xd7,0xde,0xfe,0x4f,0x35,0x21,0xb6,0x06,0x69,0xf2,0x54,0x3e,0x6a,0x1f,0xea,0x34,0x07,0xd3,0x99,0xc1,0xa4,0x60,0xd6,0x5c,0x16,0x31,0xb6,0x85,0xc0,0x40,0x95,0x82,0x59,0xf7,0x23,0x3e,0x33,0xe2,0xd1,0x00,0xb9,0x16,0x01,0xad,0x2f,0x4f},+	{0x54,0x4e,0xae,0x94,0x41,0xb2,0xbe,0x44,0x6c,0xef,0x57,0x18,0x51,0x1c,0x54,0x5f,0x98,0x04,0x8d,0x36,0x2d,0x6b,0x1e,0xa6,0xab,0xf7,0x2e,0x97,0xa4,0x84,0x54,0x44,0x38,0xb6,0x3b,0xb7,0x1d,0xd9,0x2c,0x96,0x08,0x9c,0x12,0xfc,0xaa,0x77,0x05,0xe6,0x89,0x16,0xb6,0xf3,0x39,0x9b,0x61,0x6f,0x81,0xee,0x44,0x29,0x5f,0x99,0x51,0x34,0x7c,0x7d,0xea,0x9f,0xd0,0xfc,0x52,0x91,0xf6,0x5c,0x93,0xb0,0x94,0x6c,0x81,0x4a,0x40,0x5c,0x28,0x47,0xaa,0x9a,0x8e,0x25,0xb7,0x93,0x28,0x04,0xa6,0x9c,0xb8,0x10},+	{0x9c,0x28,0x18,0x97,0x49,0x47,0x59,0x3d,0x26,0x3f,0x53,0x24,0xc5,0xf8,0xeb,0x12,0x15,0xef,0xc3,0x14,0xcb,0xbf,0x62,0x02,0x8e,0x51,0xb7,0x77,0xd5,0x78,0xb8,0x20,0x6e,0xf0,0x45,0x5a,0xbe,0x41,0x39,0x75,0x65,0x5f,0x9c,0x6d,0xed,0xae,0x7c,0xd0,0xb6,0x51,0xff,0x72,0x9c,0x6b,0x77,0x11,0xa9,0x4d,0x0d,0xef,0xd9,0xd1,0xd2,0x17,0x6a,0x3e,0x3f,0x07,0x18,0xaf,0xf2,0x27,0x69,0x10,0x52,0xd7,0x19,0xe5,0x3f,0xfd,0x22,0x00,0xa6,0x3c,0x2c,0xb7,0xe3,0x22,0xa7,0xc6,0x65,0xcc,0x63,0x4f,0x21,0x72},+	{0x93,0xa6,0x07,0x53,0x40,0x7f,0xe3,0xb4,0x95,0x67,0x33,0x2f,0xd7,0x14,0xa7,0xab,0x99,0x10,0x76,0x73,0xa7,0xd0,0xfb,0xd6,0xc9,0xcb,0x71,0x81,0xc5,0x48,0xdf,0x5f,0xc9,0x29,0x3b,0xf4,0xb9,0xb7,0x9d,0x1d,0x75,0x8f,0x51,0x4f,0x4a,0x82,0x05,0xd6,0xc4,0x9d,0x2f,0x31,0xbd,0x72,0xc0,0xf2,0xb0,0x45,0x15,0x5a,0x85,0xac,0x24,0x1f,0xaa,0x05,0x95,0x8e,0x32,0x08,0xd6,0x24,0xee,0x20,0x14,0x0c,0xd1,0xc1,0x48,0x47,0xa2,0x25,0xfb,0x06,0x5c,0xe4,0xff,0xc7,0xe6,0x95,0xe3,0x2a,0x9e,0x73,0xba,0x00},+	{0xd6,0x90,0x87,0x5c,0xde,0x98,0x2e,0x59,0xdf,0xa2,0xc2,0x45,0xd3,0xb7,0xbf,0xe5,0x22,0x99,0xb4,0xf9,0x60,0x3b,0x5a,0x11,0xf3,0x78,0xad,0x67,0x3e,0x3a,0x28,0x03,0x26,0xbb,0x88,0xea,0xf5,0x26,0x44,0xae,0xfb,0x3b,0x97,0x84,0xd9,0x79,0x06,0x36,0x50,0x4e,0x69,0x26,0x0c,0x03,0x9f,0x5c,0x26,0xd2,0x18,0xd5,0xe7,0x7d,0x29,0x72,0x39,0xb9,0x0c,0xbe,0xc7,0x1d,0x24,0x48,0x80,0x30,0x63,0x8b,0x4d,0x9b,0xf1,0x32,0x08,0x93,0x28,0x02,0x0d,0xc9,0xdf,0xd3,0x45,0x19,0x27,0x46,0x68,0x29,0xe1,0x05},+	{0x5a,0x49,0x9c,0x2d,0xb3,0xee,0x82,0xba,0x7c,0xb9,0x2b,0xf1,0xfc,0xc8,0xef,0xce,0xe0,0xd1,0xb5,0x93,0xae,0xab,0x2d,0xb0,0x9b,0x8d,0x69,0x13,0x9c,0x0c,0xc0,0x39,0x50,0x45,0x2c,0x24,0xc8,0xbb,0xbf,0xad,0xd9,0x81,0x30,0xd0,0xec,0x0c,0xc8,0xbc,0x92,0xdf,0xc8,0xf5,0xa6,0x66,0x35,0x84,0x4c,0xce,0x58,0x82,0xd3,0x25,0xcf,0x78,0x68,0x9d,0x48,0x31,0x8e,0x6b,0xae,0x15,0x87,0xf0,0x2b,0x9c,0xab,0x1c,0x85,0xaa,0x05,0xfa,0x4e,0xf0,0x97,0x5a,0xa7,0xc9,0x32,0xf8,0x3f,0x6b,0x07,0x52,0x6b,0x00},+	{0x1c,0x78,0x95,0x9d,0xe1,0xcf,0xe0,0x29,0xe2,0x10,0x63,0x96,0x18,0xdf,0x81,0xb6,0x39,0x6b,0x51,0x70,0xd3,0x39,0xdf,0x57,0x22,0x61,0xc7,0x3b,0x44,0xe3,0x57,0x4d,0x2d,0x08,0xce,0xb9,0x16,0x7e,0xcb,0xf5,0x29,0xbc,0x7a,0x41,0x4c,0xf1,0x07,0x34,0xab,0xa7,0xf4,0x2b,0xce,0x6b,0xb3,0xd4,0xce,0x75,0x9f,0x1a,0x56,0xe9,0xe2,0x7d,0xcb,0x5e,0xa5,0xb6,0xf4,0xd4,0x70,0xde,0x99,0xdb,0x85,0x5d,0x7f,0x52,0x01,0x48,0x81,0x9a,0xee,0xd3,0x40,0xc4,0xc9,0xdb,0xed,0x29,0x60,0x1a,0xaf,0x90,0x2a,0x6b},+	{0x97,0x1e,0xe6,0x9a,0xfc,0xf4,0x23,0x69,0xd1,0x5f,0x3f,0xe0,0x1d,0x28,0x35,0x57,0x2d,0xd1,0xed,0xe6,0x43,0xae,0x64,0xa7,0x4a,0x3e,0x2d,0xd1,0xe9,0xf4,0xd8,0x5f,0x0a,0xd8,0xb2,0x5b,0x24,0xf3,0xeb,0x77,0x9b,0x07,0xb9,0x2f,0x47,0x1b,0x30,0xd8,0x33,0x73,0xee,0x4c,0xf2,0xe6,0x47,0xc6,0x09,0x21,0x6c,0x27,0xc8,0x12,0x58,0x46,0xd9,0x62,0x10,0x2a,0xb2,0xbe,0x43,0x4d,0x16,0xdc,0x31,0x38,0x75,0xfb,0x65,0x70,0xd7,0x68,0x29,0xde,0x7b,0x4a,0x0d,0x18,0x90,0x67,0xb1,0x1c,0x2b,0x2c,0xb3,0x05},+	{0xfd,0xa8,0x4d,0xd2,0xcc,0x5e,0xc0,0xc8,0x83,0xef,0xdf,0x05,0xac,0x1a,0xcf,0xa1,0x61,0xcd,0xf9,0x7d,0xf2,0xef,0xbe,0xdb,0x99,0x1e,0x47,0x7b,0xa3,0x56,0x55,0x3b,0x95,0x81,0xd5,0x7a,0x2c,0xa4,0xfc,0xf7,0xcc,0xf3,0x33,0x43,0x6e,0x28,0x14,0x32,0x9d,0x97,0x0b,0x34,0x0d,0x9d,0xc2,0xb6,0xe1,0x07,0x73,0x56,0x48,0x1a,0x77,0x31,0x82,0xd4,0x4d,0xe1,0x24,0xc5,0xb0,0x32,0xb6,0xa4,0x2b,0x1a,0x54,0x51,0xb3,0xed,0xf3,0x5a,0x2b,0x28,0x48,0x60,0xd1,0xa3,0xeb,0x36,0x73,0x7a,0xd2,0x79,0xc0,0x4f},+	{0x7f,0x2f,0xbf,0x89,0xb0,0x38,0xc9,0x51,0xa7,0xe9,0xdf,0x02,0x65,0xbd,0x97,0x24,0x53,0xe4,0x80,0x78,0x9c,0xc0,0xff,0xff,0x92,0x8e,0xf9,0xca,0xce,0x67,0x45,0x12,0x0d,0xc5,0x86,0x0c,0x44,0x8b,0x34,0xdc,0x51,0xe6,0x94,0xcc,0xc9,0xcb,0x37,0x13,0xb9,0x3c,0x3e,0x64,0x4d,0xf7,0x22,0x64,0x08,0xcd,0xe3,0xba,0xc2,0x70,0x11,0x24,0xb4,0x73,0xc4,0x0a,0x86,0xab,0xf9,0x3f,0x35,0xe4,0x13,0x01,0xee,0x1d,0x91,0xf0,0xaf,0xc4,0xc6,0xeb,0x60,0x50,0xe7,0x4a,0x0d,0x00,0x87,0x6c,0x96,0x12,0x86,0x3f},+	{0xde,0x0d,0x2a,0x78,0xc9,0x0c,0x9a,0x55,0x85,0x83,0x71,0xea,0xb2,0xcd,0x1d,0x55,0x8c,0x23,0xef,0x31,0x5b,0x86,0x62,0x7f,0x3d,0x61,0x73,0x79,0x76,0xa7,0x4a,0x50,0x13,0x8d,0x04,0x36,0xfa,0xfc,0x18,0x9c,0xdd,0x9d,0x89,0x73,0xb3,0x9d,0x15,0x29,0xaa,0xd0,0x92,0x9f,0x0b,0x35,0x9f,0xdc,0xd4,0x19,0x8a,0x87,0xee,0x7e,0xf5,0x26,0xb1,0xef,0x87,0x56,0xd5,0x2c,0xab,0x0c,0x7b,0xf1,0x7a,0x24,0x62,0xd1,0x80,0x51,0x67,0x24,0x5a,0x4f,0x34,0x5a,0xc1,0x85,0x69,0x30,0xba,0x9d,0x3d,0x94,0x41,0x40},+	{0x96,0xcc,0xeb,0x43,0xba,0xee,0xc0,0xc3,0xaf,0x9c,0xea,0x26,0x9c,0x9c,0x74,0x8d,0xc6,0xcc,0x77,0x1c,0xee,0x95,0xfa,0xd9,0x0f,0x34,0x84,0x76,0xd9,0xa1,0x20,0x14,0xdd,0xaa,0x6c,0xa2,0x43,0x77,0x21,0x4b,0xce,0xb7,0x8a,0x64,0x24,0xb4,0xa6,0x47,0xe3,0xc9,0xfb,0x03,0x7a,0x4f,0x1d,0xcb,0x19,0xd0,0x00,0x98,0x42,0x31,0xd9,0x12,0x4f,0x59,0x37,0xd3,0x99,0x77,0xc6,0x00,0x7b,0xa4,0x3a,0xb2,0x40,0x51,0x3c,0x5e,0x95,0xf3,0x5f,0xe3,0x54,0x28,0x18,0x44,0x12,0xa0,0x59,0x43,0x31,0x92,0x4f,0x1b},+	{0x51,0x09,0x15,0x89,0x9d,0x10,0x5c,0x3e,0x6a,0x69,0xe9,0x2d,0x91,0xfa,0xce,0x39,0x20,0x30,0x5f,0x97,0x3f,0xe4,0xea,0x20,0xae,0x2d,0x13,0x7f,0x2a,0x57,0x9b,0x23,0xb1,0x66,0x98,0xa4,0x30,0x30,0xcf,0x33,0x59,0x48,0x5f,0x21,0xd2,0x73,0x1f,0x25,0xf6,0xf4,0xde,0x51,0x40,0xaa,0x82,0xab,0xf6,0x23,0x9a,0x6f,0xd5,0x91,0xf1,0x5f,0x68,0x90,0x2d,0xac,0x33,0xd4,0x9e,0x81,0x23,0x85,0xc9,0x5f,0x79,0xab,0x83,0x28,0x3d,0xeb,0x93,0x55,0x80,0x72,0x45,0xef,0xcb,0x36,0x8f,0x75,0x6a,0x52,0x0c,0x02},+	{0xbc,0xdb,0xd8,0x9e,0xf8,0x34,0x98,0x77,0x6c,0xa4,0x7c,0xdc,0xf9,0xaa,0xf2,0xc8,0x74,0xb0,0xe1,0xa3,0xdc,0x4c,0x52,0xa9,0x77,0x38,0x31,0x15,0x46,0xcc,0xaa,0x02,0x89,0xcc,0x42,0xf0,0x59,0xef,0x31,0xe9,0xb6,0x4b,0x12,0x8e,0x9d,0x9c,0x58,0x2c,0x97,0x59,0xc7,0xae,0x8a,0xe1,0xc8,0xad,0x0c,0xc5,0x02,0x56,0x0a,0xfe,0x2c,0x45,0xdf,0x77,0x78,0x64,0xa0,0xf7,0xa0,0x86,0x9f,0x7c,0x60,0x0e,0x27,0x64,0xc4,0xbb,0xc9,0x11,0xfb,0xf1,0x25,0xea,0x17,0xab,0x7b,0x87,0x4b,0x30,0x7b,0x7d,0xfb,0x4c},+	{0xfe,0x75,0x9b,0xb8,0x6c,0x3d,0xb4,0x72,0x80,0xdc,0x6a,0x9c,0xd9,0x94,0xc6,0x54,0x9f,0x4c,0xe3,0x3e,0x37,0xaa,0xc3,0xb8,0x64,0x53,0x07,0x39,0x2b,0x62,0xb4,0x14,0x12,0xef,0x89,0x97,0xc2,0x99,0x86,0xe2,0x0d,0x19,0x57,0xdf,0x71,0xcd,0x6e,0x2b,0xd0,0x70,0xc9,0xec,0x57,0xc8,0x43,0xc3,0xc5,0x3a,0x4d,0x43,0xbc,0x4c,0x1d,0x5b,0x26,0x9f,0x0a,0xcc,0x15,0x26,0xfb,0xb6,0xe5,0xcc,0x8d,0xb8,0x2b,0x0e,0x4f,0x3a,0x05,0xa7,0x69,0x33,0x8b,0x49,0x01,0x13,0xd1,0x2d,0x59,0x58,0x12,0xf7,0x98,0x2f},+	{0x56,0x9e,0x0f,0xb5,0x4c,0xa7,0x94,0x0c,0x20,0x13,0x8e,0x8e,0xa9,0xf4,0x1f,0x5b,0x67,0x0f,0x30,0x82,0x21,0xcc,0x2a,0x9a,0xf9,0xaa,0x06,0xd8,0x49,0xe2,0x6a,0x3a,0x01,0xa7,0x54,0x4f,0x44,0xae,0x12,0x2e,0xde,0xd7,0xcb,0xa9,0xf0,0x3e,0xfe,0xfc,0xe0,0x5d,0x83,0x75,0x0d,0x89,0xbf,0xce,0x54,0x45,0x61,0xe7,0xe9,0x62,0x80,0x1d,0x5a,0x7c,0x90,0xa9,0x85,0xda,0x7a,0x65,0x62,0x0f,0xb9,0x91,0xb5,0xa8,0x0e,0x1a,0xe9,0xb4,0x34,0xdf,0xfb,0x1d,0x0e,0x8d,0xf3,0x5f,0xf2,0xae,0xe8,0x8c,0x8b,0x29},+	{0xb2,0x0c,0xf7,0xef,0x53,0x79,0x92,0x2a,0x76,0x70,0x15,0x79,0x2a,0xc9,0x89,0x4b,0x6a,0xcf,0xa7,0x30,0x7a,0x45,0x18,0x94,0x85,0xe4,0x5c,0x4d,0x40,0xa8,0xb8,0x34,0xde,0x65,0x21,0x0a,0xea,0x72,0x7a,0x83,0xf6,0x79,0xcf,0x0b,0xb4,0x07,0xab,0x3f,0x70,0xae,0x38,0x77,0xc7,0x36,0x16,0x52,0xdc,0xd7,0xa7,0x03,0x18,0x27,0xa6,0x6b,0x35,0x33,0x69,0x83,0xb5,0xec,0x6e,0xc2,0xfd,0xfe,0xb5,0x63,0xdf,0x13,0xa8,0xd5,0x73,0x25,0xb2,0xa4,0x9a,0xaa,0x93,0xa2,0x6a,0x1c,0x5e,0x46,0xdd,0x2b,0xd6,0x71},+	{0x80,0xdf,0x78,0xd3,0x28,0xcc,0x33,0x65,0xb4,0xa4,0x0f,0x0a,0x79,0x43,0xdb,0xf6,0x5a,0xda,0x01,0xf7,0xf9,0x5f,0x64,0xe3,0xa4,0x2b,0x17,0xf3,0x17,0xf3,0xd5,0x74,0xf5,0x5e,0xf7,0xb1,0xda,0xb5,0x2d,0xcd,0xf5,0x65,0xb0,0x16,0xcf,0x95,0x7f,0xd7,0x85,0xf0,0x49,0x3f,0xea,0x1f,0x57,0x14,0x3d,0x2b,0x2b,0x26,0x21,0x36,0x33,0x1c,0x81,0xca,0xd9,0x67,0x54,0xe5,0x6f,0xa8,0x37,0x8c,0x29,0x2b,0x75,0x7c,0x8b,0x39,0x3b,0x62,0xac,0xe3,0x92,0x08,0x6d,0xda,0x8c,0xd9,0xe9,0x47,0x45,0xcc,0xeb,0x4a},+	{0xc9,0x01,0x6d,0x27,0x1b,0x07,0xf0,0x12,0x70,0x8c,0xc4,0x86,0xc5,0xba,0xb8,0xe7,0xa9,0xfb,0xd6,0x71,0x9b,0x12,0x08,0x53,0x92,0xb7,0x3d,0x5a,0xf9,0xfb,0x88,0x5d,0x10,0xb6,0x54,0x73,0x9e,0x8d,0x40,0x0b,0x6e,0x5b,0xa8,0x5b,0x53,0x32,0x6b,0x80,0x07,0xa2,0x58,0x4a,0x03,0x3a,0xe6,0xdb,0x2c,0xdf,0xa1,0xc9,0xdd,0xd9,0x3b,0x17,0xdf,0x72,0x58,0xfe,0x1e,0x0f,0x50,0x2b,0xc1,0x18,0x39,0xd4,0x2e,0x58,0xd6,0x58,0xe0,0x3a,0x67,0xc9,0x8e,0x27,0xed,0xe6,0x19,0xa3,0x9e,0xb1,0x13,0xcd,0xe1,0x06},+	{0x23,0x6f,0x16,0x6f,0x51,0xad,0xd0,0x40,0xbe,0x6a,0xab,0x1f,0x93,0x32,0x8e,0x11,0x8e,0x08,0x4d,0xa0,0x14,0x5e,0xe3,0x3f,0x66,0x62,0xe1,0x26,0x35,0x60,0x80,0x30,0x53,0x03,0x5b,0x9e,0x62,0xaf,0x2b,0x47,0x47,0x04,0x8d,0x27,0x90,0x0b,0xaa,0x3b,0x27,0xbf,0x43,0x96,0x46,0x5f,0x78,0x0c,0x13,0x7b,0x83,0x8d,0x1a,0x6a,0x3a,0x7f,0x0b,0x80,0x3d,0x5d,0x39,0x44,0xe6,0xf7,0xf6,0xed,0x01,0xc9,0x55,0xd5,0xa8,0x95,0x39,0x63,0x2c,0x59,0x30,0x78,0xcd,0x68,0x7e,0x30,0x51,0x2e,0xed,0xfd,0xd0,0x30},+	{0xb3,0x33,0x12,0xf2,0x1a,0x4d,0x59,0xe0,0x9c,0x4d,0xcc,0xf0,0x8e,0xe7,0xdb,0x1b,0x77,0x9a,0x49,0x8f,0x7f,0x18,0x65,0x69,0x68,0x98,0x09,0x2c,0x20,0x14,0x92,0x0a,0x50,0x47,0xb8,0x68,0x1e,0x97,0xb4,0x9c,0xcf,0xbb,0x64,0x66,0x29,0x72,0x95,0xa0,0x2b,0x41,0xfa,0x72,0x26,0xe7,0x8d,0x5c,0xd9,0x89,0xc5,0x51,0x43,0x08,0x15,0x46,0x2e,0xa0,0xb9,0xae,0xc0,0x19,0x90,0xbc,0xae,0x4c,0x03,0x16,0x0d,0x11,0xc7,0x55,0xec,0x32,0x99,0x65,0x01,0xf5,0x6d,0x0e,0xfe,0x5d,0xca,0x95,0x28,0x0d,0xca,0x3b},+	{0xa4,0x62,0x5d,0x3c,0xbc,0x31,0xf0,0x40,0x60,0x7a,0xf0,0xcf,0x3e,0x8b,0xfc,0x19,0x45,0xb5,0x0f,0x13,0xa2,0x3d,0x18,0x98,0xcd,0x13,0x8f,0xae,0xdd,0xde,0x31,0x56,0xbf,0x01,0xcc,0x9e,0xb6,0x8e,0x68,0x9c,0x6f,0x89,0x44,0xa6,0xad,0x83,0xbc,0xf0,0xe2,0x9f,0x7a,0x5f,0x5f,0x95,0x2d,0xca,0x41,0x82,0xf2,0x8d,0x03,0xb4,0xa8,0x4e,0x02,0xd2,0xca,0xf1,0x0a,0x46,0xed,0x2a,0x83,0xee,0x8c,0xa4,0x05,0x53,0x30,0x46,0x5f,0x1a,0xf1,0x49,0x45,0x77,0x21,0x91,0x63,0xa4,0x2c,0x54,0x30,0x09,0xce,0x24},+	{0x06,0xc1,0x06,0xfd,0xf5,0x90,0xe8,0x1f,0xf2,0x10,0x88,0x5d,0x35,0x68,0xc4,0xb5,0x3e,0xaf,0x8c,0x6e,0xfe,0x08,0x78,0x82,0x4b,0xd7,0x06,0x8a,0xc2,0xe3,0xd4,0x41,0x85,0x0b,0xf3,0xfd,0x55,0xa1,0xcf,0x3f,0xa4,0x2e,0x37,0x36,0x8e,0x16,0xf7,0xd2,0x44,0xf8,0x92,0x64,0xde,0x64,0xe0,0xb2,0x80,0x42,0x4f,0x32,0xa7,0x28,0x99,0x54,0x2e,0x1a,0xee,0x63,0xa7,0x32,0x6e,0xf2,0xea,0xfd,0x5f,0xd2,0xb7,0xe4,0x91,0xae,0x69,0x4d,0x7f,0xd1,0x3b,0xd3,0x3b,0xbc,0x6a,0xff,0xdc,0xc0,0xde,0x66,0x1b,0x49},+	{0xa7,0x32,0xea,0xc7,0x3d,0xb1,0xf5,0x98,0x98,0xdb,0x16,0x7e,0xcc,0xf8,0xd5,0xe3,0x47,0xd9,0xf8,0xcb,0x52,0xbf,0x0a,0xac,0xac,0xe4,0x5e,0xc8,0xd0,0x38,0xf3,0x08,0xa1,0x64,0xda,0xd0,0x8e,0x4a,0xf0,0x75,0x4b,0x28,0xe2,0x67,0xaf,0x2c,0x22,0xed,0xa4,0x7b,0x7b,0x1f,0x79,0xa3,0x34,0x82,0x67,0x8b,0x01,0xb7,0xb0,0xb8,0xf6,0x4c,0xbd,0x73,0x1a,0x99,0x21,0xa8,0x83,0xc3,0x7a,0x0c,0x32,0xdf,0x01,0xbc,0x27,0xab,0x63,0x70,0x77,0x84,0x1b,0x33,0x3d,0xc1,0x99,0x8a,0x07,0xeb,0x82,0x4a,0x0d,0x53},+	{0x25,0x48,0xf9,0xe1,0x30,0x36,0x4c,0x00,0x5a,0x53,0xab,0x8c,0x26,0x78,0x2d,0x7e,0x8b,0xff,0x84,0xcc,0x23,0x23,0x48,0xc7,0xb9,0x70,0x17,0x10,0x3f,0x75,0xea,0x65,0x9e,0xbf,0x9a,0x6c,0x45,0x73,0x69,0x6d,0x80,0xa8,0x00,0x49,0xfc,0xb2,0x7f,0x25,0x50,0xb8,0xcf,0xc8,0x12,0xf4,0xac,0x2b,0x5b,0xbd,0xbf,0x0c,0xe0,0xe7,0xb3,0x0d,0x63,0x63,0x09,0xe2,0x3e,0xfc,0x66,0x3d,0x6b,0xcb,0xb5,0x61,0x7f,0x2c,0xd6,0x81,0x1a,0x3b,0x44,0x13,0x42,0x04,0xbe,0x0f,0xdb,0xa1,0xe1,0x21,0x19,0xec,0xa4,0x02},+	{0xa2,0xb8,0x24,0x3b,0x9a,0x25,0xe6,0x5c,0xb8,0xa0,0xaf,0x45,0xcc,0x7a,0x57,0xb8,0x37,0x70,0xa0,0x8b,0xe8,0xe6,0xcb,0xcc,0xbf,0x09,0x78,0x12,0x51,0x3c,0x14,0x3d,0x5f,0x79,0xcf,0xf1,0x62,0x61,0xc8,0xf5,0xf2,0x57,0xee,0x26,0x19,0x86,0x8c,0x11,0x78,0x35,0x06,0x1c,0x85,0x24,0x21,0x17,0xcf,0x7f,0x06,0xec,0x5d,0x2b,0xd1,0x36,0x57,0x45,0x15,0x79,0x91,0x27,0x6d,0x12,0x0a,0x3a,0x78,0xfc,0x5c,0x8f,0xe4,0xd5,0xac,0x9b,0x17,0xdf,0xe8,0xb6,0xbd,0x36,0x59,0x28,0xa8,0x5b,0x88,0x17,0xf5,0x2e},+	{0xdc,0xae,0x58,0x8c,0x4e,0x97,0x37,0x46,0xa4,0x41,0xf0,0xab,0xfb,0x22,0xef,0xb9,0x8a,0x71,0x80,0xe9,0x56,0xd9,0x85,0xe1,0xa6,0xa8,0x43,0xb1,0xfa,0x78,0x1b,0x2f,0x51,0x2f,0x5b,0x30,0xfb,0xbf,0xee,0x96,0xb8,0x96,0x95,0x88,0xad,0x38,0xf9,0xd3,0x25,0xdd,0xd5,0x46,0xc7,0x2d,0xf5,0xf0,0x95,0x00,0x3a,0xbb,0x90,0x82,0x96,0x57,0x01,0xe1,0x20,0x0a,0x43,0xb8,0x1a,0xf7,0x47,0xec,0xf0,0x24,0x8d,0x65,0x93,0xf3,0xd1,0xee,0xe2,0x6e,0xa8,0x09,0x75,0xcf,0xe1,0xa3,0x2a,0xdc,0x35,0x3e,0xc4,0x7d},+	{0xc3,0xd9,0x7d,0x88,0x65,0x66,0x96,0x85,0x55,0x53,0xb0,0x4b,0x31,0x9b,0x0f,0xc9,0xb1,0x79,0x20,0xef,0xf8,0x8d,0xe0,0xc6,0x2f,0xc1,0x8c,0x75,0x16,0x20,0xf7,0x7e,0x18,0x97,0x3e,0x27,0x5c,0x2a,0x78,0x5a,0x94,0xfd,0x4e,0x5e,0x99,0xc6,0x76,0x35,0x3e,0x7d,0x23,0x1f,0x05,0xd8,0x2e,0x0f,0x99,0x0a,0xd5,0x82,0x1d,0xb8,0x4f,0x04,0xd9,0xe3,0x07,0xa9,0xc5,0x18,0xdf,0xc1,0x59,0x63,0x4c,0xce,0x1d,0x37,0xb3,0x57,0x49,0xbb,0x01,0xb2,0x34,0x45,0x70,0xca,0x2e,0xdd,0x30,0x9c,0x3f,0x82,0x79,0x7f},+	{0xe8,0x13,0xb5,0xa3,0x39,0xd2,0x34,0x83,0xd8,0xa8,0x1f,0xb9,0xd4,0x70,0x36,0xc1,0x33,0xbd,0x90,0xf5,0x36,0x41,0xb5,0x12,0xb4,0xd9,0x84,0xd7,0x73,0x03,0x4e,0x0a,0xba,0x87,0xf5,0x68,0xf0,0x1f,0x9c,0x6a,0xde,0xc8,0x50,0x00,0x4e,0x89,0x27,0x08,0xe7,0x5b,0xed,0x7d,0x55,0x99,0xbf,0x3c,0xf0,0xd6,0x06,0x1c,0x43,0xb0,0xa9,0x64,0x19,0x29,0x7d,0x5b,0xa1,0xd6,0xb3,0x2e,0x35,0x82,0x3a,0xd5,0xa0,0xf6,0xb4,0xb0,0x47,0x5d,0xa4,0x89,0x43,0xce,0x56,0x71,0x6c,0x34,0x18,0xce,0x0a,0x7d,0x1a,0x07},+	{0x0b,0xba,0x87,0xc8,0xaa,0x2d,0x07,0xd3,0xee,0x62,0xa5,0xbf,0x05,0x29,0x26,0x01,0x8b,0x76,0xef,0xc0,0x02,0x30,0x54,0xcf,0x9c,0x7e,0xea,0x46,0x71,0xcc,0x3b,0x2c,0x31,0x44,0xe1,0x20,0x52,0x35,0x0c,0xcc,0x41,0x51,0xb1,0x09,0x07,0x95,0x65,0x0d,0x36,0x5f,0x9d,0x20,0x1b,0x62,0xf5,0x9a,0xd3,0x55,0x77,0x61,0xf7,0xbc,0x69,0x7c,0x5f,0x29,0xe8,0x04,0xeb,0xd7,0xf0,0x07,0x7d,0xf3,0x50,0x2f,0x25,0x18,0xdb,0x10,0xd7,0x98,0x17,0x17,0xa3,0xa9,0x51,0xe9,0x1d,0xa5,0xac,0x22,0x73,0x9a,0x5a,0x6f},+	{0xc5,0xc6,0x41,0x2f,0x0c,0x00,0xa1,0x8b,0x9b,0xfb,0xfe,0x0c,0xc1,0x79,0x9f,0xc4,0x9f,0x1c,0xc5,0x3c,0x70,0x47,0xfa,0x4e,0xca,0xaf,0x47,0xe1,0xa2,0x21,0x4e,0x49,0xbe,0x44,0xd9,0xa3,0xeb,0xd4,0x29,0xe7,0x9e,0xaf,0x78,0x80,0x40,0x09,0x9e,0x8d,0x03,0x9c,0x86,0x47,0x7a,0x56,0x25,0x45,0x24,0x3b,0x8d,0xee,0x80,0x96,0xab,0x02,0x9a,0x0d,0xe5,0xdd,0x85,0x8a,0xa4,0xef,0x49,0xa2,0xb9,0x0f,0x4e,0x22,0x9a,0x21,0xd9,0xf6,0x1e,0xd9,0x1d,0x1f,0x09,0xfa,0x34,0xbb,0x46,0xea,0xcb,0x76,0x5d,0x6b},+	{0x94,0xd9,0x0c,0xec,0x6c,0x55,0x57,0x88,0xba,0x1d,0xd0,0x5c,0x6f,0xdc,0x72,0x64,0x77,0xb4,0x42,0x8f,0x14,0x69,0x01,0xaf,0x54,0x73,0x27,0x85,0xf6,0x33,0xe3,0x0a,0x22,0x25,0x78,0x1e,0x17,0x41,0xf9,0xe0,0xd3,0x36,0x69,0x03,0x74,0xae,0xe6,0xf1,0x46,0xc7,0xfc,0xd0,0xa2,0x3e,0x8b,0x40,0x3e,0x31,0xdd,0x03,0x9c,0x86,0xfb,0x16,0x62,0x09,0xb6,0x33,0x97,0x19,0x8e,0x28,0x33,0xe1,0xab,0xd8,0xb4,0x72,0xfc,0x24,0x3e,0xd0,0x91,0x09,0xed,0xf7,0x11,0x48,0x75,0xd0,0x70,0x8f,0x8b,0xe3,0x81,0x3f},+	{0xfe,0xaf,0xd9,0x7e,0xcc,0x0f,0x91,0x7f,0x4b,0x87,0x65,0x24,0xa1,0xb8,0x5c,0x54,0x04,0x47,0x0c,0x4b,0xd2,0x7e,0x39,0xa8,0x93,0x09,0xf5,0x04,0xc1,0x0f,0x51,0x50,0x24,0xc8,0x17,0x5f,0x35,0x7f,0xdb,0x0a,0xa4,0x99,0x42,0xd7,0xc3,0x23,0xb9,0x74,0xf7,0xea,0xf8,0xcb,0x8b,0x3e,0x7c,0xd5,0x3d,0xdc,0xde,0x4c,0xd3,0xe2,0xd3,0x0a,0x9d,0x24,0x6e,0x33,0xc5,0x0f,0x0c,0x6f,0xd9,0xcf,0x31,0xc3,0x19,0xde,0x5e,0x74,0x1c,0xfe,0xee,0x09,0x00,0xfd,0xd6,0xf2,0xbe,0x1e,0xfa,0xf0,0x8b,0x15,0x7c,0x12},+	{0xa2,0x79,0x98,0x2e,0x42,0x7c,0x19,0xf6,0x47,0x36,0xca,0x52,0xd4,0xdd,0x4a,0xa4,0xcb,0xac,0x4e,0x4b,0xc1,0x3f,0x41,0x9b,0x68,0x4f,0xef,0x07,0x7d,0xf8,0x4e,0x35,0x74,0xb9,0x51,0xae,0xc4,0x8f,0xa2,0xde,0x96,0xfe,0x4d,0x74,0xd3,0x73,0x99,0x1d,0xa8,0x48,0x38,0x87,0x0b,0x68,0x40,0x62,0x95,0xdf,0x67,0xd1,0x79,0x24,0xd8,0x4e,0x75,0xd9,0xc5,0x60,0x22,0xb5,0xe3,0xfe,0xb8,0xb0,0x41,0xeb,0xfc,0x2e,0x35,0x50,0x3c,0x65,0xf6,0xa9,0x30,0xac,0x08,0x88,0x6d,0x23,0x39,0x05,0xd2,0x92,0x2d,0x30},+	{0x3d,0x28,0xa4,0xbc,0xa2,0xc1,0x13,0x78,0xd9,0x3d,0x86,0xa1,0x91,0xf0,0x62,0xed,0x86,0xfa,0x68,0xc2,0xb8,0xbc,0xc7,0xae,0x4c,0xae,0x1c,0x6f,0xb7,0xd3,0xe5,0x10,0x77,0xf1,0xe0,0xe4,0xb6,0x6f,0xbc,0x2d,0x93,0x6a,0xbd,0xa4,0x29,0xbf,0xe1,0x04,0xe8,0xf6,0x7a,0x78,0xd4,0x66,0x19,0x5e,0x60,0xd0,0x26,0xb4,0x5e,0x5f,0xdc,0x0e,0x67,0x8e,0xda,0x53,0xd6,0xbf,0x53,0x54,0x41,0xf6,0xa9,0x24,0xec,0x1e,0xdc,0xe9,0x23,0x8a,0x57,0x03,0x3b,0x26,0x87,0xbf,0x72,0xba,0x1c,0x36,0x51,0x6c,0xb4,0x45},+	{0xa1,0x7f,0x4f,0x31,0xbf,0x2a,0x40,0xa9,0x50,0xf4,0x8c,0x8e,0xdc,0xf1,0x57,0xe2,0x84,0xbe,0xa8,0x23,0x4b,0xd5,0xbb,0x1d,0x3b,0x71,0xcb,0x6d,0xa3,0xbf,0x77,0x21,0xe4,0xe3,0x7f,0x8a,0xdd,0x4d,0x9d,0xce,0x30,0x0e,0x62,0x76,0x56,0x64,0x13,0xab,0x58,0x99,0x0e,0xb3,0x7b,0x4f,0x59,0x4b,0xdf,0x29,0x12,0x32,0xef,0x0a,0x1c,0x5c,0x8f,0xdb,0x79,0xfa,0xbc,0x1b,0x08,0x37,0xb3,0x59,0x5f,0xc2,0x1e,0x81,0x48,0x60,0x87,0x24,0x83,0x9c,0x65,0x76,0x7a,0x08,0xbb,0xb5,0x8a,0x7d,0x38,0x19,0xe6,0x4a},+	{0x2e,0xa3,0x44,0x53,0xaa,0xf6,0xdb,0x8d,0x78,0x40,0x1b,0xb4,0xb4,0xea,0x88,0x7d,0x60,0x0d,0x13,0x4a,0x97,0xeb,0xb0,0x5e,0x03,0x3e,0xbf,0x17,0x1b,0xd9,0x00,0x1a,0x83,0xfb,0x5b,0x98,0x44,0x7e,0x11,0x61,0x36,0x31,0x96,0x71,0x2a,0x46,0xe0,0xfc,0x4b,0x90,0x25,0xd4,0x48,0x34,0xac,0x83,0x64,0x3d,0xa4,0x5b,0xbe,0x5a,0x68,0x75,0xb2,0xf2,0x61,0xeb,0x33,0x09,0x96,0x6e,0x52,0x49,0xff,0xc9,0xa8,0x0f,0x3d,0x54,0x69,0x65,0xf6,0x7a,0x10,0x75,0x72,0xdf,0xaa,0xe6,0xb0,0x23,0xb6,0x29,0x55,0x13},+	{0x18,0xd5,0xd1,0xad,0xd7,0xdb,0xf0,0x18,0x11,0x1f,0xc1,0xcf,0x88,0x78,0x9f,0x97,0x9b,0x75,0x14,0x71,0xf0,0xe1,0x32,0x87,0x01,0x3a,0xca,0x65,0x1a,0xb8,0xb5,0x79,0xfe,0x83,0x2e,0xe2,0xbc,0x16,0xc7,0xf5,0xc1,0x85,0x09,0xe8,0x19,0xeb,0x2b,0xb4,0xae,0x4a,0x25,0x14,0x37,0xa6,0x9d,0xec,0x13,0xa6,0x90,0x15,0x05,0xea,0x72,0x59,0x11,0x78,0x8f,0xdc,0x20,0xac,0xd4,0x0f,0xa8,0x4f,0x4d,0xac,0x94,0xd2,0x9a,0x9a,0x34,0x04,0x36,0xb3,0x64,0x2d,0x1b,0xc0,0xdb,0x3b,0x5f,0x90,0x95,0x9c,0x7e,0x4f},+	{0x2e,0x30,0x81,0x57,0xbc,0x4b,0x67,0x62,0x0f,0xdc,0xad,0x89,0x39,0x0f,0x52,0xd8,0xc6,0xd9,0xfb,0x53,0xae,0x99,0x29,0x8c,0x4c,0x8e,0x63,0x2e,0xd9,0x3a,0x99,0x31,0xfe,0x99,0x52,0x35,0x3d,0x44,0xc8,0x71,0xd7,0xea,0xeb,0xdb,0x1c,0x3b,0xcd,0x8b,0x66,0x94,0xa4,0xf1,0x9e,0x49,0x92,0x80,0xc8,0xad,0x44,0xa1,0xc4,0xee,0x42,0x19,0x92,0x49,0x23,0xae,0x19,0x53,0xac,0x7d,0x92,0x3e,0xea,0x0c,0x91,0x3d,0x1b,0x2c,0x22,0x11,0x3c,0x25,0x94,0xe4,0x3c,0x55,0x75,0xca,0xf9,0x4e,0x31,0x65,0x0a,0x2a},+	{0xc2,0x27,0xf9,0xf7,0x7f,0x93,0xb7,0x2d,0x35,0xa6,0xd0,0x17,0x06,0x1f,0x74,0xdb,0x76,0xaf,0x55,0x11,0xa2,0xf3,0x82,0x59,0xed,0x2d,0x7c,0x64,0x18,0xe2,0xf6,0x4c,0x3a,0x79,0x1c,0x3c,0xcd,0x1a,0x36,0xcf,0x3b,0xbc,0x35,0x5a,0xac,0xbc,0x9e,0x2f,0xab,0xa6,0xcd,0xa8,0xe9,0x60,0xe8,0x60,0x13,0x1a,0xea,0x6d,0x9b,0xc3,0x5d,0x05,0xb6,0x5b,0x8d,0xc2,0x7c,0x22,0x19,0xb1,0xab,0xff,0x4d,0x77,0xbc,0x4e,0xe2,0x07,0x89,0x2c,0xa3,0xe4,0xce,0x78,0x3c,0xa8,0xb6,0x24,0xaa,0x10,0x77,0x30,0x1a,0x12},+	{0x97,0x4a,0x03,0x9f,0x5e,0x5d,0xdb,0xe4,0x2d,0xbc,0x34,0x30,0x09,0xfc,0x53,0xe1,0xb1,0xd3,0x51,0x95,0x91,0x46,0x05,0x46,0x2d,0xe5,0x40,0x7a,0x6c,0xc7,0x3f,0x33,0xc9,0x83,0x74,0xc7,0x3e,0x71,0x59,0xd6,0xaf,0x96,0x2b,0xb8,0x77,0xe0,0xbf,0x88,0xd3,0xbc,0x97,0x10,0x23,0x28,0x9e,0x28,0x9b,0x3a,0xed,0x6c,0x4a,0xb9,0x7b,0x52,0x2e,0x48,0x5b,0x99,0x2a,0x99,0x3d,0x56,0x01,0x38,0x38,0x6e,0x7c,0xd0,0x05,0x34,0xe5,0xd8,0x64,0x2f,0xde,0x35,0x50,0x48,0xf7,0xa9,0xa7,0x20,0x9b,0x06,0x89,0x6b},+	{0x0d,0x22,0x70,0x62,0x41,0xa0,0x2a,0x81,0x4e,0x5b,0x24,0xf9,0xfa,0x89,0x5a,0x99,0x05,0xef,0x72,0x50,0xce,0xc4,0xad,0xff,0x73,0xeb,0x73,0xaa,0x03,0x21,0xbc,0x23,0x77,0xdb,0xc7,0xb5,0x8c,0xfa,0x82,0x40,0x55,0xc1,0x34,0xc7,0xf8,0x86,0x86,0x06,0x7e,0xa5,0xe7,0xf6,0xd9,0xc8,0xe6,0x29,0xcf,0x9b,0x63,0xa7,0x08,0xd3,0x73,0x04,0x05,0x9e,0x58,0x03,0x26,0x79,0xee,0xca,0x92,0xc4,0xdc,0x46,0x12,0x42,0x4b,0x2b,0x4f,0xa9,0x01,0xe6,0x74,0xef,0xa1,0x02,0x1a,0x34,0x04,0xde,0xbf,0x73,0x2f,0x10},+	{0xc6,0x45,0x57,0x7f,0xab,0xb9,0x18,0xeb,0x90,0xc6,0x87,0x57,0xee,0x8a,0x3a,0x02,0xa9,0xaf,0xf7,0x2d,0xda,0x12,0x27,0xb7,0x3d,0x01,0x5c,0xea,0x25,0x7d,0x59,0x36,0x9a,0x1c,0x51,0xb5,0xe0,0xda,0xb4,0xa2,0x06,0xff,0xff,0x2b,0x29,0x60,0xc8,0x7a,0x34,0x42,0x50,0xf5,0x5d,0x37,0x1f,0x98,0x2d,0xa1,0x4e,0xda,0x25,0xd7,0x6b,0x3f,0xac,0x58,0x60,0x10,0x7b,0x8d,0x4d,0x73,0x5f,0x90,0xc6,0x6f,0x9e,0x57,0x40,0xd9,0x2d,0x93,0x02,0x92,0xf9,0xf8,0x66,0x64,0xd0,0xd6,0x60,0xda,0x19,0xcc,0x7e,0x7b},+	{0x0d,0x69,0x5c,0x69,0x3c,0x37,0xc2,0x78,0x6e,0x90,0x42,0x06,0x66,0x2e,0x25,0xdd,0xd2,0x2b,0xe1,0x4a,0x44,0x44,0x1d,0x95,0x56,0x39,0x74,0x01,0x76,0xad,0x35,0x42,0x9b,0xfa,0x7c,0xa7,0x51,0x4a,0xae,0x6d,0x50,0x86,0xa3,0xe7,0x54,0x36,0x26,0x82,0xdb,0x82,0x2d,0x8f,0xcd,0xff,0xbb,0x09,0xba,0xca,0xf5,0x1b,0x66,0xdc,0xbe,0x03,0xf5,0x75,0x89,0x07,0x0d,0xcb,0x58,0x62,0x98,0xf2,0x89,0x91,0x54,0x42,0x29,0x49,0xe4,0x6e,0xe3,0xe2,0x23,0xb4,0xca,0xa0,0xa1,0x66,0xf0,0xcd,0xb0,0xe2,0x7c,0x0e},+	{0xa3,0x85,0x8c,0xc4,0x3a,0x64,0x94,0xc4,0xad,0x39,0x61,0x3c,0xf4,0x1d,0x36,0xfd,0x48,0x4d,0xe9,0x3a,0xdd,0x17,0xdb,0x09,0x4a,0x67,0xb4,0x8f,0x5d,0x0a,0x6e,0x66,0xf9,0x70,0x4b,0xd9,0xdf,0xfe,0xa6,0xfe,0x2d,0xba,0xfc,0xc1,0x51,0xc0,0x30,0xf1,0x89,0xab,0x2f,0x7f,0x7e,0xd4,0x82,0x48,0xb5,0xee,0xec,0x8a,0x13,0x56,0x52,0x61,0x0d,0xcb,0x70,0x48,0x4e,0xf6,0xbb,0x2a,0x6b,0x8b,0x45,0xaa,0xf0,0xbc,0x65,0xcd,0x5d,0x98,0xe8,0x75,0xba,0x4e,0xbe,0x9a,0xe4,0xde,0x14,0xd5,0x10,0xc8,0x0b,0x7f},+	{0x6f,0x13,0xf4,0x26,0xa4,0x6b,0x00,0xb9,0x35,0x30,0xe0,0x57,0x9e,0x36,0x67,0x8d,0x28,0x3c,0x46,0x4f,0xd9,0xdf,0xc8,0xcb,0xf5,0xdb,0xee,0xf8,0xbc,0x8d,0x1f,0x0d,0xa0,0x13,0x72,0x73,0xad,0x9d,0xac,0x83,0x98,0x2e,0xf7,0x2e,0xba,0xf8,0xf6,0x9f,0x57,0x69,0xec,0x43,0xdd,0x2e,0x1e,0x31,0x75,0xab,0xc5,0xde,0x7d,0x90,0x3a,0x1d,0xdc,0x81,0xd0,0x3e,0x31,0x93,0x16,0xba,0x80,0x34,0x1b,0x85,0xad,0x9f,0x32,0x29,0xcb,0x21,0x03,0x03,0x3c,0x01,0x28,0x01,0xe3,0xfd,0x1b,0xa3,0x44,0x1b,0x01,0x00},+	{0x0c,0x6c,0xc6,0x3f,0x6c,0xa0,0xdf,0x3f,0xd2,0x0d,0xd6,0x4d,0x8e,0xe3,0x40,0x5d,0x71,0x4d,0x8e,0x26,0x38,0x8b,0xe3,0x7a,0xe1,0x57,0x83,0x6e,0x91,0x8d,0xc4,0x3a,0x5c,0xa7,0x0a,0x6a,0x69,0x1f,0x56,0x16,0x6a,0xbd,0x52,0x58,0x5c,0x72,0xbf,0xc1,0xad,0x66,0x79,0x9a,0x7f,0xdd,0xa8,0x11,0x26,0x10,0x85,0xd2,0xa2,0x88,0xd9,0x63,0x2e,0x23,0xbd,0xaf,0x53,0x07,0x12,0x00,0x83,0xf6,0xd8,0xfd,0xb8,0xce,0x2b,0xe9,0x91,0x2b,0xe7,0x84,0xb3,0x69,0x16,0xf8,0x66,0xa0,0x68,0x23,0x2b,0xd5,0xfa,0x33},+	{0x16,0x1e,0xe4,0xc5,0xc6,0x49,0x06,0x54,0x35,0x77,0x3f,0x33,0x30,0x64,0xf8,0x0a,0x46,0xe7,0x05,0xf3,0xd2,0xfc,0xac,0xb2,0xa7,0xdc,0x56,0xa2,0x29,0xf4,0xc0,0x16,0xe8,0xcf,0x22,0xc4,0xd0,0xc8,0x2c,0x8d,0xcb,0x3a,0xa1,0x05,0x7b,0x4f,0x2b,0x07,0x6f,0xa5,0xf6,0xec,0xe6,0xb6,0xfe,0xa3,0xe2,0x71,0x0a,0xb9,0xcc,0x55,0xc3,0x3c,0x31,0x91,0x3e,0x90,0x43,0x94,0xb6,0xe9,0xce,0x37,0x56,0x7a,0xcb,0x94,0xa4,0xb8,0x44,0x92,0xba,0xba,0xa4,0xd1,0x7c,0xc8,0x68,0x75,0xae,0x6b,0x42,0xaf,0x1e,0x63},+	{0x9f,0xfe,0x66,0xda,0x10,0x04,0xe9,0xb3,0xa6,0xe5,0x16,0x6c,0x52,0x4b,0xdd,0x85,0x83,0xbf,0xf9,0x1e,0x61,0x97,0x3d,0xbc,0xb5,0x19,0xa9,0x1e,0x8b,0x64,0x99,0x55,0xe8,0x0d,0x70,0xa3,0xb9,0x75,0xd9,0x47,0x52,0x05,0xf8,0xe2,0xfb,0xc5,0x80,0x72,0xe1,0x5d,0xe4,0x32,0x27,0x8f,0x65,0x53,0xb5,0x80,0x5f,0x66,0x7f,0x2c,0x1f,0x43,0x19,0x7b,0x8f,0x85,0x44,0x63,0x02,0xd6,0x4a,0x51,0xea,0xa1,0x2f,0x35,0xab,0x14,0xd7,0xa9,0x90,0x20,0x1a,0x44,0x00,0x89,0x26,0x3b,0x25,0x91,0x5f,0x71,0x04,0x7b},+	{0x43,0xae,0xf6,0xac,0x28,0xbd,0xed,0x83,0xb4,0x7a,0x5c,0x7d,0x8b,0x7c,0x35,0x86,0x44,0x2c,0xeb,0xb7,0x69,0x47,0x40,0xc0,0x3f,0x58,0xf6,0xc2,0xf5,0x7b,0xb3,0x59,0xc6,0xba,0xe6,0xc4,0x80,0xc2,0x76,0xb3,0x0b,0x9b,0x1d,0x6d,0xdd,0xd3,0x0e,0x97,0x44,0xf9,0x0b,0x45,0x58,0x95,0x9a,0xb0,0x23,0xe2,0xcd,0x57,0xfa,0xac,0xd0,0x48,0x71,0xe6,0xab,0x7d,0xe4,0x26,0x0f,0xb6,0x37,0x3a,0x2f,0x62,0x97,0xa1,0xd1,0xf1,0x94,0x03,0x96,0xe9,0x7e,0xce,0x08,0x42,0xdb,0x3b,0x6d,0x33,0x91,0x41,0x23,0x16},+	{0xf6,0x7f,0x26,0xf6,0xde,0x99,0xe4,0xb9,0x43,0x08,0x2c,0x74,0x7b,0xca,0x72,0x77,0xb1,0xf2,0xa4,0xe9,0x3f,0x15,0xa0,0x23,0x06,0x50,0xd0,0xd5,0xec,0xdf,0xdf,0x2c,0x40,0x86,0xf3,0x1f,0xd6,0x9c,0x49,0xdd,0xa0,0x25,0x36,0x06,0xc3,0x9b,0xcd,0x29,0xc3,0x3d,0xd7,0x3d,0x02,0xd8,0xe2,0x51,0x31,0x92,0x3b,0x20,0x7a,0x70,0x25,0x4a,0x6a,0xed,0xf6,0x53,0x8a,0x66,0xb7,0x2a,0xa1,0x70,0xd1,0x1d,0x58,0x42,0x42,0x30,0x61,0x01,0xe2,0x3a,0x4c,0x14,0x00,0x40,0xfc,0x49,0x8e,0x24,0x6d,0x89,0x21,0x57},+	{0xae,0x1b,0x18,0xfd,0x17,0x55,0x6e,0x0b,0xb4,0x63,0xb9,0x2b,0x9f,0x62,0x22,0x90,0x25,0x46,0x06,0x32,0xe9,0xbc,0x09,0x55,0xda,0x13,0x3c,0xf6,0x74,0xdd,0x8e,0x57,0x4e,0xda,0xd0,0xa1,0x91,0x50,0x5d,0x28,0x08,0x3e,0xfe,0xb5,0xa7,0x6f,0xaa,0x4b,0xb3,0x93,0x93,0xe1,0x7c,0x17,0xe5,0x63,0xfd,0x30,0xb0,0xc4,0xaf,0x35,0xc9,0x03,0x3d,0x0c,0x2b,0x49,0xc6,0x76,0x72,0x99,0xfc,0x05,0xe2,0xdf,0xc4,0xc2,0xcc,0x47,0x3c,0x3a,0x62,0xdd,0x84,0x9b,0xd2,0xdc,0xa2,0xc7,0x88,0x02,0x59,0xab,0xc2,0x3e},+	{0xb9,0x7b,0xd8,0xe4,0x7b,0xd2,0xa0,0xa1,0xed,0x1a,0x39,0x61,0xeb,0x4d,0x8b,0xa9,0x83,0x9b,0xcb,0x73,0xd0,0xdd,0xa0,0x99,0xce,0xca,0x0f,0x20,0x5a,0xc2,0xd5,0x2d,0xcb,0xd1,0x32,0xae,0x09,0x3a,0x21,0xa7,0xd5,0xc2,0xf5,0x40,0xdf,0x87,0x2b,0x0f,0x29,0xab,0x1e,0xe8,0xc6,0xa4,0xae,0x0b,0x5e,0xac,0xdb,0x6a,0x6c,0xf6,0x1b,0x0e,0x7e,0x88,0x2c,0x79,0xe9,0xd5,0xab,0xe2,0x5d,0x6d,0x92,0xcb,0x18,0x00,0x02,0x1a,0x1e,0x5f,0xae,0xba,0xcd,0x69,0xba,0xbf,0x5f,0x8f,0xe8,0x5a,0xb3,0x48,0x05,0x73},+	{0xee,0xb8,0xa8,0xcb,0xa3,0x51,0x35,0xc4,0x16,0x5f,0x11,0xb2,0x1d,0x6f,0xa2,0x65,0x50,0x38,0x8c,0xab,0x52,0x4f,0x0f,0x76,0xca,0xb8,0x1d,0x41,0x3b,0x44,0x43,0x30,0x34,0xe3,0xd6,0xa1,0x4b,0x09,0x5b,0x80,0x19,0x3f,0x35,0x09,0x77,0xf1,0x3e,0xbf,0x2b,0x70,0x22,0x06,0xcb,0x06,0x3f,0x42,0xdd,0x45,0x78,0xd8,0x77,0x22,0x5a,0x58,0x62,0x89,0xd4,0x33,0x82,0x5f,0x8a,0xa1,0x7f,0x25,0x78,0xec,0xb5,0xc4,0x98,0x66,0xff,0x41,0x3e,0x37,0xa5,0x6f,0x8e,0xa7,0x1f,0x98,0xef,0x50,0x89,0x27,0x56,0x76},+	{0xc0,0xc8,0x1f,0xd5,0x59,0xcf,0xc3,0x38,0xf2,0xb6,0x06,0x05,0xfd,0xd2,0xed,0x9b,0x8f,0x0e,0x57,0xab,0x9f,0x10,0xbf,0x26,0xa6,0x46,0xb8,0xc1,0xa8,0x60,0x41,0x3f,0x9d,0xcf,0x86,0xea,0xa3,0x73,0x70,0xe1,0xdc,0x5f,0x15,0x07,0xb7,0xfb,0x8c,0x3a,0x8e,0x8a,0x83,0x31,0xfc,0xe7,0x53,0x48,0x16,0xf6,0x13,0xb6,0x84,0xf4,0xbb,0x28,0x7c,0x6c,0x13,0x6f,0x5c,0x2f,0x61,0xf2,0xbe,0x11,0xdd,0xf6,0x07,0xd1,0xea,0xaf,0x33,0x6f,0xde,0x13,0xd2,0x9a,0x7e,0x52,0x5d,0xf7,0x88,0x81,0x35,0xcb,0x79,0x1e},+	{0xf1,0xe3,0xf7,0xee,0xc3,0x36,0x34,0x01,0xf8,0x10,0x9e,0xfe,0x7f,0x6a,0x8b,0x82,0xfc,0xde,0xf9,0xbc,0xe5,0x08,0xf9,0x7f,0x31,0x38,0x3b,0x3a,0x1b,0x95,0xd7,0x65,0x81,0x81,0xe0,0xf5,0xd8,0x53,0xe9,0x77,0xd9,0xde,0x9d,0x29,0x44,0x0c,0xa5,0x84,0xe5,0x25,0x45,0x86,0x0c,0x2d,0x6c,0xdc,0xf4,0xf2,0xd1,0x39,0x2d,0xb5,0x8a,0x47,0x59,0xd1,0x52,0x92,0xd3,0xa4,0xa6,0x66,0x07,0xc8,0x1a,0x87,0xbc,0xe1,0xdd,0xe5,0x6f,0xc9,0xc1,0xa6,0x40,0x6b,0x2c,0xb8,0x14,0x22,0x21,0x1a,0x41,0x7a,0xd8,0x16},+	{0x15,0x62,0x06,0x42,0x5a,0x7e,0xbd,0xb3,0xc1,0x24,0x5a,0x0c,0xcd,0xe3,0x9b,0x87,0xb7,0x94,0xf9,0xd6,0xb1,0x5d,0xc0,0x57,0xa6,0x8c,0xf3,0x65,0x81,0x7c,0xf8,0x28,0x83,0x05,0x4e,0xd5,0xe2,0xd5,0xa4,0xfb,0xfa,0x99,0xbd,0x2e,0xd7,0xaf,0x1f,0xe2,0x8f,0x77,0xe9,0x6e,0x73,0xc2,0x7a,0x49,0xde,0x6d,0x5a,0x7a,0x57,0x0b,0x99,0x1f,0xd6,0xf7,0xe8,0x1b,0xad,0x4e,0x34,0xa3,0x8f,0x79,0xea,0xac,0xeb,0x50,0x1e,0x7d,0x52,0xe0,0x0d,0x52,0x9e,0x56,0xc6,0x77,0x3e,0x6d,0x4d,0x53,0xe1,0x2f,0x88,0x45},+	{0xd6,0x83,0x79,0x75,0x5d,0x34,0x69,0x66,0xa6,0x11,0xaa,0x17,0x11,0xed,0xb6,0x62,0x8f,0x12,0x5e,0x98,0x57,0x18,0xdd,0x7d,0xdd,0xf6,0x26,0xf6,0xb8,0xe5,0x8f,0x68,0xe4,0x6f,0x3c,0x94,0x29,0x99,0xac,0xd8,0xa2,0x92,0x83,0xa3,0x61,0xf1,0xf9,0xb5,0xf3,0x9a,0xc8,0xbe,0x13,0xdb,0x99,0x26,0x74,0xf0,0x05,0xe4,0x3c,0x84,0xcf,0x7d,0xc0,0x32,0x47,0x4a,0x48,0xd6,0x90,0x6c,0x99,0x32,0x56,0xca,0xfd,0x43,0x21,0xd5,0xe1,0xc6,0x5d,0x91,0xc3,0x28,0xbe,0xb3,0x1b,0x19,0x27,0x73,0x7e,0x68,0x39,0x67},+	{0xa6,0x75,0x56,0x38,0x14,0x20,0x78,0xef,0xe8,0xa9,0xfd,0xaa,0x30,0x9f,0x64,0xa2,0xcb,0xa8,0xdf,0x5c,0x50,0xeb,0xd1,0x4c,0xb3,0xc0,0x4d,0x1d,0xba,0x5a,0x11,0x46,0xc0,0x1a,0x0c,0xc8,0x9d,0xcc,0x6d,0xa6,0x36,0xa4,0x38,0x1b,0xf4,0x5c,0xa0,0x97,0xc6,0xd7,0xdb,0x95,0xbe,0xf3,0xeb,0xa7,0xab,0x7d,0x7e,0x8d,0xf6,0xb8,0xa0,0x7d,0x76,0xda,0xb5,0xc3,0x53,0x19,0x0f,0xd4,0x9b,0x9e,0x11,0x21,0x73,0x6f,0xac,0x1d,0x60,0x59,0xb2,0xfe,0x21,0x60,0xcc,0x03,0x4b,0x4b,0x67,0x83,0x7e,0x88,0x5f,0x5a},+	{0x11,0x3d,0xa1,0x70,0xcf,0x01,0x63,0x8f,0xc4,0xd0,0x0d,0x35,0x15,0xb8,0xce,0xcf,0x7e,0xa4,0xbc,0xa4,0xd4,0x97,0x02,0xf7,0x34,0x14,0x4d,0xe4,0x56,0xb6,0x69,0x36,0xb9,0x43,0xa6,0xa0,0xd3,0x28,0x96,0x9e,0x64,0x20,0xc3,0xe6,0x00,0xcb,0xc3,0xb5,0x32,0xec,0x2d,0x7c,0x89,0x02,0x53,0x9b,0x0c,0xc7,0xd1,0xd5,0xe2,0x7a,0xe3,0x43,0x33,0xe1,0xa6,0xed,0x06,0x3f,0x7e,0x38,0xc0,0x3a,0xa1,0x99,0x51,0x1d,0x30,0x67,0x11,0x38,0x26,0x36,0xf8,0xd8,0x5a,0xbd,0xbe,0xe9,0xd5,0x4f,0xcd,0xe6,0x21,0x6a},+	{0x5f,0xe6,0x46,0x30,0x0a,0x17,0xc6,0xf1,0x24,0x35,0xd2,0x00,0x2a,0x2a,0x71,0x58,0x55,0xb7,0x82,0x8c,0x3c,0xbd,0xdb,0x69,0x57,0xff,0x95,0xa1,0xf1,0xf9,0x6b,0x58,0xe3,0xb2,0x99,0x66,0x12,0x29,0x41,0xef,0x01,0x13,0x8d,0x70,0x47,0x08,0xd3,0x71,0xbd,0xb0,0x82,0x11,0xd0,0x32,0x54,0x32,0x36,0x8b,0x1e,0x00,0x07,0x1b,0x37,0x45,0x0b,0x79,0xf8,0x5e,0x8d,0x08,0xdb,0xa6,0xe5,0x37,0x09,0x61,0xdc,0xf0,0x78,0x52,0xb8,0x6e,0xa1,0x61,0xd2,0x49,0x03,0xac,0x79,0x21,0xe5,0x90,0x37,0xb0,0xaf,0x0e},+	{0x2f,0x04,0x48,0x37,0xc1,0x55,0x05,0x96,0x11,0xaa,0x0b,0x82,0xe6,0x41,0x9a,0x21,0x0c,0x6d,0x48,0x73,0x38,0xf7,0x81,0x1c,0x61,0xc6,0x02,0x5a,0x67,0xcc,0x9a,0x30,0x1d,0xae,0x75,0x0f,0x5e,0x80,0x40,0x51,0x30,0xcc,0x62,0x26,0xe3,0xfb,0x02,0xec,0x6d,0x39,0x92,0xea,0x1e,0xdf,0xeb,0x2c,0xb3,0x5b,0x43,0xc5,0x44,0x33,0xae,0x44,0xee,0x43,0xa5,0xbb,0xb9,0x89,0xf2,0x9c,0x42,0x71,0xc9,0x5a,0x9d,0x0e,0x76,0xf3,0xaa,0x60,0x93,0x4f,0xc6,0xe5,0x82,0x1d,0x8f,0x67,0x94,0x7f,0x1b,0x22,0xd5,0x62},+	{0x6d,0x93,0xd0,0x18,0x9c,0x29,0x4c,0x52,0x0c,0x1a,0x0c,0x8a,0x6c,0xb5,0x6b,0xc8,0x31,0x86,0x4a,0xdb,0x2e,0x05,0x75,0xa3,0x62,0x45,0x75,0xbc,0xe4,0xfd,0x0e,0x5c,0x3c,0x7a,0xf7,0x3a,0x26,0xd4,0x85,0x75,0x4d,0x14,0xe9,0xfe,0x11,0x7b,0xae,0xdf,0x3d,0x19,0xf7,0x59,0x80,0x70,0x06,0xa5,0x37,0x20,0x92,0x83,0x53,0x9a,0xf2,0x14,0xf5,0xd7,0xb2,0x25,0xdc,0x7e,0x71,0xdf,0x40,0x30,0xb5,0x99,0xdb,0x70,0xf9,0x21,0x62,0x4c,0xed,0xc3,0xb7,0x34,0x92,0xda,0x3e,0x09,0xee,0x7b,0x5c,0x36,0x72,0x5e},+	{0x7f,0x21,0x71,0x45,0x07,0xfc,0x5b,0x57,0x5b,0xd9,0x94,0x06,0x5d,0x67,0x79,0x37,0x33,0x1e,0x19,0xf4,0xbb,0x37,0x0a,0x9a,0xbc,0xea,0xb4,0x47,0x4c,0x10,0xf1,0x77,0x3e,0xb3,0x08,0x2f,0x06,0x39,0x93,0x7d,0xbe,0x32,0x9f,0xdf,0xe5,0x59,0x96,0x5b,0xfd,0xbd,0x9e,0x1f,0xad,0x3d,0xff,0xac,0xb7,0x49,0x73,0xcb,0x55,0x05,0xb2,0x70,0x4c,0x2c,0x11,0x55,0xc5,0x13,0x51,0xbe,0xcd,0x1f,0x88,0x9a,0x3a,0x42,0x88,0x66,0x47,0x3b,0x50,0x5e,0x85,0x77,0x66,0x44,0x4a,0x40,0x06,0x4a,0x8f,0x39,0x34,0x0e},+	{0xe8,0xbd,0xce,0x3e,0xd9,0x22,0x7d,0xb6,0x07,0x2f,0x82,0x27,0x41,0xe8,0xb3,0x09,0x8d,0x6d,0x5b,0xb0,0x1f,0xa6,0x3f,0x74,0x72,0x23,0x36,0x8a,0x36,0x05,0x54,0x5e,0x28,0x19,0x4b,0x3e,0x09,0x0b,0x93,0x18,0x40,0xf6,0xf3,0x73,0x0e,0xe1,0xe3,0x7d,0x6f,0x5d,0x39,0x73,0xda,0x17,0x32,0xf4,0x3e,0x9c,0x37,0xca,0xd6,0xde,0x8a,0x6f,0x9a,0xb2,0xb7,0xfd,0x3d,0x12,0x40,0xe3,0x91,0xb2,0x1a,0xa2,0xe1,0x97,0x7b,0x48,0x9e,0x94,0xe6,0xfd,0x02,0x7d,0x96,0xf9,0x97,0xde,0xd3,0xc8,0x2e,0xe7,0x0d,0x78},+	{0xbc,0xe7,0x9a,0x08,0x45,0x85,0xe2,0x0a,0x06,0x4d,0x7f,0x1c,0xcf,0xde,0x8d,0x38,0xb8,0x11,0x48,0x0a,0x51,0x15,0xac,0x38,0xe4,0x8c,0x92,0x71,0xf6,0x8b,0xb2,0x0e,0x72,0x27,0xf4,0x00,0xf3,0xea,0x1f,0x67,0xaa,0x41,0x8c,0x2a,0x2a,0xeb,0x72,0x8f,0x92,0x32,0x37,0x97,0xd7,0x7f,0xa1,0x29,0xa6,0x87,0xb5,0x32,0xad,0xc6,0xef,0x1d,0xa7,0x95,0x51,0xef,0x1a,0xbe,0x5b,0xaf,0xed,0x15,0x7b,0x91,0x77,0x12,0x8c,0x14,0x2e,0xda,0xe5,0x7a,0xfb,0xf7,0x91,0x29,0x67,0x28,0xdd,0xf8,0x1b,0x20,0x7d,0x46},+	{0xad,0x4f,0xef,0x74,0x9a,0x91,0xfe,0x95,0xa2,0x08,0xa3,0xf6,0xec,0x7b,0x82,0x3a,0x01,0x7b,0xa4,0x09,0xd3,0x01,0x4e,0x96,0x97,0xc7,0xa3,0x5b,0x4f,0x3c,0xc4,0x71,0xa9,0xe7,0x7a,0x56,0xbd,0xf4,0x1e,0xbc,0xbd,0x98,0x44,0xd6,0xb2,0x4c,0x62,0x3f,0xc8,0x4e,0x1f,0x2c,0xd2,0x64,0x10,0xe4,0x01,0x40,0x38,0xba,0xa5,0xc5,0xf9,0x2e,0xcd,0x74,0x9e,0xfa,0xf6,0x6d,0xfd,0xb6,0x7a,0x26,0xaf,0xe4,0xbc,0x78,0x82,0xf1,0x0e,0x99,0xef,0xf1,0xd0,0xb3,0x55,0x82,0x93,0xf2,0xc5,0x90,0xa3,0x8c,0x75,0x5a},+	{0x95,0x24,0x46,0xd9,0x10,0x27,0xb7,0xa2,0x03,0x50,0x7d,0xd5,0xd2,0xc6,0xa8,0x3a,0xca,0x87,0xb4,0xa0,0xbf,0x00,0xd4,0xe3,0xec,0x72,0xeb,0xb3,0x44,0xe2,0xba,0x2d,0x94,0xdc,0x61,0x1d,0x8b,0x91,0xe0,0x8c,0x66,0x30,0x81,0x9a,0x46,0x36,0xed,0x8d,0xd3,0xaa,0xe8,0xaf,0x29,0xa8,0xe6,0xd4,0x3f,0xd4,0x39,0xf6,0x27,0x80,0x73,0x0a,0xcc,0xe1,0xff,0x57,0x2f,0x4a,0x0f,0x98,0x43,0x98,0x83,0xe1,0x0d,0x0d,0x67,0x00,0xfd,0x15,0xfb,0x49,0x4a,0x3f,0x5c,0x10,0x9c,0xa6,0x26,0x51,0x63,0xca,0x98,0x26},+	{0x78,0xba,0xb0,0x32,0x88,0x31,0x65,0xe7,0x8b,0xff,0x5c,0x92,0xf7,0x31,0x18,0x38,0xcc,0x1f,0x29,0xa0,0x91,0x1b,0xa8,0x08,0x07,0xeb,0xca,0x49,0xcc,0x3d,0xb4,0x1f,0x0e,0xd9,0x3d,0x5e,0x2f,0x70,0x3d,0x2e,0x86,0x53,0xd2,0xe4,0x18,0x09,0x3f,0x9e,0x6a,0xa9,0x4d,0x02,0xf6,0x3e,0x77,0x5e,0x32,0x33,0xfa,0x4a,0x0c,0x4b,0x00,0x3c,0x2b,0xb8,0xf4,0x06,0xac,0x46,0xa9,0x9a,0xf3,0xc4,0x06,0xa8,0xa5,0x84,0xa2,0x1c,0x87,0x47,0xcd,0xc6,0x5f,0x26,0xd3,0x3e,0x17,0xd2,0x1f,0xcd,0x01,0xfd,0x43,0x6b},+	{0x44,0xc5,0x97,0x46,0x4b,0x5d,0xa7,0xc7,0xbf,0xff,0x0f,0xdf,0x48,0xf8,0xfd,0x15,0x5a,0x78,0x46,0xaa,0xeb,0xb9,0x68,0x28,0x14,0xf7,0x52,0x5b,0x10,0xd7,0x68,0x5a,0xf3,0x0e,0x76,0x3e,0x58,0x42,0xc7,0xb5,0x90,0xb9,0x0a,0xee,0xb9,0x52,0xdc,0x75,0x3f,0x92,0x2b,0x07,0xc2,0x27,0x14,0xbf,0xf0,0xd9,0xf0,0x6f,0x2d,0x0b,0x42,0x73,0x06,0x1e,0x85,0x9e,0xcb,0xf6,0x2c,0xaf,0xc4,0x38,0x22,0xc6,0x13,0x39,0x59,0x8f,0x73,0xf3,0xfb,0x99,0x96,0xb8,0x8a,0xda,0x9e,0xbc,0x34,0xea,0x2f,0x63,0xb5,0x3d},+	{0xd8,0xd9,0x5d,0xf7,0x2b,0xee,0x6e,0xf4,0xa5,0x59,0x67,0x39,0xf6,0xb1,0x17,0x0d,0x73,0x72,0x9e,0x49,0x31,0xd1,0xf2,0x1b,0x13,0x5f,0xd7,0x49,0xdf,0x1a,0x32,0x04,0xd5,0x25,0x98,0x82,0xb1,0x90,0x49,0x2e,0x91,0x89,0x9a,0x3e,0x87,0xeb,0xea,0xed,0xf8,0x4a,0x70,0x4c,0x39,0x3d,0xf0,0xee,0x0e,0x2b,0xdf,0x95,0xa4,0x7e,0x19,0x59,0xae,0x5a,0xe5,0xe4,0x19,0x60,0xe1,0x04,0xe9,0x92,0x2f,0x7e,0x7a,0x43,0x7b,0xe7,0xa4,0x9a,0x15,0x6f,0xc1,0x2d,0xce,0xc7,0xc0,0x0c,0xd7,0xf4,0xc1,0xfd,0xea,0x45},+	{0x2b,0xd7,0x45,0x80,0x85,0x01,0x84,0x69,0x51,0x06,0x2f,0xcf,0xa2,0xfa,0x22,0x4c,0xc6,0x2d,0x22,0x6b,0x65,0x36,0x1a,0x94,0xde,0xda,0x62,0x03,0xc8,0xeb,0x5e,0x5a,0xed,0xb1,0xcc,0xcf,0x24,0x46,0x0e,0xb6,0x95,0x03,0x5c,0xbd,0x92,0xc2,0xdb,0x59,0xc9,0x81,0x04,0xdc,0x1d,0x9d,0xa0,0x31,0x40,0xd9,0x56,0x5d,0xea,0xce,0x73,0x3f,0xc6,0x8d,0x4e,0x0a,0xd1,0xbf,0xa7,0xb7,0x39,0xb3,0xc9,0x44,0x7e,0x00,0x57,0xbe,0xfa,0xae,0x57,0x15,0x7f,0x20,0xc1,0x60,0xdb,0x18,0x62,0x26,0x91,0x88,0x05,0x26},+	{0x04,0xff,0x60,0x83,0xa6,0x04,0xf7,0x59,0xf4,0xe6,0x61,0x76,0xde,0x3f,0xd9,0xc3,0x51,0x35,0x87,0x12,0x73,0x2a,0x1b,0x83,0x57,0x5d,0x61,0x4e,0x2e,0x0c,0xad,0x54,0x42,0xe5,0x76,0xc6,0x3c,0x8e,0x81,0x4c,0xad,0xcc,0xce,0x03,0x93,0x2c,0x42,0x5e,0x08,0x9f,0x12,0xb4,0xca,0xcc,0x07,0xec,0xb8,0x43,0x44,0xb2,0x10,0xfa,0xed,0x0d,0x2a,0x52,0x2b,0xb8,0xd5,0x67,0x3b,0xee,0xeb,0xc1,0xa5,0x9f,0x46,0x63,0xf1,0x36,0xd3,0x9f,0xc1,0x6e,0xf2,0xd2,0xb4,0xa5,0x08,0x94,0x7a,0xa7,0xba,0xb2,0xec,0x62},+	{0x3d,0x2b,0x15,0x61,0x52,0x79,0xed,0xe5,0xd1,0xd7,0xdd,0x0e,0x7d,0x35,0x62,0x49,0x71,0x4c,0x6b,0xb9,0xd0,0xc8,0x82,0x74,0xbe,0xd8,0x66,0xa9,0x19,0xf9,0x59,0x2e,0x74,0x28,0xb6,0xaf,0x36,0x28,0x07,0x92,0xa5,0x04,0xe1,0x79,0x85,0x5e,0xcd,0x5f,0x4a,0xa1,0x30,0xc6,0xad,0x01,0xad,0x5a,0x98,0x3f,0x66,0x75,0x50,0x3d,0x91,0x61,0xda,0x31,0x32,0x1a,0x36,0x2d,0xc6,0x0d,0x70,0x02,0x20,0x94,0x32,0x58,0x47,0xfa,0xce,0x94,0x95,0x3f,0x51,0x01,0xd8,0x02,0x5c,0x5d,0xc0,0x31,0xa1,0xc2,0xdb,0x3d},+	{0x4b,0xc5,0x5e,0xce,0xf9,0x0f,0xdc,0x9a,0x0d,0x13,0x2f,0x8c,0x6b,0x2a,0x9c,0x03,0x15,0x95,0xf8,0xf0,0xc7,0x07,0x80,0x02,0x6b,0xb3,0x04,0xac,0x14,0x83,0x96,0x78,0x14,0xbb,0x96,0x27,0xa2,0x57,0xaa,0xf3,0x21,0xda,0x07,0x9b,0xb7,0xba,0x3a,0x88,0x1c,0x39,0xa0,0x31,0x18,0xe2,0x4b,0xe5,0xf9,0x05,0x32,0xd8,0x38,0xfb,0xe7,0x5e,0x8e,0x6a,0x44,0x41,0xcb,0xfd,0x8d,0x53,0xf9,0x37,0x49,0x43,0xa9,0xfd,0xac,0xa5,0x78,0x8c,0x3c,0x26,0x8d,0x90,0xaf,0x46,0x09,0x0d,0xca,0x9b,0x3c,0x63,0xd0,0x61},+	{0x66,0x25,0xdb,0xff,0x35,0x49,0x74,0x63,0xbb,0x68,0x0b,0x78,0x89,0x6b,0xbd,0xc5,0x03,0xec,0x3e,0x55,0x80,0x32,0x1b,0x6f,0xf5,0xd7,0xae,0x47,0xd8,0x5f,0x96,0x6e,0xdf,0x73,0xfc,0xf8,0xbc,0x28,0xa3,0xad,0xfc,0x37,0xf0,0xa6,0x5d,0x69,0x84,0xee,0x09,0xa9,0xc2,0x38,0xdb,0xb4,0x7f,0x63,0xdc,0x7b,0x06,0xf8,0x2d,0xac,0x23,0x5b,0x7b,0x52,0x80,0xee,0x53,0xb9,0xd2,0x9a,0x8d,0x6d,0xde,0xfa,0xaa,0x19,0x8f,0xe8,0xcf,0x82,0x0e,0x15,0x04,0x17,0x71,0x0e,0xdc,0xde,0x95,0xdd,0xb9,0xbb,0xb9,0x79},+	{0xc2,0x26,0x31,0x6a,0x40,0x55,0xb3,0xeb,0x93,0xc3,0xc8,0x68,0xa8,0x83,0x63,0xd2,0x82,0x7a,0xb9,0xe5,0x29,0x64,0x0c,0x6c,0x47,0x21,0xfd,0xc9,0x58,0xf1,0x65,0x50,0x74,0x73,0x9f,0x8e,0xae,0x7d,0x99,0xd1,0x16,0x08,0xbb,0xcf,0xf8,0xa2,0x32,0xa0,0x0a,0x5f,0x44,0x6d,0x12,0xba,0x6c,0xcd,0x34,0xb8,0xcc,0x0a,0x46,0x11,0xa8,0x1b,0x54,0x99,0x42,0x0c,0xfb,0x69,0x81,0x70,0x67,0xcf,0x6e,0xd7,0xac,0x00,0x46,0xe1,0xba,0x45,0xe6,0x70,0x8a,0xb9,0xaa,0x2e,0xf2,0xfa,0xa4,0x58,0x9e,0xf3,0x81,0x39},+	{0x93,0x0a,0x23,0x59,0x75,0x8a,0xfb,0x18,0x5d,0xf4,0xe6,0x60,0x69,0x8f,0x16,0x1d,0xb5,0x3c,0xa9,0x14,0x45,0xa9,0x85,0x3a,0xfd,0xd0,0xac,0x05,0x37,0x08,0xdc,0x38,0xde,0x6f,0xe6,0x6d,0xa5,0xdf,0x45,0xc8,0x3a,0x48,0x40,0x2c,0x00,0xa5,0x52,0xe1,0x32,0xf6,0xb4,0xc7,0x63,0xe1,0xd2,0xe9,0x65,0x1b,0xbc,0xdc,0x2e,0x45,0xf4,0x30,0x40,0x97,0x75,0xc5,0x82,0x27,0x6d,0x85,0xcc,0xbe,0x9c,0xf9,0x69,0x45,0x13,0xfa,0x71,0x4e,0xea,0xc0,0x73,0xfc,0x44,0x88,0x69,0x24,0x3f,0x59,0x1a,0x9a,0x2d,0x63},+	{0xa6,0xcb,0x07,0xb8,0x15,0x6b,0xbb,0xf6,0xd7,0xf0,0x54,0xbc,0xdf,0xc7,0x23,0x18,0x0b,0x67,0x29,0x6e,0x03,0x97,0x1d,0xbb,0x57,0x4a,0xed,0x47,0x88,0xf4,0x24,0x0b,0xa7,0x84,0x0c,0xed,0x11,0xfd,0x09,0xbf,0x3a,0x69,0x9f,0x0d,0x81,0x71,0xf0,0x63,0x79,0x87,0xcf,0x57,0x2d,0x8c,0x90,0x21,0xa2,0x4b,0xf6,0x8a,0xf2,0x7d,0x5a,0x3a,0xc7,0xea,0x1b,0x51,0xbe,0xd4,0xda,0xdc,0xf2,0xcc,0x26,0xed,0x75,0x80,0x53,0xa4,0x65,0x9a,0x5f,0x00,0x9f,0xff,0x9c,0xe1,0x63,0x1f,0x48,0x75,0x44,0xf7,0xfc,0x34},+	{0xca,0x67,0x97,0x78,0x4c,0xe0,0x97,0xc1,0x7d,0x46,0xd9,0x38,0xcb,0x4d,0x71,0xb8,0xa8,0x5f,0xf9,0x83,0x82,0x88,0xde,0x55,0xf7,0x63,0xfa,0x4d,0x16,0xdc,0x3b,0x3d,0x98,0xaa,0xcf,0x78,0xab,0x1d,0xbb,0xa5,0xf2,0x72,0x0b,0x19,0x67,0xa2,0xed,0x5c,0x8e,0x60,0x92,0x0a,0x11,0xc9,0x09,0x93,0xb0,0x74,0xb3,0x2f,0x04,0xa3,0x19,0x01,0x7d,0x17,0xc2,0xe8,0x9c,0xd8,0xa2,0x67,0xc1,0xd0,0x95,0x68,0xf6,0xa5,0x9d,0x66,0xb0,0xa2,0x82,0xb2,0xe5,0x98,0x65,0xf5,0x73,0x0a,0xe2,0xed,0xf1,0x88,0xc0,0x56},+	{0x17,0x6e,0xa8,0x10,0x11,0x3d,0x6d,0x33,0xfa,0xb2,0x75,0x0b,0x32,0x88,0xf3,0xd7,0x88,0x29,0x07,0x25,0x76,0x33,0x15,0xf9,0x87,0x8b,0x10,0x99,0x6b,0x4c,0x67,0x09,0x02,0x8f,0xf3,0x24,0xac,0x5f,0x1b,0x58,0xbd,0x0c,0xe3,0xba,0xfe,0xe9,0x0b,0xa9,0xf0,0x92,0xcf,0x8a,0x02,0x69,0x21,0x9a,0x8f,0x03,0x59,0x83,0xa4,0x7e,0x8b,0x03,0xf8,0x6f,0x31,0x99,0x21,0xf8,0x4e,0x9f,0x4f,0x8d,0xa7,0xea,0x82,0xd2,0x49,0x2f,0x74,0x31,0xef,0x5a,0xab,0xa5,0x71,0x09,0x65,0xeb,0x69,0x59,0x02,0x31,0x5e,0x6e},+	{0xfb,0x93,0xe5,0x87,0xf5,0x62,0x6c,0xb1,0x71,0x3e,0x5d,0xca,0xde,0xed,0x99,0x49,0x6d,0x3e,0xcc,0x14,0xe0,0xc1,0x91,0xb4,0xa8,0xdb,0xa8,0x89,0x47,0x11,0xf5,0x08,0x22,0x62,0x06,0x63,0x0e,0xfb,0x04,0x33,0x3f,0xba,0xac,0x87,0x89,0x06,0x35,0xfb,0xa3,0x61,0x10,0x8c,0x77,0x24,0x19,0xbd,0x20,0x86,0x83,0xd1,0x43,0xad,0x58,0x30,0xd0,0x63,0x76,0xe5,0xfd,0x0f,0x3c,0x32,0x10,0xa6,0x2e,0xa2,0x38,0xdf,0xc3,0x05,0x9a,0x4f,0x99,0xac,0xbd,0x8a,0xc7,0xbd,0x99,0xdc,0xe3,0xef,0xa4,0x9f,0x54,0x26},+	{0xd6,0xf9,0x6b,0x1e,0x46,0x5a,0x1d,0x74,0x81,0xa5,0x77,0x77,0xfc,0xb3,0x05,0x23,0xd9,0xd3,0x74,0x64,0xa2,0x74,0x55,0xd4,0xff,0xe0,0x01,0x64,0xdc,0xe1,0x26,0x19,0x6e,0x66,0x3f,0xaf,0x49,0x85,0x46,0xdb,0xa5,0x0e,0x4a,0xf1,0x04,0xcf,0x7f,0xd7,0x47,0x0c,0xba,0xa4,0xf7,0x3f,0xf2,0x3d,0x85,0x3c,0xce,0x32,0xe1,0xdf,0x10,0x3a,0xa0,0xce,0x17,0xea,0x8a,0x4e,0x7f,0xe0,0xfd,0xc1,0x1f,0x3a,0x46,0x15,0xd5,0x2f,0xf1,0xc0,0xf2,0x31,0xfd,0x22,0x53,0x17,0x15,0x5d,0x1e,0x86,0x1d,0xd0,0xa1,0x1f},+	{0x32,0x98,0x59,0x7d,0x94,0x55,0x80,0xcc,0x20,0x55,0xf1,0x37,0xda,0x56,0x46,0x1e,0x20,0x93,0x05,0x4e,0x74,0xf7,0xf6,0x99,0x33,0xcf,0x75,0x6a,0xbc,0x63,0x35,0x77,0xab,0x94,0xdf,0xd1,0x00,0xac,0xdc,0x38,0xe9,0x0d,0x08,0xd1,0xdd,0x2b,0x71,0x2e,0x62,0xe2,0xd5,0xfd,0x3e,0xe9,0x13,0x7f,0xe5,0x01,0x9a,0xee,0x18,0xed,0xfc,0x73,0xb3,0x9c,0x13,0x63,0x08,0xe9,0xb1,0x06,0xcd,0x3e,0xa0,0xc5,0x67,0xda,0x93,0xa4,0x32,0x89,0x63,0xad,0xc8,0xce,0x77,0x8d,0x44,0x4f,0x86,0x1b,0x70,0x6b,0x42,0x1f},+	{0x01,0x1c,0x91,0x41,0x4c,0x26,0xc9,0xef,0x25,0x2c,0xa2,0x17,0xb8,0xb7,0xa3,0xf1,0x47,0x14,0x0f,0xf3,0x6b,0xda,0x75,0x58,0x90,0xb0,0x31,0x1d,0x27,0xf5,0x1a,0x4e,0x52,0x25,0xa1,0x91,0xc8,0x35,0x7e,0xf1,0x76,0x9c,0x5e,0x57,0x53,0x81,0x6b,0xb7,0x3e,0x72,0x9b,0x0d,0x6f,0x40,0x83,0xfa,0x38,0xe4,0xa7,0x3f,0x1b,0xbb,0x76,0x0b,0x9b,0x93,0x92,0x7f,0xf9,0xc1,0xb8,0x08,0x6e,0xab,0x44,0xd4,0xcb,0x71,0x67,0xbe,0x17,0x80,0xbb,0x99,0x63,0x64,0xe5,0x22,0x55,0xa9,0x72,0xb7,0x1e,0xd6,0x6d,0x7b},+	{0x92,0x3d,0xf3,0x50,0xe8,0xc1,0xad,0xb7,0xcf,0xd5,0x8c,0x60,0x4f,0xfa,0x98,0x79,0xdb,0x5b,0xfc,0x8d,0xbd,0x2d,0x96,0xad,0x4f,0x2f,0x1d,0xaf,0xce,0x9b,0x3e,0x70,0xc7,0xd2,0x01,0xab,0xf9,0xab,0x30,0x57,0x18,0x3b,0x14,0x40,0xdc,0x76,0xfb,0x16,0x81,0xb2,0xcb,0xa0,0x65,0xbe,0x6c,0x86,0xfe,0x6a,0xff,0x9b,0x65,0x9b,0xfa,0x53,0x55,0x54,0x88,0x94,0xe9,0xc8,0x14,0x6c,0xe5,0xd4,0xae,0x65,0x66,0x5d,0x3a,0x84,0xf1,0x5a,0xd6,0xbc,0x3e,0xb7,0x1b,0x18,0x50,0x1f,0xc6,0xc4,0xe5,0x93,0x8d,0x39},+	{0xf3,0x48,0xe2,0x33,0x67,0xd1,0x4b,0x1c,0x5f,0x0a,0xbf,0x15,0x87,0x12,0x9e,0xbd,0x76,0x03,0x0b,0xa1,0xf0,0x8c,0x3f,0xd4,0x13,0x1b,0x19,0xdf,0x5d,0x9b,0xb0,0x53,0xf2,0xe3,0xe7,0xd2,0x60,0x7c,0x87,0xc3,0xb1,0x8b,0x82,0x30,0xa0,0xaa,0x34,0x3b,0x38,0xf1,0x9e,0x73,0xe7,0x26,0x3e,0x28,0x77,0x05,0xc3,0x02,0x90,0x9c,0x9c,0x69,0xcc,0xf1,0x46,0x59,0x23,0xa7,0x06,0xf3,0x7d,0xd9,0xe5,0xcc,0xb5,0x18,0x17,0x92,0x75,0xe9,0xb4,0x81,0x47,0xd2,0xcd,0x28,0x07,0xd9,0xcd,0x6f,0x0c,0xf3,0xca,0x51},+	{0x0a,0xe0,0x74,0x76,0x42,0xa7,0x0b,0xa6,0xf3,0x7b,0x7a,0xa1,0x70,0x85,0x0e,0x63,0xcc,0x24,0x33,0xcf,0x3d,0x56,0x58,0x37,0xaa,0xfd,0x83,0x23,0x29,0xaa,0x04,0x55,0xc7,0x54,0xac,0x18,0x9a,0xf9,0x7a,0x73,0x0f,0xb3,0x1c,0xc5,0xdc,0x78,0x33,0x90,0xc7,0x0c,0xe1,0x4c,0x33,0xbc,0x89,0x2b,0x9a,0xe9,0xf8,0x89,0xc1,0x29,0xae,0x12,0xcf,0x01,0x0d,0x1f,0xcb,0xc0,0x9e,0xa9,0xae,0xf7,0x34,0x3a,0xcc,0xef,0xd1,0x0d,0x22,0x4e,0x9c,0xd0,0x21,0x75,0xca,0x55,0xea,0xa5,0xeb,0x58,0xe9,0x4f,0xd1,0x5f},+	{0x2c,0xab,0x45,0x28,0xdf,0x2d,0xdc,0xb5,0x93,0xe9,0x7f,0x0a,0xb1,0x91,0x94,0x06,0x46,0xe3,0x02,0x40,0xd6,0xf3,0xaa,0x4d,0xd1,0x74,0x64,0x58,0x6e,0xf2,0x3f,0x09,0x8e,0xcb,0x93,0xbf,0x5e,0xfe,0x42,0x3c,0x5f,0x56,0xd4,0x36,0x51,0xa8,0xdf,0xbe,0xe8,0x20,0x42,0x88,0x9e,0x85,0xf0,0xe0,0x28,0xd1,0x25,0x07,0x96,0x3f,0xd7,0x7d,0x29,0x98,0x05,0x68,0xfe,0x24,0x0d,0xb1,0xe5,0x23,0xaf,0xdb,0x72,0x06,0x73,0x75,0x29,0xac,0x57,0xb4,0x3a,0x25,0x67,0x13,0xa4,0x70,0xb4,0x86,0xbc,0xbc,0x59,0x2f},+	{0x5f,0x13,0x17,0x99,0x42,0x7d,0x84,0x83,0xd7,0x03,0x7d,0x56,0x1f,0x91,0x1b,0xad,0xd1,0xaa,0x77,0xbe,0xd9,0x48,0x77,0x7e,0x4a,0xaf,0x51,0x2e,0x2e,0xb4,0x58,0x54,0x01,0xc3,0x91,0xb6,0x60,0xd5,0x41,0x70,0x1e,0xe7,0xd7,0xad,0x3f,0x1b,0x20,0x85,0x85,0x55,0x33,0x11,0x63,0xe1,0xc2,0x16,0xb1,0x28,0x08,0x01,0x3d,0x5e,0xa5,0x2a,0x4f,0x44,0x07,0x0c,0xe6,0x92,0x51,0xed,0x10,0x1d,0x42,0x74,0x2d,0x4e,0xc5,0x42,0x64,0xc8,0xb5,0xfd,0x82,0x4c,0x2b,0x35,0x64,0x86,0x76,0x8a,0x4a,0x00,0xe9,0x13},+	{0xdb,0xce,0x2f,0x83,0x45,0x88,0x9d,0x73,0x63,0xf8,0x6b,0xae,0xc9,0xd6,0x38,0xfa,0xf7,0xfe,0x4f,0xb7,0xca,0x0d,0xbc,0x32,0x5e,0xe4,0xbc,0x14,0x88,0x7e,0x93,0x73,0x7f,0x87,0x3b,0x19,0xc9,0x00,0x2e,0xbb,0x6b,0x50,0xdc,0xe0,0x90,0xa8,0xe3,0xec,0x9f,0x64,0xde,0x36,0xc0,0xb7,0xf3,0xec,0x1a,0x9e,0xde,0x98,0x08,0x04,0x46,0x5f,0x8d,0xf4,0x7b,0x29,0x16,0x71,0x03,0xb9,0x34,0x68,0xf0,0xd4,0x22,0x3b,0xd1,0xa9,0xc6,0xbd,0x96,0x46,0x57,0x15,0x97,0xe1,0x35,0xe8,0xd5,0x91,0xe8,0xa4,0xf8,0x2c},+	{0x67,0x0f,0x11,0x07,0x87,0xfd,0x93,0x6d,0x49,0xb5,0x38,0x7c,0xd3,0x09,0x4c,0xdd,0x86,0x6a,0x73,0xc2,0x4c,0x6a,0xb1,0x7c,0x09,0x2a,0x25,0x58,0x6e,0xbd,0x49,0x20,0xa2,0x6b,0xd0,0x17,0x7e,0x48,0xb5,0x2c,0x6b,0x19,0x50,0x39,0x1c,0x38,0xd2,0x24,0x30,0x8a,0x97,0x85,0x81,0x9c,0x65,0xd7,0xf6,0xa4,0xd6,0x91,0x28,0x7f,0x6f,0x7a,0x49,0xef,0x9a,0x6a,0x8d,0xfd,0x09,0x7d,0x0b,0xb9,0x3d,0x5b,0xbe,0x60,0xee,0xf0,0xd4,0xbf,0x9e,0x51,0x2c,0xb5,0x21,0x4c,0x1d,0x94,0x45,0xc5,0xdf,0xaa,0x11,0x60},+	{0x3c,0xf8,0x95,0xcf,0x6d,0x92,0x67,0x5f,0x71,0x90,0x28,0x71,0x61,0x85,0x7e,0x7c,0x5b,0x7a,0x8f,0x99,0xf3,0xe7,0xa1,0xd6,0xe0,0xf9,0x62,0x0b,0x1b,0xcc,0xc5,0x6f,0x90,0xf8,0xcb,0x02,0xc8,0xd0,0xde,0x63,0xaa,0x6a,0xff,0x0d,0xca,0x98,0xd0,0xfb,0x99,0xed,0xb6,0xb9,0xfd,0x0a,0x4d,0x62,0x1e,0x0b,0x34,0x79,0xb7,0x18,0xce,0x69,0xcb,0x79,0x98,0xb2,0x28,0x55,0xef,0xd1,0x92,0x90,0x7e,0xd4,0x3c,0xae,0x1a,0xdd,0x52,0x23,0x9f,0x18,0x42,0x04,0x7e,0x12,0xf1,0x01,0x71,0xe5,0x3a,0x6b,0x59,0x15},+	{0xa2,0x79,0x91,0x3f,0xd2,0x39,0x27,0x46,0xcf,0xdd,0xd6,0x97,0x31,0x12,0x83,0xff,0x8a,0x14,0xf2,0x53,0xb5,0xde,0x07,0x13,0xda,0x4d,0x5f,0x7b,0x68,0x37,0x22,0x0d,0xca,0x24,0x51,0x7e,0x16,0x31,0xff,0x09,0xdf,0x45,0xc7,0xd9,0x8b,0x15,0xe4,0x0b,0xe5,0x56,0xf5,0x7e,0x22,0x7d,0x2b,0x29,0x38,0xd1,0xb6,0xaf,0x41,0xe2,0xa4,0x3a,0xf5,0x05,0x33,0x2a,0xbf,0x38,0xc1,0x2c,0xc3,0x26,0xe9,0xa2,0x8f,0x3f,0x58,0x48,0xeb,0xd2,0x49,0x55,0xa2,0xb1,0x3a,0x08,0x6c,0xa3,0x87,0x46,0x6e,0xaa,0xfc,0x32},+	{0xf5,0x9a,0x7d,0xc5,0x8d,0x6e,0xc5,0x7b,0xf2,0xbd,0xf0,0x9d,0xed,0xd2,0x0b,0x3e,0xa3,0xe4,0xef,0x22,0xde,0x14,0xc0,0xaa,0x5c,0x6a,0xbd,0xfe,0xce,0xe9,0x27,0x46,0xdf,0xcc,0x87,0x27,0x73,0xa4,0x07,0x32,0xf8,0xe3,0x13,0xf2,0x08,0x19,0xe3,0x17,0x4e,0x96,0x0d,0xf6,0xd7,0xec,0xb2,0xd5,0xe9,0x0b,0x60,0xc2,0x36,0x63,0x6f,0x74,0x1c,0x97,0x6c,0xab,0x45,0xf3,0x4a,0x3f,0x1f,0x73,0x43,0x99,0x72,0xeb,0x88,0xe2,0x6d,0x18,0x44,0x03,0x8a,0x6a,0x59,0x33,0x93,0x62,0xd6,0x7e,0x00,0x17,0x49,0x7b},+	{0x64,0xb0,0x84,0xab,0x5c,0xfb,0x85,0x2d,0x14,0xbc,0xf3,0x89,0xd2,0x10,0x78,0x49,0x0c,0xce,0x15,0x7b,0x44,0xdc,0x6a,0x47,0x7b,0xfd,0x44,0xf8,0x76,0xa3,0x2b,0x12,0xdd,0xa2,0x53,0xdd,0x28,0x1b,0x34,0x54,0x3f,0xfc,0x42,0xdf,0x5b,0x90,0x17,0xaa,0xf4,0xf8,0xd2,0x4d,0xd9,0x92,0xf5,0x0f,0x7d,0xd3,0x8c,0xe0,0x0f,0x62,0x03,0x1d,0x54,0xe5,0xb4,0xa2,0xcd,0x32,0x02,0xc2,0x7f,0x18,0x5d,0x11,0x42,0xfd,0xd0,0x9e,0xd9,0x79,0xd4,0x7d,0xbe,0xb4,0xab,0x2e,0x4c,0xec,0x68,0x2b,0xf5,0x0b,0xc7,0x02},+	{0xbb,0x2f,0x0b,0x5d,0x4b,0xec,0x87,0xa2,0xca,0x82,0x48,0x07,0x90,0x57,0x5c,0x41,0x5c,0x81,0xd0,0xc1,0x1e,0xa6,0x44,0xe0,0xe0,0xf5,0x9e,0x40,0x0a,0x4f,0x33,0x26,0xe1,0x72,0x8d,0x45,0xbf,0x32,0xe5,0xac,0xb5,0x3c,0xb7,0x7c,0xe0,0x68,0xe7,0x5b,0xe7,0xbd,0x8b,0xee,0x94,0x7d,0xcf,0x56,0x03,0x3a,0xb4,0xfe,0xe3,0x97,0x06,0x6b,0xc0,0xa3,0x62,0xdf,0x4a,0xf0,0xc8,0xb6,0x5d,0xa4,0x6d,0x07,0xef,0x00,0xf0,0x3e,0xa9,0xd2,0xf0,0x49,0x58,0xb9,0x9c,0x9c,0xae,0x2f,0x1b,0x44,0x43,0x7f,0xc3,0x1c},+	{0x4f,0x32,0xc7,0x5c,0x5a,0x56,0x8f,0x50,0x22,0xa9,0x06,0xe5,0xc0,0xc4,0x61,0xd0,0x19,0xac,0x45,0x5c,0xdb,0xab,0x18,0xfb,0x4a,0x31,0x80,0x03,0xc1,0x09,0x68,0x6c,0xb9,0xae,0xce,0xc9,0xf1,0x56,0x66,0xd7,0x6a,0x65,0xe5,0x18,0xf8,0x15,0x5b,0x1c,0x34,0x23,0x4c,0x84,0x32,0x28,0xe7,0x26,0x38,0x68,0x19,0x2f,0x77,0x6f,0x34,0x3a,0xc8,0x6a,0xda,0xe2,0x12,0x51,0xd5,0xd2,0xed,0x51,0xe8,0xb1,0x31,0x03,0xbd,0xe9,0x62,0x72,0xc6,0x8e,0xdd,0x46,0x07,0x96,0xd0,0xc5,0xf7,0x6e,0x9f,0x1b,0x91,0x05},+	{0xbb,0x0e,0xdf,0xf5,0x83,0x99,0x33,0xc1,0xac,0x4c,0x2c,0x51,0x8f,0x75,0xf3,0xc0,0xe1,0x98,0xb3,0x0b,0x0a,0x13,0xf1,0x2c,0x62,0x0c,0x27,0xaa,0xf9,0xec,0x3c,0x6b,0xef,0xea,0x2e,0x51,0xf3,0xac,0x49,0x53,0x49,0xcb,0xc1,0x1c,0xd3,0x41,0xc1,0x20,0x8d,0x68,0x9a,0xa9,0x07,0x0c,0x18,0x24,0x17,0x2d,0x4b,0xc6,0xd1,0xf9,0x5e,0x55,0x08,0xbd,0x73,0x3b,0xba,0x70,0xa7,0x36,0x0c,0xbf,0xaf,0xa3,0x08,0xef,0x4a,0x62,0xf2,0x46,0x09,0xb4,0x98,0xff,0x37,0x57,0x9d,0x74,0x81,0x33,0xe1,0x4d,0x5f,0x67},+	{0xfc,0x82,0x17,0x6b,0x03,0x52,0x2c,0x0e,0xb4,0x83,0xad,0x6c,0x81,0x6c,0x81,0x64,0x3e,0x07,0x64,0x69,0xd9,0xbd,0xdc,0xd0,0x20,0xc5,0x64,0x01,0xf7,0x9d,0xd9,0x13,0x1d,0xb3,0xda,0x3b,0xd9,0xf6,0x2f,0xa1,0xfe,0x2d,0x65,0x9d,0x0f,0xd8,0x25,0x07,0x87,0x94,0xbe,0x9a,0xf3,0x4f,0x9c,0x01,0x43,0x3c,0xcd,0x82,0xb8,0x50,0xf4,0x60,0xca,0xc0,0xe5,0x21,0xc3,0x5e,0x4b,0x01,0xa2,0xbf,0x19,0xd7,0xc9,0x69,0xcb,0x4f,0xa0,0x23,0x00,0x75,0x18,0x1c,0x5f,0x4e,0x80,0xac,0xed,0x55,0x9e,0xde,0x06,0x1c},+	{0xe2,0xc4,0x3e,0xa3,0xd6,0x7a,0x0f,0x99,0x8e,0xe0,0x2e,0xbe,0x38,0xf9,0x08,0x66,0x15,0x45,0x28,0x63,0xc5,0x43,0xa1,0x9c,0x0d,0xb6,0x2d,0xec,0x1f,0x8a,0xf3,0x4c,0xaa,0x69,0x6d,0xff,0x40,0x2b,0xd5,0xff,0xbb,0x49,0x40,0xdc,0x18,0x0b,0x53,0x34,0x97,0x98,0x4d,0xa3,0x2f,0x5c,0x4a,0x5e,0x2d,0xba,0x32,0x7d,0x8e,0x6f,0x09,0x78,0xe7,0x5c,0xfa,0x0d,0x65,0xaa,0xaa,0xa0,0x8c,0x47,0xb5,0x48,0x2a,0x9e,0xc4,0xf9,0x5b,0x72,0x03,0x70,0x7d,0xcc,0x09,0x4f,0xbe,0x1a,0x09,0x26,0x3a,0xad,0x3c,0x37},+	{0x7c,0xf5,0xc9,0x82,0x4d,0x63,0x94,0xb2,0x36,0x45,0x93,0x24,0xe1,0xfd,0xcb,0x1f,0x5a,0xdb,0x8c,0x41,0xb3,0x4d,0x9c,0x9e,0xfc,0x19,0x44,0x45,0xd9,0xf3,0x40,0x00,0xad,0xbb,0xdd,0x89,0xfb,0xa8,0xbe,0xf1,0xcb,0xae,0xae,0x61,0xbc,0x2c,0xcb,0x3b,0x9d,0x8d,0x9b,0x1f,0xbb,0xa7,0x58,0x8f,0x86,0xa6,0x12,0x51,0xda,0x7e,0x54,0x21,0xd3,0x86,0x59,0xfd,0x39,0xe9,0xfd,0xde,0x0c,0x38,0x0a,0x51,0x89,0x2c,0x27,0xf4,0xb9,0x19,0x31,0xbb,0x07,0xa4,0x2b,0xb7,0xf4,0x4d,0x25,0x4a,0x33,0x0a,0x55,0x63},+	{0x37,0xcf,0x69,0xb5,0xed,0xd6,0x07,0x65,0xe1,0x2e,0xa5,0x0c,0xb0,0x29,0x84,0x17,0x5d,0xd6,0x6b,0xeb,0x90,0x00,0x7c,0xea,0x51,0x8f,0xf7,0xda,0xc7,0x62,0xea,0x3e,0x49,0x7b,0x54,0x72,0x45,0x58,0xba,0x9b,0xe0,0x08,0xc4,0xe2,0xfa,0xc6,0x05,0xf3,0x8d,0xf1,0x34,0xc7,0x69,0xfa,0xe8,0x60,0x7a,0x76,0x7d,0xaa,0xaf,0x2b,0xa9,0x39,0x4e,0x27,0x93,0xe6,0x13,0xc7,0x24,0x9d,0x75,0xd3,0xdb,0x68,0x77,0x85,0x63,0x5f,0x9a,0xb3,0x8a,0xeb,0x60,0x55,0x52,0x70,0xcd,0xc4,0xc9,0x65,0x06,0x6a,0x43,0x68},+	{0x27,0x3f,0x2f,0x20,0xe8,0x35,0x02,0xbc,0xb0,0x75,0xf9,0x64,0xe2,0x00,0x5c,0xc7,0x16,0x24,0x8c,0xa3,0xd5,0xe9,0xa4,0x91,0xf9,0x89,0xb7,0x8a,0xf6,0xe7,0xb6,0x17,0x7c,0x10,0x20,0xe8,0x17,0xd3,0x56,0x1e,0x65,0xe9,0x0a,0x84,0x44,0x68,0x26,0xc5,0x7a,0xfc,0x0f,0x32,0xc6,0xa1,0xe0,0xc1,0x72,0x14,0x61,0x91,0x9c,0x66,0x73,0x53,0x57,0x52,0x0e,0x9a,0xab,0x14,0x28,0x5d,0xfc,0xb3,0xca,0xc9,0x84,0x20,0x8f,0x90,0xca,0x1e,0x2d,0x5b,0x88,0xf5,0xca,0xaf,0x11,0x7d,0xf8,0x78,0xa6,0xb5,0xb4,0x1c},+	{0x6c,0xfc,0x4a,0x39,0x6b,0xc0,0x64,0xb6,0xb1,0x5f,0xda,0x98,0x24,0xde,0x88,0x0c,0x34,0xd8,0xca,0x4b,0x16,0x03,0x8d,0x4f,0xa2,0x34,0x74,0xde,0x78,0xca,0x0b,0x33,0xe7,0x07,0xa0,0xa2,0x62,0xaa,0x74,0x6b,0xb1,0xc7,0x71,0xf0,0xb0,0xe0,0x11,0xf3,0x23,0xe2,0x0b,0x00,0x38,0xe4,0x07,0x57,0xac,0x6e,0xef,0x82,0x2d,0xfd,0xc0,0x2d,0x4e,0x74,0x19,0x11,0x84,0xff,0x2e,0x98,0x24,0x47,0x07,0x2b,0x96,0x5e,0x69,0xf9,0xfb,0x53,0xc9,0xbf,0x4f,0xc1,0x8a,0xc5,0xf5,0x1c,0x9f,0x36,0x1b,0xbe,0x31,0x3c},+	{0xee,0x8a,0x94,0x08,0x4d,0x86,0xf4,0xb0,0x6f,0x1c,0xba,0x91,0xee,0x19,0xdc,0x07,0x58,0xa1,0xac,0xa6,0xae,0xcd,0x75,0x79,0xbb,0xd4,0x62,0x42,0x13,0x61,0x0b,0x33,0x72,0x42,0xcb,0xf9,0x93,0xbc,0x68,0xc1,0x98,0xdb,0xce,0xc7,0x1f,0x71,0xb8,0xae,0x7a,0x8d,0xac,0x34,0xaa,0x52,0x0e,0x7f,0xbb,0x55,0x7d,0x7e,0x09,0xc1,0xce,0x41,0x8a,0x80,0x6d,0xa2,0xd7,0x19,0x96,0xf7,0x6d,0x15,0x9e,0x1d,0x9e,0xd4,0x1f,0xbb,0x27,0xdf,0xa1,0xdb,0x6c,0xc3,0xd7,0x73,0x7d,0x77,0x28,0x1f,0xd9,0x4c,0xb4,0x26},+	{0x75,0x74,0x38,0x8f,0x47,0x48,0xf0,0x51,0x3c,0xcb,0xbe,0x9c,0xf4,0xbc,0x5d,0xb2,0x55,0x20,0x9f,0xd9,0x44,0x12,0xab,0x9a,0xd6,0xa5,0x10,0x1c,0x6c,0x9e,0x70,0x2c,0x83,0x03,0x73,0x62,0x93,0xf2,0xb7,0xe1,0x2c,0x8a,0xca,0xeb,0xff,0x79,0x52,0x4b,0x14,0x13,0xd4,0xbf,0x8a,0x77,0xfc,0xda,0x0f,0x61,0x72,0x9c,0x14,0x10,0xeb,0x7d,0x7a,0xee,0x66,0x87,0x6a,0xaf,0x62,0xcb,0x0e,0xcd,0x53,0x55,0x04,0xec,0xcb,0x66,0xb5,0xe4,0x0b,0x0f,0x38,0x01,0x80,0x58,0xea,0xe2,0x2c,0xf6,0x9f,0x8e,0xe6,0x08},+	{0xad,0x30,0xc1,0x4b,0x0a,0x50,0xad,0x34,0x9c,0xd4,0x0b,0x3d,0x49,0xdb,0x38,0x8d,0xbe,0x89,0x0a,0x50,0x98,0x3d,0x5c,0xa2,0x09,0x3b,0xba,0xee,0x87,0x3f,0x1f,0x2f,0xf9,0xf2,0xb8,0x0a,0xd5,0x09,0x2d,0x2f,0xdf,0x23,0x59,0xc5,0x8d,0x21,0xb9,0xac,0xb9,0x6c,0x76,0x73,0x26,0x34,0x8f,0x4a,0xf5,0x19,0xf7,0x38,0xd7,0x3b,0xb1,0x4c,0x4a,0xb6,0x15,0xe5,0x75,0x8c,0x84,0xf7,0x38,0x90,0x4a,0xdb,0xba,0x01,0x95,0xa5,0x50,0x1b,0x75,0x3f,0x3f,0x31,0x0d,0xc2,0xe8,0x2e,0xae,0xc0,0x53,0xe3,0xa1,0x19},+	{0xc3,0x05,0xfa,0xba,0x60,0x75,0x1c,0x7d,0x61,0x5e,0xe5,0xc6,0xa0,0xa0,0xe1,0xb3,0x73,0x64,0xd6,0xc0,0x18,0x97,0x52,0xe3,0x86,0x34,0x0c,0xc2,0x11,0x6b,0x54,0x41,0xbd,0xbd,0x96,0xd5,0xcd,0x72,0x21,0xb4,0x40,0xfc,0xee,0x98,0x43,0x45,0xe0,0x93,0xb5,0x09,0x41,0xb4,0x47,0x53,0xb1,0x9f,0x34,0xae,0x66,0x02,0x99,0xd3,0x6b,0x73,0xb4,0xb3,0x34,0x93,0x50,0x2d,0x53,0x85,0x73,0x65,0x81,0x60,0x4b,0x11,0xfd,0x46,0x75,0x83,0x5c,0x42,0x30,0x5f,0x5f,0xcc,0x5c,0xab,0x7f,0xb8,0xa2,0x95,0x22,0x41},+	{0xe9,0xd6,0x7e,0xf5,0x88,0x9b,0xc9,0x19,0x25,0xc8,0xf8,0x6d,0x26,0xcb,0x93,0x53,0x73,0xd2,0x0a,0xb3,0x13,0x32,0xee,0x5c,0x34,0x2e,0x2d,0xb5,0xeb,0x53,0xe1,0x14,0xc6,0xea,0x93,0xe2,0x61,0x52,0x65,0x2e,0xdb,0xac,0x33,0x21,0x03,0x92,0x5a,0x84,0x6b,0x99,0x00,0x79,0xcb,0x75,0x09,0x46,0x80,0xdd,0x5a,0x19,0x8d,0xbb,0x60,0x07,0x8a,0x81,0xe6,0xcd,0x17,0x1a,0x3e,0x41,0x84,0xa0,0x69,0xed,0xa9,0x6d,0x15,0x57,0xb1,0xcc,0xca,0x46,0x8f,0x26,0xbf,0x2c,0xf2,0xc5,0x3a,0xc3,0x9b,0xbe,0x34,0x6b},+	{0xb2,0xc0,0x78,0x3a,0x64,0x2f,0xdf,0xf3,0x7c,0x02,0x2e,0xf2,0x1e,0x97,0x3e,0x4c,0xa3,0xb5,0xc1,0x49,0x5e,0x1c,0x7d,0xec,0x2d,0xdd,0x22,0x09,0x8f,0xc1,0x12,0x20,0xd3,0xf2,0x71,0x65,0x65,0x69,0xfc,0x11,0x7a,0x73,0x0e,0x53,0x45,0xe8,0xc9,0xc6,0x35,0x50,0xfe,0xd4,0xa2,0xe7,0x3a,0xe3,0x0b,0xd3,0x6d,0x2e,0xb6,0xc7,0xb9,0x01,0x29,0x9d,0xc8,0x5a,0xe5,0x55,0x0b,0x88,0x63,0xa7,0xa0,0x45,0x1f,0x24,0x83,0x14,0x1f,0x6c,0xe7,0xc2,0xdf,0xef,0x36,0x3d,0xe8,0xad,0x4b,0x4e,0x78,0x5b,0xaf,0x08},+	{0x33,0x25,0x1f,0x88,0xdc,0x99,0x34,0x28,0xb6,0x23,0x93,0x77,0xda,0x25,0x05,0x9d,0xf4,0x41,0x34,0x67,0xfb,0xdd,0x7a,0x89,0x8d,0x16,0x3a,0x16,0x71,0x9d,0xb7,0x32,0x4b,0x2c,0xcc,0x89,0xd2,0x14,0x73,0xe2,0x8d,0x17,0x87,0xa2,0x11,0xbd,0xe4,0x4b,0xce,0x64,0x33,0xfa,0xd6,0x28,0xd5,0x18,0x6e,0x82,0xd9,0xaf,0xd5,0xc1,0x23,0x64,0x6a,0xb3,0xfc,0xed,0xd9,0xf8,0x85,0xcc,0xf9,0xe5,0x46,0x37,0x8f,0xc2,0xbc,0x22,0xcd,0xd3,0xe5,0xf9,0x38,0xe3,0x9d,0xe4,0xcc,0x2d,0x3e,0xc1,0xfb,0x5e,0x0a,0x48},+	{0x71,0x20,0x62,0x01,0x0b,0xe7,0x51,0x0b,0xc5,0xaf,0x1d,0x8b,0xcf,0x05,0xb5,0x06,0xcd,0xab,0x5a,0xef,0x61,0xb0,0x6b,0x2c,0x31,0xbf,0xb7,0x0c,0x60,0x27,0xaa,0x47,0x1f,0x22,0xce,0x42,0xe4,0x4c,0x61,0xb6,0x28,0x39,0x05,0x4c,0xcc,0x9d,0x19,0x6e,0x03,0xbe,0x1c,0xdc,0xa4,0xb4,0x3f,0x66,0x06,0x8e,0x1c,0x69,0x47,0x1d,0xb3,0x24,0xc3,0xf8,0x15,0xc0,0xed,0x1e,0x54,0x2a,0x7c,0x3f,0x69,0x7c,0x7e,0xfe,0xa4,0x11,0xd6,0x78,0xa2,0x4e,0x13,0x66,0xaf,0xf0,0x94,0xa0,0xdd,0x14,0x5d,0x58,0x5b,0x54},+	{0x0f,0x3a,0xd4,0xa0,0x5e,0x27,0xbf,0x67,0xbe,0xee,0x9b,0x08,0x34,0x8e,0xe6,0xad,0x2e,0xe7,0x79,0xd4,0x4c,0x13,0x89,0x42,0x54,0x54,0xba,0x32,0xc3,0xf9,0x62,0x0f,0xe1,0x21,0xb3,0xe3,0xd0,0xe4,0x04,0x62,0x95,0x1e,0xff,0x28,0x7a,0x63,0xaa,0x3b,0x9e,0xbd,0x99,0x5b,0xfd,0xcf,0x0c,0x0b,0x71,0xd0,0xc8,0x64,0x3e,0xdc,0x22,0x4d,0x39,0x5f,0x3b,0xd6,0x89,0x65,0xb4,0xfc,0x61,0xcf,0xcb,0x57,0x3f,0x6a,0xae,0x5c,0x05,0xfa,0x3a,0x95,0xd2,0xc2,0xba,0xfe,0x36,0x14,0x37,0x36,0x1a,0xa0,0x0f,0x1c},+	{0xff,0x3d,0x94,0x22,0xb6,0x04,0xc6,0xd2,0xa0,0xb3,0xcf,0x44,0xce,0xbe,0x8c,0xbc,0x78,0x86,0x80,0x97,0xf3,0x4f,0x25,0x5d,0xbf,0xa6,0x1c,0x3b,0x4f,0x61,0xa3,0x0f,0x50,0x6a,0x93,0x8c,0x0e,0x2b,0x08,0x69,0xb6,0xc5,0xda,0xc1,0x35,0xa0,0xc9,0xf9,0x34,0xb6,0xdf,0xc4,0x54,0x3e,0xb7,0x6f,0x40,0xc1,0x2b,0x1d,0x9b,0x41,0x05,0x40,0xf0,0x82,0xbe,0xb9,0xbd,0xfe,0x03,0xa0,0x90,0xac,0x44,0x3a,0xaf,0xc1,0x89,0x20,0x8e,0xfa,0x54,0x19,0x91,0x9f,0x49,0xf8,0x42,0xab,0x40,0xef,0x8a,0x21,0xba,0x1f},+	{0x3e,0xf5,0xc8,0xfa,0x48,0x94,0x54,0xab,0x41,0x37,0xa6,0x7b,0x9a,0xe8,0xf6,0x81,0x01,0x5e,0x2b,0x6c,0x7d,0x6c,0xfd,0x74,0x42,0x6e,0xc8,0xa8,0xca,0x3a,0x2e,0x39,0x94,0x01,0x7b,0x3e,0x04,0x57,0x3e,0x4f,0x7f,0xaf,0xda,0x08,0xee,0x3e,0x1d,0xa8,0xf1,0xde,0xdc,0x99,0xab,0xc6,0x39,0xc8,0xd5,0x61,0x77,0xff,0x13,0x5d,0x53,0x6c,0xaf,0x35,0x8a,0x3e,0xe9,0x34,0xbd,0x4c,0x16,0xe8,0x87,0x58,0x44,0x81,0x07,0x2e,0xab,0xb0,0x9a,0xf2,0x76,0x9c,0x31,0x19,0x3b,0xc1,0x0a,0xd5,0xe4,0x7f,0xe1,0x25},+	{0x76,0xf6,0x04,0x1e,0xd7,0x9b,0x28,0x0a,0x95,0x0f,0x42,0xd6,0x52,0x1c,0x8e,0x20,0xab,0x1f,0x69,0x34,0xb0,0xd8,0x86,0x51,0x51,0xb3,0x9f,0x2a,0x44,0x51,0x57,0x25,0xa7,0x21,0xf1,0x76,0xf5,0x7f,0x5f,0x91,0xe3,0x87,0xcd,0x2f,0x27,0x32,0x4a,0xc3,0x26,0xe5,0x1b,0x4d,0xde,0x2f,0xba,0xcc,0x9b,0x89,0x69,0x89,0x8f,0x82,0xba,0x6b,0x01,0x39,0xfe,0x90,0x66,0xbc,0xd1,0xe2,0xd5,0x7a,0x99,0xa0,0x18,0x4a,0xb5,0x4c,0xd4,0x60,0x84,0xaf,0x14,0x69,0x1d,0x97,0xe4,0x7b,0x6b,0x7f,0x4f,0x50,0x9d,0x55},+	{0xd5,0x54,0xeb,0xb3,0x78,0x83,0x73,0xa7,0x7c,0x3c,0x55,0xa5,0x66,0xd3,0x69,0x1d,0xba,0x00,0x28,0xf9,0x62,0xcf,0x26,0x0a,0x17,0x32,0x7e,0x80,0xd5,0x12,0xab,0x01,0xfd,0x66,0xd2,0xf6,0xe7,0x91,0x48,0x9c,0x1b,0x78,0x07,0x03,0x9b,0xa1,0x44,0x07,0x3b,0xe2,0x61,0x60,0x1d,0x8f,0x38,0x88,0x0e,0xd5,0x4b,0x35,0xa3,0xa6,0x3e,0x12,0x96,0x2d,0xe3,0x41,0x90,0x18,0x8d,0x11,0x48,0x58,0x31,0xd8,0xc2,0xe3,0xed,0xb9,0xd9,0x45,0x32,0xd8,0x71,0x42,0xab,0x1e,0x54,0xa1,0x18,0xc9,0xe2,0x61,0x39,0x4a},+	{0xa0,0xbb,0xe6,0xf8,0xe0,0x3b,0xdc,0x71,0x0a,0xe3,0xff,0x7e,0x34,0xf8,0xce,0xd6,0x6a,0x47,0x3a,0xe1,0x5f,0x42,0x92,0xa9,0x63,0xb7,0x1d,0xfb,0xe3,0xbc,0xd6,0x2c,0x1e,0x3f,0x23,0xf3,0x44,0xd6,0x27,0x03,0x16,0xf0,0xfc,0x34,0x0e,0x26,0x9a,0x49,0x79,0xb9,0xda,0xf2,0x16,0xa7,0xb5,0x83,0x1f,0x11,0xd4,0x9b,0xad,0xee,0xac,0x68,0x10,0xc2,0xd7,0xf3,0x0e,0xc9,0xb4,0x38,0x0c,0x04,0xad,0xb7,0x24,0x6e,0x8e,0x30,0x23,0x3e,0xe7,0xb7,0xf1,0xd9,0x60,0x38,0x97,0xf5,0x08,0xb5,0xd5,0x60,0x57,0x59},+	{0x97,0x63,0xaa,0x04,0xe1,0xbf,0x29,0x61,0xcb,0xfc,0xa7,0xa4,0x08,0x00,0x96,0x8f,0x58,0x94,0x90,0x7d,0x89,0xc0,0x8b,0x3f,0xa9,0x91,0xb2,0xdc,0x3e,0xa4,0x9f,0x70,0x90,0x27,0x02,0xfd,0xeb,0xcb,0x2a,0x88,0x60,0x57,0x11,0xc4,0x05,0x33,0xaf,0x89,0xf4,0x73,0x34,0x7d,0xe3,0x92,0xf4,0x65,0x2b,0x5a,0x51,0x54,0xdf,0xc5,0xb2,0x2c,0xca,0x2a,0xfd,0x63,0x8c,0x5d,0x0a,0xeb,0xff,0x4e,0x69,0x2e,0x66,0xc1,0x2b,0xd2,0x3a,0xb0,0xcb,0xf8,0x6e,0xf3,0x23,0x27,0x1f,0x13,0xc8,0xf0,0xec,0x29,0xf0,0x70},+	{0x33,0x3e,0xed,0x2e,0xb3,0x07,0x13,0x46,0xe7,0x81,0x55,0xa4,0x33,0x2f,0x04,0xae,0x66,0x03,0x5f,0x19,0xd3,0x49,0x44,0xc9,0x58,0x48,0x31,0x6c,0x8a,0x5d,0x7d,0x0b,0xb9,0xb0,0x10,0x5e,0xaa,0xaf,0x6a,0x2a,0xa9,0x1a,0x04,0xef,0x70,0xa3,0xf0,0x78,0x1f,0xd6,0x3a,0xaa,0x77,0xfb,0x3e,0x77,0xe1,0xd9,0x4b,0xa7,0xa2,0xa5,0xec,0x44,0x43,0xd5,0x95,0x7b,0x32,0x48,0xd4,0x25,0x1d,0x0f,0x34,0xa3,0x00,0x83,0xd3,0x70,0x2b,0xc5,0xe1,0x60,0x1c,0x53,0x1c,0xde,0xe4,0xe9,0x7d,0x2c,0x51,0x24,0x22,0x27},+	{0x2e,0x34,0xc5,0x49,0xaf,0x92,0xbc,0x1a,0xd0,0xfa,0xe6,0xb2,0x11,0xd8,0xee,0xff,0x29,0x4e,0xc8,0xfc,0x8d,0x8c,0xa2,0xef,0x43,0xc5,0x4c,0xa4,0x18,0xdf,0xb5,0x11,0xfc,0x75,0xa9,0x42,0x8a,0xbb,0x7b,0xbf,0x58,0xa3,0xad,0x96,0x77,0x39,0x5c,0x8c,0x48,0xaa,0xed,0xcd,0x6f,0xc7,0x7f,0xe2,0xa6,0x20,0xbc,0xf6,0xd7,0x5f,0x73,0x19,0x66,0x42,0xc8,0x42,0xd0,0x90,0xab,0xe3,0x7e,0x54,0x19,0x7f,0x0f,0x8e,0x84,0xeb,0xb9,0x97,0xa4,0x65,0xd0,0xa1,0x03,0x25,0x5f,0x89,0xdf,0x91,0x11,0x91,0xef,0x0f}+};
+ cbits/ed25519/ed25519-donna-batchverify.h view
@@ -0,0 +1,275 @@+/*+	Ed25519 batch verification+*/++#define max_batch_size 64+#define heap_batch_size ((max_batch_size * 2) + 1)++/* which limb is the 128th bit in? */+static const size_t limb128bits = (128 + bignum256modm_bits_per_limb - 1) / bignum256modm_bits_per_limb;++typedef size_t heap_index_t;++typedef struct batch_heap_t {+	unsigned char r[heap_batch_size][16]; /* 128 bit random values */+	ge25519 points[heap_batch_size];+	bignum256modm scalars[heap_batch_size];+	heap_index_t heap[heap_batch_size];+	size_t size;+} batch_heap;++/* swap two values in the heap */+static void+heap_swap(heap_index_t *heap, size_t a, size_t b) {+	heap_index_t temp;+	temp = heap[a];+	heap[a] = heap[b];+	heap[b] = temp;+}++/* add the scalar at the end of the list to the heap */+static void+heap_insert_next(batch_heap *heap) {+	size_t node = heap->size, parent;+	heap_index_t *pheap = heap->heap;+	bignum256modm *scalars = heap->scalars;++	/* insert at the bottom */+	pheap[node] = (heap_index_t)node;++	/* sift node up to its sorted spot */+	parent = (node - 1) / 2;+	while (node && lt256_modm_batch(scalars[pheap[parent]], scalars[pheap[node]], bignum256modm_limb_size - 1)) {+		heap_swap(pheap, parent, node);+		node = parent;+		parent = (node - 1) / 2;+	}+	heap->size++;+}++/* update the heap when the root element is updated */+static void+heap_updated_root(batch_heap *heap, size_t limbsize) {+	size_t node, parent, childr, childl;+	heap_index_t *pheap = heap->heap;+	bignum256modm *scalars = heap->scalars;++	/* sift root to the bottom */+	parent = 0;+	node = 1;+	childl = 1;+	childr = 2;+	while ((childr < heap->size)) {+		node = lt256_modm_batch(scalars[pheap[childl]], scalars[pheap[childr]], limbsize) ? childr : childl;+		heap_swap(pheap, parent, node);+		parent = node;+		childl = (parent * 2) + 1;+		childr = childl + 1;+	}++	/* sift root back up to its sorted spot */+	parent = (node - 1) / 2;+	while (node && lte256_modm_batch(scalars[pheap[parent]], scalars[pheap[node]], limbsize)) {+		heap_swap(pheap, parent, node);+		node = parent;+		parent = (node - 1) / 2;+	}+}++/* build the heap with count elements, count must be >= 3 */+static void+heap_build(batch_heap *heap, size_t count) {+	heap->heap[0] = 0;+	heap->size = 0;+	while (heap->size < count)+		heap_insert_next(heap);+}++/* extend the heap to contain new_count elements */+static void+heap_extend(batch_heap *heap, size_t new_count) {+	while (heap->size < new_count)+		heap_insert_next(heap);+}++/* get the top 2 elements of the heap */+static void+heap_get_top2(batch_heap *heap, heap_index_t *max1, heap_index_t *max2, size_t limbsize) {+	heap_index_t h0 = heap->heap[0], h1 = heap->heap[1], h2 = heap->heap[2];+	if (lt256_modm_batch(heap->scalars[h1], heap->scalars[h2], limbsize))+		h1 = h2;+	*max1 = h0;+	*max2 = h1;+}++/* */+static void+ge25519_multi_scalarmult_vartime_final(ge25519 *r, ge25519 *point, bignum256modm scalar) {+	const bignum256modm_element_t topbit = ((bignum256modm_element_t)1 << (bignum256modm_bits_per_limb - 1));+	size_t limb = limb128bits;+	bignum256modm_element_t flag;++	if (isone256_modm_batch(scalar)) {+		/* this will happen most of the time after bos-carter */+		*r = *point;+		return;+	} else if (iszero256_modm_batch(scalar)) {+		/* this will only happen if all scalars == 0 */+		memset(r, 0, sizeof(*r));+		r->y[0] = 1;+		r->z[0] = 1;+		return;+	}++	*r = *point;++	/* find the limb where first bit is set */+	while (!scalar[limb])+		limb--;++	/* find the first bit */+	flag = topbit;+	while ((scalar[limb] & flag) == 0)+		flag >>= 1;++	/* exponentiate */+	for (;;) {+		ge25519_double(r, r);+		if (scalar[limb] & flag)+			ge25519_add(r, r, point);++		flag >>= 1;+		if (!flag) {+			if (!limb--)+				break;+			flag = topbit;+		}+	}+}++/* count must be >= 5 */+static void+ge25519_multi_scalarmult_vartime(ge25519 *r, batch_heap *heap, size_t count) {+	heap_index_t max1, max2;++	/* start with the full limb size */+	size_t limbsize = bignum256modm_limb_size - 1;++	/* whether the heap has been extended to include the 128 bit scalars */+	int extended = 0;++	/* grab an odd number of scalars to build the heap, unknown limb sizes */+	heap_build(heap, ((count + 1) / 2) | 1);++	for (;;) {+		heap_get_top2(heap, &max1, &max2, limbsize);++		/* only one scalar remaining, we're done */+		if (iszero256_modm_batch(heap->scalars[max2]))+			break;++		/* exhausted another limb? */+		if (!heap->scalars[max1][limbsize])+			limbsize -= 1;++		/* can we extend to the 128 bit scalars? */+		if (!extended && isatmost128bits256_modm_batch(heap->scalars[max1])) {+			heap_extend(heap, count);+			heap_get_top2(heap, &max1, &max2, limbsize);+			extended = 1;+		}++		sub256_modm_batch(heap->scalars[max1], heap->scalars[max1], heap->scalars[max2], limbsize);+		ge25519_add(&heap->points[max2], &heap->points[max2], &heap->points[max1]);+		heap_updated_root(heap, limbsize);+	}++	ge25519_multi_scalarmult_vartime_final(r, &heap->points[max1], heap->scalars[max1]);+}++/* not actually used for anything other than testing */+unsigned char batch_point_buffer[3][32];++static int+ge25519_is_neutral_vartime(const ge25519 *p) {+	static const unsigned char zero[32] = {0};+	unsigned char point_buffer[3][32];+	curve25519_contract(point_buffer[0], p->x);+	curve25519_contract(point_buffer[1], p->y);+	curve25519_contract(point_buffer[2], p->z);+	memcpy(batch_point_buffer[1], point_buffer[1], 32);+	return (memcmp(point_buffer[0], zero, 32) == 0) && (memcmp(point_buffer[1], point_buffer[2], 32) == 0);+}++int+ED25519_FN(ed25519_sign_open_batch) (const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid) {+	batch_heap ALIGN(16) batch;+	ge25519 ALIGN(16) p;+	bignum256modm *r_scalars;+	size_t i, batchsize;+	unsigned char hram[64];+	int ret = 0;++	for (i = 0; i < num; i++)+		valid[i] = 1;++	while (num > 3) {+		batchsize = (num > max_batch_size) ? max_batch_size : num;++		/* generate r (scalars[batchsize+1]..scalars[2*batchsize] */+		ED25519_FN(ed25519_randombytes_unsafe) (batch.r, batchsize * 16);+		r_scalars = &batch.scalars[batchsize + 1];+		for (i = 0; i < batchsize; i++)+			expand256_modm(r_scalars[i], batch.r[i], 16);++		/* compute scalars[0] = ((r1s1 + r2s2 + ...)) */+		for (i = 0; i < batchsize; i++) {+			expand256_modm(batch.scalars[i], RS[i] + 32, 32);+			mul256_modm(batch.scalars[i], batch.scalars[i], r_scalars[i]);+		}+		for (i = 1; i < batchsize; i++)+			add256_modm(batch.scalars[0], batch.scalars[0], batch.scalars[i]);++		/* compute scalars[1]..scalars[batchsize] as r[i]*H(R[i],A[i],m[i]) */+		for (i = 0; i < batchsize; i++) {+			ed25519_hram(hram, RS[i], pk[i], m[i], mlen[i]);+			expand256_modm(batch.scalars[i+1], hram, 64);+			mul256_modm(batch.scalars[i+1], batch.scalars[i+1], r_scalars[i]);+		}++		/* compute points */+		batch.points[0] = ge25519_basepoint;+		for (i = 0; i < batchsize; i++)+			if (!ge25519_unpack_negative_vartime(&batch.points[i+1], pk[i]))+				goto fallback;+		for (i = 0; i < batchsize; i++)+			if (!ge25519_unpack_negative_vartime(&batch.points[batchsize+i+1], RS[i]))+				goto fallback;++		ge25519_multi_scalarmult_vartime(&p, &batch, (batchsize * 2) + 1);+		if (!ge25519_is_neutral_vartime(&p)) {+			ret |= 2;++			fallback:+			for (i = 0; i < batchsize; i++) {+				valid[i] = ED25519_FN(ed25519_sign_open) (m[i], mlen[i], pk[i], RS[i]) ? 0 : 1;+				ret |= (valid[i] ^ 1);+			}+		}++		m += batchsize;+		mlen += batchsize;+		pk += batchsize;+		RS += batchsize;+		num -= batchsize;+		valid += batchsize;+	}++	for (i = 0; i < num; i++) {+		valid[i] = ED25519_FN(ed25519_sign_open) (m[i], mlen[i], pk[i], RS[i]) ? 0 : 1;+		ret |= (valid[i] ^ 1);+	}++	return ret;+}+
+ cbits/ed25519/ed25519-donna-impl-base.h view
@@ -0,0 +1,364 @@+/*+	conversions+*/++DONNA_INLINE static void+ge25519_p1p1_to_partial(ge25519 *r, const ge25519_p1p1 *p) {+	curve25519_mul(r->x, p->x, p->t);+	curve25519_mul(r->y, p->y, p->z);+	curve25519_mul(r->z, p->z, p->t); +}++DONNA_INLINE static void+ge25519_p1p1_to_full(ge25519 *r, const ge25519_p1p1 *p) {+	curve25519_mul(r->x, p->x, p->t);+	curve25519_mul(r->y, p->y, p->z);+	curve25519_mul(r->z, p->z, p->t); +	curve25519_mul(r->t, p->x, p->y); +}++static void+ge25519_full_to_pniels(ge25519_pniels *p, const ge25519 *r) {+	curve25519_sub(p->ysubx, r->y, r->x);+	curve25519_add(p->xaddy, r->y, r->x);+	curve25519_copy(p->z, r->z);+	curve25519_mul(p->t2d, r->t, ge25519_ec2d);+}++/*+	adding & doubling+*/++static void+ge25519_add_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519 *q) {+	bignum25519 a,b,c,d,t,u;++	curve25519_sub(a, p->y, p->x);+	curve25519_add(b, p->y, p->x);+	curve25519_sub(t, q->y, q->x);+	curve25519_add(u, q->y, q->x);+	curve25519_mul(a, a, t);+	curve25519_mul(b, b, u);+	curve25519_mul(c, p->t, q->t);+	curve25519_mul(c, c, ge25519_ec2d);+	curve25519_mul(d, p->z, q->z);+	curve25519_add(d, d, d);+	curve25519_sub(r->x, b, a);+	curve25519_add(r->y, b, a);+	curve25519_add_after_basic(r->z, d, c);+	curve25519_sub_after_basic(r->t, d, c);+}+++static void+ge25519_double_p1p1(ge25519_p1p1 *r, const ge25519 *p) {+	bignum25519 a,b,c;++	curve25519_square(a, p->x);+	curve25519_square(b, p->y);+	curve25519_square(c, p->z);+	curve25519_add_reduce(c, c, c);+	curve25519_add(r->x, p->x, p->y);+	curve25519_square(r->x, r->x);+	curve25519_add(r->y, b, a);+	curve25519_sub(r->z, b, a);+	curve25519_sub_after_basic(r->x, r->x, r->y);+	curve25519_sub_after_basic(r->t, c, r->z);+}++static void+ge25519_nielsadd2_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_niels *q, unsigned char signbit) {+	const bignum25519 *qb = (const bignum25519 *)q;+	bignum25519 *rb = (bignum25519 *)r;+	bignum25519 a,b,c;++	curve25519_sub(a, p->y, p->x);+	curve25519_add(b, p->y, p->x);+	curve25519_mul(a, a, qb[signbit]); /* x for +, y for - */+	curve25519_mul(r->x, b, qb[signbit^1]); /* y for +, x for - */+	curve25519_add(r->y, r->x, a);+	curve25519_sub(r->x, r->x, a);+	curve25519_mul(c, p->t, q->t2d);+	curve25519_add_reduce(r->t, p->z, p->z);+	curve25519_copy(r->z, r->t);+	curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */+	curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */+}++static void+ge25519_pnielsadd_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_pniels *q, unsigned char signbit) {+	const bignum25519 *qb = (const bignum25519 *)q;+	bignum25519 *rb = (bignum25519 *)r;+	bignum25519 a,b,c;++	curve25519_sub(a, p->y, p->x);+	curve25519_add(b, p->y, p->x);+	curve25519_mul(a, a, qb[signbit]); /* ysubx for +, xaddy for - */+	curve25519_mul(r->x, b, qb[signbit^1]); /* xaddy for +, ysubx for - */+	curve25519_add(r->y, r->x, a);+	curve25519_sub(r->x, r->x, a);+	curve25519_mul(c, p->t, q->t2d);+	curve25519_mul(r->t, p->z, q->z);+	curve25519_add_reduce(r->t, r->t, r->t);+	curve25519_copy(r->z, r->t);+	curve25519_add(rb[2+signbit], rb[2+signbit], c); /* z for +, t for - */+	curve25519_sub(rb[2+(signbit^1)], rb[2+(signbit^1)], c); /* t for +, z for - */+}++static void+ge25519_double_partial(ge25519 *r, const ge25519 *p) {+	ge25519_p1p1 t;+	ge25519_double_p1p1(&t, p);+	ge25519_p1p1_to_partial(r, &t);+}++static void+ge25519_double(ge25519 *r, const ge25519 *p) {+	ge25519_p1p1 t;+	ge25519_double_p1p1(&t, p);+	ge25519_p1p1_to_full(r, &t);+}++static void+ge25519_add(ge25519 *r, const ge25519 *p,  const ge25519 *q) {+	ge25519_p1p1 t;+	ge25519_add_p1p1(&t, p, q);+	ge25519_p1p1_to_full(r, &t);+}++static void+ge25519_nielsadd2(ge25519 *r, const ge25519_niels *q) {+	bignum25519 a,b,c,e,f,g,h;++	curve25519_sub(a, r->y, r->x);+	curve25519_add(b, r->y, r->x);+	curve25519_mul(a, a, q->ysubx);+	curve25519_mul(e, b, q->xaddy);+	curve25519_add(h, e, a);+	curve25519_sub(e, e, a);+	curve25519_mul(c, r->t, q->t2d);+	curve25519_add(f, r->z, r->z);+	curve25519_add_after_basic(g, f, c);+	curve25519_sub_after_basic(f, f, c);+	curve25519_mul(r->x, e, f);+	curve25519_mul(r->y, h, g);+	curve25519_mul(r->z, g, f);+	curve25519_mul(r->t, e, h);+}++static void+ge25519_pnielsadd(ge25519_pniels *r, const ge25519 *p, const ge25519_pniels *q) {+	bignum25519 a,b,c,x,y,z,t;++	curve25519_sub(a, p->y, p->x);+	curve25519_add(b, p->y, p->x);+	curve25519_mul(a, a, q->ysubx);+	curve25519_mul(x, b, q->xaddy);+	curve25519_add(y, x, a);+	curve25519_sub(x, x, a);+	curve25519_mul(c, p->t, q->t2d);+	curve25519_mul(t, p->z, q->z);+	curve25519_add(t, t, t);+	curve25519_add_after_basic(z, t, c);+	curve25519_sub_after_basic(t, t, c);+	curve25519_mul(r->xaddy, x, t);+	curve25519_mul(r->ysubx, y, z);+	curve25519_mul(r->z, z, t);+	curve25519_mul(r->t2d, x, y);+	curve25519_copy(y, r->ysubx);+	curve25519_sub(r->ysubx, r->ysubx, r->xaddy);+	curve25519_add(r->xaddy, r->xaddy, y);+	curve25519_mul(r->t2d, r->t2d, ge25519_ec2d);+}+++/*+	pack & unpack+*/++static void+ge25519_pack(unsigned char r[32], const ge25519 *p) {+	bignum25519 tx, ty, zi;+	unsigned char parity[32];+	curve25519_recip(zi, p->z);+	curve25519_mul(tx, p->x, zi);+	curve25519_mul(ty, p->y, zi);+	curve25519_contract(r, ty);+	curve25519_contract(parity, tx);+	r[31] ^= ((parity[0] & 1) << 7);+}++static int+ge25519_unpack_negative_vartime(ge25519 *r, const unsigned char p[32]) {+	static const unsigned char zero[32] = {0};+	static const bignum25519 one = {1};+	unsigned char parity = p[31] >> 7;+	unsigned char check[32];+	bignum25519 t, root, num, den, d3;++	curve25519_expand(r->y, p);+	curve25519_copy(r->z, one);+	curve25519_square(num, r->y); /* x = y^2 */+	curve25519_mul(den, num, ge25519_ecd); /* den = dy^2 */+	curve25519_sub_reduce(num, num, r->z); /* x = y^1 - 1 */+	curve25519_add(den, den, r->z); /* den = dy^2 + 1 */++	/* Computation of sqrt(num/den) */+	/* 1.: computation of num^((p-5)/8)*den^((7p-35)/8) = (num*den^7)^((p-5)/8) */+	curve25519_square(t, den);+	curve25519_mul(d3, t, den);+	curve25519_square(r->x, d3);+	curve25519_mul(r->x, r->x, den);+	curve25519_mul(r->x, r->x, num);+	curve25519_pow_two252m3(r->x, r->x);++	/* 2. computation of r->x = num * den^3 * (num*den^7)^((p-5)/8) */+	curve25519_mul(r->x, r->x, d3);+	curve25519_mul(r->x, r->x, num);++	/* 3. Check if either of the roots works: */+	curve25519_square(t, r->x);+	curve25519_mul(t, t, den);+	curve25519_sub_reduce(root, t, num);+	curve25519_contract(check, root);+	if (!ed25519_verify(check, zero, 32)) {+		curve25519_add_reduce(t, t, num);+		curve25519_contract(check, t);+		if (!ed25519_verify(check, zero, 32))+			return 0;+		curve25519_mul(r->x, r->x, ge25519_sqrtneg1);+	}++	curve25519_contract(check, r->x);+	if ((check[0] & 1) == parity) {+		curve25519_copy(t, r->x);+		curve25519_neg(r->x, t);+	}+	curve25519_mul(r->t, r->x, r->y);+	return 1;+}+++/*+	scalarmults+*/++#define S1_SWINDOWSIZE 5+#define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2))+#define S2_SWINDOWSIZE 7+#define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2))++/* computes [s1]p1 + [s2]basepoint */+static void +ge25519_double_scalarmult_vartime(ge25519 *r, const ge25519 *p1, const bignum256modm s1, const bignum256modm s2) {+	signed char slide1[256], slide2[256];+	ge25519_pniels pre1[S1_TABLE_SIZE];+	ge25519 d1;+	ge25519_p1p1 t;+	int32_t i;++	contract256_slidingwindow_modm(slide1, s1, S1_SWINDOWSIZE);+	contract256_slidingwindow_modm(slide2, s2, S2_SWINDOWSIZE);++	ge25519_double(&d1, p1);+	ge25519_full_to_pniels(pre1, p1);+	for (i = 0; i < S1_TABLE_SIZE - 1; i++)+		ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);++	/* set neutral */+	memset(r, 0, sizeof(ge25519));+	r->y[0] = 1;+	r->z[0] = 1;++	i = 255;+	while ((i >= 0) && !(slide1[i] | slide2[i]))+		i--;++	for (; i >= 0; i--) {+		ge25519_double_p1p1(&t, r);++		if (slide1[i]) {+			ge25519_p1p1_to_full(r, &t);+			ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (unsigned char)slide1[i] >> 7);+		}++		if (slide2[i]) {+			ge25519_p1p1_to_full(r, &t);+			ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (unsigned char)slide2[i] >> 7);+		}++		ge25519_p1p1_to_partial(r, &t);+	}+}++++#if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS)++static uint32_t+ge25519_windowb_equal(uint32_t b, uint32_t c) {+	return ((b ^ c) - 1) >> 31;+}++static void+ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const uint8_t table[256][96], uint32_t pos, signed char b) {+	bignum25519 neg;+	uint32_t sign = (uint32_t)((unsigned char)b >> 7);+	uint32_t mask = ~(sign - 1);+	uint32_t u = (b + mask) ^ mask;+	uint32_t i;++	/* ysubx, xaddy, t2d in packed form. initialize to ysubx = 1, xaddy = 1, t2d = 0 */+	uint8_t packed[96] = {0};+	packed[0] = 1;+	packed[32] = 1;++	for (i = 0; i < 8; i++)+		curve25519_move_conditional_bytes(packed, table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));++	/* expand in to t */+	curve25519_expand(t->ysubx, packed +  0);+	curve25519_expand(t->xaddy, packed + 32);+	curve25519_expand(t->t2d  , packed + 64);++	/* adjust for sign */+	curve25519_swap_conditional(t->ysubx, t->xaddy, sign);+	curve25519_neg(neg, t->t2d);+	curve25519_swap_conditional(t->t2d, neg, sign);+}++#endif /* HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS */+++/* computes [s]basepoint */+static void+ge25519_scalarmult_base_niels(ge25519 *r, const uint8_t basepoint_table[256][96], const bignum256modm s) {+	signed char b[64];+	uint32_t i;+	ge25519_niels t;++	contract256_window4_modm(b, s);++	ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[1]);+	curve25519_sub_reduce(r->x, t.xaddy, t.ysubx);+	curve25519_add_reduce(r->y, t.xaddy, t.ysubx);+	memset(r->z, 0, sizeof(bignum25519));+	curve25519_copy(r->t, t.t2d);+	r->z[0] = 2;	+	for (i = 3; i < 64; i += 2) {+		ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);+		ge25519_nielsadd2(r, &t);+	}+	ge25519_double_partial(r, r);+	ge25519_double_partial(r, r);+	ge25519_double_partial(r, r);+	ge25519_double(r, r);+	ge25519_scalarmult_base_choose_niels(&t, basepoint_table, 0, b[0]);+	curve25519_mul(t.t2d, t.t2d, ge25519_ecd);+	ge25519_nielsadd2(r, &t);+	for(i = 2; i < 64; i += 2) {+		ge25519_scalarmult_base_choose_niels(&t, basepoint_table, i / 2, b[i]);+		ge25519_nielsadd2(r, &t);+	}+}+
+ cbits/ed25519/ed25519-donna-portable-identify.h view
@@ -0,0 +1,103 @@+/* os */+#if defined(_WIN32)	|| defined(_WIN64) || defined(__TOS_WIN__) || defined(__WINDOWS__)+	#define OS_WINDOWS+#elif defined(sun) || defined(__sun) || defined(__SVR4) || defined(__svr4__)+	#define OS_SOLARIS+#else+	#include <sys/param.h> /* need this to define BSD */+	#define OS_NIX+	#if defined(__linux__)+		#define OS_LINUX+	#elif defined(BSD)+		#define OS_BSD+		#if defined(MACOS_X) || (defined(__APPLE__) & defined(__MACH__))+			#define OS_OSX+		#elif defined(macintosh) || defined(Macintosh)+			#define OS_MAC+		#elif defined(__OpenBSD__)+			#define OS_OPENBSD+		#endif+	#endif+#endif+++/* compiler */+#if defined(_MSC_VER)+	#define COMPILER_MSVC+#endif+#if defined(__ICC)+	#define COMPILER_INTEL+#endif+#if defined(__GNUC__)+	#if (__GNUC__ >= 3)+		#define COMPILER_GCC ((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + (__GNUC_PATCHLEVEL__))+	#else+		#define COMPILER_GCC ((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100)                        )+	#endif+#endif+#if defined(__PATHCC__)+	#define COMPILER_PATHCC+#endif+#if defined(__clang__)+	#define COMPILER_CLANG ((__clang_major__ * 10000) + (__clang_minor__ * 100) + (__clang_patchlevel__))+#endif++++/* cpu */+#if defined(__amd64__) || defined(__amd64) || defined(__x86_64__ ) || defined(_M_X64)+	#define CPU_X86_64+#elif defined(__i586__) || defined(__i686__) || (defined(_M_IX86) && (_M_IX86 >= 500))+	#define CPU_X86 500+#elif defined(__i486__) || (defined(_M_IX86) && (_M_IX86 >= 400))+	#define CPU_X86 400+#elif defined(__i386__) || (defined(_M_IX86) && (_M_IX86 >= 300)) || defined(__X86__) || defined(_X86_) || defined(__I86__)+	#define CPU_X86 300+#elif defined(__ia64__) || defined(_IA64) || defined(__IA64__) || defined(_M_IA64) || defined(__ia64)+	#define CPU_IA64+#endif++#if defined(__sparc__) || defined(__sparc) || defined(__sparcv9)+	#define CPU_SPARC+	#if defined(__sparcv9)+		#define CPU_SPARC64+	#endif+#endif++#if defined(powerpc) || defined(__PPC__) || defined(__ppc__) || defined(_ARCH_PPC) || defined(__powerpc__) || defined(__powerpc) || defined(POWERPC) || defined(_M_PPC)+	#define CPU_PPC+	#if defined(_ARCH_PWR7)+		#define CPU_POWER7+	#elif defined(__64BIT__)+		#define CPU_PPC64+	#else+		#define CPU_PPC32+	#endif+#endif++#if defined(__hppa__) || defined(__hppa)+	#define CPU_HPPA+#endif++#if defined(__alpha__) || defined(__alpha) || defined(_M_ALPHA)+	#define CPU_ALPHA+#endif++/* 64 bit cpu */+#if defined(CPU_X86_64) || defined(CPU_IA64) || defined(CPU_SPARC64) || defined(__64BIT__) || defined(__LP64__) || defined(_LP64) || (defined(_MIPS_SZLONG) && (_MIPS_SZLONG == 64))+	#define CPU_64BITS+#endif++#if defined(COMPILER_MSVC)+	typedef signed char int8_t;+	typedef unsigned char uint8_t;+	typedef signed short int16_t;+	typedef unsigned short uint16_t;+	typedef signed int int32_t;+	typedef unsigned int uint32_t;+	typedef signed __int64 int64_t;+	typedef unsigned __int64 uint64_t;+#else+	#include <stdint.h>+#endif+
+ cbits/ed25519/ed25519-donna-portable.h view
@@ -0,0 +1,138 @@+#include "ed25519-donna-portable-identify.h"++#define mul32x32_64(a,b) (((uint64_t)(a))*(b))++/* platform */+#if defined(COMPILER_MSVC)+	#include <intrin.h>+	#if !defined(_DEBUG)+		#undef mul32x32_64		+		#define mul32x32_64(a,b) __emulu(a,b)+	#endif+	#undef inline+	#define inline __forceinline+	#define DONNA_INLINE __forceinline+	#define DONNA_NOINLINE __declspec(noinline)+	#define ALIGN(x) __declspec(align(x))+	#define ROTL32(a,b) _rotl(a,b)+	#define ROTR32(a,b) _rotr(a,b)+#else+	#include <sys/param.h>+	#define DONNA_INLINE inline __attribute__((always_inline))+	#define DONNA_NOINLINE __attribute__((noinline))+	#ifdef ALIGN+	#undef ALIGN+	#endif+	#define ALIGN(x) __attribute__((aligned(x)))+	#define ROTL32(a,b) (((a) << (b)) | ((a) >> (32 - b)))+	#define ROTR32(a,b) (((a) >> (b)) | ((a) << (32 - b)))+#endif++/* uint128_t */+#if defined(CPU_64BITS) && !defined(ED25519_FORCE_32BIT)+	#if defined(COMPILER_CLANG) && (COMPILER_CLANG >= 30100)+		#define HAVE_NATIVE_UINT128+		typedef unsigned __int128 uint128_t;+	#elif defined(COMPILER_MSVC)+		#define HAVE_UINT128+		typedef struct uint128_t {+			uint64_t lo, hi;+		} uint128_t;+		#define mul64x64_128(out,a,b) out.lo = _umul128(a,b,&out.hi);+		#define shr128_pair(out,hi,lo,shift) out = __shiftright128(lo, hi, shift);+		#define shl128_pair(out,hi,lo,shift) out = __shiftleft128(lo, hi, shift);+		#define shr128(out,in,shift) shr128_pair(out, in.hi, in.lo, shift)+		#define shl128(out,in,shift) shl128_pair(out, in.hi, in.lo, shift)+		#define add128(a,b) { uint64_t p = a.lo; a.lo += b.lo; a.hi += b.hi + (a.lo < p); }+		#define add128_64(a,b) { uint64_t p = a.lo; a.lo += b; a.hi += (a.lo < p); }+		#define lo128(a) (a.lo)+		#define hi128(a) (a.hi)+	#elif defined(COMPILER_GCC) && !defined(HAVE_NATIVE_UINT128)+		#if defined(__SIZEOF_INT128__)+			#define HAVE_NATIVE_UINT128+			typedef unsigned __int128 uint128_t;+		#elif (COMPILER_GCC >= 40400)+			#define HAVE_NATIVE_UINT128+			typedef unsigned uint128_t __attribute__((mode(TI)));+		#elif defined(CPU_X86_64)+			#define HAVE_UINT128+			typedef struct uint128_t {+				uint64_t lo, hi;+			} uint128_t;+			#define mul64x64_128(out,a,b) __asm__ ("mulq %3" : "=a" (out.lo), "=d" (out.hi) : "a" (a), "rm" (b));+			#define shr128_pair(out,hi,lo,shift) __asm__ ("shrdq %2,%1,%0" : "+r" (lo) : "r" (hi), "J" (shift)); out = lo;+			#define shl128_pair(out,hi,lo,shift) __asm__ ("shldq %2,%1,%0" : "+r" (hi) : "r" (lo), "J" (shift)); out = hi;+			#define shr128(out,in,shift) shr128_pair(out,in.hi, in.lo, shift)+			#define shl128(out,in,shift) shl128_pair(out,in.hi, in.lo, shift)+			#define add128(a,b) __asm__ ("addq %4,%2; adcq %5,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b.lo), "rm" (b.hi) : "cc");+			#define add128_64(a,b) __asm__ ("addq %4,%2; adcq $0,%3" : "=r" (a.hi), "=r" (a.lo) : "1" (a.lo), "0" (a.hi), "rm" (b) : "cc");+			#define lo128(a) (a.lo)+			#define hi128(a) (a.hi)+		#endif+	#endif++	#if defined(HAVE_NATIVE_UINT128)+		#define HAVE_UINT128+		#define mul64x64_128(out,a,b) out = (uint128_t)a * b;+		#define shr128_pair(out,hi,lo,shift) out = (uint64_t)((((uint128_t)hi << 64) | lo) >> (shift));+		#define shl128_pair(out,hi,lo,shift) out = (uint64_t)(((((uint128_t)hi << 64) | lo) << (shift)) >> 64);+		#define shr128(out,in,shift) out = (uint64_t)(in >> (shift));+		#define shl128(out,in,shift) out = (uint64_t)((in << shift) >> 64);+		#define add128(a,b) a += b;+		#define add128_64(a,b) a += (uint64_t)b;+		#define lo128(a) ((uint64_t)a)+		#define hi128(a) ((uint64_t)(a >> 64))+	#endif++	#if !defined(HAVE_UINT128)+		#error Need a uint128_t implementation!+	#endif+#endif++/* endian */+#if !defined(ED25519_OPENSSLRNG)+static inline void U32TO8_LE(unsigned char *p, const uint32_t v) {+	p[0] = (unsigned char)(v      );+	p[1] = (unsigned char)(v >>  8);+	p[2] = (unsigned char)(v >> 16);+	p[3] = (unsigned char)(v >> 24);+}+#endif++#if !defined(HAVE_UINT128)+static inline uint32_t U8TO32_LE(const unsigned char *p) {+	return+	(((uint32_t)(p[0])      ) | +	 ((uint32_t)(p[1]) <<  8) |+	 ((uint32_t)(p[2]) << 16) |+	 ((uint32_t)(p[3]) << 24));+}+#else+static inline uint64_t U8TO64_LE(const unsigned char *p) {+	return+	(((uint64_t)(p[0])      ) |+	 ((uint64_t)(p[1]) <<  8) |+	 ((uint64_t)(p[2]) << 16) |+	 ((uint64_t)(p[3]) << 24) |+	 ((uint64_t)(p[4]) << 32) |+	 ((uint64_t)(p[5]) << 40) |+	 ((uint64_t)(p[6]) << 48) |+	 ((uint64_t)(p[7]) << 56));+}++static inline void U64TO8_LE(unsigned char *p, const uint64_t v) {+	p[0] = (unsigned char)(v      );+	p[1] = (unsigned char)(v >>  8);+	p[2] = (unsigned char)(v >> 16);+	p[3] = (unsigned char)(v >> 24);+	p[4] = (unsigned char)(v >> 32);+	p[5] = (unsigned char)(v >> 40);+	p[6] = (unsigned char)(v >> 48);+	p[7] = (unsigned char)(v >> 56);+}+#endif++#include <stdlib.h>+#include <string.h>++
+ cbits/ed25519/ed25519-donna.h view
@@ -0,0 +1,115 @@+/*+	Public domain by Andrew M. <liquidsun@gmail.com>+	Modified from the amd64-51-30k implementation by+		Daniel J. Bernstein+		Niels Duif+		Tanja Lange+		Peter Schwabe+		Bo-Yin Yang+*/+++#include "ed25519-donna-portable.h"++#if defined(ED25519_SSE2)+#else+	#if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)+		#define ED25519_64BIT+	#else+		#define ED25519_32BIT+	#endif+#endif++#if !defined(ED25519_NO_INLINE_ASM)+	/* detect extra features first so un-needed functions can be disabled throughout */+	#if defined(ED25519_SSE2)+		#if defined(COMPILER_GCC) && defined(CPU_X86)+			#define ED25519_GCC_32BIT_SSE_CHOOSE+		#elif defined(COMPILER_GCC) && defined(CPU_X86_64)+			#define ED25519_GCC_64BIT_SSE_CHOOSE+		#endif+	#else+		#if defined(CPU_X86_64)+			#if defined(COMPILER_GCC) +				#if defined(ED25519_64BIT)+					#define ED25519_GCC_64BIT_X86_CHOOSE+				#else+					#define ED25519_GCC_64BIT_32BIT_CHOOSE+				#endif+			#endif+		#endif+	#endif+#endif++#if defined(ED25519_SSE2)+	#include "curve25519-donna-sse2.h"+#elif defined(ED25519_64BIT)+	#include "curve25519-donna-64bit.h"+#else+	#include "curve25519-donna-32bit.h"+#endif++#include "curve25519-donna-helpers.h"++/* separate uint128 check for 64 bit sse2 */+#if defined(HAVE_UINT128) && !defined(ED25519_FORCE_32BIT)+	#include "modm-donna-64bit.h"+#else+	#include "modm-donna-32bit.h"+#endif++typedef unsigned char hash_512bits[64];++/*+	Timing safe memory compare+*/+static int+ed25519_verify(const unsigned char *x, const unsigned char *y, size_t len) {+	size_t differentbits = 0;+	while (len--)+		differentbits |= (*x++ ^ *y++);+	return (int) (1 & ((differentbits - 1) >> 8));+}+++/*+ * Arithmetic on the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2+ * with d = -(121665/121666) = 37095705934669439343138083508754565189542113879843219016388785533085940283555+ * Base point: (15112221349535400772501151409588531511454012693041857206046113283949847762202,46316835694926478169428394003475163141307993866256225615783033603165251855960);+ */++typedef struct ge25519_t {+	bignum25519 x, y, z, t;+} ge25519;++typedef struct ge25519_p1p1_t {+	bignum25519 x, y, z, t;+} ge25519_p1p1;++typedef struct ge25519_niels_t {+	bignum25519 ysubx, xaddy, t2d;+} ge25519_niels;++typedef struct ge25519_pniels_t {+	bignum25519 ysubx, xaddy, z, t2d;+} ge25519_pniels;++#include "ed25519-donna-basepoint-table.h"++#if defined(ED25519_64BIT)+	#include "ed25519-donna-64bit-tables.h"+	#include "ed25519-donna-64bit-x86.h"+#else+	#include "ed25519-donna-32bit-tables.h"+	#include "ed25519-donna-64bit-x86-32bit.h"+#endif+++#if defined(ED25519_SSE2)+	#include "ed25519-donna-32bit-sse2.h"+	#include "ed25519-donna-64bit-sse2.h"+	#include "ed25519-donna-impl-sse2.h"+#else+	#include "ed25519-donna-impl-base.h"+#endif+
+ cbits/ed25519/ed25519-hash.h view
@@ -0,0 +1,26 @@+#include <cryptonite_sha512.h>+typedef struct sha512_ctx ed25519_hash_context;++static void+ed25519_hash_init(ed25519_hash_context *ctx) {+	cryptonite_sha512_init(ctx);+}++static void+ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen) {+	cryptonite_sha512_update(ctx, in, inlen);+}++static void+ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash) {+	cryptonite_sha512_finalize(ctx, hash);+}++static void+ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {+	ed25519_hash_context ctx;+	cryptonite_sha512_init(&ctx);+	cryptonite_sha512_update(&ctx, in, inlen);+	cryptonite_sha512_finalize(&ctx, hash);+	memset(&ctx, 0, sizeof(ctx));+}
+ cbits/ed25519/ed25519-randombytes.h view
@@ -0,0 +1,4 @@+void+ED25519_FN(ed25519_randombytes_unsafe) (void *p, size_t len) {+	exit(1);+}
+ cbits/ed25519/ed25519.c view
@@ -0,0 +1,143 @@+/*+	Public domain by Andrew M. <liquidsun@gmail.com>++	Ed25519 reference implementation using Ed25519-donna+*/+++#define ED25519_FN(fn)         cryptonite_##fn++#include "ed25519-donna.h"+#include "ed25519.h"+#include "ed25519-randombytes.h"+#include "ed25519-hash.h"++/*+	Generates a (extsk[0..31]) and aExt (extsk[32..63])+*/++DONNA_INLINE static void+ed25519_extsk(hash_512bits extsk, const ed25519_secret_key sk) {+	ed25519_hash(extsk, sk, 32);+	extsk[0] &= 248;+	extsk[31] &= 127;+	extsk[31] |= 64;+}++static void+ed25519_hram(hash_512bits hram, const ed25519_signature RS, const ed25519_public_key pk, const unsigned char *m, size_t mlen) {+	ed25519_hash_context ctx;+	ed25519_hash_init(&ctx);+	ed25519_hash_update(&ctx, RS, 32);+	ed25519_hash_update(&ctx, pk, 32);+	ed25519_hash_update(&ctx, m, mlen);+	ed25519_hash_final(&ctx, hram);+}++void+ED25519_FN(ed25519_publickey) (const ed25519_secret_key sk, ed25519_public_key pk) {+	bignum256modm a;+	ge25519 ALIGN(16) A;+	hash_512bits extsk;++	/* A = aB */+	ed25519_extsk(extsk, sk);+	expand256_modm(a, extsk, 32);+	ge25519_scalarmult_base_niels(&A, ge25519_niels_base_multiples, a);+	ge25519_pack(pk, &A);+}+++void+ED25519_FN(ed25519_sign) (const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS) {+	ed25519_hash_context ctx;+	bignum256modm r, S, a;+	ge25519 ALIGN(16) R;+	hash_512bits extsk, hashr, hram;++	ed25519_extsk(extsk, sk);++	/* r = H(aExt[32..64], m) */+	ed25519_hash_init(&ctx);+	ed25519_hash_update(&ctx, extsk + 32, 32);+	ed25519_hash_update(&ctx, m, mlen);+	ed25519_hash_final(&ctx, hashr);+	expand256_modm(r, hashr, 64);++	/* R = rB */+	ge25519_scalarmult_base_niels(&R, ge25519_niels_base_multiples, r);+	ge25519_pack(RS, &R);++	/* S = H(R,A,m).. */+	ed25519_hram(hram, RS, pk, m, mlen);+	expand256_modm(S, hram, 64);++	/* S = H(R,A,m)a */+	expand256_modm(a, extsk, 32);+	mul256_modm(S, S, a);++	/* S = (r + H(R,A,m)a) */+	add256_modm(S, S, r);++	/* S = (r + H(R,A,m)a) mod L */	+	contract256_modm(RS + 32, S);+}++int+ED25519_FN(ed25519_sign_open) (const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS) {+	ge25519 ALIGN(16) R, A;+	hash_512bits hash;+	bignum256modm hram, S;+	unsigned char checkR[32];++	if ((RS[63] & 224) || !ge25519_unpack_negative_vartime(&A, pk))+		return -1;++	/* hram = H(R,A,m) */+	ed25519_hram(hash, RS, pk, m, mlen);+	expand256_modm(hram, hash, 64);++	/* S */+	expand256_modm(S, RS + 32, 32);++	/* SB - H(R,A,m)A */+	ge25519_double_scalarmult_vartime(&R, &A, hram, S);+	ge25519_pack(checkR, &R);++	/* check that R = SB - H(R,A,m)A */+	return ed25519_verify(RS, checkR, 32) ? 0 : -1;+}++#include "ed25519-donna-batchverify.h"++/*+	Fast Curve25519 basepoint scalar multiplication+*/++void+ED25519_FN(curved25519_scalarmult_basepoint) (curved25519_key pk, const curved25519_key e) {+	curved25519_key ec;+	bignum256modm s;+	bignum25519 ALIGN(16) yplusz, zminusy;+	ge25519 ALIGN(16) p;+	size_t i;++	/* clamp */+	for (i = 0; i < 32; i++) ec[i] = e[i];+	ec[0] &= 248;+	ec[31] &= 127;+	ec[31] |= 64;++	expand_raw256_modm(s, ec);++	/* scalar * basepoint */+	ge25519_scalarmult_base_niels(&p, ge25519_niels_base_multiples, s);++	/* u = (y + z) / (z - y) */+	curve25519_add(yplusz, p.y, p.z);+	curve25519_sub(zminusy, p.z, p.y);+	curve25519_recip(zminusy, zminusy);+	curve25519_mul(yplusz, yplusz, zminusy);+	curve25519_contract(pk, yplusz);+}+
+ cbits/ed25519/ed25519.h view
@@ -0,0 +1,30 @@+#ifndef ED25519_H+#define ED25519_H++#include <stdlib.h>++#if defined(__cplusplus)+extern "C" {+#endif++typedef unsigned char ed25519_signature[64];+typedef unsigned char ed25519_public_key[32];+typedef unsigned char ed25519_secret_key[32];++typedef unsigned char curved25519_key[32];++void cryptonite_ed25519_publickey(const ed25519_secret_key sk, ed25519_public_key pk);+int cryptonite_ed25519_sign_open(const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS);+void cryptonite_ed25519_sign(const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS);++//int cryptonite_ed25519_sign_open_batch(const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid);++//void ed25519_randombytes_unsafe(void *out, size_t count);++//void curved25519_scalarmult_basepoint(curved25519_key pk, const curved25519_key e);++#if defined(__cplusplus)+}+#endif++#endif // ED25519_H
+ cbits/ed25519/modm-donna-64bit.h view
@@ -0,0 +1,361 @@+/*+	Public domain by Andrew M. <liquidsun@gmail.com>+*/+++/*+	Arithmetic modulo the group order n = 2^252 +  27742317777372353535851937790883648493 = 7237005577332262213973186563042994240857116359379907606001950938285454250989++	k = 32+	b = 1 << 8 = 256+	m = 2^252 + 27742317777372353535851937790883648493 = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed+	mu = floor( b^(k*2) / m ) = 0xfffffffffffffffffffffffffffffffeb2106215d086329a7ed9ce5a30a2c131b+*/++#define bignum256modm_bits_per_limb 56+#define bignum256modm_limb_size 5++typedef uint64_t bignum256modm_element_t;+typedef bignum256modm_element_t bignum256modm[5];++static const bignum256modm modm_m = {+	0x12631a5cf5d3ed, +	0xf9dea2f79cd658, +	0x000000000014de, +	0x00000000000000, +	0x00000010000000+};++static const bignum256modm modm_mu = {+	0x9ce5a30a2c131b,+	0x215d086329a7ed,+	0xffffffffeb2106,+	0xffffffffffffff,+	0x00000fffffffff+};++static bignum256modm_element_t+lt_modm(bignum256modm_element_t a, bignum256modm_element_t b) {+	return (a - b) >> 63;+}++static void+reduce256_modm(bignum256modm r) {+	bignum256modm t;+	bignum256modm_element_t b = 0, pb, mask;++	/* t = r - m */+	pb = 0;+	pb += modm_m[0]; b = lt_modm(r[0], pb); t[0] = (r[0] - pb + (b << 56)); pb = b;+	pb += modm_m[1]; b = lt_modm(r[1], pb); t[1] = (r[1] - pb + (b << 56)); pb = b;+	pb += modm_m[2]; b = lt_modm(r[2], pb); t[2] = (r[2] - pb + (b << 56)); pb = b;+	pb += modm_m[3]; b = lt_modm(r[3], pb); t[3] = (r[3] - pb + (b << 56)); pb = b;+	pb += modm_m[4]; b = lt_modm(r[4], pb); t[4] = (r[4] - pb + (b << 32)); ++	/* keep r if r was smaller than m */+	mask = b - 1;++	r[0] ^= mask & (r[0] ^ t[0]);+	r[1] ^= mask & (r[1] ^ t[1]);+	r[2] ^= mask & (r[2] ^ t[2]);+	r[3] ^= mask & (r[3] ^ t[3]);+	r[4] ^= mask & (r[4] ^ t[4]);+}++static void+barrett_reduce256_modm(bignum256modm r, const bignum256modm q1, const bignum256modm r1) {+	bignum256modm q3, r2;+	uint128_t c, mul;+	bignum256modm_element_t f, b, pb;++	/* q1 = x >> 248 = 264 bits = 5 56 bit elements+	   q2 = mu * q1+	   q3 = (q2 / 256(32+1)) = q2 / (2^8)^(32+1) = q2 >> 264 */+	mul64x64_128(c, modm_mu[0], q1[3])                 mul64x64_128(mul, modm_mu[3], q1[0]) add128(c, mul) mul64x64_128(mul, modm_mu[1], q1[2]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[1]) add128(c, mul) shr128(f, c, 56);+	mul64x64_128(c, modm_mu[0], q1[4]) add128_64(c, f) mul64x64_128(mul, modm_mu[4], q1[0]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[1]) add128(c, mul) mul64x64_128(mul, modm_mu[1], q1[3]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[2]) add128(c, mul)+	f = lo128(c); q3[0] = (f >> 40) & 0xffff; shr128(f, c, 56);+	mul64x64_128(c, modm_mu[4], q1[1]) add128_64(c, f) mul64x64_128(mul, modm_mu[1], q1[4]) add128(c, mul) mul64x64_128(mul, modm_mu[2], q1[3]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[2]) add128(c, mul)+	f = lo128(c); q3[0] |= (f << 16) & 0xffffffffffffff; q3[1] = (f >> 40) & 0xffff; shr128(f, c, 56);+	mul64x64_128(c, modm_mu[4], q1[2]) add128_64(c, f) mul64x64_128(mul, modm_mu[2], q1[4]) add128(c, mul) mul64x64_128(mul, modm_mu[3], q1[3]) add128(c, mul)+	f = lo128(c); q3[1] |= (f << 16) & 0xffffffffffffff; q3[2] = (f >> 40) & 0xffff; shr128(f, c, 56);+	mul64x64_128(c, modm_mu[4], q1[3]) add128_64(c, f) mul64x64_128(mul, modm_mu[3], q1[4]) add128(c, mul)+	f = lo128(c); q3[2] |= (f << 16) & 0xffffffffffffff; q3[3] = (f >> 40) & 0xffff; shr128(f, c, 56);+	mul64x64_128(c, modm_mu[4], q1[4]) add128_64(c, f)+	f = lo128(c); q3[3] |= (f << 16) & 0xffffffffffffff; q3[4] = (f >> 40) & 0xffff; shr128(f, c, 56);+	q3[4] |= (f << 16);++	mul64x64_128(c, modm_m[0], q3[0]) +	r2[0] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, modm_m[0], q3[1]) add128_64(c, f) mul64x64_128(mul, modm_m[1], q3[0]) add128(c, mul)+	r2[1] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, modm_m[0], q3[2]) add128_64(c, f) mul64x64_128(mul, modm_m[2], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[1]) add128(c, mul)+	r2[2] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, modm_m[0], q3[3]) add128_64(c, f) mul64x64_128(mul, modm_m[3], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[2]) add128(c, mul) mul64x64_128(mul, modm_m[2], q3[1]) add128(c, mul)+	r2[3] = lo128(c) & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, modm_m[0], q3[4]) add128_64(c, f) mul64x64_128(mul, modm_m[4], q3[0]) add128(c, mul) mul64x64_128(mul, modm_m[3], q3[1]) add128(c, mul) mul64x64_128(mul, modm_m[1], q3[3]) add128(c, mul) mul64x64_128(mul, modm_m[2], q3[2]) add128(c, mul)+	r2[4] = lo128(c) & 0x0000ffffffffff;++	pb = 0;+	pb += r2[0]; b = lt_modm(r1[0], pb); r[0] = (r1[0] - pb + (b << 56)); pb = b;+	pb += r2[1]; b = lt_modm(r1[1], pb); r[1] = (r1[1] - pb + (b << 56)); pb = b;+	pb += r2[2]; b = lt_modm(r1[2], pb); r[2] = (r1[2] - pb + (b << 56)); pb = b;+	pb += r2[3]; b = lt_modm(r1[3], pb); r[3] = (r1[3] - pb + (b << 56)); pb = b;+	pb += r2[4]; b = lt_modm(r1[4], pb); r[4] = (r1[4] - pb + (b << 40)); ++	reduce256_modm(r);+	reduce256_modm(r);+}+++static void+add256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {+	bignum256modm_element_t c;++	c  = x[0] + y[0]; r[0] = c & 0xffffffffffffff; c >>= 56;+	c += x[1] + y[1]; r[1] = c & 0xffffffffffffff; c >>= 56;+	c += x[2] + y[2]; r[2] = c & 0xffffffffffffff; c >>= 56;+	c += x[3] + y[3]; r[3] = c & 0xffffffffffffff; c >>= 56;+	c += x[4] + y[4]; r[4] = c;++	reduce256_modm(r);+}++static void+mul256_modm(bignum256modm r, const bignum256modm x, const bignum256modm y) {+	bignum256modm q1, r1;+	uint128_t c, mul;+	bignum256modm_element_t f;++	mul64x64_128(c, x[0], y[0])+	f = lo128(c); r1[0] = f & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[0], y[1]) add128_64(c, f) mul64x64_128(mul, x[1], y[0]) add128(c, mul) +	f = lo128(c); r1[1] = f & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[0], y[2]) add128_64(c, f) mul64x64_128(mul, x[2], y[0]) add128(c, mul) mul64x64_128(mul, x[1], y[1]) add128(c, mul) +	f = lo128(c); r1[2] = f & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[0], y[3]) add128_64(c, f) mul64x64_128(mul, x[3], y[0]) add128(c, mul) mul64x64_128(mul, x[1], y[2]) add128(c, mul) mul64x64_128(mul, x[2], y[1]) add128(c, mul) +	f = lo128(c); r1[3] = f & 0xffffffffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[0], y[4]) add128_64(c, f) mul64x64_128(mul, x[4], y[0]) add128(c, mul) mul64x64_128(mul, x[3], y[1]) add128(c, mul) mul64x64_128(mul, x[1], y[3]) add128(c, mul) mul64x64_128(mul, x[2], y[2]) add128(c, mul) +	f = lo128(c); r1[4] = f & 0x0000ffffffffff; q1[0] = (f >> 24) & 0xffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[4], y[1]) add128_64(c, f) mul64x64_128(mul, x[1], y[4]) add128(c, mul) mul64x64_128(mul, x[2], y[3]) add128(c, mul) mul64x64_128(mul, x[3], y[2]) add128(c, mul) +	f = lo128(c); q1[0] |= (f << 32) & 0xffffffffffffff; q1[1] = (f >> 24) & 0xffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[4], y[2]) add128_64(c, f) mul64x64_128(mul, x[2], y[4]) add128(c, mul) mul64x64_128(mul, x[3], y[3]) add128(c, mul) +	f = lo128(c); q1[1] |= (f << 32) & 0xffffffffffffff; q1[2] = (f >> 24) & 0xffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[4], y[3]) add128_64(c, f) mul64x64_128(mul, x[3], y[4]) add128(c, mul) +	f = lo128(c); q1[2] |= (f << 32) & 0xffffffffffffff; q1[3] = (f >> 24) & 0xffffffff; shr128(f, c, 56);+	mul64x64_128(c, x[4], y[4]) add128_64(c, f)+	f = lo128(c); q1[3] |= (f << 32) & 0xffffffffffffff; q1[4] = (f >> 24) & 0xffffffff; shr128(f, c, 56);+	q1[4] |= (f << 32);++	barrett_reduce256_modm(r, q1, r1);+}++static void+expand256_modm(bignum256modm out, const unsigned char *in, size_t len) {+	unsigned char work[64] = {0};+	bignum256modm_element_t x[16];+	bignum256modm q1;++	memcpy(work, in, len);+	x[0] = U8TO64_LE(work +  0);+	x[1] = U8TO64_LE(work +  8);+	x[2] = U8TO64_LE(work + 16);+	x[3] = U8TO64_LE(work + 24);+	x[4] = U8TO64_LE(work + 32);+	x[5] = U8TO64_LE(work + 40);+	x[6] = U8TO64_LE(work + 48);+	x[7] = U8TO64_LE(work + 56);++	/* r1 = (x mod 256^(32+1)) = x mod (2^8)(31+1) = x & ((1 << 264) - 1) */+	out[0] = (                         x[0]) & 0xffffffffffffff;+	out[1] = ((x[ 0] >> 56) | (x[ 1] <<  8)) & 0xffffffffffffff;+	out[2] = ((x[ 1] >> 48) | (x[ 2] << 16)) & 0xffffffffffffff;+	out[3] = ((x[ 2] >> 40) | (x[ 3] << 24)) & 0xffffffffffffff;+	out[4] = ((x[ 3] >> 32) | (x[ 4] << 32)) & 0x0000ffffffffff;++	/* under 252 bits, no need to reduce */+	if (len < 32)+		return;++	/* q1 = x >> 248 = 264 bits */+	q1[0] = ((x[ 3] >> 56) | (x[ 4] <<  8)) & 0xffffffffffffff;+	q1[1] = ((x[ 4] >> 48) | (x[ 5] << 16)) & 0xffffffffffffff;+	q1[2] = ((x[ 5] >> 40) | (x[ 6] << 24)) & 0xffffffffffffff;+	q1[3] = ((x[ 6] >> 32) | (x[ 7] << 32)) & 0xffffffffffffff;+	q1[4] = ((x[ 7] >> 24)                );++	barrett_reduce256_modm(out, q1, out);+}++static void+expand_raw256_modm(bignum256modm out, const unsigned char in[32]) {+	bignum256modm_element_t x[4];++	x[0] = U8TO64_LE(in +  0);+	x[1] = U8TO64_LE(in +  8);+	x[2] = U8TO64_LE(in + 16);+	x[3] = U8TO64_LE(in + 24);++	out[0] = (                         x[0]) & 0xffffffffffffff;+	out[1] = ((x[ 0] >> 56) | (x[ 1] <<  8)) & 0xffffffffffffff;+	out[2] = ((x[ 1] >> 48) | (x[ 2] << 16)) & 0xffffffffffffff;+	out[3] = ((x[ 2] >> 40) | (x[ 3] << 24)) & 0xffffffffffffff;+	out[4] = ((x[ 3] >> 32)                ) & 0x000000ffffffff;+}++static void+contract256_modm(unsigned char out[32], const bignum256modm in) {+	U64TO8_LE(out +  0, (in[0]      ) | (in[1] << 56));+	U64TO8_LE(out +  8, (in[1] >>  8) | (in[2] << 48));+	U64TO8_LE(out + 16, (in[2] >> 16) | (in[3] << 40));+	U64TO8_LE(out + 24, (in[3] >> 24) | (in[4] << 32));+}++static void+contract256_window4_modm(signed char r[64], const bignum256modm in) {+	char carry;+	signed char *quads = r;+	bignum256modm_element_t i, j, v, m;++	for (i = 0; i < 5; i++) {+		v = in[i];+		m = (i == 4) ? 8 : 14;+		for (j = 0; j < m; j++) {+			*quads++ = (v & 15);+			v >>= 4;+		}+	}++	/* making it signed */+	carry = 0;+	for(i = 0; i < 63; i++) {+		r[i] += carry;+		r[i+1] += (r[i] >> 4);+		r[i] &= 15;+		carry = (r[i] >> 3);+		r[i] -= (carry << 4);+	}+	r[63] += carry;+}++static void+contract256_slidingwindow_modm(signed char r[256], const bignum256modm s, int windowsize) {+	int i,j,k,b;+	int m = (1 << (windowsize - 1)) - 1, soplen = 256;+	signed char *bits = r;+	bignum256modm_element_t v;++	/* first put the binary expansion into r  */+	for (i = 0; i < 4; i++) {+		v = s[i];+		for (j = 0; j < 56; j++, v >>= 1)+			*bits++ = (v & 1);+	}+	v = s[4];+	for (j = 0; j < 32; j++, v >>= 1)+		*bits++ = (v & 1);++	/* Making it sliding window */+	for (j = 0; j < soplen; j++) {+		if (!r[j])+			continue;++		for (b = 1; (b < (soplen - j)) && (b <= 6); b++) {+			if ((r[j] + (r[j + b] << b)) <= m) {+				r[j] += r[j + b] << b;+				r[j + b] = 0;+			} else if ((r[j] - (r[j + b] << b)) >= -m) {+				r[j] -= r[j + b] << b;+				for (k = j + b; k < soplen; k++) {+					if (!r[k]) {+						r[k] = 1;+						break;+					}+					r[k] = 0;+				}+			} else if (r[j + b]) {+				break;+			}+		}+	}+}++/*+	helpers for batch verifcation, are allowed to be vartime+*/++/* out = a - b, a must be larger than b */+static void+sub256_modm_batch(bignum256modm out, const bignum256modm a, const bignum256modm b, size_t limbsize) {+	size_t i = 0;+	bignum256modm_element_t carry = 0;+	switch (limbsize) {+		case 4: out[i] = (a[i] - b[i])        ; carry = (out[i] >> 63); out[i] &= 0xffffffffffffff; i++;+		case 3: out[i] = (a[i] - b[i]) - carry; carry = (out[i] >> 63); out[i] &= 0xffffffffffffff; i++;+		case 2: out[i] = (a[i] - b[i]) - carry; carry = (out[i] >> 63); out[i] &= 0xffffffffffffff; i++;+		case 1: out[i] = (a[i] - b[i]) - carry; carry = (out[i] >> 63); out[i] &= 0xffffffffffffff; i++;+		case 0: +		default: out[i] = (a[i] - b[i]) - carry;+	}+}+++/* is a < b */+static int+lt256_modm_batch(const bignum256modm a, const bignum256modm b, size_t limbsize) {+	size_t i = 0;+	bignum256modm_element_t t, carry = 0;+	switch (limbsize) {+		case 4: t = (a[i] - b[i])        ; carry = (t >> 63); i++;+		case 3: t = (a[i] - b[i]) - carry; carry = (t >> 63); i++;+		case 2: t = (a[i] - b[i]) - carry; carry = (t >> 63); i++;+		case 1: t = (a[i] - b[i]) - carry; carry = (t >> 63); i++;+		case 0: t = (a[i] - b[i]) - carry; carry = (t >> 63);+	}+	return (int)carry;+}++/* is a <= b */+static int+lte256_modm_batch(const bignum256modm a, const bignum256modm b, size_t limbsize) {+	size_t i = 0;+	bignum256modm_element_t t, carry = 0;+	switch (limbsize) {+		case 4: t = (b[i] - a[i])        ; carry = (t >> 63); i++;+		case 3: t = (b[i] - a[i]) - carry; carry = (t >> 63); i++;+		case 2: t = (b[i] - a[i]) - carry; carry = (t >> 63); i++;+		case 1: t = (b[i] - a[i]) - carry; carry = (t >> 63); i++;+		case 0: t = (b[i] - a[i]) - carry; carry = (t >> 63);+	}+	return (int)!carry;+}++/* is a == 0 */+static int+iszero256_modm_batch(const bignum256modm a) {+	size_t i;+	for (i = 0; i < 5; i++)+		if (a[i])+			return 0;+	return 1;+}++/* is a == 1 */+static int+isone256_modm_batch(const bignum256modm a) {+	size_t i;+	for (i = 0; i < 5; i++)+		if (a[i] != ((i) ? 0 : 1))+			return 0;+	return 1;+}++/* can a fit in to (at most) 128 bits */+static int+isatmost128bits256_modm_batch(const bignum256modm a) {+	uint64_t mask =+		((a[4]                   )  | /*  32 */+		 (a[3]                   )  | /*  88 */+		 (a[2] & 0xffffffffff0000));++	return (mask == 0);+}
+ cbits/p256/p256.c view
@@ -0,0 +1,373 @@+/*+ * Copyright 2013 The Android Open Source Project+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions are met:+ *     * Redistributions of source code must retain the above copyright+ *       notice, this list of conditions and the following disclaimer.+ *     * Redistributions in binary form must reproduce the above copyright+ *       notice, this list of conditions and the following disclaimer in the+ *       documentation and/or other materials provided with the distribution.+ *     * Neither the name of Google Inc. nor the names of its contributors may+ *       be used to endorse or promote products derived from this software+ *       without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO+ * EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++// This is an implementation of the P256 elliptic curve group. It's written to+// be portable 32-bit, although it's still constant-time.+//+// WARNING: Implementing these functions in a constant-time manner is far from+//          obvious. Be careful when touching this code.+//+// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.++#include <assert.h>+#include <stdint.h>+#include <string.h>+#include <stdio.h>++#include "p256/p256.h"++const cryptonite_p256_int cryptonite_SECP256r1_n =  // curve order+  {{0xfc632551, 0xf3b9cac2, 0xa7179e84, 0xbce6faad, -1, -1, 0, -1}};++const cryptonite_p256_int cryptonite_SECP256r1_p =  // curve field size+  {{-1, -1, -1, 0, 0, 0, 1, -1 }};++const cryptonite_p256_int cryptonite_SECP256r1_b =  // curve b+  {{0x27d2604b, 0x3bce3c3e, 0xcc53b0f6, 0x651d06b0,+    0x769886bc, 0xb3ebbd55, 0xaa3a93e7, 0x5ac635d8}};++void cryptonite_p256_init(cryptonite_p256_int* a) {+  memset(a, 0, sizeof(*a));+}++void cryptonite_p256_clear(cryptonite_p256_int* a) { cryptonite_p256_init(a); }++int cryptonite_p256_get_bit(const cryptonite_p256_int* scalar, int bit) {+  return (P256_DIGIT(scalar, bit / P256_BITSPERDIGIT)+              >> (bit & (P256_BITSPERDIGIT - 1))) & 1;+}++int cryptonite_p256_is_zero(const cryptonite_p256_int* a) {+  int i, result = 0;+  for (i = 0; i < P256_NDIGITS; ++i) result |= P256_DIGIT(a, i);+  return !result;+}++// top, c[] += a[] * b+// Returns new top+static cryptonite_p256_digit mulAdd(const cryptonite_p256_int* a,+                         cryptonite_p256_digit b,+                         cryptonite_p256_digit top,+                         cryptonite_p256_digit* c) {+  int i;+  cryptonite_p256_ddigit carry = 0;++  for (i = 0; i < P256_NDIGITS; ++i) {+    carry += *c;+    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) * b;+    *c++ = (cryptonite_p256_digit)carry;+    carry >>= P256_BITSPERDIGIT;+  }+  return top + (cryptonite_p256_digit)carry;+}++// top, c[] -= top_a, a[]+static cryptonite_p256_digit subTop(cryptonite_p256_digit top_a,+                         const cryptonite_p256_digit* a,+                         cryptonite_p256_digit top_c,+                         cryptonite_p256_digit* c) {+  int i;+  cryptonite_p256_sddigit borrow = 0;++  for (i = 0; i < P256_NDIGITS; ++i) {+    borrow += *c;+    borrow -= *a++;+    *c++ = (cryptonite_p256_digit)borrow;+    borrow >>= P256_BITSPERDIGIT;+  }+  borrow += top_c;+  borrow -= top_a;+  top_c = (cryptonite_p256_digit)borrow;+  assert((borrow >> P256_BITSPERDIGIT) == 0);+  return top_c;+}++// top, c[] -= MOD[] & mask (0 or -1)+// returns new top.+static cryptonite_p256_digit subM(const cryptonite_p256_int* MOD,+                       cryptonite_p256_digit top,+                       cryptonite_p256_digit* c,+                       cryptonite_p256_digit mask) {+  int i;+  cryptonite_p256_sddigit borrow = 0;+  for (i = 0; i < P256_NDIGITS; ++i) {+    borrow += *c;+    borrow -= P256_DIGIT(MOD, i) & mask;+    *c++ = (cryptonite_p256_digit)borrow;+    borrow >>= P256_BITSPERDIGIT;+  }+  return top + (cryptonite_p256_digit)borrow;+}++// top, c[] += MOD[] & mask (0 or -1)+// returns new top.+static cryptonite_p256_digit addM(const cryptonite_p256_int* MOD,+                       cryptonite_p256_digit top,+                       cryptonite_p256_digit* c,+                       cryptonite_p256_digit mask) {+  int i;+  cryptonite_p256_ddigit carry = 0;+  for (i = 0; i < P256_NDIGITS; ++i) {+    carry += *c;+    carry += P256_DIGIT(MOD, i) & mask;+    *c++ = (cryptonite_p256_digit)carry;+    carry >>= P256_BITSPERDIGIT;+  }+  return top + (cryptonite_p256_digit)carry;+}++// c = a * b mod MOD. c can be a and/or b.+void cryptonite_p256_modmul(const cryptonite_p256_int* MOD,+                 const cryptonite_p256_int* a,+                 const cryptonite_p256_digit top_b,+                 const cryptonite_p256_int* b,+                 cryptonite_p256_int* c) {+  cryptonite_p256_digit tmp[P256_NDIGITS * 2 + 1] = { 0 };+  cryptonite_p256_digit top = 0;+  int i;++  // Multiply/add into tmp.+  for (i = 0; i < P256_NDIGITS; ++i) {+    if (i) tmp[i + P256_NDIGITS - 1] = top;+    top = mulAdd(a, P256_DIGIT(b, i), 0, tmp + i);+  }++  // Multiply/add top digit+  tmp[i + P256_NDIGITS - 1] = top;+  top = mulAdd(a, top_b, 0, tmp + i);++  // Reduce tmp, digit by digit.+  for (; i >= 0; --i) {+    cryptonite_p256_digit reducer[P256_NDIGITS] = { 0 };+    cryptonite_p256_digit top_reducer;++    // top can be any value at this point.+    // Guestimate reducer as top * MOD, since msw of MOD is -1.+    top_reducer = mulAdd(MOD, top, 0, reducer);++    // Subtract reducer from top | tmp.+    top = subTop(top_reducer, reducer, top, tmp + i);++    // top is now either 0 or 1. Make it 0, fixed-timing.+    assert(top <= 1);++    top = subM(MOD, top, tmp + i, ~(top - 1));++    assert(top == 0);++    // We have now reduced the top digit off tmp. Fetch new top digit.+    top = tmp[i + P256_NDIGITS - 1];+  }++  // tmp might still be larger than MOD, yet same bit length.+  // Make sure it is less, fixed-timing.+  addM(MOD, 0, tmp, subM(MOD, 0, tmp, -1));++  memcpy(c, tmp, P256_NBYTES);+}+int cryptonite_p256_is_odd(const cryptonite_p256_int* a) { return P256_DIGIT(a, 0) & 1; }+int cryptonite_p256_is_even(const cryptonite_p256_int* a) { return !(P256_DIGIT(a, 0) & 1); }++cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {+  int i;+  cryptonite_p256_digit top = P256_DIGIT(a, P256_NDIGITS - 1);++  n %= P256_BITSPERDIGIT;+  for (i = P256_NDIGITS - 1; i > 0; --i) {+    cryptonite_p256_digit accu = (P256_DIGIT(a, i) << n);+    accu |= (P256_DIGIT(a, i - 1) >> (P256_BITSPERDIGIT - n));+    P256_DIGIT(b, i) = accu;+  }+  P256_DIGIT(b, i) = (P256_DIGIT(a, i) << n);++  top = (cryptonite_p256_digit)((((cryptonite_p256_ddigit)top) << n) >> P256_BITSPERDIGIT);++  return top;+}++void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {+  int i;++  n %= P256_BITSPERDIGIT;+  for (i = 0; i < P256_NDIGITS - 1; ++i) {+    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> n);+    accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - n));+    P256_DIGIT(b, i) = accu;+  }+  P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> n);+}++static void cryptonite_p256_shr1(const cryptonite_p256_int* a, int highbit, cryptonite_p256_int* b) {+  int i;++  for (i = 0; i < P256_NDIGITS - 1; ++i) {+    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> 1);+    accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - 1));+    P256_DIGIT(b, i) = accu;+  }+  P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> 1) |+      (highbit << (P256_BITSPERDIGIT - 1));+}++// Return -1, 0, 1 for a < b, a == b or a > b respectively.+int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int* b) {+  int i;+  cryptonite_p256_sddigit borrow = 0;+  cryptonite_p256_digit notzero = 0;++  for (i = 0; i < P256_NDIGITS; ++i) {+    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);+    // Track whether any result digit is ever not zero.+    // Relies on !!(non-zero) evaluating to 1, e.g., !!(-1) evaluating to 1.+    notzero |= !!((cryptonite_p256_digit)borrow);+    borrow >>= P256_BITSPERDIGIT;+  }+  return (int)borrow | notzero;+}++// c = a - b. Returns borrow: 0 or -1.+int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {+  int i;+  cryptonite_p256_sddigit borrow = 0;++  for (i = 0; i < P256_NDIGITS; ++i) {+    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);+    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)borrow;+    borrow >>= P256_BITSPERDIGIT;+  }+  return (int)borrow;+}++// c = a + b. Returns carry: 0 or 1.+int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {+  int i;+  cryptonite_p256_ddigit carry = 0;++  for (i = 0; i < P256_NDIGITS; ++i) {+    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) + P256_DIGIT(b, i);+    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)carry;+    carry >>= P256_BITSPERDIGIT;+  }+  return (int)carry;+}++// b = a + d. Returns carry, 0 or 1.+int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit d, cryptonite_p256_int* b) {+  int i;+  cryptonite_p256_ddigit carry = d;++  for (i = 0; i < P256_NDIGITS; ++i) {+    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i);+    if (b) P256_DIGIT(b, i) = (cryptonite_p256_digit)carry;+    carry >>= P256_BITSPERDIGIT;+  }+  return (int)carry;+}++// b = 1/a mod MOD, binary euclid.+void cryptonite_p256_modinv_vartime(const cryptonite_p256_int* MOD,+                         const cryptonite_p256_int* a,+                         cryptonite_p256_int* b) {+  cryptonite_p256_int R = P256_ZERO;+  cryptonite_p256_int S = P256_ONE;+  cryptonite_p256_int U = *MOD;+  cryptonite_p256_int V = *a;++  for (;;) {+    if (cryptonite_p256_is_even(&U)) {+      cryptonite_p256_shr1(&U, 0, &U);+      if (cryptonite_p256_is_even(&R)) {+        cryptonite_p256_shr1(&R, 0, &R);+      } else {+        // R = (R+MOD)/2+        cryptonite_p256_shr1(&R, cryptonite_p256_add(&R, MOD, &R), &R);+      }+    } else if (cryptonite_p256_is_even(&V)) {+      cryptonite_p256_shr1(&V, 0, &V);+      if (cryptonite_p256_is_even(&S)) {+        cryptonite_p256_shr1(&S, 0, &S);+      } else {+        // S = (S+MOD)/2+        cryptonite_p256_shr1(&S, cryptonite_p256_add(&S, MOD, &S) , &S);+      }+    } else {  // U,V both odd.+      if (!cryptonite_p256_sub(&V, &U, NULL)) {+        cryptonite_p256_sub(&V, &U, &V);+        if (cryptonite_p256_sub(&S, &R, &S)) cryptonite_p256_add(&S, MOD, &S);+        if (cryptonite_p256_is_zero(&V)) break;  // done.+      } else {+        cryptonite_p256_sub(&U, &V, &U);+        if (cryptonite_p256_sub(&R, &S, &R)) cryptonite_p256_add(&R, MOD, &R);+      }+    }+  }++  cryptonite_p256_mod(MOD, &R, b);+}++void cryptonite_p256_mod(const cryptonite_p256_int* MOD,+              const cryptonite_p256_int* in,+              cryptonite_p256_int* out) {+  if (out != in) *out = *in;+  addM(MOD, 0, P256_DIGITS(out), subM(MOD, 0, P256_DIGITS(out), -1));+}++// Verify y^2 == x^3 - 3x + b mod p+// and 0 < x < p and 0 < y < p+int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y) {+  cryptonite_p256_int y2, x3;++  if (cryptonite_p256_cmp(&cryptonite_SECP256r1_p, x) <= 0 ||+      cryptonite_p256_cmp(&cryptonite_SECP256r1_p, y) <= 0 ||+      cryptonite_p256_is_zero(x) ||+      cryptonite_p256_is_zero(y)) return 0;++  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, y, 0, y, &y2);  // y^2++  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, x, &x3);  // x^2+  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, &x3, &x3);  // x^3+  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - x+  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 2x+  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 3x+  if (cryptonite_p256_add(&x3, &cryptonite_SECP256r1_b, &x3))  // x^3 - 3x + b+    cryptonite_p256_sub(&x3, &cryptonite_SECP256r1_p, &x3);++  return cryptonite_p256_cmp(&y2, &x3) == 0;+}++void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst) {+  int i;+  const uint8_t* p = &src[0];++  for (i = P256_NDIGITS - 1; i >= 0; --i) {+    P256_DIGIT(dst, i) =+        (p[0] << 24) |+        (p[1] << 16) |+        (p[2] << 8) |+        p[3];+    p += 4;+  }+}
+ cbits/p256/p256.h view
@@ -0,0 +1,162 @@+/*+ * Copyright 2013 The Android Open Source Project+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions are met:+ *     * Redistributions of source code must retain the above copyright+ *       notice, this list of conditions and the following disclaimer.+ *     * Redistributions in binary form must reproduce the above copyright+ *       notice, this list of conditions and the following disclaimer in the+ *       documentation and/or other materials provided with the distribution.+ *     * Neither the name of Google Inc. nor the names of its contributors may+ *       be used to endorse or promote products derived from this software+ *       without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO+ * EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++#ifndef SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_+#define SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_++// Collection of routines manipulating 256 bit unsigned integers.+// Just enough to implement ecdsa-p256 and related algorithms.++#include <stdint.h>++#ifdef __cplusplus+extern "C" {+#endif++#define P256_BITSPERDIGIT 32+#define P256_NDIGITS 8+#define P256_NBYTES 32++typedef int cryptonite_p256_err;+typedef uint32_t cryptonite_p256_digit;+typedef int32_t cryptonite_p256_sdigit;+typedef uint64_t cryptonite_p256_ddigit;+typedef int64_t cryptonite_p256_sddigit;++// Defining cryptonite_p256_int as struct to leverage struct assigment.+typedef struct {+  cryptonite_p256_digit a[P256_NDIGITS];+} cryptonite_p256_int;++extern const cryptonite_p256_int cryptonite_SECP256r1_n;  // Curve order+extern const cryptonite_p256_int cryptonite_SECP256r1_p;  // Curve prime+extern const cryptonite_p256_int cryptonite_SECP256r1_b;  // Curve param++// Initialize a cryptonite_p256_int to zero.+void cryptonite_p256_init(cryptonite_p256_int* a);++// Clear a cryptonite_p256_int to zero.+void cryptonite_p256_clear(cryptonite_p256_int* a);++// Return bit. Index 0 is least significant.+int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);++// b := a % MOD+void cryptonite_p256_mod(+    const cryptonite_p256_int* MOD,+    const cryptonite_p256_int* a,+    cryptonite_p256_int* b);++// c := a * (top_b | b) % MOD+void cryptonite_p256_modmul(+    const cryptonite_p256_int* MOD,+    const cryptonite_p256_int* a,+    const cryptonite_p256_digit top_b,+    const cryptonite_p256_int* b,+    cryptonite_p256_int* c);++// b := 1 / a % MOD+// MOD best be SECP256r1_n+void cryptonite_p256_modinv(+    const cryptonite_p256_int* MOD,+    const cryptonite_p256_int* a,+    cryptonite_p256_int* b);++// b := 1 / a % MOD+// MOD best be SECP256r1_n+// Faster than cryptonite_p256_modinv()+void cryptonite_p256_modinv_vartime(+    const cryptonite_p256_int* MOD,+    const cryptonite_p256_int* a,+    cryptonite_p256_int* b);++// b := a << (n % P256_BITSPERDIGIT)+// Returns the bits shifted out of most significant digit.+cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);++// b := a >> (n % P256_BITSPERDIGIT)+void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);++int cryptonite_p256_is_zero(const cryptonite_p256_int* a);+int cryptonite_p256_is_odd(const cryptonite_p256_int* a);+int cryptonite_p256_is_even(const cryptonite_p256_int* a);++// Returns -1, 0 or 1.+int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);++// c: = a - b+// Returns -1 on borrow.+int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);++// c := a + b+// Returns 1 on carry.+int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);++// c := a + (single digit)b+// Returns carry 1 on carry.+int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);++// ec routines.++// {out_x,out_y} := nG+void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,+                         cryptonite_p256_int *out_x,+                         cryptonite_p256_int *out_y);++// {out_x,out_y} := n{in_x,in_y}+void cryptonite_p256_point_mul(const cryptonite_p256_int *n,+                    const cryptonite_p256_int *in_x,+                    const cryptonite_p256_int *in_y,+                    cryptonite_p256_int *out_x,+                    cryptonite_p256_int *out_y);++// {out_x,out_y} := n1G + n2{in_x,in_y}+void cryptonite_p256_points_mul_vartime(+    const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,+    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,+    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);++// Return whether point {x,y} is on curve.+int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);++// Outputs big-endian binary form. No leading zero skips.+void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);++// Reads from big-endian binary form,+// thus pre-pad with leading zeros if short.+void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);++#define P256_DIGITS(x) ((x)->a)+#define P256_DIGIT(x,y) ((x)->a[y])++#define P256_ZERO {{0}}+#define P256_ONE {{1}}++#ifdef __cplusplus+}+#endif++#endif  // SYSTEM_CORE_INCLUDE_MINCRYPT_LITE_P256_H_
+ cbits/p256/p256_ec.c view
@@ -0,0 +1,1305 @@+/*+ * Copyright 2013 The Android Open Source Project+ *+ * Redistribution and use in source and binary forms, with or without+ * modification, are permitted provided that the following conditions are met:+ *     * Redistributions of source code must retain the above copyright+ *       notice, this list of conditions and the following disclaimer.+ *     * Redistributions in binary form must reproduce the above copyright+ *       notice, this list of conditions and the following disclaimer in the+ *       documentation and/or other materials provided with the distribution.+ *     * Neither the name of Google Inc. nor the names of its contributors may+ *       be used to endorse or promote products derived from this software+ *       without specific prior written permission.+ *+ * THIS SOFTWARE IS PROVIDED BY Google Inc. ``AS IS'' AND ANY EXPRESS OR+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO+ * EVENT SHALL Google Inc. BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.+ */++// This is an implementation of the P256 elliptic curve group. It's written to+// be portable 32-bit, although it's still constant-time.+//+// WARNING: Implementing these functions in a constant-time manner is far from+//          obvious. Be careful when touching this code.+//+// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.++#include <stdint.h>+#include <stdio.h>++#include <string.h>+#include <stdlib.h>++#include "p256/p256.h"++typedef uint8_t u8;+typedef uint32_t u32;+typedef int32_t s32;+typedef uint64_t u64;++/* Our field elements are represented as nine 32-bit limbs.+ *+ * The value of an felem (field element) is:+ *   x[0] + (x[1] * 2**29) + (x[2] * 2**57) + ... + (x[8] * 2**228)+ *+ * That is, each limb is alternately 29 or 28-bits wide in little-endian+ * order.+ *+ * This means that an felem hits 2**257, rather than 2**256 as we would like. A+ * 28, 29, ... pattern would cause us to hit 2**256, but that causes problems+ * when multiplying as terms end up one bit short of a limb which would require+ * much bit-shifting to correct.+ *+ * Finally, the values stored in an felem are in Montgomery form. So the value+ * |y| is stored as (y*R) mod p, where p is the P-256 prime and R is 2**257.+ */+typedef u32 limb;+#define NLIMBS 9+typedef limb felem[NLIMBS];++static const limb kBottom28Bits = 0xfffffff;+static const limb kBottom29Bits = 0x1fffffff;++/* kOne is the number 1 as an felem. It's 2**257 mod p split up into 29 and+ * 28-bit words. */+static const felem kOne = {+    2, 0, 0, 0xffff800,+    0x1fffffff, 0xfffffff, 0x1fbfffff, 0x1ffffff,+    0+};+static const felem kZero = {0};+static const felem kP = {+    0x1fffffff, 0xfffffff, 0x1fffffff, 0x3ff,+    0, 0, 0x200000, 0xf000000,+    0xfffffff+};+static const felem k2P = {+    0x1ffffffe, 0xfffffff, 0x1fffffff, 0x7ff,+    0, 0, 0x400000, 0xe000000,+    0x1fffffff+};+/* kPrecomputed contains precomputed values to aid the calculation of scalar+ * multiples of the base point, G. It's actually two, equal length, tables+ * concatenated.+ *+ * The first table contains (x,y) felem pairs for 16 multiples of the base+ * point, G.+ *+ *   Index  |  Index (binary) | Value+ *       0  |           0000  | 0G (all zeros, omitted)+ *       1  |           0001  | G+ *       2  |           0010  | 2**64G+ *       3  |           0011  | 2**64G + G+ *       4  |           0100  | 2**128G+ *       5  |           0101  | 2**128G + G+ *       6  |           0110  | 2**128G + 2**64G+ *       7  |           0111  | 2**128G + 2**64G + G+ *       8  |           1000  | 2**192G+ *       9  |           1001  | 2**192G + G+ *      10  |           1010  | 2**192G + 2**64G+ *      11  |           1011  | 2**192G + 2**64G + G+ *      12  |           1100  | 2**192G + 2**128G+ *      13  |           1101  | 2**192G + 2**128G + G+ *      14  |           1110  | 2**192G + 2**128G + 2**64G+ *      15  |           1111  | 2**192G + 2**128G + 2**64G + G+ *+ * The second table follows the same style, but the terms are 2**32G,+ * 2**96G, 2**160G, 2**224G.+ *+ * This is ~2KB of data. */+static const limb kPrecomputed[NLIMBS * 2 * 15 * 2] = {+    0x11522878, 0xe730d41, 0xdb60179, 0x4afe2ff, 0x12883add, 0xcaddd88, 0x119e7edc, 0xd4a6eab, 0x3120bee,+    0x1d2aac15, 0xf25357c, 0x19e45cdd, 0x5c721d0, 0x1992c5a5, 0xa237487, 0x154ba21, 0x14b10bb, 0xae3fe3,+    0xd41a576, 0x922fc51, 0x234994f, 0x60b60d3, 0x164586ae, 0xce95f18, 0x1fe49073, 0x3fa36cc, 0x5ebcd2c,+    0xb402f2f, 0x15c70bf, 0x1561925c, 0x5a26704, 0xda91e90, 0xcdc1c7f, 0x1ea12446, 0xe1ade1e, 0xec91f22,+    0x26f7778, 0x566847e, 0xa0bec9e, 0x234f453, 0x1a31f21a, 0xd85e75c, 0x56c7109, 0xa267a00, 0xb57c050,+    0x98fb57, 0xaa837cc, 0x60c0792, 0xcfa5e19, 0x61bab9e, 0x589e39b, 0xa324c5, 0x7d6dee7, 0x2976e4b,+    0x1fc4124a, 0xa8c244b, 0x1ce86762, 0xcd61c7e, 0x1831c8e0, 0x75774e1, 0x1d96a5a9, 0x843a649, 0xc3ab0fa,+    0x6e2e7d5, 0x7673a2a, 0x178b65e8, 0x4003e9b, 0x1a1f11c2, 0x7816ea, 0xf643e11, 0x58c43df, 0xf423fc2,+    0x19633ffa, 0x891f2b2, 0x123c231c, 0x46add8c, 0x54700dd, 0x59e2b17, 0x172db40f, 0x83e277d, 0xb0dd609,+    0xfd1da12, 0x35c6e52, 0x19ede20c, 0xd19e0c0, 0x97d0f40, 0xb015b19, 0x449e3f5, 0xe10c9e, 0x33ab581,+    0x56a67ab, 0x577734d, 0x1dddc062, 0xc57b10d, 0x149b39d, 0x26a9e7b, 0xc35df9f, 0x48764cd, 0x76dbcca,+    0xca4b366, 0xe9303ab, 0x1a7480e7, 0x57e9e81, 0x1e13eb50, 0xf466cf3, 0x6f16b20, 0x4ba3173, 0xc168c33,+    0x15cb5439, 0x6a38e11, 0x73658bd, 0xb29564f, 0x3f6dc5b, 0x53b97e, 0x1322c4c0, 0x65dd7ff, 0x3a1e4f6,+    0x14e614aa, 0x9246317, 0x1bc83aca, 0xad97eed, 0xd38ce4a, 0xf82b006, 0x341f077, 0xa6add89, 0x4894acd,+    0x9f162d5, 0xf8410ef, 0x1b266a56, 0xd7f223, 0x3e0cb92, 0xe39b672, 0x6a2901a, 0x69a8556, 0x7e7c0,+    0x9b7d8d3, 0x309a80, 0x1ad05f7f, 0xc2fb5dd, 0xcbfd41d, 0x9ceb638, 0x1051825c, 0xda0cf5b, 0x812e881,+    0x6f35669, 0x6a56f2c, 0x1df8d184, 0x345820, 0x1477d477, 0x1645db1, 0xbe80c51, 0xc22be3e, 0xe35e65a,+    0x1aeb7aa0, 0xc375315, 0xf67bc99, 0x7fdd7b9, 0x191fc1be, 0x61235d, 0x2c184e9, 0x1c5a839, 0x47a1e26,+    0xb7cb456, 0x93e225d, 0x14f3c6ed, 0xccc1ac9, 0x17fe37f3, 0x4988989, 0x1a90c502, 0x2f32042, 0xa17769b,+    0xafd8c7c, 0x8191c6e, 0x1dcdb237, 0x16200c0, 0x107b32a1, 0x66c08db, 0x10d06a02, 0x3fc93, 0x5620023,+    0x16722b27, 0x68b5c59, 0x270fcfc, 0xfad0ecc, 0xe5de1c2, 0xeab466b, 0x2fc513c, 0x407f75c, 0xbaab133,+    0x9705fe9, 0xb88b8e7, 0x734c993, 0x1e1ff8f, 0x19156970, 0xabd0f00, 0x10469ea7, 0x3293ac0, 0xcdc98aa,+    0x1d843fd, 0xe14bfe8, 0x15be825f, 0x8b5212, 0xeb3fb67, 0x81cbd29, 0xbc62f16, 0x2b6fcc7, 0xf5a4e29,+    0x13560b66, 0xc0b6ac2, 0x51ae690, 0xd41e271, 0xf3e9bd4, 0x1d70aab, 0x1029f72, 0x73e1c35, 0xee70fbc,+    0xad81baf, 0x9ecc49a, 0x86c741e, 0xfe6be30, 0x176752e7, 0x23d416, 0x1f83de85, 0x27de188, 0x66f70b8,+    0x181cd51f, 0x96b6e4c, 0x188f2335, 0xa5df759, 0x17a77eb6, 0xfeb0e73, 0x154ae914, 0x2f3ec51, 0x3826b59,+    0xb91f17d, 0x1c72949, 0x1362bf0a, 0xe23fddf, 0xa5614b0, 0xf7d8f, 0x79061, 0x823d9d2, 0x8213f39,+    0x1128ae0b, 0xd095d05, 0xb85c0c2, 0x1ecb2ef, 0x24ddc84, 0xe35e901, 0x18411a4a, 0xf5ddc3d, 0x3786689,+    0x52260e8, 0x5ae3564, 0x542b10d, 0x8d93a45, 0x19952aa4, 0x996cc41, 0x1051a729, 0x4be3499, 0x52b23aa,+    0x109f307e, 0x6f5b6bb, 0x1f84e1e7, 0x77a0cfa, 0x10c4df3f, 0x25a02ea, 0xb048035, 0xe31de66, 0xc6ecaa3,+    0x28ea335, 0x2886024, 0x1372f020, 0xf55d35, 0x15e4684c, 0xf2a9e17, 0x1a4a7529, 0xcb7beb1, 0xb2a78a1,+    0x1ab21f1f, 0x6361ccf, 0x6c9179d, 0xb135627, 0x1267b974, 0x4408bad, 0x1cbff658, 0xe3d6511, 0xc7d76f,+    0x1cc7a69, 0xe7ee31b, 0x54fab4f, 0x2b914f, 0x1ad27a30, 0xcd3579e, 0xc50124c, 0x50daa90, 0xb13f72,+    0xb06aa75, 0x70f5cc6, 0x1649e5aa, 0x84a5312, 0x329043c, 0x41c4011, 0x13d32411, 0xb04a838, 0xd760d2d,+    0x1713b532, 0xbaa0c03, 0x84022ab, 0x6bcf5c1, 0x2f45379, 0x18ae070, 0x18c9e11e, 0x20bca9a, 0x66f496b,+    0x3eef294, 0x67500d2, 0xd7f613c, 0x2dbbeb, 0xb741038, 0xe04133f, 0x1582968d, 0xbe985f7, 0x1acbc1a,+    0x1a6a939f, 0x33e50f6, 0xd665ed4, 0xb4b7bd6, 0x1e5a3799, 0x6b33847, 0x17fa56ff, 0x65ef930, 0x21dc4a,+    0x2b37659, 0x450fe17, 0xb357b65, 0xdf5efac, 0x15397bef, 0x9d35a7f, 0x112ac15f, 0x624e62e, 0xa90ae2f,+    0x107eecd2, 0x1f69bbe, 0x77d6bce, 0x5741394, 0x13c684fc, 0x950c910, 0x725522b, 0xdc78583, 0x40eeabb,+    0x1fde328a, 0xbd61d96, 0xd28c387, 0x9e77d89, 0x12550c40, 0x759cb7d, 0x367ef34, 0xae2a960, 0x91b8bdc,+    0x93462a9, 0xf469ef, 0xb2e9aef, 0xd2ca771, 0x54e1f42, 0x7aaa49, 0x6316abb, 0x2413c8e, 0x5425bf9,+    0x1bed3e3a, 0xf272274, 0x1f5e7326, 0x6416517, 0xea27072, 0x9cedea7, 0x6e7633, 0x7c91952, 0xd806dce,+    0x8e2a7e1, 0xe421e1a, 0x418c9e1, 0x1dbc890, 0x1b395c36, 0xa1dc175, 0x1dc4ef73, 0x8956f34, 0xe4b5cf2,+    0x1b0d3a18, 0x3194a36, 0x6c2641f, 0xe44124c, 0xa2f4eaa, 0xa8c25ba, 0xf927ed7, 0x627b614, 0x7371cca,+    0xba16694, 0x417bc03, 0x7c0a7e3, 0x9c35c19, 0x1168a205, 0x8b6b00d, 0x10e3edc9, 0x9c19bf2, 0x5882229,+    0x1b2b4162, 0xa5cef1a, 0x1543622b, 0x9bd433e, 0x364e04d, 0x7480792, 0x5c9b5b3, 0xe85ff25, 0x408ef57,+    0x1814cfa4, 0x121b41b, 0xd248a0f, 0x3b05222, 0x39bb16a, 0xc75966d, 0xa038113, 0xa4a1769, 0x11fbc6c,+    0x917e50e, 0xeec3da8, 0x169d6eac, 0x10c1699, 0xa416153, 0xf724912, 0x15cd60b7, 0x4acbad9, 0x5efc5fa,+    0xf150ed7, 0x122b51, 0x1104b40a, 0xcb7f442, 0xfbb28ff, 0x6ac53ca, 0x196142cc, 0x7bf0fa9, 0x957651,+    0x4e0f215, 0xed439f8, 0x3f46bd5, 0x5ace82f, 0x110916b6, 0x6db078, 0xffd7d57, 0xf2ecaac, 0xca86dec,+    0x15d6b2da, 0x965ecc9, 0x1c92b4c2, 0x1f3811, 0x1cb080f5, 0x2d8b804, 0x19d1c12d, 0xf20bd46, 0x1951fa7,+    0xa3656c3, 0x523a425, 0xfcd0692, 0xd44ddc8, 0x131f0f5b, 0xaf80e4a, 0xcd9fc74, 0x99bb618, 0x2db944c,+    0xa673090, 0x1c210e1, 0x178c8d23, 0x1474383, 0x10b8743d, 0x985a55b, 0x2e74779, 0x576138, 0x9587927,+    0x133130fa, 0xbe05516, 0x9f4d619, 0xbb62570, 0x99ec591, 0xd9468fe, 0x1d07782d, 0xfc72e0b, 0x701b298,+    0x1863863b, 0x85954b8, 0x121a0c36, 0x9e7fedf, 0xf64b429, 0x9b9d71e, 0x14e2f5d8, 0xf858d3a, 0x942eea8,+    0xda5b765, 0x6edafff, 0xa9d18cc, 0xc65e4ba, 0x1c747e86, 0xe4ea915, 0x1981d7a1, 0x8395659, 0x52ed4e2,+    0x87d43b7, 0x37ab11b, 0x19d292ce, 0xf8d4692, 0x18c3053f, 0x8863e13, 0x4c146c0, 0x6bdf55a, 0x4e4457d,+    0x16152289, 0xac78ec2, 0x1a59c5a2, 0x2028b97, 0x71c2d01, 0x295851f, 0x404747b, 0x878558d, 0x7d29aa4,+    0x13d8341f, 0x8daefd7, 0x139c972d, 0x6b7ea75, 0xd4a9dde, 0xff163d8, 0x81d55d7, 0xa5bef68, 0xb7b30d8,+    0xbe73d6f, 0xaa88141, 0xd976c81, 0x7e7a9cc, 0x18beb771, 0xd773cbd, 0x13f51951, 0x9d0c177, 0x1c49a78,+};+++/* Field element operations: */++/* NON_ZERO_TO_ALL_ONES returns:+ *   0xffffffff for 0 < x <= 2**31+ *   0 for x == 0 or x > 2**31.+ *+ * x must be a u32 or an equivalent type such as limb. */+#define NON_ZERO_TO_ALL_ONES(x) ((((u32)(x) - 1) >> 31) - 1)++/* felem_reduce_carry adds a multiple of p in order to cancel |carry|,+ * which is a term at 2**257.+ *+ * On entry: carry < 2**3, inout[0,2,...] < 2**29, inout[1,3,...] < 2**28.+ * On exit: inout[0,2,..] < 2**30, inout[1,3,...] < 2**29. */+static void felem_reduce_carry(felem inout, limb carry) {+  const u32 carry_mask = NON_ZERO_TO_ALL_ONES(carry);++  inout[0] += carry << 1;+  inout[3] += 0x10000000 & carry_mask;+  /* carry < 2**3 thus (carry << 11) < 2**14 and we added 2**28 in the+   * previous line therefore this doesn't underflow. */+  inout[3] -= carry << 11;+  inout[4] += (0x20000000 - 1) & carry_mask;+  inout[5] += (0x10000000 - 1) & carry_mask;+  inout[6] += (0x20000000 - 1) & carry_mask;+  inout[6] -= carry << 22;+  /* This may underflow if carry is non-zero but, if so, we'll fix it in the+   * next line. */+  inout[7] -= 1 & carry_mask;+  inout[7] += carry << 25;+}++/* felem_sum sets out = in+in2.+ *+ * On entry, in[i]+in2[i] must not overflow a 32-bit word.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */+static void felem_sum(felem out, const felem in, const felem in2) {+  limb carry = 0;+  unsigned i;++  for (i = 0;; i++) {+    out[i] = in[i] + in2[i];+    out[i] += carry;+    carry = out[i] >> 29;+    out[i] &= kBottom29Bits;++    i++;+    if (i == NLIMBS)+      break;++    out[i] = in[i] + in2[i];+    out[i] += carry;+    carry = out[i] >> 28;+    out[i] &= kBottom28Bits;+  }++  felem_reduce_carry(out, carry);+}++#define two31m3 (((limb)1) << 31) - (((limb)1) << 3)+#define two30m2 (((limb)1) << 30) - (((limb)1) << 2)+#define two30p13m2 (((limb)1) << 30) + (((limb)1) << 13) - (((limb)1) << 2)+#define two31m2 (((limb)1) << 31) - (((limb)1) << 2)+#define two31p24m2 (((limb)1) << 31) + (((limb)1) << 24) - (((limb)1) << 2)+#define two30m27m2 (((limb)1) << 30) - (((limb)1) << 27) - (((limb)1) << 2)++/* zero31 is 0 mod p. */+static const felem zero31 = { two31m3, two30m2, two31m2, two30p13m2, two31m2, two30m2, two31p24m2, two30m27m2, two31m2 };++/* felem_diff sets out = in-in2.+ *+ * On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and+ *           in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_diff(felem out, const felem in, const felem in2) {+  limb carry = 0;+  unsigned i;++   for (i = 0;; i++) {+    out[i] = in[i] - in2[i];+    out[i] += zero31[i];+    out[i] += carry;+    carry = out[i] >> 29;+    out[i] &= kBottom29Bits;++    i++;+    if (i == NLIMBS)+      break;++    out[i] = in[i] - in2[i];+    out[i] += zero31[i];+    out[i] += carry;+    carry = out[i] >> 28;+    out[i] &= kBottom28Bits;+  }++  felem_reduce_carry(out, carry);+}++/* felem_reduce_degree sets out = tmp/R mod p where tmp contains 64-bit words+ * with the same 29,28,... bit positions as an felem.+ *+ * The values in felems are in Montgomery form: x*R mod p where R = 2**257.+ * Since we just multiplied two Montgomery values together, the result is+ * x*y*R*R mod p. We wish to divide by R in order for the result also to be+ * in Montgomery form.+ *+ * On entry: tmp[i] < 2**64+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29 */+static void felem_reduce_degree(felem out, u64 tmp[17]) {+   /* The following table may be helpful when reading this code:+    *+    * Limb number:   0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10...+    * Width (bits):  29| 28| 29| 28| 29| 28| 29| 28| 29| 28| 29+    * Start bit:     0 | 29| 57| 86|114|143|171|200|228|257|285+    *   (odd phase): 0 | 28| 57| 85|114|142|171|199|228|256|285 */+  limb tmp2[18], carry, x, xMask;+  unsigned i;++  /* tmp contains 64-bit words with the same 29,28,29-bit positions as an+   * felem. So the top of an element of tmp might overlap with another+   * element two positions down. The following loop eliminates this+   * overlap. */+  tmp2[0] = (limb)(tmp[0] & kBottom29Bits);++  /* In the following we use "(limb) tmp[x]" and "(limb) (tmp[x]>>32)" to try+   * and hint to the compiler that it can do a single-word shift by selecting+   * the right register rather than doing a double-word shift and truncating+   * afterwards. */+  tmp2[1] = ((limb) tmp[0]) >> 29;+  tmp2[1] |= (((limb)(tmp[0] >> 32)) << 3) & kBottom28Bits;+  tmp2[1] += ((limb) tmp[1]) & kBottom28Bits;+  carry = tmp2[1] >> 28;+  tmp2[1] &= kBottom28Bits;++  for (i = 2; i < 17; i++) {+    tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;+    tmp2[i] += ((limb)(tmp[i - 1])) >> 28;+    tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 4) & kBottom29Bits;+    tmp2[i] += ((limb) tmp[i]) & kBottom29Bits;+    tmp2[i] += carry;+    carry = tmp2[i] >> 29;+    tmp2[i] &= kBottom29Bits;++    i++;+    if (i == 17)+      break;+    tmp2[i] = ((limb)(tmp[i - 2] >> 32)) >> 25;+    tmp2[i] += ((limb)(tmp[i - 1])) >> 29;+    tmp2[i] += (((limb)(tmp[i - 1] >> 32)) << 3) & kBottom28Bits;+    tmp2[i] += ((limb) tmp[i]) & kBottom28Bits;+    tmp2[i] += carry;+    carry = tmp2[i] >> 28;+    tmp2[i] &= kBottom28Bits;+  }++  tmp2[17] = ((limb)(tmp[15] >> 32)) >> 25;+  tmp2[17] += ((limb)(tmp[16])) >> 29;+  tmp2[17] += (((limb)(tmp[16] >> 32)) << 3);+  tmp2[17] += carry;++  /* Montgomery elimination of terms.+   *+   * Since R is 2**257, we can divide by R with a bitwise shift if we can+   * ensure that the right-most 257 bits are all zero. We can make that true by+   * adding multiplies of p without affecting the value.+   *+   * So we eliminate limbs from right to left. Since the bottom 29 bits of p+   * are all ones, then by adding tmp2[0]*p to tmp2 we'll make tmp2[0] == 0.+   * We can do that for 8 further limbs and then right shift to eliminate the+   * extra factor of R. */+  for (i = 0;; i += 2) {+    tmp2[i + 1] += tmp2[i] >> 29;+    x = tmp2[i] & kBottom29Bits;+    xMask = NON_ZERO_TO_ALL_ONES(x);+    tmp2[i] = 0;++    /* The bounds calculations for this loop are tricky. Each iteration of+     * the loop eliminates two words by adding values to words to their+     * right.+     *+     * The following table contains the amounts added to each word (as an+     * offset from the value of i at the top of the loop). The amounts are+     * accounted for from the first and second half of the loop separately+     * and are written as, for example, 28 to mean a value <2**28.+     *+     * Word:                   3   4   5   6   7   8   9   10+     * Added in top half:     28  11      29  21  29  28+     *                                        28  29+     *                                            29+     * Added in bottom half:      29  10      28  21  28   28+     *                                            29+     *+     * The value that is currently offset 7 will be offset 5 for the next+     * iteration and then offset 3 for the iteration after that. Therefore+     * the total value added will be the values added at 7, 5 and 3.+     *+     * The following table accumulates these values. The sums at the bottom+     * are written as, for example, 29+28, to mean a value < 2**29+2**28.+     *+     * Word:                   3   4   5   6   7   8   9  10  11  12  13+     *                        28  11  10  29  21  29  28  28  28  28  28+     *                            29  28  11  28  29  28  29  28  29  28+     *                                    29  28  21  21  29  21  29  21+     *                                        10  29  28  21  28  21  28+     *                                        28  29  28  29  28  29  28+     *                                            11  10  29  10  29  10+     *                                            29  28  11  28  11+     *                                                    29      29+     *                        --------------------------------------------+     *                                                30+ 31+ 30+ 31+ 30++     *                                                28+ 29+ 28+ 29+ 21++     *                                                21+ 28+ 21+ 28+ 10+     *                                                10  21+ 10  21++     *                                                    11      11+     *+     * So the greatest amount is added to tmp2[10] and tmp2[12]. If+     * tmp2[10/12] has an initial value of <2**29, then the maximum value+     * will be < 2**31 + 2**30 + 2**28 + 2**21 + 2**11, which is < 2**32,+     * as required. */+    tmp2[i + 3] += (x << 10) & kBottom28Bits;+    tmp2[i + 4] += (x >> 18);++    tmp2[i + 6] += (x << 21) & kBottom29Bits;+    tmp2[i + 7] += x >> 8;++    /* At position 200, which is the starting bit position for word 7, we+     * have a factor of 0xf000000 = 2**28 - 2**24. */+    tmp2[i + 7] += 0x10000000 & xMask;+    /* Word 7 is 28 bits wide, so the 2**28 term exactly hits word 8. */+    tmp2[i + 8] += (x - 1) & xMask;+    tmp2[i + 7] -= (x << 24) & kBottom28Bits;+    tmp2[i + 8] -= x >> 4;++    tmp2[i + 8] += 0x20000000 & xMask;+    tmp2[i + 8] -= x;+    tmp2[i + 8] += (x << 28) & kBottom29Bits;+    tmp2[i + 9] += ((x >> 1) - 1) & xMask;++    if (i+1 == NLIMBS)+      break;+    tmp2[i + 2] += tmp2[i + 1] >> 28;+    x = tmp2[i + 1] & kBottom28Bits;+    xMask = NON_ZERO_TO_ALL_ONES(x);+    tmp2[i + 1] = 0;++    tmp2[i + 4] += (x << 11) & kBottom29Bits;+    tmp2[i + 5] += (x >> 18);++    tmp2[i + 7] += (x << 21) & kBottom28Bits;+    tmp2[i + 8] += x >> 7;++    /* At position 199, which is the starting bit of the 8th word when+     * dealing with a context starting on an odd word, we have a factor of+     * 0x1e000000 = 2**29 - 2**25. Since we have not updated i, the 8th+     * word from i+1 is i+8. */+    tmp2[i + 8] += 0x20000000 & xMask;+    tmp2[i + 9] += (x - 1) & xMask;+    tmp2[i + 8] -= (x << 25) & kBottom29Bits;+    tmp2[i + 9] -= x >> 4;++    tmp2[i + 9] += 0x10000000 & xMask;+    tmp2[i + 9] -= x;+    tmp2[i + 10] += (x - 1) & xMask;+  }++  /* We merge the right shift with a carry chain. The words above 2**257 have+   * widths of 28,29,... which we need to correct when copying them down.  */+  carry = 0;+  for (i = 0; i < 8; i++) {+    /* The maximum value of tmp2[i + 9] occurs on the first iteration and+     * is < 2**30+2**29+2**28. Adding 2**29 (from tmp2[i + 10]) is+     * therefore safe. */+    out[i] = tmp2[i + 9];+    out[i] += carry;+    out[i] += (tmp2[i + 10] << 28) & kBottom29Bits;+    carry = out[i] >> 29;+    out[i] &= kBottom29Bits;++    i++;+    out[i] = tmp2[i + 9] >> 1;+    out[i] += carry;+    carry = out[i] >> 28;+    out[i] &= kBottom28Bits;+  }++  out[8] = tmp2[17];+  out[8] += carry;+  carry = out[8] >> 29;+  out[8] &= kBottom29Bits;++  felem_reduce_carry(out, carry);+}++/* felem_square sets out=in*in.+ *+ * On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_square(felem out, const felem in) {+  u64 tmp[17];++  tmp[0] = ((u64) in[0]) * in[0];+  tmp[1] = ((u64) in[0]) * (in[1] << 1);+  tmp[2] = ((u64) in[0]) * (in[2] << 1) ++           ((u64) in[1]) * (in[1] << 1);+  tmp[3] = ((u64) in[0]) * (in[3] << 1) ++           ((u64) in[1]) * (in[2] << 1);+  tmp[4] = ((u64) in[0]) * (in[4] << 1) ++           ((u64) in[1]) * (in[3] << 2) + ((u64) in[2]) * in[2];+  tmp[5] = ((u64) in[0]) * (in[5] << 1) + ((u64) in[1]) *+           (in[4] << 1) + ((u64) in[2]) * (in[3] << 1);+  tmp[6] = ((u64) in[0]) * (in[6] << 1) + ((u64) in[1]) *+           (in[5] << 2) + ((u64) in[2]) * (in[4] << 1) ++           ((u64) in[3]) * (in[3] << 1);+  tmp[7] = ((u64) in[0]) * (in[7] << 1) + ((u64) in[1]) *+           (in[6] << 1) + ((u64) in[2]) * (in[5] << 1) ++           ((u64) in[3]) * (in[4] << 1);+  /* tmp[8] has the greatest value of 2**61 + 2**60 + 2**61 + 2**60 + 2**60,+   * which is < 2**64 as required. */+  tmp[8] = ((u64) in[0]) * (in[8] << 1) + ((u64) in[1]) *+           (in[7] << 2) + ((u64) in[2]) * (in[6] << 1) ++           ((u64) in[3]) * (in[5] << 2) + ((u64) in[4]) * in[4];+  tmp[9] = ((u64) in[1]) * (in[8] << 1) + ((u64) in[2]) *+           (in[7] << 1) + ((u64) in[3]) * (in[6] << 1) ++           ((u64) in[4]) * (in[5] << 1);+  tmp[10] = ((u64) in[2]) * (in[8] << 1) + ((u64) in[3]) *+            (in[7] << 2) + ((u64) in[4]) * (in[6] << 1) ++            ((u64) in[5]) * (in[5] << 1);+  tmp[11] = ((u64) in[3]) * (in[8] << 1) + ((u64) in[4]) *+            (in[7] << 1) + ((u64) in[5]) * (in[6] << 1);+  tmp[12] = ((u64) in[4]) * (in[8] << 1) ++            ((u64) in[5]) * (in[7] << 2) + ((u64) in[6]) * in[6];+  tmp[13] = ((u64) in[5]) * (in[8] << 1) ++            ((u64) in[6]) * (in[7] << 1);+  tmp[14] = ((u64) in[6]) * (in[8] << 1) ++            ((u64) in[7]) * (in[7] << 1);+  tmp[15] = ((u64) in[7]) * (in[8] << 1);+  tmp[16] = ((u64) in[8]) * in[8];++  felem_reduce_degree(out, tmp);+}++/* felem_mul sets out=in*in2.+ *+ * On entry: in[0,2,...] < 2**30, in[1,3,...] < 2**29 and+ *           in2[0,2,...] < 2**30, in2[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_mul(felem out, const felem in, const felem in2) {+  u64 tmp[17];++  tmp[0] = ((u64) in[0]) * in2[0];+  tmp[1] = ((u64) in[0]) * (in2[1] << 0) ++           ((u64) in[1]) * (in2[0] << 0);+  tmp[2] = ((u64) in[0]) * (in2[2] << 0) + ((u64) in[1]) *+           (in2[1] << 1) + ((u64) in[2]) * (in2[0] << 0);+  tmp[3] = ((u64) in[0]) * (in2[3] << 0) + ((u64) in[1]) *+           (in2[2] << 0) + ((u64) in[2]) * (in2[1] << 0) ++           ((u64) in[3]) * (in2[0] << 0);+  tmp[4] = ((u64) in[0]) * (in2[4] << 0) + ((u64) in[1]) *+           (in2[3] << 1) + ((u64) in[2]) * (in2[2] << 0) ++           ((u64) in[3]) * (in2[1] << 1) ++           ((u64) in[4]) * (in2[0] << 0);+  tmp[5] = ((u64) in[0]) * (in2[5] << 0) + ((u64) in[1]) *+           (in2[4] << 0) + ((u64) in[2]) * (in2[3] << 0) ++           ((u64) in[3]) * (in2[2] << 0) + ((u64) in[4]) *+           (in2[1] << 0) + ((u64) in[5]) * (in2[0] << 0);+  tmp[6] = ((u64) in[0]) * (in2[6] << 0) + ((u64) in[1]) *+           (in2[5] << 1) + ((u64) in[2]) * (in2[4] << 0) ++           ((u64) in[3]) * (in2[3] << 1) + ((u64) in[4]) *+           (in2[2] << 0) + ((u64) in[5]) * (in2[1] << 1) ++           ((u64) in[6]) * (in2[0] << 0);+  tmp[7] = ((u64) in[0]) * (in2[7] << 0) + ((u64) in[1]) *+           (in2[6] << 0) + ((u64) in[2]) * (in2[5] << 0) ++           ((u64) in[3]) * (in2[4] << 0) + ((u64) in[4]) *+           (in2[3] << 0) + ((u64) in[5]) * (in2[2] << 0) ++           ((u64) in[6]) * (in2[1] << 0) ++           ((u64) in[7]) * (in2[0] << 0);+  /* tmp[8] has the greatest value but doesn't overflow. See logic in+   * felem_square. */+  tmp[8] = ((u64) in[0]) * (in2[8] << 0) + ((u64) in[1]) *+           (in2[7] << 1) + ((u64) in[2]) * (in2[6] << 0) ++           ((u64) in[3]) * (in2[5] << 1) + ((u64) in[4]) *+           (in2[4] << 0) + ((u64) in[5]) * (in2[3] << 1) ++           ((u64) in[6]) * (in2[2] << 0) + ((u64) in[7]) *+           (in2[1] << 1) + ((u64) in[8]) * (in2[0] << 0);+  tmp[9] = ((u64) in[1]) * (in2[8] << 0) + ((u64) in[2]) *+           (in2[7] << 0) + ((u64) in[3]) * (in2[6] << 0) ++           ((u64) in[4]) * (in2[5] << 0) + ((u64) in[5]) *+           (in2[4] << 0) + ((u64) in[6]) * (in2[3] << 0) ++           ((u64) in[7]) * (in2[2] << 0) ++           ((u64) in[8]) * (in2[1] << 0);+  tmp[10] = ((u64) in[2]) * (in2[8] << 0) + ((u64) in[3]) *+            (in2[7] << 1) + ((u64) in[4]) * (in2[6] << 0) ++            ((u64) in[5]) * (in2[5] << 1) + ((u64) in[6]) *+            (in2[4] << 0) + ((u64) in[7]) * (in2[3] << 1) ++            ((u64) in[8]) * (in2[2] << 0);+  tmp[11] = ((u64) in[3]) * (in2[8] << 0) + ((u64) in[4]) *+            (in2[7] << 0) + ((u64) in[5]) * (in2[6] << 0) ++            ((u64) in[6]) * (in2[5] << 0) + ((u64) in[7]) *+            (in2[4] << 0) + ((u64) in[8]) * (in2[3] << 0);+  tmp[12] = ((u64) in[4]) * (in2[8] << 0) + ((u64) in[5]) *+            (in2[7] << 1) + ((u64) in[6]) * (in2[6] << 0) ++            ((u64) in[7]) * (in2[5] << 1) ++            ((u64) in[8]) * (in2[4] << 0);+  tmp[13] = ((u64) in[5]) * (in2[8] << 0) + ((u64) in[6]) *+            (in2[7] << 0) + ((u64) in[7]) * (in2[6] << 0) ++            ((u64) in[8]) * (in2[5] << 0);+  tmp[14] = ((u64) in[6]) * (in2[8] << 0) + ((u64) in[7]) *+            (in2[7] << 1) + ((u64) in[8]) * (in2[6] << 0);+  tmp[15] = ((u64) in[7]) * (in2[8] << 0) ++            ((u64) in[8]) * (in2[7] << 0);+  tmp[16] = ((u64) in[8]) * (in2[8] << 0);++  felem_reduce_degree(out, tmp);+}++static void felem_assign(felem out, const felem in) {+  memcpy(out, in, sizeof(felem));+}++/* felem_inv calculates |out| = |in|^{-1}+ *+ * Based on Fermat's Little Theorem:+ *   a^p = a (mod p)+ *   a^{p-1} = 1 (mod p)+ *   a^{p-2} = a^{-1} (mod p)+ */+static void felem_inv(felem out, const felem in) {+  felem ftmp, ftmp2;+  /* each e_I will hold |in|^{2^I - 1} */+  felem e2, e4, e8, e16, e32, e64;+  unsigned i;++  felem_square(ftmp, in); /* 2^1 */+  felem_mul(ftmp, in, ftmp); /* 2^2 - 2^0 */+  felem_assign(e2, ftmp);+  felem_square(ftmp, ftmp); /* 2^3 - 2^1 */+  felem_square(ftmp, ftmp); /* 2^4 - 2^2 */+  felem_mul(ftmp, ftmp, e2); /* 2^4 - 2^0 */+  felem_assign(e4, ftmp);+  felem_square(ftmp, ftmp); /* 2^5 - 2^1 */+  felem_square(ftmp, ftmp); /* 2^6 - 2^2 */+  felem_square(ftmp, ftmp); /* 2^7 - 2^3 */+  felem_square(ftmp, ftmp); /* 2^8 - 2^4 */+  felem_mul(ftmp, ftmp, e4); /* 2^8 - 2^0 */+  felem_assign(e8, ftmp);+  for (i = 0; i < 8; i++) {+    felem_square(ftmp, ftmp);+  } /* 2^16 - 2^8 */+  felem_mul(ftmp, ftmp, e8); /* 2^16 - 2^0 */+  felem_assign(e16, ftmp);+  for (i = 0; i < 16; i++) {+    felem_square(ftmp, ftmp);+  } /* 2^32 - 2^16 */+  felem_mul(ftmp, ftmp, e16); /* 2^32 - 2^0 */+  felem_assign(e32, ftmp);+  for (i = 0; i < 32; i++) {+    felem_square(ftmp, ftmp);+  } /* 2^64 - 2^32 */+  felem_assign(e64, ftmp);+  felem_mul(ftmp, ftmp, in); /* 2^64 - 2^32 + 2^0 */+  for (i = 0; i < 192; i++) {+    felem_square(ftmp, ftmp);+  } /* 2^256 - 2^224 + 2^192 */++  felem_mul(ftmp2, e64, e32); /* 2^64 - 2^0 */+  for (i = 0; i < 16; i++) {+    felem_square(ftmp2, ftmp2);+  } /* 2^80 - 2^16 */+  felem_mul(ftmp2, ftmp2, e16); /* 2^80 - 2^0 */+  for (i = 0; i < 8; i++) {+    felem_square(ftmp2, ftmp2);+  } /* 2^88 - 2^8 */+  felem_mul(ftmp2, ftmp2, e8); /* 2^88 - 2^0 */+  for (i = 0; i < 4; i++) {+    felem_square(ftmp2, ftmp2);+  } /* 2^92 - 2^4 */+  felem_mul(ftmp2, ftmp2, e4); /* 2^92 - 2^0 */+  felem_square(ftmp2, ftmp2); /* 2^93 - 2^1 */+  felem_square(ftmp2, ftmp2); /* 2^94 - 2^2 */+  felem_mul(ftmp2, ftmp2, e2); /* 2^94 - 2^0 */+  felem_square(ftmp2, ftmp2); /* 2^95 - 2^1 */+  felem_square(ftmp2, ftmp2); /* 2^96 - 2^2 */+  felem_mul(ftmp2, ftmp2, in); /* 2^96 - 3 */++  felem_mul(out, ftmp2, ftmp); /* 2^256 - 2^224 + 2^192 + 2^96 - 3 */+}++/* felem_scalar_3 sets out=3*out.+ *+ * On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_scalar_3(felem out) {+  limb carry = 0;+  unsigned i;++  for (i = 0;; i++) {+    out[i] *= 3;+    out[i] += carry;+    carry = out[i] >> 29;+    out[i] &= kBottom29Bits;++    i++;+    if (i == NLIMBS)+      break;++    out[i] *= 3;+    out[i] += carry;+    carry = out[i] >> 28;+    out[i] &= kBottom28Bits;+  }++  felem_reduce_carry(out, carry);+}++/* felem_scalar_4 sets out=4*out.+ *+ * On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_scalar_4(felem out) {+  limb carry = 0, next_carry;+  unsigned i;++  for (i = 0;; i++) {+    next_carry = out[i] >> 27;+    out[i] <<= 2;+    out[i] &= kBottom29Bits;+    out[i] += carry;+    carry = next_carry + (out[i] >> 29);+    out[i] &= kBottom29Bits;++    i++;+    if (i == NLIMBS)+      break;++    next_carry = out[i] >> 26;+    out[i] <<= 2;+    out[i] &= kBottom28Bits;+    out[i] += carry;+    carry = next_carry + (out[i] >> 28);+    out[i] &= kBottom28Bits;+  }++  felem_reduce_carry(out, carry);+}++/* felem_scalar_8 sets out=8*out.+ *+ * On entry: out[0,2,...] < 2**30, out[1,3,...] < 2**29.+ * On exit: out[0,2,...] < 2**30, out[1,3,...] < 2**29. */+static void felem_scalar_8(felem out) {+  limb carry = 0, next_carry;+  unsigned i;++  for (i = 0;; i++) {+    next_carry = out[i] >> 26;+    out[i] <<= 3;+    out[i] &= kBottom29Bits;+    out[i] += carry;+    carry = next_carry + (out[i] >> 29);+    out[i] &= kBottom29Bits;++    i++;+    if (i == NLIMBS)+      break;++    next_carry = out[i] >> 25;+    out[i] <<= 3;+    out[i] &= kBottom28Bits;+    out[i] += carry;+    carry = next_carry + (out[i] >> 28);+    out[i] &= kBottom28Bits;+  }++  felem_reduce_carry(out, carry);+}++/* felem_is_zero_vartime returns 1 iff |in| == 0. It takes a variable amount of+ * time depending on the value of |in|. */+static char felem_is_zero_vartime(const felem in) {+  limb carry;+  int i;+  limb tmp[NLIMBS];++  felem_assign(tmp, in);++  /* First, reduce tmp to a minimal form. */+  do {+    carry = 0;+    for (i = 0;; i++) {+      tmp[i] += carry;+      carry = tmp[i] >> 29;+      tmp[i] &= kBottom29Bits;++      i++;+      if (i == NLIMBS)+        break;++      tmp[i] += carry;+      carry = tmp[i] >> 28;+      tmp[i] &= kBottom28Bits;+    }++    felem_reduce_carry(tmp, carry);+  } while (carry);++  /* tmp < 2**257, so the only possible zero values are 0, p and 2p. */+  return memcmp(tmp, kZero, sizeof(tmp)) == 0 ||+         memcmp(tmp, kP, sizeof(tmp)) == 0 ||+         memcmp(tmp, k2P, sizeof(tmp)) == 0;+}+++/* Group operations:+ *+ * Elements of the elliptic curve group are represented in Jacobian+ * coordinates: (x, y, z). An affine point (x', y') is x'=x/z**2, y'=y/z**3 in+ * Jacobian form. */++/* point_double sets {x_out,y_out,z_out} = 2*{x,y,z}.+ *+ * See http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l */+static void point_double(felem x_out, felem y_out, felem z_out, const felem x,+                         const felem y, const felem z) {+  felem delta, gamma, alpha, beta, tmp, tmp2;++  felem_square(delta, z);+  felem_square(gamma, y);+  felem_mul(beta, x, gamma);++  felem_sum(tmp, x, delta);+  felem_diff(tmp2, x, delta);+  felem_mul(alpha, tmp, tmp2);+  felem_scalar_3(alpha);++  felem_sum(tmp, y, z);+  felem_square(tmp, tmp);+  felem_diff(tmp, tmp, gamma);+  felem_diff(z_out, tmp, delta);++  felem_scalar_4(beta);+  felem_square(x_out, alpha);+  felem_diff(x_out, x_out, beta);+  felem_diff(x_out, x_out, beta);++  felem_diff(tmp, beta, x_out);+  felem_mul(tmp, alpha, tmp);+  felem_square(tmp2, gamma);+  felem_scalar_8(tmp2);+  felem_diff(y_out, tmp, tmp2);+}++/* point_add_mixed sets {x_out,y_out,z_out} = {x1,y1,z1} + {x2,y2,1}.+ * (i.e. the second point is affine.)+ *+ * See http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl+ *+ * Note that this function does not handle P+P, infinity+P nor P+infinity+ * correctly. */+static void point_add_mixed(felem x_out, felem y_out, felem z_out,+                            const felem x1, const felem y1, const felem z1,+                            const felem x2, const felem y2) {+  felem z1z1, z1z1z1, s2, u2, h, i, j, r, rr, v, tmp;++  felem_square(z1z1, z1);+  felem_sum(tmp, z1, z1);++  felem_mul(u2, x2, z1z1);+  felem_mul(z1z1z1, z1, z1z1);+  felem_mul(s2, y2, z1z1z1);+  felem_diff(h, u2, x1);+  felem_sum(i, h, h);+  felem_square(i, i);+  felem_mul(j, h, i);+  felem_diff(r, s2, y1);+  felem_sum(r, r, r);+  felem_mul(v, x1, i);++  felem_mul(z_out, tmp, h);+  felem_square(rr, r);+  felem_diff(x_out, rr, j);+  felem_diff(x_out, x_out, v);+  felem_diff(x_out, x_out, v);++  felem_diff(tmp, v, x_out);+  felem_mul(y_out, tmp, r);+  felem_mul(tmp, y1, j);+  felem_diff(y_out, y_out, tmp);+  felem_diff(y_out, y_out, tmp);+}++/* point_add sets {x_out,y_out,z_out} = {x1,y1,z1} + {x2,y2,z2}.+ *+ * See http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl+ *+ * Note that this function does not handle P+P, infinity+P nor P+infinity+ * correctly. */+static void point_add(felem x_out, felem y_out, felem z_out, const felem x1,+                      const felem y1, const felem z1, const felem x2,+                      const felem y2, const felem z2) {+  felem z1z1, z1z1z1, z2z2, z2z2z2, s1, s2, u1, u2, h, i, j, r, rr, v, tmp;++  felem_square(z1z1, z1);+  felem_square(z2z2, z2);+  felem_mul(u1, x1, z2z2);++  felem_sum(tmp, z1, z2);+  felem_square(tmp, tmp);+  felem_diff(tmp, tmp, z1z1);+  felem_diff(tmp, tmp, z2z2);++  felem_mul(z2z2z2, z2, z2z2);+  felem_mul(s1, y1, z2z2z2);++  felem_mul(u2, x2, z1z1);+  felem_mul(z1z1z1, z1, z1z1);+  felem_mul(s2, y2, z1z1z1);+  felem_diff(h, u2, u1);+  felem_sum(i, h, h);+  felem_square(i, i);+  felem_mul(j, h, i);+  felem_diff(r, s2, s1);+  felem_sum(r, r, r);+  felem_mul(v, u1, i);++  felem_mul(z_out, tmp, h);+  felem_square(rr, r);+  felem_diff(x_out, rr, j);+  felem_diff(x_out, x_out, v);+  felem_diff(x_out, x_out, v);++  felem_diff(tmp, v, x_out);+  felem_mul(y_out, tmp, r);+  felem_mul(tmp, s1, j);+  felem_diff(y_out, y_out, tmp);+  felem_diff(y_out, y_out, tmp);+}++/* point_add_or_double_vartime sets {x_out,y_out,z_out} = {x1,y1,z1} ++ *                                                        {x2,y2,z2}.+ *+ * See http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl+ *+ * This function handles the case where {x1,y1,z1}={x2,y2,z2}. */+static void point_add_or_double_vartime(+    felem x_out, felem y_out, felem z_out, const felem x1, const felem y1,+    const felem z1, const felem x2, const felem y2, const felem z2) {+  felem z1z1, z1z1z1, z2z2, z2z2z2, s1, s2, u1, u2, h, i, j, r, rr, v, tmp;+  char x_equal, y_equal;++  felem_square(z1z1, z1);+  felem_square(z2z2, z2);+  felem_mul(u1, x1, z2z2);++  felem_sum(tmp, z1, z2);+  felem_square(tmp, tmp);+  felem_diff(tmp, tmp, z1z1);+  felem_diff(tmp, tmp, z2z2);++  felem_mul(z2z2z2, z2, z2z2);+  felem_mul(s1, y1, z2z2z2);++  felem_mul(u2, x2, z1z1);+  felem_mul(z1z1z1, z1, z1z1);+  felem_mul(s2, y2, z1z1z1);+  felem_diff(h, u2, u1);+  x_equal = felem_is_zero_vartime(h);+  felem_sum(i, h, h);+  felem_square(i, i);+  felem_mul(j, h, i);+  felem_diff(r, s2, s1);+  y_equal = felem_is_zero_vartime(r);+  if (x_equal && y_equal) {+    point_double(x_out, y_out, z_out, x1, y1, z1);+    return;+  }+  felem_sum(r, r, r);+  felem_mul(v, u1, i);++  felem_mul(z_out, tmp, h);+  felem_square(rr, r);+  felem_diff(x_out, rr, j);+  felem_diff(x_out, x_out, v);+  felem_diff(x_out, x_out, v);++  felem_diff(tmp, v, x_out);+  felem_mul(y_out, tmp, r);+  felem_mul(tmp, s1, j);+  felem_diff(y_out, y_out, tmp);+  felem_diff(y_out, y_out, tmp);+}++/* copy_conditional sets out=in if mask = 0xffffffff in constant time.+ *+ * On entry: mask is either 0 or 0xffffffff. */+static void copy_conditional(felem out, const felem in, limb mask) {+  int i;++  for (i = 0; i < NLIMBS; i++) {+    const limb tmp = mask & (in[i] ^ out[i]);+    out[i] ^= tmp;+  }+}++/* select_affine_point sets {out_x,out_y} to the index'th entry of table.+ * On entry: index < 16, table[0] must be zero. */+static void select_affine_point(felem out_x, felem out_y, const limb* table,+                                limb index) {+  limb i, j;++  memset(out_x, 0, sizeof(felem));+  memset(out_y, 0, sizeof(felem));++  for (i = 1; i < 16; i++) {+    limb mask = i ^ index;+    mask |= mask >> 2;+    mask |= mask >> 1;+    mask &= 1;+    mask--;+    for (j = 0; j < NLIMBS; j++, table++) {+      out_x[j] |= *table & mask;+    }+    for (j = 0; j < NLIMBS; j++, table++) {+      out_y[j] |= *table & mask;+    }+  }+}++/* select_jacobian_point sets {out_x,out_y,out_z} to the index'th entry of+ * table. On entry: index < 16, table[0] must be zero. */+static void select_jacobian_point(felem out_x, felem out_y, felem out_z,+                                  const limb* table, limb index) {+  limb i, j;++  memset(out_x, 0, sizeof(felem));+  memset(out_y, 0, sizeof(felem));+  memset(out_z, 0, sizeof(felem));++  /* The implicit value at index 0 is all zero. We don't need to perform that+   * iteration of the loop because we already set out_* to zero. */+  table += 3 * NLIMBS;++  // Hit all entries to obscure cache profiling.+  for (i = 1; i < 16; i++) {+    limb mask = i ^ index;+    mask |= mask >> 2;+    mask |= mask >> 1;+    mask &= 1;+    mask--;+    for (j = 0; j < NLIMBS; j++, table++) {+      out_x[j] |= *table & mask;+    }+    for (j = 0; j < NLIMBS; j++, table++) {+      out_y[j] |= *table & mask;+    }+    for (j = 0; j < NLIMBS; j++, table++) {+      out_z[j] |= *table & mask;+    }+  }+}++/* scalar_base_mult sets {nx,ny,nz} = scalar*G where scalar is a little-endian+ * number. Note that the value of scalar must be less than the order of the+ * group. */+static void scalar_base_mult(felem nx, felem ny, felem nz,+                             const cryptonite_p256_int* scalar) {+  int i, j;+  limb n_is_infinity_mask = -1, p_is_noninfinite_mask, mask;+  u32 table_offset;++  felem px, py;+  felem tx, ty, tz;++  memset(nx, 0, sizeof(felem));+  memset(ny, 0, sizeof(felem));+  memset(nz, 0, sizeof(felem));++  /* The loop adds bits at positions 0, 64, 128 and 192, followed by+   * positions 32,96,160 and 224 and does this 32 times. */+  for (i = 0; i < 32; i++) {+    if (i) {+      point_double(nx, ny, nz, nx, ny, nz);+    }+    table_offset = 0;+    for (j = 0; j <= 32; j += 32) {+      char bit0 = cryptonite_p256_get_bit(scalar, 31 - i + j);+      char bit1 = cryptonite_p256_get_bit(scalar, 95 - i + j);+      char bit2 = cryptonite_p256_get_bit(scalar, 159 - i + j);+      char bit3 = cryptonite_p256_get_bit(scalar, 223 - i + j);+      limb index = bit0 | (bit1 << 1) | (bit2 << 2) | (bit3 << 3);++      select_affine_point(px, py, kPrecomputed + table_offset, index);+      table_offset += 30 * NLIMBS;++      /* Since scalar is less than the order of the group, we know that+       * {nx,ny,nz} != {px,py,1}, unless both are zero, which we handle+       * below. */+      point_add_mixed(tx, ty, tz, nx, ny, nz, px, py);+      /* The result of point_add_mixed is incorrect if {nx,ny,nz} is zero+       * (a.k.a.  the point at infinity). We handle that situation by+       * copying the point from the table. */+      copy_conditional(nx, px, n_is_infinity_mask);+      copy_conditional(ny, py, n_is_infinity_mask);+      copy_conditional(nz, kOne, n_is_infinity_mask);++      /* Equally, the result is also wrong if the point from the table is+       * zero, which happens when the index is zero. We handle that by+       * only copying from {tx,ty,tz} to {nx,ny,nz} if index != 0. */+      p_is_noninfinite_mask = NON_ZERO_TO_ALL_ONES(index);+      mask = p_is_noninfinite_mask & ~n_is_infinity_mask;+      copy_conditional(nx, tx, mask);+      copy_conditional(ny, ty, mask);+      copy_conditional(nz, tz, mask);+      /* If p was not zero, then n is now non-zero. */+      n_is_infinity_mask &= ~p_is_noninfinite_mask;+    }+  }+}++/* point_to_affine converts a Jacobian point to an affine point. If the input+ * is the point at infinity then it returns (0, 0) in constant time. */+static void point_to_affine(felem x_out, felem y_out, const felem nx,+                            const felem ny, const felem nz) {+  felem z_inv, z_inv_sq;+  felem_inv(z_inv, nz);+  felem_square(z_inv_sq, z_inv);+  felem_mul(x_out, nx, z_inv_sq);+  felem_mul(z_inv, z_inv, z_inv_sq);+  felem_mul(y_out, ny, z_inv);+}++/* scalar_base_mult sets {nx,ny,nz} = scalar*{x,y}. */+static void scalar_mult(felem nx, felem ny, felem nz, const felem x,+                        const felem y, const cryptonite_p256_int* scalar) {+  int i;+  felem px, py, pz, tx, ty, tz;+  felem precomp[16][3];+  limb n_is_infinity_mask, index, p_is_noninfinite_mask, mask;++  /* We precompute 0,1,2,... times {x,y}. */+  memset(precomp, 0, sizeof(felem) * 3);+  memcpy(&precomp[1][0], x, sizeof(felem));+  memcpy(&precomp[1][1], y, sizeof(felem));+  memcpy(&precomp[1][2], kOne, sizeof(felem));++  for (i = 2; i < 16; i += 2) {+    point_double(precomp[i][0], precomp[i][1], precomp[i][2],+                 precomp[i / 2][0], precomp[i / 2][1], precomp[i / 2][2]);++    point_add_mixed(precomp[i + 1][0], precomp[i + 1][1], precomp[i + 1][2],+                    precomp[i][0], precomp[i][1], precomp[i][2], x, y);+  }++  memset(nx, 0, sizeof(felem));+  memset(ny, 0, sizeof(felem));+  memset(nz, 0, sizeof(felem));+  n_is_infinity_mask = -1;++  /* We add in a window of four bits each iteration and do this 64 times. */+  for (i = 0; i < 256; i += 4) {+    if (i) {+      point_double(nx, ny, nz, nx, ny, nz);+      point_double(nx, ny, nz, nx, ny, nz);+      point_double(nx, ny, nz, nx, ny, nz);+      point_double(nx, ny, nz, nx, ny, nz);+    }++    index = (cryptonite_p256_get_bit(scalar, 255 - i - 0) << 3) |+            (cryptonite_p256_get_bit(scalar, 255 - i - 1) << 2) |+            (cryptonite_p256_get_bit(scalar, 255 - i - 2) << 1) |+            cryptonite_p256_get_bit(scalar, 255 - i - 3);++    /* See the comments in scalar_base_mult about handling infinities. */+    select_jacobian_point(px, py, pz, precomp[0][0], index);+    point_add(tx, ty, tz, nx, ny, nz, px, py, pz);+    copy_conditional(nx, px, n_is_infinity_mask);+    copy_conditional(ny, py, n_is_infinity_mask);+    copy_conditional(nz, pz, n_is_infinity_mask);++    p_is_noninfinite_mask = NON_ZERO_TO_ALL_ONES(index);+    mask = p_is_noninfinite_mask & ~n_is_infinity_mask;++    copy_conditional(nx, tx, mask);+    copy_conditional(ny, ty, mask);+    copy_conditional(nz, tz, mask);+    n_is_infinity_mask &= ~p_is_noninfinite_mask;+  }+}++#define kRDigits {2, 0, 0, 0xfffffffe, 0xffffffff, 0xffffffff, 0xfffffffd, 1} // 2^257 mod p256.p++#define kRInvDigits {0x80000000, 1, 0xffffffff, 0, 0x80000001, 0xfffffffe, 1, 0x7fffffff}  // 1 / 2^257 mod p256.p++static const cryptonite_p256_int kR = { kRDigits };+static const cryptonite_p256_int kRInv = { kRInvDigits };++/* to_montgomery sets out = R*in. */+static void to_montgomery(felem out, const cryptonite_p256_int* in) {+  cryptonite_p256_int in_shifted;+  int i;++  cryptonite_p256_init(&in_shifted);+  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);++  for (i = 0; i < NLIMBS; i++) {+    if ((i & 1) == 0) {+      out[i] = P256_DIGIT(&in_shifted, 0) & kBottom29Bits;+      cryptonite_p256_shr(&in_shifted, 29, &in_shifted);+    } else {+      out[i] = P256_DIGIT(&in_shifted, 0) & kBottom28Bits;+      cryptonite_p256_shr(&in_shifted, 28, &in_shifted);+    }+  }++  cryptonite_p256_clear(&in_shifted);+}++/* from_montgomery sets out=in/R. */+static void from_montgomery(cryptonite_p256_int* out, const felem in) {+  cryptonite_p256_int result, tmp;+  int i, top;++  cryptonite_p256_init(&result);+  cryptonite_p256_init(&tmp);++  cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);+  for (i = NLIMBS - 2; i >= 0; i--) {+    if ((i & 1) == 0) {+      top = cryptonite_p256_shl(&result, 29, &tmp);+    } else {+      top = cryptonite_p256_shl(&result, 28, &tmp);+    }+    top |= cryptonite_p256_add_d(&tmp, in[i], &result);+  }++  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);++  cryptonite_p256_clear(&result);+  cryptonite_p256_clear(&tmp);+}++/* cryptonite_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the+ * order of the group. */+void cryptonite_p256_base_point_mul(const cryptonite_p256_int* n, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {+  felem x, y, z;++  scalar_base_mult(x, y, z, n);++  {+    felem x_affine, y_affine;++    point_to_affine(x_affine, y_affine, x, y, z);+    from_montgomery(out_x, x_affine);+    from_montgomery(out_y, y_affine);+  }+}++/* cryptonite_p256_points_mul_vartime sets {out_x,out_y} = n1*G + n2*{in_x,in_y}, where+ * n1 and n2 are < the order of the group.+ *+ * As indicated by the name, this function operates in variable time. This+ * is safe because it's used for signature validation which doesn't deal+ * with secrets. */+void cryptonite_p256_points_mul_vartime(+    const cryptonite_p256_int* n1, const cryptonite_p256_int* n2, const cryptonite_p256_int* in_x,+    const cryptonite_p256_int* in_y, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {+  felem x1, y1, z1, x2, y2, z2, px, py;++  /* If both scalars are zero, then the result is the point at infinity. */+  if (cryptonite_p256_is_zero(n1) != 0 && cryptonite_p256_is_zero(n2) != 0) {+    cryptonite_p256_clear(out_x);+    cryptonite_p256_clear(out_y);+    return;+  }++  to_montgomery(px, in_x);+  to_montgomery(py, in_y);+  scalar_base_mult(x1, y1, z1, n1);+  scalar_mult(x2, y2, z2, px, py, n2);++  if (cryptonite_p256_is_zero(n2) != 0) {+    /* If n2 == 0, then {x2,y2,z2} is zero and the result is just+         * {x1,y1,z1}. */+  } else if (cryptonite_p256_is_zero(n1) != 0) {+    /* If n1 == 0, then {x1,y1,z1} is zero and the result is just+         * {x2,y2,z2}. */+    memcpy(x1, x2, sizeof(x2));+    memcpy(y1, y2, sizeof(y2));+    memcpy(z1, z2, sizeof(z2));+  } else {+    /* This function handles the case where {x1,y1,z1} == {x2,y2,z2}. */+    point_add_or_double_vartime(x1, y1, z1, x1, y1, z1, x2, y2, z2);+  }++  point_to_affine(px, py, x1, y1, z1);+  from_montgomery(out_x, px);+  from_montgomery(out_y, py);+}++/* this function is not part of the original source+   add 2 points together. so far untested.+   probably vartime, as it use point_add_or_double_vartime+ */+void cryptonite_p256e_point_add(+    const cryptonite_p256_int *in_x1, const cryptonite_p256_int *in_y1,+    const cryptonite_p256_int *in_x2, const cryptonite_p256_int *in_y2,+    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y)+{+    felem x1, y1, z1, x2, y2, z2, px1, py1, px2, py2;+    const cryptonite_p256_int one = P256_ONE;++    to_montgomery(px1, in_x1);+    to_montgomery(py1, in_y1);+    to_montgomery(px2, in_x2);+    to_montgomery(py2, in_y2);++    scalar_mult(x1, y1, z1, px1, py1, &one);+    scalar_mult(x2, y2, z2, px2, py2, &one);+    point_add_or_double_vartime(x1, y1, z1, x1, y1, z1, x2, y2, z2);++    point_to_affine(px1, py1, x1, y1, z1);+    from_montgomery(out_x, px1);+    from_montgomery(out_y, py1);+}
+ cryptonite.cabal view
@@ -0,0 +1,274 @@+Name:                cryptonite+Version:             0.1+Synopsis:            Cryptography Primitives sink+Description:+    A repository of cryptographic primitives.+    .+    * Symmetric ciphers: AES, DES, 3DES, Blowfish, Camellia, RC4, Salsa, ChaCha.+    .+    * Hash: SHA1, SHA2, SHA3, MD2, MD4, MD5, Kekkak, Skein, Ripemd, Tiger, Whirlpool+    .+    * MAC: HMAC, Poly1305+    .+    * Assymmetric crypto: DSA, RSA, DH, ECDH, ECDSA, ECC, Curve25519, Ed25519+    .+    * Key Derivation Function: PBKDF2, Scrypt+    .+    * Cryptographic Random generation: System Entropy, Deterministic Random Generator+    .+    * Data related: Anti-Forensic Information Splitter (AFIS)+    .+    If anything cryptographic related is missing from here, submit+    a pull request to have it added. This package strive to be a+    cryptographic kitchen sink that provides cryptography for everyone.+    .+    Evaluate the security related to your requirements before using.+License:             BSD3+License-file:        LICENSE+Copyright:           Vincent Hanquez <vincent@snarc.org>+Author:              Vincent Hanquez <vincent@snarc.org>+Maintainer:          vincent@snarc.org+Category:            Cryptography+Stability:           experimental+Build-Type:          Simple+Homepage:            https://github.com/vincenthz/cryptonite+Bug-reports:         https://github.com/vincenthz/cryptonite/issues+Cabal-Version:       >=1.10+extra-doc-files:     README.md CHANGELOG.md+extra-source-files:  cbits/*.h+                     cbits/aes/*.h+                     cbits/ed25519/*.h+                     cbits/p256/*.h+                     cbits/aes/x86ni_impl.c+                     tests/*.hs++source-repository head+  type: git+  location: https://github.com/vincenthz/cryptonite++Flag support_aesni+  Description:       allow compilation with AESNI on system and architecture that supports it+  Default:           True+  Manual:            True++Flag support_pclmuldq+  Description:       Allow compilation with pclmuldq on architecture that supports it+  Default:           False+  Manual:            True++Flag integer-gmp+  Description:       Whether or not to use GMP for some functions+  Default:           True+  Manual:            True++Flag support_deepseq+  Description:       add deepseq instances for cryptographic types+  Default:           True+  Manual:            True++Library+  Exposed-modules:   Crypto.Cipher.AES+                     Crypto.Cipher.Blowfish+                     Crypto.Cipher.Camellia+                     Crypto.Cipher.ChaCha+                     Crypto.Cipher.DES+                     Crypto.Cipher.RC4+                     Crypto.Cipher.Salsa+                     Crypto.Cipher.TripleDES+                     Crypto.Cipher.Types+                     Crypto.Data.AFIS+                     Crypto.Error+                     Crypto.MAC.Poly1305+                     Crypto.MAC.HMAC+                     Crypto.Number.Basic+                     Crypto.Number.F2m+                     Crypto.Number.Generate+                     Crypto.Number.ModArithmetic+                     Crypto.Number.Prime+                     Crypto.Number.Serialize+                     Crypto.KDF.PBKDF2+                     Crypto.KDF.Scrypt+                     Crypto.Hash+                     Crypto.Hash.IO+                     Crypto.Hash.Algorithms+                     Crypto.PubKey.Curve25519+                     Crypto.PubKey.HashDescr+                     Crypto.PubKey.MaskGenFunction+                     Crypto.PubKey.DH+                     Crypto.PubKey.DSA+                     Crypto.PubKey.ECC.Generate+                     Crypto.PubKey.ECC.Prim+                     Crypto.PubKey.ECC.DH+                     Crypto.PubKey.ECC.ECDSA+                     Crypto.PubKey.ECC.P256+                     Crypto.PubKey.ECC.Types+                     Crypto.PubKey.Ed25519+                     Crypto.PubKey.RSA+                     Crypto.PubKey.RSA.PKCS15+                     Crypto.PubKey.RSA.Prim+                     Crypto.PubKey.RSA.PSS+                     Crypto.PubKey.RSA.OAEP+                     Crypto.PubKey.RSA.Types+                     Crypto.Random+                     Crypto.Random.Types+                     Crypto.Random.Entropy+                     Crypto.Random.EntropyPool+                     Crypto.Random.Entropy.Unsafe+  Other-modules:     Crypto.Cipher.AES.Primitive+                     Crypto.Cipher.Blowfish.Box+                     Crypto.Cipher.Blowfish.Primitive+                     Crypto.Cipher.Camellia.Primitive+                     Crypto.Cipher.DES.Primitive+                     Crypto.Cipher.Types.AEAD+                     Crypto.Cipher.Types.Base+                     Crypto.Cipher.Types.Block+                     Crypto.Cipher.Types.GF+                     Crypto.Cipher.Types.Stream+                     Crypto.Cipher.Types.Utils+                     Crypto.Error.Types+                     Crypto.Number.Compat+                     Crypto.Hash.Types+                     Crypto.Hash.SHA1+                     Crypto.Hash.SHA224+                     Crypto.Hash.SHA256+                     Crypto.Hash.SHA384+                     Crypto.Hash.SHA512+                     Crypto.Hash.SHA512t+                     Crypto.Hash.SHA3+                     Crypto.Hash.Kekkak+                     Crypto.Hash.MD2+                     Crypto.Hash.MD4+                     Crypto.Hash.MD5+                     Crypto.Hash.RIPEMD160+                     Crypto.Hash.Skein256+                     Crypto.Hash.Skein512+                     Crypto.Hash.Tiger+                     Crypto.Hash.Whirlpool+                     Crypto.Random.Entropy.Source+                     Crypto.Random.Entropy.Backend+                     Crypto.Random.ChaChaDRG+                     Crypto.Random.Probabilistic+                     Crypto.PubKey.Internal+                     Crypto.PubKey.ElGamal+                     Crypto.Internal.ByteArray+                     Crypto.Internal.Compat+                     Crypto.Internal.CompatPrim+                     Crypto.Internal.DeepSeq+                     Crypto.Internal.Imports+                     Crypto.Internal.Words+                     Crypto.Internal.WordArray+  Build-depends:     base >= 4.3 && < 5+                   , bytestring+                   , memory >= 0.2+                   , ghc-prim+  ghc-options:       -Wall -fwarn-tabs -optc-O3+  default-language:  Haskell2010+  C-sources:         cbits/cryptonite_chacha.c+                   , cbits/cryptonite_salsa.c+                   , cbits/cryptonite_rc4.c+                   , cbits/cryptonite_cpu.c+                   , cbits/aes/generic.c+                   , cbits/aes/gf.c+                   , cbits/cryptonite_aes.c+                   , cbits/curve25519/curve25519-donna.c+                   , cbits/ed25519/ed25519.c+                   , cbits/p256/p256.c+                   , cbits/p256/p256_ec.c+                   , cbits/cryptonite_poly1305.c+                   , cbits/cryptonite_sha1.c+                   , cbits/cryptonite_sha256.c+                   , cbits/cryptonite_sha512.c+                   , cbits/cryptonite_sha3.c+                   , cbits/cryptonite_kekkak.c+                   , cbits/cryptonite_md2.c+                   , cbits/cryptonite_md4.c+                   , cbits/cryptonite_md5.c+                   , cbits/cryptonite_ripemd.c+                   , cbits/cryptonite_skein256.c+                   , cbits/cryptonite_skein512.c+                   , cbits/cryptonite_tiger.c+                   , cbits/cryptonite_whirlpool.c+                   , cbits/cryptonite_scrypt.c+  include-dirs:  cbits cbits/ed25519++  -- FIXME armel or mispel is also little endian.+  -- might be a good idea to also add a runtime autodetect mode.+  -- ARCH_ENDIAN_UNKNOWN+  if (arch(i386) || arch(x86_64))+    CPP-options: -DARCH_IS_LITTLE_ENDIAN++  if arch(i386)+    CPP-options: -DARCH_X86++  if arch(x86_64)+    CPP-options:    -DARCH_X86_64+    CPP-options:    -DSUPPORT_RDRAND+    Other-modules:  Crypto.Random.Entropy.RDRand+    c-sources:      cbits/cryptonite_rdrand.c++  if flag(support_aesni) && (os(linux) || os(freebsd) || os(osx)) && (arch(i386) || arch(x86_64))+    CC-options:     -mssse3 -maes -DWITH_AESNI+    if flag(support_pclmuldq)+       CC-options:  -msse4.1 -mpclmul -DWITH_PCLMUL+    C-sources:      cbits/aes/x86ni.c++  if os(windows)+    cpp-options:    -DWINDOWS+    Build-Depends:  Win32+    Other-modules:  Crypto.Random.Entropy.Windows+    extra-libraries: advapi32+  else+    Other-modules:  Crypto.Random.Entropy.Unix++  if impl(ghc) && flag(integer-gmp)+    Build-depends:   integer-gmp++  if flag(support_deepseq)+    CPP-options:     -DWITH_DEEPSEQ_SUPPORT+    Build-depends:   deepseq++Test-Suite test-cryptonite+  type:              exitcode-stdio-1.0+  hs-source-dirs:    tests+  Main-is:           Tests.hs+  Other-modules:     BlockCipher+                     ChaCha+                     Hash+                     Imports+                     KAT_AES.KATCBC+                     KAT_AES.KATECB+                     KAT_AES.KATGCM+                     KAT_AES.KATOCB3+                     KAT_AES.KATXTS+                     KAT_AES+                     KAT_AFIS+                     KAT_Blowfish+                     KAT_Camellia+                     KAT_Curve25519+                     KAT_DES+                     KAT_Ed25519+                     KAT_HMAC+                     KAT_PBKDF2+                     KAT_PubKey.DSA+                     KAT_PubKey.ECC+                     KAT_PubKey.ECDSA+                     KAT_PubKey.OAEP+                     KAT_PubKey.PSS+                     KAT_PubKey+                     KAT_RC4+                     KAT_Scrypt+                     KAT_TripleDES+                     Poly1305+                     Salsa+                     Utils+  Build-Depends:     base >= 3 && < 5+                   , bytestring+                   , memory+                   , byteable+                   , tasty+                   , tasty-quickcheck+                   , tasty-hunit+                   , tasty-kat+                   , cryptonite+  ghc-options:       -Wall -fno-warn-orphans -fno-warn-missing-signatures -rtsopts+  default-language:  Haskell2010
+ tests/BlockCipher.hs view
@@ -0,0 +1,458 @@+{-# LANGUAGE ViewPatterns #-}+module BlockCipher+    ( KAT_ECB(..)+    , KAT_CBC(..)+    , KAT_CFB(..)+    , KAT_CTR(..)+    , KAT_XTS(..)+    , KAT_AEAD(..)+    , KATs(..)+    , defaultKATs+    , testBlockCipher+    , CipherInfo+    ) where++import           Imports+import           Data.Maybe+import           Crypto.Error+import           Crypto.Cipher.Types+import           Data.ByteArray as B hiding (pack, null)+import qualified Data.ByteString as B++------------------------------------------------------------------------+-- KAT+------------------------------------------------------------------------++type BlockSize = Int+type KeySize = Int+type CipherInfo a = (BlockSize, KeySize, ByteString -> a)++instance Show (IV c) where+    show _ = "IV"++-- | ECB KAT+data KAT_ECB = KAT_ECB+    { ecbKey        :: ByteString -- ^ Key+    , ecbPlaintext  :: ByteString -- ^ Plaintext+    , ecbCiphertext :: ByteString -- ^ Ciphertext+    } deriving (Show,Eq)++-- | CBC KAT+data KAT_CBC = KAT_CBC+    { cbcKey        :: ByteString -- ^ Key+    , cbcIV         :: ByteString -- ^ IV+    , cbcPlaintext  :: ByteString -- ^ Plaintext+    , cbcCiphertext :: ByteString -- ^ Ciphertext+    } deriving (Show,Eq)++-- | CFB KAT+data KAT_CFB = KAT_CFB+    { cfbKey        :: ByteString -- ^ Key+    , cfbIV         :: ByteString -- ^ IV+    , cfbPlaintext  :: ByteString -- ^ Plaintext+    , cfbCiphertext :: ByteString -- ^ Ciphertext+    } deriving (Show,Eq)++-- | CTR KAT+data KAT_CTR = KAT_CTR+    { ctrKey        :: ByteString -- ^ Key+    , ctrIV         :: ByteString -- ^ IV (usually represented as a 128 bits integer)+    , ctrPlaintext  :: ByteString -- ^ Plaintext+    , ctrCiphertext :: ByteString -- ^ Ciphertext+    } deriving (Show,Eq)++-- | XTS KAT+data KAT_XTS = KAT_XTS+    { xtsKey1       :: ByteString -- ^ 1st XTS key+    , xtsKey2       :: ByteString -- ^ 2nd XTS key+    , xtsIV         :: ByteString -- ^ XTS IV+    , xtsPlaintext  :: ByteString -- ^ plaintext+    , xtsCiphertext :: ByteString -- ^ Ciphertext+    } deriving (Show,Eq)++-- | AEAD KAT+data KAT_AEAD = KAT_AEAD+    { aeadMode       :: AEADMode+    , aeadKey        :: ByteString -- ^ Key+    , aeadIV         :: ByteString -- ^ IV for initialization+    , aeadHeader     :: ByteString -- ^ Authentificated Header+    , aeadPlaintext  :: ByteString -- ^ Plaintext+    , aeadCiphertext :: ByteString -- ^ Ciphertext+    , aeadTaglen     :: Int        -- ^ aead tag len+    , aeadTag        :: ByteString -- ^ expected tag+    } deriving (Show,Eq)++-- | all the KATs. use defaultKATs to prevent compilation error+-- from future expansion of this data structure+data KATs = KATs+    { kat_ECB  :: [KAT_ECB]+    , kat_CBC  :: [KAT_CBC]+    , kat_CFB  :: [KAT_CFB]+    , kat_CTR  :: [KAT_CTR]+    , kat_XTS  :: [KAT_XTS]+    , kat_AEAD :: [KAT_AEAD]+    } deriving (Show,Eq)++defaultKATs = KATs [] [] [] [] [] []++{-+testECB (_, _, cipherInit) ecbEncrypt ecbDecrypt kats =+    testGroup "ECB" (concatMap katTest (zip is kats) {- ++ propTests-})+  where katTest (i,d) =+            [ testCase ("E" ++ show i) (ecbEncrypt ctx (ecbPlaintext d) @?= ecbCiphertext d)+            , testCase ("D" ++ show i) (ecbDecrypt ctx (ecbCiphertext d) @?= ecbPlaintext d)+            ]+          where ctx = cipherInit (ecbKey d)+        --propTest = testProperty "decrypt.encrypt" (ECBUnit key plaintext) =+        +        --testProperty_ECB (ECBUnit (cipherInit -> ctx) (toBytes -> plaintext)) =+        --    plaintext `assertEq` ecbDecrypt ctx (ecbEncrypt ctx plaintext)++testKatCBC cbcInit cbcEncrypt cbcDecrypt (i,d) =+    [ testCase ("E" ++ show i) (cbcEncrypt ctx iv (cbcPlaintext d) @?= cbcCiphertext d)+    , testCase ("D" ++ show i) (cbcDecrypt ctx iv (cbcCiphertext d) @?= cbcPlaintext d)+    ]+  where ctx = cbcInit $ cbcKey d+        iv  = cbcIV d++testKatCFB cfbInit cfbEncrypt cfbDecrypt (i,d) =+    [ testCase ("E" ++ show i) (cfbEncrypt ctx iv (cfbPlaintext d) @?= cfbCiphertext d)+    , testCase ("D" ++ show i) (cfbDecrypt ctx iv (cfbCiphertext d) @?= cfbPlaintext d)+    ]+  where ctx = cfbInit $ cfbKey d+        iv  = cfbIV d++testKatCTR ctrInit ctrCombine (i,d) =+    [ testCase ("E" ++ i) (ctrCombine ctx iv (ctrPlaintext d) @?= ctrCiphertext d)+    , testCase ("D" ++ i) (ctrCombine ctx iv (ctrCiphertext d) @?= ctrPlaintext d)+    ]+  where ctx = ctrInit $ ctrKey d+        iv  = ctrIV d++testKatXTS xtsInit xtsEncrypt xtsDecrypt (i,d) =+    [ testCase ("E" ++ i) (xtsEncrypt ctx iv 0 (xtsPlaintext d) @?= xtsCiphertext d)+    , testCase ("D" ++ i) (xtsDecrypt ctx iv 0 (xtsCiphertext d) @?= xtsPlaintext d)+    ]+  where ctx  = xtsInit (xtsKey1 d, xtsKey2 d)+        iv   = xtsIV d++testKatAEAD cipherInit aeadInit aeadAppendHeader aeadEncrypt aeadDecrypt aeadFinalize (i,d) =+    [ testCase ("AE" ++ i) (etag @?= aeadTag d)+    , testCase ("AD" ++ i) (dtag @?= aeadTag d)+    , testCase ("E" ++ i)  (ebs @?= aeadCiphertext d)+    , testCase ("D" ++ i)  (dbs @?= aeadPlaintext d)+    ]+  where ctx              = cipherInit $ aeadKey d+        (Just aead)      = aeadInit ctx (aeadIV d)+        aeadHeaded       = aeadAppendHeader aead (aeadHeader d)+        (ebs,aeadEFinal) = aeadEncrypt aeadHeaded (aeadPlaintext d)+        (dbs,aeadDFinal) = aeadDecrypt aeadHeaded (aeadCiphertext d)+        etag = aeadFinalize aeadEFinal (aeadTaglen d)+        dtag = aeadFinalize aeadDFinal (aeadTaglen d)+-}++testKATs :: BlockCipher cipher+         => KATs+         -> cipher+         -> TestTree+testKATs kats cipher = testGroup "KAT"+    (   maybeGroup makeECBTest "ECB" (kat_ECB kats)+     ++ maybeGroup makeCBCTest "CBC" (kat_CBC kats)+     ++ maybeGroup makeCFBTest "CFB" (kat_CFB kats)+     ++ maybeGroup makeCTRTest "CTR" (kat_CTR kats)+     -- ++ maybeGroup makeXTSTest "XTS" (kat_XTS kats)+     -- ++ maybeGroup makeAEADTest "AEAD" (kat_AEAD kats)+    )+  where makeECBTest i d =+            [ testCase ("E" ++ i) (ecbEncrypt ctx (ecbPlaintext d) @?= ecbCiphertext d)+            , testCase ("D" ++ i) (ecbDecrypt ctx (ecbCiphertext d) @?= ecbPlaintext d)+            ]+          where ctx = cipherInitNoErr (cipherMakeKey cipher $ ecbKey d)+        makeCBCTest i d =+            [ testCase ("E" ++ i) (cbcEncrypt ctx iv (cbcPlaintext d) @?= cbcCiphertext d)+            , testCase ("D" ++ i) (cbcDecrypt ctx iv (cbcCiphertext d) @?= cbcPlaintext d)+            ]+          where ctx = cipherInitNoErr (cipherMakeKey cipher $ cbcKey d)+                iv  = cipherMakeIV cipher $ cbcIV d+        makeCFBTest i d =+            [ testCase ("E" ++ i) (cfbEncrypt ctx iv (cfbPlaintext d) @?= cfbCiphertext d)+            , testCase ("D" ++ i) (cfbDecrypt ctx iv (cfbCiphertext d) @?= cfbPlaintext d)+            ]+          where ctx = cipherInitNoErr (cipherMakeKey cipher $ cfbKey d)+                iv  = cipherMakeIV cipher $ cfbIV d+        makeCTRTest i d =+            [ testCase ("E" ++ i) (ctrCombine ctx iv (ctrPlaintext d) @?= ctrCiphertext d)+            , testCase ("D" ++ i) (ctrCombine ctx iv (ctrCiphertext d) @?= ctrPlaintext d)+            ]+          where ctx = cipherInitNoErr (cipherMakeKey cipher $ ctrKey d)+                iv  = cipherMakeIV cipher $ ctrIV d+{-+        makeXTSTest i d  =+            [ testCase ("E" ++ i) (xtsEncrypt ctx iv 0 (xtsPlaintext d) @?= xtsCiphertext d)+            , testCase ("D" ++ i) (xtsDecrypt ctx iv 0 (xtsCiphertext d) @?= xtsPlaintext d)+            ]+          where ctx1 = cipherInit (cipherMakeKey cipher $ xtsKey1 d)+                ctx2 = cipherInit (cipherMakeKey cipher $ xtsKey2 d)+                ctx  = (ctx1, ctx2)+                iv   = cipherMakeIV cipher $ xtsIV d+        makeAEADTest i d =+            [ testCase ("AE" ++ i) (etag @?= aeadTag d)+            , testCase ("AD" ++ i) (dtag @?= aeadTag d)+            , testCase ("E" ++ i)  (ebs @?= aeadCiphertext d)+            , testCase ("D" ++ i)  (dbs @?= aeadPlaintext d)+            ]+          where ctx  = cipherInit (cipherMakeKey cipher $ aeadKey d)+                aead = maybe (error $ "cipher doesn't support aead mode: " ++ show (aeadMode d)) id+                     $ aeadInit (aeadMode d) ctx (aeadIV d)+                aeadHeaded     = aeadAppendHeader aead (aeadHeader d)+                (ebs,aeadEFinal) = aeadEncrypt aeadHeaded (aeadPlaintext d)+                (dbs,aeadDFinal) = aeadDecrypt aeadHeaded (aeadCiphertext d)+                etag = aeadFinalize aeadEFinal (aeadTaglen d)+                dtag = aeadFinalize aeadDFinal (aeadTaglen d)+-}++        cipherInitNoErr :: BlockCipher c => Key c -> c+        cipherInitNoErr (Key k) =+            case cipherInit k of+                CryptoPassed a -> a+                CryptoFailed e -> error (show e)++------------------------------------------------------------------------+-- Properties+------------------------------------------------------------------------++-- | any sized bytestring+newtype Plaintext a = Plaintext { unPlaintext :: B.ByteString }+    deriving (Show,Eq)++-- | A multiple of blocksize bytestring+newtype PlaintextBS a = PlaintextBS { unPlaintextBS :: B.ByteString }+    deriving (Show,Eq)++newtype Key a = Key ByteString+    deriving (Show,Eq)++-- | a ECB unit test+data ECBUnit a = ECBUnit (Key a) (PlaintextBS a)+    deriving (Eq)++-- | a CBC unit test+data CBCUnit a = CBCUnit (Key a) (IV a) (PlaintextBS a)+    deriving (Eq)++-- | a CBC unit test+data CFBUnit a = CFBUnit (Key a) (IV a) (PlaintextBS a)+    deriving (Eq)++-- | a CFB unit test+data CFB8Unit a = CFB8Unit (Key a) (IV a) (Plaintext a)+    deriving (Eq)++-- | a CTR unit test+data CTRUnit a = CTRUnit (Key a) (IV a) (Plaintext a)+    deriving (Eq)++-- | a XTS unit test+data XTSUnit a = XTSUnit (Key a) (Key a) (IV a) (PlaintextBS a)+    deriving (Eq)++-- | a AEAD unit test+data AEADUnit a = AEADUnit (Key a) B.ByteString (Plaintext a) (Plaintext a)+    deriving (Eq)++-- | Stream cipher unit test+data StreamUnit a = StreamUnit (Key a) (Plaintext a)+    deriving (Eq)++instance Show (ECBUnit a) where+    show (ECBUnit key b) = "ECB(key=" ++ show key ++ ",input=" ++ show b ++ ")"+instance Show (CBCUnit a) where+    show (CBCUnit key iv b) = "CBC(key=" ++ show key ++ ",iv=" ++ show iv ++ ",input=" ++ show b ++ ")"+instance Show (CFBUnit a) where+    show (CFBUnit key iv b) = "CFB(key=" ++ show key ++ ",iv=" ++ show iv ++ ",input=" ++ show b ++ ")"+instance Show (CFB8Unit a) where+    show (CFB8Unit key iv b) = "CFB8(key=" ++ show key ++ ",iv=" ++ show iv ++ ",input=" ++ show b ++ ")"+instance Show (CTRUnit a) where+    show (CTRUnit key iv b) = "CTR(key=" ++ show key ++ ",iv=" ++ show iv ++ ",input=" ++ show b ++ ")"+instance Show (XTSUnit a) where+    show (XTSUnit key1 key2 iv b) = "XTS(key1=" ++ show key1 ++ ",key2=" ++ show key2 ++ ",iv=" ++ show iv ++ ",input=" ++ show b ++ ")"+instance Show (AEADUnit a) where+    show (AEADUnit key iv aad b) = "AEAD(key=" ++ show key ++ ",iv=" ++ show iv ++ ",aad=" ++ show (unPlaintext aad) ++ ",input=" ++ show b ++ ")"+instance Show (StreamUnit a) where+    show (StreamUnit key b) = "Stream(key=" ++ show key ++ ",input=" ++ show b ++ ")"++-- | Generate an arbitrary valid key for a specific block cipher+generateKey :: Cipher a => Gen (Key a)+generateKey = keyFromCipher undefined+  where keyFromCipher :: Cipher a => a -> Gen (Key a)+        keyFromCipher cipher = do+            sz <- case cipherKeySize cipher of+                         KeySizeRange low high -> choose (low, high)+                         KeySizeFixed v -> return v+                         KeySizeEnum l  -> elements l+            Key . B.pack <$> replicateM sz arbitrary++-- | Generate an arbitrary valid IV for a specific block cipher+generateIv :: BlockCipher a => Gen (IV a)+generateIv = ivFromCipher undefined+  where ivFromCipher :: BlockCipher a => a -> Gen (IV a)+        ivFromCipher cipher = fromJust . makeIV . B.pack <$> replicateM (blockSize cipher) arbitrary++-- | Generate an arbitrary valid IV for AEAD for a specific block cipher+generateIvAEAD :: Gen B.ByteString+generateIvAEAD = choose (12,90) >>= \sz -> (B.pack <$> replicateM sz arbitrary)++-- | Generate a plaintext multiple of blocksize bytes+generatePlaintextMultipleBS :: BlockCipher a => Gen (PlaintextBS a)+generatePlaintextMultipleBS = choose (1,128) >>= \size -> replicateM (size * 16) arbitrary >>= return . PlaintextBS . B.pack++-- | Generate any sized plaintext+generatePlaintext :: Gen (Plaintext a)+generatePlaintext = choose (0,324) >>= \size -> replicateM size arbitrary >>= return . Plaintext . B.pack++instance BlockCipher a => Arbitrary (ECBUnit a) where+    arbitrary = ECBUnit <$> generateKey+                        <*> generatePlaintextMultipleBS++instance BlockCipher a => Arbitrary (CBCUnit a) where+    arbitrary = CBCUnit <$> generateKey+                        <*> generateIv+                        <*> generatePlaintextMultipleBS++instance BlockCipher a => Arbitrary (CFBUnit a) where+    arbitrary = CFBUnit <$> generateKey+                        <*> generateIv+                        <*> generatePlaintextMultipleBS++instance BlockCipher a => Arbitrary (CFB8Unit a) where+    arbitrary = CFB8Unit <$> generateKey <*> generateIv <*> generatePlaintext++instance BlockCipher a => Arbitrary (CTRUnit a) where+    arbitrary = CTRUnit <$> generateKey+                        <*> generateIv+                        <*> generatePlaintext++instance BlockCipher a => Arbitrary (XTSUnit a) where+    arbitrary = XTSUnit <$> generateKey+                        <*> generateKey+                        <*> generateIv+                        <*> generatePlaintextMultipleBS++instance BlockCipher a => Arbitrary (AEADUnit a) where+    arbitrary = AEADUnit <$> generateKey+                         <*> generateIvAEAD+                         <*> generatePlaintext+                         <*> generatePlaintext++instance StreamCipher a => Arbitrary (StreamUnit a) where+    arbitrary = StreamUnit <$> generateKey+                           <*> generatePlaintext++testBlockCipherBasic :: BlockCipher a => a -> [TestTree]+testBlockCipherBasic cipher = [ testProperty "ECB" ecbProp ]+  where ecbProp = toTests cipher+        toTests :: BlockCipher a => a -> (ECBUnit a -> Bool)+        toTests _ = testProperty_ECB+        testProperty_ECB (ECBUnit key (unPlaintextBS -> plaintext)) = withCtx key $ \ctx ->+            plaintext `assertEq` ecbDecrypt ctx (ecbEncrypt ctx plaintext)++testBlockCipherModes :: BlockCipher a => a -> [TestTree]+testBlockCipherModes cipher =+    [ testProperty "CBC" cbcProp+    , testProperty "CFB" cfbProp+    --, testProperty "CFB8" cfb8Prop+    , testProperty "CTR" ctrProp+    ]+  where (cbcProp,cfbProp,ctrProp) = toTests cipher+        toTests :: BlockCipher a+                => a+                -> ((CBCUnit a -> Bool), (CFBUnit a -> Bool), {-(CFB8Unit a -> Bool),-} (CTRUnit a -> Bool))+        toTests _ = (testProperty_CBC+                    ,testProperty_CFB+                    --,testProperty_CFB8+                    ,testProperty_CTR+                    )+        testProperty_CBC (CBCUnit key testIV (unPlaintextBS -> plaintext)) = withCtx key $ \ctx ->+            plaintext `assertEq` cbcDecrypt ctx testIV (cbcEncrypt ctx testIV plaintext)++        testProperty_CFB (CFBUnit key testIV (unPlaintextBS -> plaintext)) = withCtx key $ \ctx ->+            plaintext `assertEq` cfbDecrypt ctx testIV (cfbEncrypt ctx testIV plaintext)++{-+        testProperty_CFB8 (CFB8Unit (cipherInit -> ctx) testIV (unPlaintext -> plaintext)) =+            plaintext `assertEq` cfb8Decrypt ctx testIV (cfb8Encrypt ctx testIV plaintext)+-}++        testProperty_CTR (CTRUnit key testIV (unPlaintext -> plaintext)) = withCtx key $ \ctx ->+            plaintext `assertEq` ctrCombine ctx testIV (ctrCombine ctx testIV plaintext)++testBlockCipherAEAD :: BlockCipher a => a -> [TestTree]+testBlockCipherAEAD cipher =+    [ testProperty "OCB" (aeadProp AEAD_OCB)+    , testProperty "CCM" (aeadProp AEAD_CCM)+    , testProperty "EAX" (aeadProp AEAD_EAX)+    , testProperty "CWC" (aeadProp AEAD_CWC)+    , testProperty "GCM" (aeadProp AEAD_GCM)+    ]+  where aeadProp = toTests cipher+        toTests :: BlockCipher a => a -> (AEADMode -> AEADUnit a -> Bool)+        toTests _ = testProperty_AEAD+        testProperty_AEAD mode (AEADUnit key testIV (unPlaintext -> aad) (unPlaintext -> plaintext)) = withCtx key $ \ctx ->+            case aeadInit mode ctx testIV of+                CryptoPassed iniAead ->+                    let aead           = aeadAppendHeader iniAead aad+                        (eText, aeadE) = aeadEncrypt aead plaintext+                        (dText, aeadD) = aeadDecrypt aead eText+                        eTag           = aeadFinalize aeadE (blockSize ctx)+                        dTag           = aeadFinalize aeadD (blockSize ctx)+                     in (plaintext `assertEq` dText) && (eTag `B.eq` dTag)+                CryptoFailed err+                    | err == CryptoError_AEADModeNotSupported -> True+                    | otherwise                               -> error ("testProperty_AEAD: " ++ show err)++withCtx :: Cipher c => Key c -> (c -> a) -> a+withCtx (Key key) f =+    case cipherInit key of+        CryptoFailed e   -> error ("init failed: " ++ show e)+        CryptoPassed ctx -> f ctx++{-+testBlockCipherXTS :: BlockCipher a => a -> [TestTree]+testBlockCipherXTS cipher = [testProperty "XTS" xtsProp]+  where xtsProp = toTests cipher+        toTests :: BlockCipher a => a -> (XTSUnit a -> Bool)+        toTests _ = testProperty_XTS++        testProperty_XTS (XTSUnit (cipherInit -> ctx1) (cipherInit -> ctx2) testIV (toBytes -> plaintext))+            | blockSize ctx1 == 16 = plaintext `assertEq` xtsDecrypt (ctx1, ctx2) testIV 0 (xtsEncrypt (ctx1, ctx2) testIV 0 plaintext)+            | otherwise            = True+-}++-- | Test a generic block cipher for properties+-- related to block cipher modes.+testModes :: BlockCipher a => a -> [TestTree]+testModes cipher =+    [ testGroup "decrypt.encrypt==id"+--        (testBlockCipherBasic cipher ++ testBlockCipherModes cipher ++ testBlockCipherAEAD cipher ++ testBlockCipherXTS cipher)+        (testBlockCipherBasic cipher ++ testBlockCipherModes cipher ++ testBlockCipherAEAD cipher)+    ]++-- | Return tests for a specific blockcipher and a list of KATs+testBlockCipher :: BlockCipher a => KATs -> a -> TestTree+testBlockCipher kats cipher = testGroup (cipherName cipher)+    (  (if kats == defaultKATs  then [] else [testKATs kats cipher])+    ++ testModes cipher+    )++cipherMakeKey :: Cipher cipher => cipher -> ByteString -> Key cipher+cipherMakeKey _ bs = Key bs++cipherMakeIV :: BlockCipher cipher => cipher -> ByteString -> IV cipher+cipherMakeIV _ bs = fromJust $ makeIV bs++maybeGroup :: (String -> t -> [TestTree]) -> TestName -> [t] -> [TestTree]+maybeGroup mkTest groupName l+    | null l    = []+    | otherwise = [testGroup groupName (concatMap (\(i, d) -> mkTest (show i) d) $ zip nbs l)]+  where nbs :: [Int]+        nbs = [0..]
+ tests/ChaCha.hs view
@@ -0,0 +1,90 @@+{-# LANGUAGE OverloadedStrings #-}+module ChaCha (tests) where++import qualified Crypto.Cipher.ChaCha as ChaCha+import Imports++import qualified Data.ByteString as B++b8_128_k0_i0 = "\xe2\x8a\x5f\xa4\xa6\x7f\x8c\x5d\xef\xed\x3e\x6f\xb7\x30\x34\x86\xaa\x84\x27\xd3\x14\x19\xa7\x29\x57\x2d\x77\x79\x53\x49\x11\x20\xb6\x4a\xb8\xe7\x2b\x8d\xeb\x85\xcd\x6a\xea\x7c\xb6\x08\x9a\x10\x18\x24\xbe\xeb\x08\x81\x4a\x42\x8a\xab\x1f\xa2\xc8\x16\x08\x1b\x8a\x26\xaf\x44\x8a\x1b\xa9\x06\x36\x8f\xd8\xc8\x38\x31\xc1\x8c\xec\x8c\xed\x81\x1a\x02\x8e\x67\x5b\x8d\x2b\xe8\xfc\xe0\x81\x16\x5c\xea\xe9\xf1\xd1\xb7\xa9\x75\x49\x77\x49\x48\x05\x69\xce\xb8\x3d\xe6\xa0\xa5\x87\xd4\x98\x4f\x19\x92\x5f\x5d\x33\x8e\x43\x0d"++b12_128_k0_i0 =+    "\xe1\x04\x7b\xa9\x47\x6b\xf8\xff\x31\x2c\x01\xb4\x34\x5a\x7d\x8c\xa5\x79\x2b\x0a\xd4\x67\x31\x3f\x1d\xc4\x12\xb5\xfd\xce\x32\x41\x0d\xea\x8b\x68\xbd\x77\x4c\x36\xa9\x20\xf0\x92\xa0\x4d\x3f\x95\x27\x4f\xbe\xff\x97\xbc\x84\x91\xfc\xef\x37\xf8\x59\x70\xb4\x50\x1d\x43\xb6\x1a\x8f\x7e\x19\xfc\xed\xde\xf3\x68\xae\x6b\xfb\x11\x10\x1b\xd9\xfd\x3e\x4d\x12\x7d\xe3\x0d\xb2\xdb\x1b\x47\x2e\x76\x42\x68\x03\xa4\x5e\x15\xb9\x62\x75\x19\x86\xef\x1d\x9d\x50\xf5\x98\xa5\xdc\xdc\x9f\xa5\x29\xa2\x83\x57\x99\x1e\x78\x4e\xa2\x0f"++b20_128_k0_i0 =+    "\x89\x67\x09\x52\x60\x83\x64\xfd\x00\xb2\xf9\x09\x36\xf0\x31\xc8\xe7\x56\xe1\x5d\xba\x04\xb8\x49\x3d\x00\x42\x92\x59\xb2\x0f\x46\xcc\x04\xf1\x11\x24\x6b\x6c\x2c\xe0\x66\xbe\x3b\xfb\x32\xd9\xaa\x0f\xdd\xfb\xc1\x21\x23\xd4\xb9\xe4\x4f\x34\xdc\xa0\x5a\x10\x3f\x6c\xd1\x35\xc2\x87\x8c\x83\x2b\x58\x96\xb1\x34\xf6\x14\x2a\x9d\x4d\x8d\x0d\x8f\x10\x26\xd2\x0a\x0a\x81\x51\x2c\xbc\xe6\xe9\x75\x8a\x71\x43\xd0\x21\x97\x80\x22\xa3\x84\x14\x1a\x80\xce\xa3\x06\x2f\x41\xf6\x7a\x75\x2e\x66\xad\x34\x11\x98\x4c\x78\x7e\x30\xad"++b8_256_k0_i0 =+    "\x3e\x00\xef\x2f\x89\x5f\x40\xd6\x7f\x5b\xb8\xe8\x1f\x09\xa5\xa1\x2c\x84\x0e\xc3\xce\x9a\x7f\x3b\x18\x1b\xe1\x88\xef\x71\x1a\x1e\x98\x4c\xe1\x72\xb9\x21\x6f\x41\x9f\x44\x53\x67\x45\x6d\x56\x19\x31\x4a\x42\xa3\xda\x86\xb0\x01\x38\x7b\xfd\xb8\x0e\x0c\xfe\x42\xd2\xae\xfa\x0d\xea\xa5\xc1\x51\xbf\x0a\xdb\x6c\x01\xf2\xa5\xad\xc0\xfd\x58\x12\x59\xf9\xa2\xaa\xdc\xf2\x0f\x8f\xd5\x66\xa2\x6b\x50\x32\xec\x38\xbb\xc5\xda\x98\xee\x0c\x6f\x56\x8b\x87\x2a\x65\xa0\x8a\xbf\x25\x1d\xeb\x21\xbb\x4b\x56\xe5\xd8\x82\x1e\x68\xaa"++b12_256_k0_i0 =+    "\x9b\xf4\x9a\x6a\x07\x55\xf9\x53\x81\x1f\xce\x12\x5f\x26\x83\xd5\x04\x29\xc3\xbb\x49\xe0\x74\x14\x7e\x00\x89\xa5\x2e\xae\x15\x5f\x05\x64\xf8\x79\xd2\x7a\xe3\xc0\x2c\xe8\x28\x34\xac\xfa\x8c\x79\x3a\x62\x9f\x2c\xa0\xde\x69\x19\x61\x0b\xe8\x2f\x41\x13\x26\xbe\x0b\xd5\x88\x41\x20\x3e\x74\xfe\x86\xfc\x71\x33\x8c\xe0\x17\x3d\xc6\x28\xeb\xb7\x19\xbd\xcb\xcc\x15\x15\x85\x21\x4c\xc0\x89\xb4\x42\x25\x8d\xcd\xa1\x4c\xf1\x11\xc6\x02\xb8\x97\x1b\x8c\xc8\x43\xe9\x1e\x46\xca\x90\x51\x51\xc0\x27\x44\xa6\xb0\x17\xe6\x93\x16"++b20_256_k0_i0 =+    "\x76\xb8\xe0\xad\xa0\xf1\x3d\x90\x40\x5d\x6a\xe5\x53\x86\xbd\x28\xbd\xd2\x19\xb8\xa0\x8d\xed\x1a\xa8\x36\xef\xcc\x8b\x77\x0d\xc7\xda\x41\x59\x7c\x51\x57\x48\x8d\x77\x24\xe0\x3f\xb8\xd8\x4a\x37\x6a\x43\xb8\xf4\x15\x18\xa1\x1c\xc3\x87\xb6\x69\xb2\xee\x65\x86\x9f\x07\xe7\xbe\x55\x51\x38\x7a\x98\xba\x97\x7c\x73\x2d\x08\x0d\xcb\x0f\x29\xa0\x48\xe3\x65\x69\x12\xc6\x53\x3e\x32\xee\x7a\xed\x29\xb7\x21\x76\x9c\xe6\x4e\x43\xd5\x71\x33\xb0\x74\xd8\x39\xd5\x31\xed\x1f\x28\x51\x0a\xfb\x45\xac\xe1\x0a\x1f\x4b\x79\x4d\x6f"++data Vector = Vector Int -- rounds+                     ByteString -- key+                     ByteString -- nonce+    deriving (Show,Eq)++instance Arbitrary Vector where+    arbitrary = Vector 20 <$> arbitraryBS 16 <*> arbitraryBS 12++tests = testGroup "ChaCha"+    [ testCase "8-128-K0-I0"  (chachaRunSimple b8_128_k0_i0 8 16 8)+    , testCase "12-128-K0-I0" (chachaRunSimple b12_128_k0_i0 12 16 8)+    , testCase "20-128-K0-I0" (chachaRunSimple b20_128_k0_i0 20 16 8)+    , testCase "8-256-K0-I0"  (chachaRunSimple b8_256_k0_i0 8 32 8)+    , testCase "12-256-K0-I0" (chachaRunSimple b12_256_k0_i0 12 32 8)+    , testCase "20-256-K0-I0" (chachaRunSimple b20_256_k0_i0 20 32 8)+    , testProperty "generate-combine" chachaGenerateCombine+    , testProperty "chunking-generate" chachaGenerateChunks+    , testProperty "chunking-combine" chachaCombineChunks+    ]+  where chachaRunSimple expected rounds klen nonceLen =+            let chacha = ChaCha.initialize rounds (B.replicate klen 0) (B.replicate nonceLen 0)+             in expected @=? fst (ChaCha.generate chacha (B.length expected))++        chachaGenerateChunks :: ChunkingLen -> Vector -> Bool+        chachaGenerateChunks (ChunkingLen ckLen) (Vector rounds key iv) =+            let initChaCha    = ChaCha.initialize rounds key iv+                nbBytes       = 1048+                (expected,_)  = ChaCha.generate initChaCha nbBytes+                chunks        = loop nbBytes ckLen initChaCha+             in expected `propertyEq` B.concat chunks++          where loop n []     chacha = loop n ckLen chacha+                loop 0 _      _      = []+                loop n (x:xs) chacha =+                    let len       = min x n+                        (c, next) = ChaCha.generate chacha len+                     in c : loop (n - len) xs next++        chachaGenerateCombine :: ChunkingLen0_127 -> Vector -> Int0_2901 -> Bool+        chachaGenerateCombine (ChunkingLen0_127 ckLen) (Vector rounds key iv) (Int0_2901 nbBytes) =+            let initChaCha    = ChaCha.initialize rounds key iv+             in loop nbBytes ckLen initChaCha+          where loop n []     chacha = loop n ckLen chacha+                loop 0 _      _     = True+                loop n (x:xs) chacha =+                    let len        = min x n+                        (c1, next) = ChaCha.generate chacha len+                        (c2, _)    = ChaCha.combine chacha (B.replicate len 0)+                     in if c1 == c2 then loop (n - len) xs next else False+++        chachaCombineChunks :: ChunkingLen0_127 -> Vector -> ArbitraryBS0_2901 -> Bool+        chachaCombineChunks (ChunkingLen0_127 ckLen) (Vector rounds key iv) (ArbitraryBS0_2901 wholebs) =+            let initChaCha    = ChaCha.initialize rounds key iv+                (expected,_)  = ChaCha.combine initChaCha wholebs+                chunks        = loop wholebs ckLen initChaCha+             in expected `propertyEq` B.concat chunks++          where loop bs []     chacha = loop bs ckLen chacha+                loop bs (x:xs) chacha+                    | B.null bs = []+                    | otherwise =+                        let (bs1, bs2) = B.splitAt (min x (B.length bs)) bs+                            (c, next)  = ChaCha.combine chacha bs1+                         in c : loop bs2 xs next
+ tests/Hash.hs view
@@ -0,0 +1,168 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ViewPatterns #-}+{-# LANGUAGE ExistentialQuantification #-}+module Hash+    ( tests+    ) where++import Crypto.Hash++import qualified Data.ByteString as B+import qualified Data.ByteArray.Encoding as B (convertToBase, Base(..))+import Imports++v0,v1,v2 :: ByteString+v0 = ""+v1 = "The quick brown fox jumps over the lazy dog"+v2 = "The quick brown fox jumps over the lazy cog"+vectors = [ v0, v1, v2 ]++instance Arbitrary ByteString where+    arbitrary = B.pack `fmap` arbitrary++data HashAlg = forall alg . HashAlgorithm alg => HashAlg alg++expected :: [ (String, HashAlg, [ByteString]) ]+expected = [+    ("MD2", HashAlg MD2, [+        "8350e5a3e24c153df2275c9f80692773",+        "03d85a0d629d2c442e987525319fc471",+        "6b890c9292668cdbbfda00a4ebf31f05" ]),+    ("MD4", HashAlg MD4, [+        "31d6cfe0d16ae931b73c59d7e0c089c0",+        "1bee69a46ba811185c194762abaeae90",+        "b86e130ce7028da59e672d56ad0113df" ]),+    ("MD5", HashAlg MD5, [+        "d41d8cd98f00b204e9800998ecf8427e",+        "9e107d9d372bb6826bd81d3542a419d6",+        "1055d3e698d289f2af8663725127bd4b" ]),+    ("SHA1", HashAlg SHA1, [+        "da39a3ee5e6b4b0d3255bfef95601890afd80709",+        "2fd4e1c67a2d28fced849ee1bb76e7391b93eb12",+        "de9f2c7fd25e1b3afad3e85a0bd17d9b100db4b3" ]),+    ("SHA224", HashAlg SHA224, [+        "d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f",+        "730e109bd7a8a32b1cb9d9a09aa2325d2430587ddbc0c38bad911525",+        "fee755f44a55f20fb3362cdc3c493615b3cb574ed95ce610ee5b1e9b" ]),+    ("SHA256", HashAlg SHA256, [+        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",+        "d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592",+        "e4c4d8f3bf76b692de791a173e05321150f7a345b46484fe427f6acc7ecc81be" ]),+    ("SHA384", HashAlg SHA384, [+        "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b",+        "ca737f1014a48f4c0b6dd43cb177b0afd9e5169367544c494011e3317dbf9a509cb1e5dc1e85a941bbee3d7f2afbc9b1",+        "098cea620b0978caa5f0befba6ddcf22764bea977e1c70b3483edfdf1de25f4b40d6cea3cadf00f809d422feb1f0161b" ]),+    ("SHA512", HashAlg SHA512, [+        "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",+        "07e547d9586f6a73f73fbac0435ed76951218fb7d0c8d788a309d785436bbb642e93a252a954f23912547d1e8a3b5ed6e1bfd7097821233fa0538f3db854fee6",+        "3eeee1d0e11733ef152a6c29503b3ae20c4f1f3cda4cb26f1bc1a41f91c7fe4ab3bd86494049e201c4bd5155f31ecb7a3c8606843c4cc8dfcab7da11c8ae5045" ]),+    ("SHA512/224", HashAlg SHA512t_224, [+        "6ed0dd02806fa89e25de060c19d3ac86cabb87d6a0ddd05c333b84f4",+        "944cd2847fb54558d4775db0485a50003111c8e5daa63fe722c6aa37",+        "2b9d6565a7e40f780ba8ab7c8dcf41e3ed3b77997f4c55aa987eede5" ]),+    ("SHA512/256", HashAlg SHA512t_256, [+        "c672b8d1ef56ed28ab87c3622c5114069bdd3ad7b8f9737498d0c01ecef0967a",+        "dd9d67b371519c339ed8dbd25af90e976a1eeefd4ad3d889005e532fc5bef04d",+        "cc8d255a7f2f38fd50388fd1f65ea7910835c5c1e73da46fba01ea50d5dd76fb" ]),+    ("RIPEMD160", HashAlg RIPEMD160, [+        "9c1185a5c5e9fc54612808977ee8f548b2258d31",+        "37f332f68db77bd9d7edd4969571ad671cf9dd3b",+        "132072df690933835eb8b6ad0b77e7b6f14acad7" ]),+    ("Tiger", HashAlg Tiger, [+        "3293ac630c13f0245f92bbb1766e16167a4e58492dde73f3",+        "6d12a41e72e644f017b6f0e2f7b44c6285f06dd5d2c5b075",+        "a8f04b0f7201a0d728101c9d26525b31764a3493fcd8458f" ])+{-+    , ("Skein256-160", HashAlg Skein256_160, [+        "ff800bed6d2044ee9d604a674e3fda50d9b24a72",+        "3265703c166aa3e0d7da070b9cf1b1a5953f0a77",+        "17b29aa1424b3ec022505bd215ff73fd2e6d1e5a" ])+-}+    , ("Skein256-256", HashAlg Skein256_256, [+        "c8877087da56e072870daa843f176e9453115929094c3a40c463a196c29bf7ba",+        "c0fbd7d779b20f0a4614a66697f9e41859eaf382f14bf857e8cdb210adb9b3fe",+        "fb2f2f2deed0e1dd7ee2b91cee34e2d1c22072e1f5eaee288c35a0723eb653cd" ])+{-+    , ("Skein512-160", HashAlg Skein512_160, [+        "49daf1ccebb3544bc93cb5019ba91b0eea8876ee",+        "826325ee55a6dd18c3b2dbbc9c10420f5475975e",+        "7544ec7a35712ec953f02b0d0c86641cae4eb6e5" ])+-}+    , ("Skein512-384", HashAlg Skein512_384, [+        "dd5aaf4589dc227bd1eb7bc68771f5baeaa3586ef6c7680167a023ec8ce26980f06c4082c488b4ac9ef313f8cbe70808",+        "f814c107f3465e7c54048a5503547deddc377264f05c706b0d19db4847b354855ee52ab6a785c238c9e710d848542041",+        "e06520eeadc1d0a44fee1d2492547499c1e58526387c8b9c53905e5edb79f9840575cbf844e21b1ad1ea126dd8a8ca6f" ])+    , ("Skein512-512", HashAlg Skein512_512, [+        "bc5b4c50925519c290cc634277ae3d6257212395cba733bbad37a4af0fa06af41fca7903d06564fea7a2d3730dbdb80c1f85562dfcc070334ea4d1d9e72cba7a",+        "94c2ae036dba8783d0b3f7d6cc111ff810702f5c77707999be7e1c9486ff238a7044de734293147359b4ac7e1d09cd247c351d69826b78dcddd951f0ef912713",+        "7f81113575e4b4d3441940e87aca331e6d63d103fe5107f29cd877af0d0f5e0ea34164258c60da5190189d0872e63a96596d2ef25e709099842da71d64111e0f" ])+{-+    , ("Skein512-896", HashAlg Skein512_896, [+        "b95175236c83a459ce7ec6c12b761a838b22d750e765b3fdaa892201b2aa714bc3d1d887dd64028bbf177c1dd11baa09c6c4ddb598fd07d6a8c131a09fc5b958e2999a8006754b25abe3bf8492b7eabec70e52e04e5ac867df2393c573f16eee3244554f1d2b724f2c0437c62007f770",+        "3265708553e7d146e5c7bcbc97b3e9e9f5b53a5e4af53612bdd6454da4fa7b13d413184fe34ed57b6574be10e389d0ec4b1d2b1dd2c80e0257d5a76b2cd86a19a27b1bcb3cc24d911b5dc5ee74d19ad558fd85b5f024e99f56d1d3199f1f9f88ed85fab9f945f11cf9fc00e94e3ca4c7",+        "3d23d3db9be719bbd2119f8402a28f38d8225faa79d5b68b80738c64a82004aafc7a840cd6dd9bced6644fa894a3d8d7d2ee89525fd1956a2db052c4c2f8d2111c91ef46b0997540d42bcf384826af1a5ef6510077f52d0574cf2b46f1b6a5dad07ed40f3d21a13ca2d079fa602ff02d" ])+-}+    , ("Whirlpool", HashAlg Whirlpool, [+        "19fa61d75522a4669b44e39c1d2e1726c530232130d407f89afee0964997f7a73e83be698b288febcf88e3e03c4f0757ea8964e59b63d93708b138cc42a66eb3",+        "b97de512e91e3828b40d2b0fdce9ceb3c4a71f9bea8d88e75c4fa854df36725fd2b52eb6544edcacd6f8beddfea403cb55ae31f03ad62a5ef54e42ee82c3fb35",+        "dce81fc695cfea3d7e1446509238daf89f24cc61896f2d265927daa70f2108f8902f0dfd68be085d5abb9fcd2e482c1dc24f2fabf81f40b73495cad44d7360d3"])+    , ("Kekkak-224", HashAlg Kekkak_224, [+        "f71837502ba8e10837bdd8d365adb85591895602fc552b48b7390abd",+        "310aee6b30c47350576ac2873fa89fd190cdc488442f3ef654cf23fe",+        "0b27ff3b732133287f6831e2af47cf342b7ef1f3fcdee248811090cd" ])+    , ("Kekkak-256", HashAlg Kekkak_256, [+        "c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470",+        "4d741b6f1eb29cb2a9b9911c82f56fa8d73b04959d3d9d222895df6c0b28aa15",+        "ed6c07f044d7573cc53bf1276f8cba3dac497919597a45b4599c8f73e22aa334" ])+    , ("Kekkak-384", HashAlg Kekkak_384, [+        "2c23146a63a29acf99e73b88f8c24eaa7dc60aa771780ccc006afbfa8fe2479b2dd2b21362337441ac12b515911957ff",+        "283990fa9d5fb731d786c5bbee94ea4db4910f18c62c03d173fc0a5e494422e8a0b3da7574dae7fa0baf005e504063b3",+        "1cc515e1812491058d8b8b226fd85045e746b4937a58b0111b6b7a39dd431b6295bd6b6d05e01e225586b4dab3cbb87a" ])+    , ("Kekkak-512", HashAlg Kekkak_512, [+        "0eab42de4c3ceb9235fc91acffe746b29c29a8c366b7c60e4e67c466f36a4304c00fa9caf9d87976ba469bcbe06713b435f091ef2769fb160cdab33d3670680e",+        "d135bb84d0439dbac432247ee573a23ea7d3c9deb2a968eb31d47c4fb45f1ef4422d6c531b5b9bd6f449ebcc449ea94d0a8f05f62130fda612da53c79659f609",+        "10f8caabb5b179861da5e447d34b84d604e3eb81830880e1c2135ffc94580a47cb21f6243ec0053d58b1124d13af2090033659075ee718e0f111bb3f69fb24cf" ])+    , ("SHA3-224", HashAlg SHA3_224, [+        "6b4e03423667dbb73b6e15454f0eb1abd4597f9a1b078e3f5b5a6bc7",+        "d15dadceaa4d5d7bb3b48f446421d542e08ad8887305e28d58335795",+        "b770eb6ac3ac52bd2f9e8dc186d6b604e7c3b7ffc8bd9220b0078ced" ])+    , ("SHA3-256", HashAlg SHA3_256, [+        "a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a",+        "69070dda01975c8c120c3aada1b282394e7f032fa9cf32f4cb2259a0897dfc04",+        "cc80b0b13ba89613d93f02ee7ccbe72ee26c6edfe577f22e63a1380221caedbc" ])+    , ("SHA3-384", HashAlg SHA3_384, [+        "0c63a75b845e4f7d01107d852e4c2485c51a50aaaa94fc61995e71bbee983a2ac3713831264adb47fb6bd1e058d5f004",+        "7063465e08a93bce31cd89d2e3ca8f602498696e253592ed26f07bf7e703cf328581e1471a7ba7ab119b1a9ebdf8be41",+        "e414797403c7d01ab64b41e90df4165d59b7f147e4292ba2da336acba242fd651949eb1cfff7e9012e134b40981842e1" ])+    , ("SHA3-512", HashAlg SHA3_512, [+        "a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e301758586281dcd26",+        "01dedd5de4ef14642445ba5f5b97c15e47b9ad931326e4b0727cd94cefc44fff23f07bf543139939b49128caf436dc1bdee54fcb24023a08d9403f9b4bf0d450",+        "28e361fe8c56e617caa56c28c7c36e5c13be552b77081be82b642f08bb7ef085b9a81910fe98269386b9aacfd2349076c9506126e198f6f6ad44c12017ca77b1" ])+    ]++runhash :: HashAlg -> ByteString -> ByteString+runhash (HashAlg hashAlg) v = B.convertToBase B.Base16 $ hashWith hashAlg $ v++runhashinc :: HashAlg -> [ByteString] -> ByteString+runhashinc (HashAlg hashAlg) v = B.convertToBase B.Base16 $ hashinc $ v+  where hashinc = hashFinalize . foldl hashUpdate (hashInitWith hashAlg)++makeTestAlg (name, hashAlg, results) =+    testGroup name $ concatMap maketest (zip3 is vectors results)+  where+        is :: [Int]+        is = [1..]++        maketest (i, v, r) =+            [ testCase (show i) (r @=? runhash hashAlg v)+            ]++makeTestChunk (hashName, hashAlg, _) =+    [ testProperty hashName $ \ckLen (ArbitraryBS0_2901 inp) ->+        runhash hashAlg inp `propertyEq` runhashinc hashAlg (chunkS ckLen inp)+    ]++tests = testGroup "hash"+    [ testGroup "KATs" (map makeTestAlg expected)+    , testGroup "Chunking" (concatMap makeTestChunk expected)+    ]
+ tests/Imports.hs view
@@ -0,0 +1,22 @@+module Imports+    (+    -- * Individual Types+      Word16, Word32, Word64+    , ByteString+    -- * Modules+    , module X+    ) where++import Data.Word (Word16, Word32, Word64)+import Data.ByteString (ByteString)++import Control.Applicative as X+import Control.Monad as X+import Data.Foldable as X (foldl')+import Data.Monoid as X+import Data.ByteString.Char8 as X ()++import Test.Tasty as X+import Test.Tasty.HUnit as X+import Test.Tasty.QuickCheck as X hiding (vector)+import Utils as X
+ tests/KAT_AES.hs view
@@ -0,0 +1,77 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_AES (tests) where++import Imports+import BlockCipher+import Crypto.Cipher.Types+import qualified Crypto.Cipher.AES as AES++import qualified KAT_AES.KATECB as KATECB+import qualified KAT_AES.KATCBC as KATCBC+import qualified KAT_AES.KATXTS as KATXTS+import qualified KAT_AES.KATGCM as KATGCM+import qualified KAT_AES.KATOCB3 as KATOCB3++{-+instance Show AES.AES where+    show _ = "AES"+instance Arbitrary AES.AESIV where+    arbitrary = AES.aesIV_ . B.pack <$> replicateM 16 arbitrary+instance Arbitrary AES.AES where+    arbitrary = AES.initAES . B.pack <$> replicateM 16 arbitrary+-}++toKatECB (k,p,c) = KAT_ECB { ecbKey = k, ecbPlaintext = p, ecbCiphertext = c }+toKatCBC (k,iv,p,c) = KAT_CBC { cbcKey = k, cbcIV = iv, cbcPlaintext = p, cbcCiphertext = c }+toKatXTS (k1,k2,iv,p,_,c) = KAT_XTS { xtsKey1 = k1, xtsKey2 = k2, xtsIV = iv, xtsPlaintext = p, xtsCiphertext = c }+toKatAEAD mode (k,iv,h,p,c,taglen,tag) =+    KAT_AEAD { aeadMode       = mode+             , aeadKey        = k+             , aeadIV         = iv+             , aeadHeader     = h+             , aeadPlaintext  = p+             , aeadCiphertext = c+             , aeadTaglen     = taglen+             , aeadTag        = tag+             }+toKatGCM = toKatAEAD AEAD_GCM+toKatOCB = toKatAEAD AEAD_OCB++kats128 = defaultKATs+    { kat_ECB  = map toKatECB KATECB.vectors_aes128_enc+    , kat_CBC  = map toKatCBC KATCBC.vectors_aes128_enc+    , kat_CFB  = [ KAT_CFB { cfbKey        = "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c"+                           , cfbIV         = "\xC8\xA6\x45\x37\xA0\xB3\xA9\x3F\xCD\xE3\xCD\xAD\x9F\x1C\xE5\x8B"+                           , cfbPlaintext  = "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef"+                           , cfbCiphertext = "\x26\x75\x1f\x67\xa3\xcb\xb1\x40\xb1\x80\x8c\xf1\x87\xa4\xf4\xdf"+                           }+                 ]+    , kat_XTS  = map toKatXTS KATXTS.vectors_aes128_enc+    , kat_AEAD = map toKatGCM KATGCM.vectors_aes128_enc +++                 map toKatOCB KATOCB3.vectors_aes128_enc+    }++kats192 = defaultKATs+    { kat_ECB  = map toKatECB KATECB.vectors_aes192_enc+    , kat_CBC  = map toKatCBC KATCBC.vectors_aes192_enc+    }++kats256 = defaultKATs+    { kat_ECB  = map toKatECB KATECB.vectors_aes256_enc+    , kat_CBC  = map toKatCBC KATCBC.vectors_aes256_enc+    , kat_XTS  = map toKatXTS KATXTS.vectors_aes256_enc+    , kat_AEAD = map toKatGCM KATGCM.vectors_aes256_enc+    }++tests = testGroup "AES"+    [ testBlockCipher kats128 (undefined :: AES.AES128)+    , testBlockCipher kats192 (undefined :: AES.AES192)+    , testBlockCipher kats256 (undefined :: AES.AES256)+{-+    , testProperty "genCtr" $ \(key, iv1) ->+        let (bs1, iv2)    = AES.genCounter key iv1 32+            (bs2, iv3)    = AES.genCounter key iv2 32+            (bsAll, iv3') = AES.genCounter key iv1 64+         in (B.concat [bs1,bs2] == bsAll && iv3 == iv3')+-}+    ]
+ tests/KAT_AES/KATCBC.hs view
@@ -0,0 +1,107 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_AES.KATCBC where++import qualified Data.ByteString as B+import Data.ByteString.Char8 ()++type KATCBC = (B.ByteString, B.ByteString, B.ByteString, B.ByteString)++vectors_aes128_enc, vectors_aes128_dec+                  , vectors_aes192_enc, vectors_aes192_dec+                  , vectors_aes256_enc, vectors_aes256_dec :: [KATCBC]+vectors_aes128_enc =+	[+        ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x66\xe9\x4b\xd4\xef\x8a\x2c\x3b\x88\x4c\xfa\x59\xca\x34\x2b\x2e")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xb6\xae\xaf\xfa\x75\x2d\xc0\x8b\x51\x63\x97\x31\x76\x1a\xed\x00")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xcb\x64\xcf\x3f\x42\x2a\xe8\x4b\xb9\x0e\x3a\xb4\xdb\xa7\xbd\x86")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xe5\xb5\x07\x7f\x93\x46\x46\x2c\x62\xa0\x75\xc0\xc7\x08\xee\x96")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xe1\x4d\x5d\x0e\xe2\x77\x15\xdf\x08\xb4\x15\x2b\xa2\x3d\xa8\xe0")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x5e\x77\xe5\x9f\x8f\x85\x94\x34\x89\xa2\x41\x49\xc7\x5f\x4e\xc9")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x8f\x42\xc2\x4b\xee\x6e\x63\x47\x2b\x16\x5a\xa9\x41\x31\x2f\x7c")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xb0\xea\x4a\xc0\xd2\x5c\xcd\x7c\x82\xcb\x8a\x30\x68\xc6\xfe\x2e")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\xe1\x4d\x5d\x0e\xe2\x77\x15\xdf\x08\xb4\x15\x2b\xa2\x3d\xa8\xe0")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x17\xd6\x14\xf3\x79\xa9\x35\x90\x77\xe9\x55\x77\xfd\x31\xc2\x0a")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x8f\x42\xc2\x4b\xee\x6e\x63\x47\x2b\x16\x5a\xa9\x41\x31\x2f\x7c")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\xe5\xb5\x07\x7f\x93\x46\x46\x2c\x62\xa0\x75\xc0\xc7\x08\xee\x96")+	]++vectors_aes192_enc =+	[+        ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xaa\xe0\x69\x92\xac\xbf\x52\xa3\xe8\xf4\xa9\x6e\xc9\x30\x0b\xd7")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x5f\x88\xef\x3f\xbd\xeb\xf2\xe4\xe2\x66\x65\x12\xd3\xbc\xb7\x0f")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xdb\x42\xf5\x1c\xd2\x0e\xca\xd2\x9e\xb0\x13\x2b\x0f\xaa\x4b\x85")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xda\xb4\x01\x5f\x98\x70\x25\xeb\xb8\xa8\x5f\x3c\x7f\x73\x70\x19")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xcf\x1e\xce\x3c\x44\xb0\x78\xfb\x27\xcb\x0a\x3e\x07\x1b\x08\x20")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x98\xb8\x95\xa1\x45\xca\x4e\x0b\xf8\x3e\x69\x32\x81\xc1\xa0\x97")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xf2\xf0\xae\xd8\xcd\xc9\x21\xca\x4b\x55\x84\x5d\xa4\x15\x21\xc2")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x5e\xea\x4b\x13\xdd\xd9\x17\x12\xb0\x14\xe2\x82\x2d\x18\x76\xfb")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\xcf\x1e\xce\x3c\x44\xb0\x78\xfb\x27\xcb\x0a\x3e\x07\x1b\x08\x20")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\xeb\x8c\x17\x30\x90\xc7\x5b\x77\xd6\x72\xb4\x57\xa7\x78\xd9\xd0")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\xf2\xf0\xae\xd8\xcd\xc9\x21\xca\x4b\x55\x84\x5d\xa4\x15\x21\xc2")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\xda\xb4\x01\x5f\x98\x70\x25\xeb\xb8\xa8\x5f\x3c\x7f\x73\x70\x19")++	]++vectors_aes256_enc =+	[+        ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xdc\x95\xc0\x78\xa2\x40\x89\x89\xad\x48\xa2\x14\x92\x84\x20\x87")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x72\x98\xca\xa5\x65\x03\x1e\xad\xc6\xce\x23\xd2\x3e\xa6\x63\x78")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xf4\x35\xa1\x11\xa3\xe4\xa1\x94\x49\x19\xf9\x12\xc5\xa2\x41\xde")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x91\xc0\x87\x62\x87\x6d\xcc\xf9\xba\x20\x4a\x33\x76\x8f\xa5\xfe")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x7b\xc3\x02\x6c\xd7\x37\x10\x3e\x62\x90\x2b\xcd\x18\xfb\x01\x63")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x9c\xac\x94\xc6\xb4\x85\x61\xf8\xff\xaa\xa7\x86\x16\xba\x48\x92")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\xf9\xc7\x44\x4b\xb0\xcc\x80\x6c\x7c\x39\xee\x22\x11\xf1\x46")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x6d\xed\xd0\xa3\xe6\x94\xa0\xde\x65\x1d\x68\xa6\xb5\x5a\x64\xa2")+        , ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x7b\xc3\x02\x6c\xd7\x37\x10\x3e\x62\x90\x2b\xcd\x18\xfb\x01\x63")+        , ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x62\xae\x12\xf3\x24\xbf\xea\x08\xd5\xf6\x75\xb5\x13\x02\x6b\xbf")+        , ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\xf9\xc7\x44\x4b\xb0\xcc\x80\x6c\x7c\x39\xee\x22\x11\xf1\x46")+        , ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x91\xc0\x87\x62\x87\x6d\xcc\xf9\xba\x20\x4a\x33\x76\x8f\xa5\xfe")+	]++vectors_aes128_dec =+	[+		("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x14\x0f\x0f\x10\x11\xb5\x22\x3d\x79\x58\x77\x17\xff\xd9\xec\x3a")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x33\x08\x32\x40\xd6\x5c\xbc\x72\xaa\x0b\x44\xf3\xe1\x9e\xa9\x5a")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x65\x0a\x42\xa0\x3c\x4b\x93\xa4\xb7\x43\xdc\x9e\x9c\xf4\xc0\x9b")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x80\xcd\x20\xe1\xbd\x89\x3c\x5e\xe4\x20\x76\x85\xb0\x9a\x0e\x3e")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x15\x0e\x0e\x11\x10\xb4\x23\x3c\x78\x59\x76\x16\xfe\xd8\xed\x3b")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x32\x09\x33\x41\xd7\x5d\xbd\x73\xab\x0a\x45\xf2\xe0\x9f\xa8\x5b")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x64\x0b\x43\xa1\x3d\x4a\x92\xa5\xb6\x42\xdd\x9f\x9d\xf5\xc1\x9a")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x81\xcc\x21\xe0\xbc\x88\x3d\x5f\xe5\x21\x77\x84\xb1\x9b\x0f\x3f")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\xf5\x06\x41\x7e\x6a\x8f\xbc\x32\xdd\xa5\x52\x73\xbf\x9f\x4d\x5c")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\xbf\x6d\x28\xac\x20\xc9\x1d\x65\xa9\xd4\xb0\x96\xc2\xd5\xa5\x09")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x5f\x2a\x46\xab\x8d\xb9\x5b\x22\x15\xfe\x1a\xa4\xdd\x69\x59\x26")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x71\x9b\x21\xb5\x39\x7c\x2f\x16\x7c\x8b\x45\x22\xb5\x20\xec\x2e")+	]++vectors_aes192_dec =+	[+		("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x13\x46\x0e\x87\xa8\xfc\x02\x3e\xf2\x50\x1a\xfe\x7f\xf5\x1c\x51")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x91\x75\x27\xfc\xd4\xa0\x6f\x32\x27\x29\x90\x14\xca\xde\xd4\x1a")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x29\x64\x80\xb6\xa5\xd6\xcf\xb3\x78\x3f\x21\x6b\x80\x31\x3d\xb3")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xbc\xa5\x06\x07\xd0\x67\x30\x85\x2d\x3a\x50\x4b\x68\x0a\x19\xcc")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x12\x47\x0f\x86\xa9\xfd\x03\x3f\xf3\x51\x1b\xff\x7e\xf4\x1d\x50")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x90\x74\x26\xfd\xd5\xa1\x6e\x33\x26\x28\x91\x15\xcb\xdf\xd5\x1b")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x28\x65\x81\xb7\xa4\xd7\xce\xb2\x79\x3e\x20\x6a\x81\x30\x3c\xb2")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xbd\xa4\x07\x06\xd1\x66\x31\x84\x2c\x3b\x51\x4a\x69\x0b\x18\xcd")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x38\xf9\xf9\xd1\x7e\x2c\x82\xaf\xdc\xed\x68\x03\xb6\x31\x46\x3e")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x35\x4e\xc1\x01\x0f\x17\x50\x5e\x63\x37\x40\x4b\x9a\xf2\xc0\x5c")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\xa7\x7c\xc9\xd1\x4f\x44\xf7\xf7\xcc\x45\x80\x83\x19\xb7\xa4\x71")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\xf9\x1d\xb1\x13\x0b\xd1\xc0\x66\x9f\xfa\xc2\x0e\xbe\xdd\xcb\xca")+	]++vectors_aes256_dec =+	[+		("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x67\x67\x1c\xe1\xfa\x91\xdd\xeb\x0f\x8f\xbb\xb3\x66\xb5\x31\xb4")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x7b\xd3\xfb\x90\x65\x56\x9f\x39\x8b\x09\xcb\x93\x4b\x1e\x01\x23")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xda\xa8\xbf\x5c\xde\x2e\x52\x45\x5f\xa3\xb3\xfe\x33\x32\x47\xca")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x83\x24\xdc\xb4\x30\x12\x73\x6c\xed\x58\xab\x8f\x4b\x05\xca\x0b")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x66\x66\x1d\xe0\xfb\x90\xdc\xea\x0e\x8e\xba\xb2\x67\xb4\x30\xb5")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x7a\xd2\xfa\x91\x64\x57\x9e\x38\x8a\x08\xca\x92\x4a\x1f\x00\x22")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\xdb\xa9\xbe\x5d\xdf\x2f\x53\x44\x5e\xa2\xb2\xff\x32\x33\x46\xcb")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x82\x25\xdd\xb5\x31\x13\x72\x6d\xec\x59\xaa\x8e\x4a\x04\xcb\x0a")+		, ("\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x68\xe9\x07\x16\xe3\x66\x1b\x1d\xb1\x89\x74\xb0\x9c\x46\x47\xe4")+		, ("\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01","\x7f\xb9\xeb\xa4\xd3\x5f\x70\x40\xab\x52\xec\xd2\x3b\x48\xb7\x6e")+		, ("\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02","\x6c\x58\x0f\x41\x82\x36\xbc\xff\x64\x1d\xac\xa7\x3e\x34\x11\x18")+		, ("\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03\x03","\x3f\x62\xd6\x8c\xb1\xf7\x62\x28\xa4\xc3\x82\x4f\x8b\x24\xe7\x4b")+	]
+ tests/KAT_AES/KATECB.hs view
@@ -0,0 +1,148 @@+module KAT_AES.KATECB where++import qualified Data.ByteString as B++vectors_aes128_enc =+	[+	  ( B.pack [0x10, 0xa5, 0x88, 0x69, 0xd7, 0x4b, 0xe5, 0xa3,0x74,0xcf,0x86,0x7c,0xfb,0x47,0x38,0x59]+	  , B.replicate 16 0+	  , B.pack [0x6d,0x25,0x1e,0x69,0x44,0xb0,0x51,0xe0,0x4e,0xaa,0x6f,0xb4,0xdb,0xf7,0x84,0x65]+	  )+	, ( B.replicate 16 0+	  , B.replicate 16 0+	  , B.pack [0x66,0xe9,0x4b,0xd4,0xef,0x8a,0x2c,0x3b,0x88,0x4c,0xfa,0x59,0xca,0x34,0x2b,0x2e]+	  )+	, ( B.replicate 16 0+	  , B.replicate 16 1+	  , B.pack [0xe1,0x4d,0x5d,0x0e,0xe2,0x77,0x15,0xdf,0x08,0xb4,0x15,0x2b,0xa2,0x3d,0xa8,0xe0]+	  )+	, ( B.replicate 16 1+	  , B.replicate 16 2+	  , B.pack [0x17,0xd6,0x14,0xf3,0x79,0xa9,0x35,0x90,0x77,0xe9,0x55,0x77,0xfd,0x31,0xc2,0x0a]+	  )+	, ( B.replicate 16 2+	  , B.replicate 16 1+	  , B.pack [0x8f,0x42,0xc2,0x4b,0xee,0x6e,0x63,0x47,0x2b,0x16,0x5a,0xa9,0x41,0x31,0x2f,0x7c]+	  )+	, ( B.replicate 16 3+	  , B.replicate 16 2+	  , B.pack [0x90,0x98,0x85,0xe4,0x77,0xbc,0x20,0xf5,0x8a,0x66,0x97,0x1d,0xa0,0xbc,0x75,0xe3]+	  )+	]++vectors_aes192_enc =+	[+	  ( B.replicate 24 0+	  , B.replicate 16 0+	  , B.pack [0xaa,0xe0,0x69,0x92,0xac,0xbf,0x52,0xa3,0xe8,0xf4,0xa9,0x6e,0xc9,0x30,0x0b,0xd7]+	  )+	, ( B.replicate 24 0+	  , B.replicate 16 1+	  , B.pack [0xcf,0x1e,0xce,0x3c,0x44,0xb0,0x78,0xfb,0x27,0xcb,0x0a,0x3e,0x07,0x1b,0x08,0x20]+	  )+	, ( B.replicate 24 1+	  , B.replicate 16 2+	  , B.pack [0xeb,0x8c,0x17,0x30,0x90,0xc7,0x5b,0x77,0xd6,0x72,0xb4,0x57,0xa7,0x78,0xd9,0xd0]+	  )+	, ( B.replicate 24 2+	  , B.replicate 16 1+	  , B.pack [0xf2,0xf0,0xae,0xd8,0xcd,0xc9,0x21,0xca,0x4b,0x55,0x84,0x5d,0xa4,0x15,0x21,0xc2]+	  )+	, ( B.replicate 24 3+	  , B.replicate 16 2+	  , B.pack [0xca,0xcc,0x30,0x79,0xe4,0xb7,0x95,0x27,0x63,0xd2,0x55,0xd6,0x34,0x10,0x46,0x14]+	  )+	]++vectors_aes256_enc =+	[ ( B.replicate 32 0+	  , B.replicate 16 0+	  , B.pack [0xdc,0x95,0xc0,0x78,0xa2,0x40,0x89,0x89,0xad,0x48,0xa2,0x14,0x92,0x84,0x20,0x87]+	  )+	, ( B.replicate 32 0+	  , B.replicate 16 1+	  , B.pack [0x7b,0xc3,0x02,0x6c,0xd7,0x37,0x10,0x3e,0x62,0x90,0x2b,0xcd,0x18,0xfb,0x01,0x63]+	  )+	, ( B.replicate 32 1+	  , B.replicate 16 2+	  , B.pack [0x62,0xae,0x12,0xf3,0x24,0xbf,0xea,0x08,0xd5,0xf6,0x75,0xb5,0x13,0x02,0x6b,0xbf]+	  )+	, ( B.replicate 32 2+	  , B.replicate 16 1+	  , B.pack [0x00,0xf9,0xc7,0x44,0x4b,0xb0,0xcc,0x80,0x6c,0x7c,0x39,0xee,0x22,0x11,0xf1,0x46]+	  )+	, ( B.replicate 32 3+	  , B.replicate 16 2+	  , B.pack [0xb4,0x05,0x87,0x3e,0xa0,0x76,0x1b,0x9c,0xa9,0x9f,0x70,0xb0,0x16,0x16,0xce,0xb1]+	  )+	]++vectors_aes128_dec =+	[ ( B.replicate 16 0+	  , B.replicate 16 0+	  , B.pack [0x14,0x0f,0x0f,0x10,0x11,0xb5,0x22,0x3d,0x79,0x58,0x77,0x17,0xff,0xd9,0xec,0x3a]+	  )+	, ( B.replicate 16 0+	  , B.replicate 16 1+	  , B.pack [0x15,0x6d,0x0f,0x85,0x75,0xd5,0x33,0x07,0x52,0xf8,0x4a,0xf2,0x72,0xff,0x30,0x50]+	  )+	, ( B.replicate 16 1+	  , B.replicate 16 2+	  , B.pack [0x34,0x37,0xd6,0xe2,0x31,0xd7,0x02,0x41,0x9b,0x51,0xb4,0x94,0x72,0x71,0xb6,0x11]+	  )+	, ( B.replicate 16 2+	  , B.replicate 16 1+	  , B.pack [0xe3,0xcd,0xe2,0x37,0xc8,0xf2,0xd9,0x7b,0x8d,0x79,0xf9,0x17,0x1d,0x4b,0xda,0xc1]+	  )+	, ( B.replicate 16 3+	  , B.replicate 16 2+	  , B.pack [0x5b,0x94,0xaa,0xed,0xd7,0x83,0x99,0x8c,0xd5,0x15,0x35,0x35,0x18,0xcc,0x45,0xe2]+	  )+	]++vectors_aes192_dec =+	[+	  ( B.replicate 24 0+	  , B.replicate 16 0+	  , B.pack [0x13,0x46,0x0e,0x87,0xa8,0xfc,0x02,0x3e,0xf2,0x50,0x1a,0xfe,0x7f,0xf5,0x1c,0x51]+	  )+	, ( B.replicate 24 0+	  , B.replicate 16 1+	  , B.pack [0x92,0x17,0x07,0xc3,0x3d,0x1c,0xc5,0x96,0x7d,0xa5,0x1d,0xbb,0xb0,0x66,0xb2,0x6c]+	  )+	, ( B.replicate 24 1+	  , B.replicate 16 2+	  , B.pack [0xee,0x92,0x97,0xc6,0xba,0xe8,0x26,0x4d,0xff,0x08,0x0e,0xbb,0x1e,0x74,0x11,0xc1]+	  )+	, ( B.replicate 24 2+	  , B.replicate 16 1+	  , B.pack [0x49,0x67,0xdf,0x70,0xd2,0x9e,0x9a,0x7f,0x5d,0x7c,0xb9,0xc1,0x20,0xc3,0x8a,0x71]+	  )+	, ( B.replicate 24 3+	  , B.replicate 16 2+	  , B.pack [0x74,0x38,0x62,0x42,0x6b,0x56,0x7f,0xd5,0xf0,0x1d,0x1b,0x59,0x56,0x01,0x26,0x29]+	  )+	]++vectors_aes256_dec =+	[ ( B.replicate 32 0+	  , B.replicate 16 0+	  , B.pack [0x67,0x67,0x1c,0xe1,0xfa,0x91,0xdd,0xeb,0x0f,0x8f,0xbb,0xb3,0x66,0xb5,0x31,0xb4]+	  )+	, ( B.replicate 32 0+	  , B.replicate 16 1+	  , B.pack [0xcc,0x09,0x21,0xa3,0xc5,0xca,0x17,0xf7,0x48,0xb7,0xc2,0x7b,0x73,0xba,0x87,0xa2]+	  )+	, ( B.replicate 32 1+	  , B.replicate 16 2+	  , B.pack [0xc0,0x4b,0x27,0x90,0x1a,0x50,0xcf,0xfa,0xf1,0xbb,0x88,0x9f,0xc0,0x92,0x5e,0x14]+	  )+	, ( B.replicate 32 2+	  , B.replicate 16 1+	  , B.pack [0x24,0x61,0x53,0x5d,0x16,0x1c,0x15,0x39,0x88,0x32,0x77,0x29,0xc5,0x8c,0xc0,0x3a]+	  )+	, ( B.replicate 32 3+	  , B.replicate 16 2+	  , B.pack [0x30,0xc9,0x1c,0xce,0xfe,0x89,0x30,0xcf,0xff,0x31,0xdb,0xcc,0xfc,0x11,0xc5,0x23]+	  )+	]
+ tests/KAT_AES/KATGCM.hs view
@@ -0,0 +1,86 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_AES.KATGCM where++import qualified Data.ByteString as B+import Data.ByteString.Char8 ()++-- (key, iv, aad, input, out, taglen, tag)+type KATGCM = (B.ByteString, B.ByteString, B.ByteString, B.ByteString, B.ByteString, Int, B.ByteString)++vectors_aes128_enc :: [KATGCM]+vectors_aes128_enc =+    [ -- vectors 0+        ( {-key = -}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}""+        , {-input = -}""+        , {-out = -}""+        , {-taglen = -}16+        , {-tag = -}"\x58\xe2\xfc\xce\xfa\x7e\x30\x61\x36\x7f\x1d\x57\xa4\xe7\x45\x5a")+    -- vectors 1+    ,   ( {-key = -}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}"\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"+        , {-input = -}"\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a"+        , {-out = -}"\x09\x82\xd0\xc4\x6a\xbc\xa9\x98\xf9\x22\xc8\xb3\x7b\xb8\xf4\x72\xfd\x9f\xa0\xa1\x43\x41\x53\x29\xfd\xf7\x83\xf5\x9e\x81\xcb\xea"+        , {-taglen = -}16+        , {-tag = -}"\x28\x50\x64\x2f\xa8\x8b\xab\x21\x2a\x67\x1a\x97\x48\x69\xa5\x6c")++    -- vectors 2+    ,   ( {-key = -}"\x01\x02\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}"\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"+        , {-input = -}"\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a"+        , {-out = -}"\x1c\xa3\xb5\x41\x39\x6f\x19\x7a\x91\x2d\x27\x15\x70\xd1\xf5\x76\xde\xf1\xbe\x84\x42\x2a\xbb\xbe\x0b\x2d\x91\x21\x82\xbf\x7f\x17"+        , {-taglen = -}16+        , {-tag = -}"\x15\x2a\x05\xbb\x7e\x13\x5d\xbe\x93\x7f\xa0\x54\x7a\x8e\x74\xb6")+    -- vectors 3+    ,   ( {-key = -}"\x01\x02\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}"\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01"+        , {-input = -}"\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a\x0a"+        , {-out = -}"\xda\x35\xf6\x0a\x65\xc2\xa4\x6c\xb6\x6e\xb6\xf8\x1f\x0b\x9c\x74\x53\x4c\x97\x70\x36\xf7\xdf\x05\x6d\x00\xfe\xbf\xb4\xcb\xf5\x27"+        , {-taglen = -}16+        , {-tag = -}"\xb7\x76\x7c\x3b\x9e\xf1\xe2\xcb\xc9\x11\xf1\x9a\xdc\xfa\x35\x0d")+    ,   ( {-key = -}"\x01\x02\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}"\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76"+        , {-input = -}"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"+        , {-out = -}"\xe4\x42\xf8\xc4\xc6\x67\x84\x86\x4a\x5a\x6e\xc7\xe0\xca\x68\xac\x16\xbc\x5b\xbf\xf7\xd5\xf3\xfa\xf3\xb2\xcb\xb0\xa2\x14\xa1\x81"+        , {-taglen = -}16+        , {-tag = -}"\x5f\x63\xb8\xeb\x1d\x6f\xa8\x7a\xeb\x39\xa5\xf6\xd7\xed\xc3\x13")+    ,   ( {-key = -}"\x01\x02\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-iv = -}"\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , {-aad = -}"\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76\x76"+        , {-input = -}"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"+        , {-out = -}"\xe4\x42\xf8\xc4\xc6\x67\x84\x86\x4a\x5a\x6e\xc7\xe0\xca\x68\xac\x16\xbc\x5b\xbf\xf7\xd5\xf3\xfa\xf3\xb2\xcb\xb0\xa2\x14\xa1"+        , {-taglen = -}16+        , {-tag = -}"\x94\xd1\x47\xc3\xa2\xca\x93\xe9\x66\x93\x1e\x3b\xb3\xbb\x67\x01")+    ]++vectors_aes256_enc :: [KATGCM]+vectors_aes256_enc =+    [+        ( "\xb5\x2c\x50\x5a\x37\xd7\x8e\xda\x5d\xd3\x4f\x20\xc2\x25\x40\xea\x1b\x58\x96\x3c\xf8\xe5\xbf\x8f\xfa\x85\xf9\xf2\x49\x25\x05\xb4"+        , "\x51\x6c\x33\x92\x9d\xf5\xa3\x28\x4f\xf4\x63\xd7"+        , ""+        , ""+        , ""+        , 16+        , "\xbd\xc1\xac\x88\x4d\x33\x24\x57\xa1\xd2\x66\x4f\x16\x8c\x76\xf0")+    ,   ( "\x78\xdc\x4e\x0a\xaf\x52\xd9\x35\xc3\xc0\x1e\xea\x57\x42\x8f\x00\xca\x1f\xd4\x75\xf5\xda\x86\xa4\x9c\x8d\xd7\x3d\x68\xc8\xe2\x23"+        , "\xd7\x9c\xf2\x2d\x50\x4c\xc7\x93\xc3\xfb\x6c\x8a"+        , "\xb9\x6b\xaa\x8c\x1c\x75\xa6\x71\xbf\xb2\xd0\x8d\x06\xbe\x5f\x36"+        , ""+        , ""+        , 16+        , "\x3e\x5d\x48\x6a\xa2\xe3\x0b\x22\xe0\x40\xb8\x57\x23\xa0\x6e\x76")+    ,   ( "\xc3\xf1\x05\x86\xf2\x46\xaa\xca\xdc\xce\x37\x01\x44\x17\x70\xc0\x3c\xfe\xc9\x40\xaf\xe1\x90\x8c\x4c\x53\x7d\xf4\xe0\x1c\x50\xa0"+        , "\x4f\x52\xfa\xa1\xfa\x67\xa0\xe5\xf4\x19\x64\x52"+        , "\x46\xf9\xa2\x2b\x4e\x52\xe1\x52\x65\x13\xa9\x52\xdb\xee\x3b\x91\xf6\x95\x95\x50\x1e\x01\x77\xd5\x0f\xf3\x64\x63\x85\x88\xc0\x8d\x92\xfa\xb8\xc5\x8a\x96\x9b\xdc\xc8\x4c\x46\x8d\x84\x98\xc4\xf0\x63\x92\xb9\x9e\xd5\xe0\xc4\x84\x50\x7f\xc4\x8d\xc1\x8d\x87\xc4\x0e\x2e\xd8\x48\xb4\x31\x50\xbe\x9d\x36\xf1\x4c\xf2\xce\xf1\x31\x0b\xa4\xa7\x45\xad\xcc\x7b\xdc\x41\xf6"+        , "\x79\xd9\x7e\xa3\xa2\xed\xd6\x50\x45\x82\x1e\xa7\x45\xa4\x47\x42"+        , "\x56\x0c\xf7\x16\xe5\x61\x90\xe9\x39\x7c\x2f\x10\x36\x29\xeb\x1f"+        , 16+        , "\xff\x7c\x91\x24\x87\x96\x44\xe8\x05\x55\x68\x7d\x27\x3c\x55\xd8"+        )+    ]
+ tests/KAT_AES/KATOCB3.hs view
@@ -0,0 +1,46 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_AES.KATOCB3 where++import qualified Data.ByteString as B+import Data.ByteString.Char8 ()++-- (key, iv, aad, input, out, taglen, tag)+type KATOCB3 = (B.ByteString, B.ByteString, B.ByteString, B.ByteString, B.ByteString, Int, B.ByteString)++key1   = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"+nonce1 = "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b"++vectors_aes128_enc :: [KATOCB3]+vectors_aes128_enc =+    [ ( {-key = -} key1+      , {-iv = -} nonce1+      , {-aad = -}""+      , {-input = -}""+      , {-out = -}""+      , {-taglen = -} 16+      , {-tag = -} "\x19\x7b\x9c\x3c\x44\x1d\x3c\x83\xea\xfb\x2b\xef\x63\x3b\x91\x82")+    , ( key1, nonce1+      , "\x00\x01\x02\x03\x04\x05\x06\x07"+      , "\x00\x01\x02\x03\x04\x05\x06\x07"+      , "\x92\xb6\x57\x13\x0a\x74\xb8\x5a"+      , 16+      , "\x16\xdc\x76\xa4\x6d\x47\xe1\xea\xd5\x37\x20\x9e\x8a\x96\xd1\x4e")+    , ( key1, nonce1+      , "\x00\x01\x02\x03\x04\x05\x06\x07"+      , ""+      , ""+      , 16+      , "\x98\xb9\x15\x52\xc8\xc0\x09\x18\x50\x44\xe3\x0a\x6e\xb2\xfe\x21")+    , ( key1, nonce1+      , ""+      , "\x00\x01\x02\x03\x04\x05\x06\x07"+      , "\x92\xb6\x57\x13\x0a\x74\xb8\x5a"+      , 16+      , "\x97\x1e\xff\xca\xe1\x9a\xd4\x71\x6f\x88\xe8\x7b\x87\x1f\xbe\xed")+    , ( key1, nonce1+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"+      , "\xbe\xa5\xe8\x79\x8d\xbe\x71\x10\x03\x1c\x14\x4d\xa0\xb2\x61\x22"+      , 16+      , "\x77\x6c\x99\x24\xd6\x72\x3a\x1f\xc4\x52\x45\x32\xac\x3e\x5b\xeb")+    ]
+ tests/KAT_AES/KATXTS.hs view
@@ -0,0 +1,59 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_AES.KATXTS where++import qualified Data.ByteString as B+import Data.ByteString.Char8 ()++type KATXTS = (B.ByteString, B.ByteString, B.ByteString, B.ByteString, B.ByteString, B.ByteString)++vectors_aes128_enc, vectors_aes128_dec, vectors_aes256_enc, vectors_aes256_dec :: [KATXTS]+vectors_aes128_enc =+    [+        ( "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x66\xe9\x4b\xd4\xef\x8a\x2c\x3b\x88\x4c\xfa\x59\xca\x34\x2b\x2e\xcc\xd2\x97\xa8\xdf\x15\x59\x76\x10\x99\xf4\xb3\x94\x69\x56\x5c"+        , "\x91\x7c\xf6\x9e\xbd\x68\xb2\xec\x9b\x9f\xe9\xa3\xea\xdd\xa6\x92\xcd\x43\xd2\xf5\x95\x98\xed\x85\x8c\x02\xc2\x65\x2f\xbf\x92\x2e"+        )+    ,+        ( "\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11\x11"+        , "\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22"+        , "\x33\x33\x33\x33\x33\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44"+        , "\x3f\x80\x3b\xcd\x0d\x7f\xd2\xb3\x75\x58\x41\x9f\x59\xd5\xcd\xa6\xf9\x00\x77\x9a\x1b\xfe\xa4\x67\xeb\xb0\x82\x3e\xb3\xaa\x9b\x4d"+        , "\xc4\x54\x18\x5e\x6a\x16\x93\x6e\x39\x33\x40\x38\xac\xef\x83\x8b\xfb\x18\x6f\xff\x74\x80\xad\xc4\x28\x93\x82\xec\xd6\xd3\x94\xf0"+        )+    ,+        ( "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"+        , "\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22\x22"+        , "\x33\x33\x33\x33\x33\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44"+        , "\x3f\x80\x3b\xcd\x0d\x7f\xd2\xb3\x75\x58\x41\x9f\x59\xd5\xcd\xa6\xf9\x00\x77\x9a\x1b\xfe\xa4\x67\xeb\xb0\x82\x3e\xb3\xaa\x9b\x4d"+        , "\xaf\x85\x33\x6b\x59\x7a\xfc\x1a\x90\x0b\x2e\xb2\x1e\xc9\x49\xd2\x92\xdf\x4c\x04\x7e\x0b\x21\x53\x21\x86\xa5\x97\x1a\x22\x7a\x89"+        )+    ,+        ( "\x27\x18\x28\x18\x28\x45\x90\x45\x23\x53\x60\x28\x74\x71\x35\x26"+        , "\x31\x41\x59\x26\x53\x58\x97\x93\x23\x84\x62\x64\x33\x83\x27\x95"+        , "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"+        , ""+        , "\x27\xa7\x47\x9b\xef\xa1\xd4\x76\x48\x9f\x30\x8c\xd4\xcf\xa6\xe2\xa9\x6e\x4b\xbe\x32\x08\xff\x25\x28\x7d\xd3\x81\x96\x16\xe8\x9c\xc7\x8c\xf7\xf5\xe5\x43\x44\x5f\x83\x33\xd8\xfa\x7f\x56\x00\x00\x05\x27\x9f\xa5\xd8\xb5\xe4\xad\x40\xe7\x36\xdd\xb4\xd3\x54\x12\x32\x80\x63\xfd\x2a\xab\x53\xe5\xea\x1e\x0a\x9f\x33\x25\x00\xa5\xdf\x94\x87\xd0\x7a\x5c\x92\xcc\x51\x2c\x88\x66\xc7\xe8\x60\xce\x93\xfd\xf1\x66\xa2\x49\x12\xb4\x22\x97\x61\x46\xae\x20\xce\x84\x6b\xb7\xdc\x9b\xa9\x4a\x76\x7a\xae\xf2\x0c\x0d\x61\xad\x02\x65\x5e\xa9\x2d\xc4\xc4\xe4\x1a\x89\x52\xc6\x51\xd3\x31\x74\xbe\x51\xa1\x0c\x42\x11\x10\xe6\xd8\x15\x88\xed\xe8\x21\x03\xa2\x52\xd8\xa7\x50\xe8\x76\x8d\xef\xff\xed\x91\x22\x81\x0a\xae\xb9\x9f\x91\x72\xaf\x82\xb6\x04\xdc\x4b\x8e\x51\xbc\xb0\x82\x35\xa6\xf4\x34\x13\x32\xe4\xca\x60\x48\x2a\x4b\xa1\xa0\x3b\x3e\x65\x00\x8f\xc5\xda\x76\xb7\x0b\xf1\x69\x0d\xb4\xea\xe2\x9c\x5f\x1b\xad\xd0\x3c\x5c\xcf\x2a\x55\xd7\x05\xdd\xcd\x86\xd4\x49\x51\x1c\xeb\x7e\xc3\x0b\xf1\x2b\x1f\xa3\x5b\x91\x3f\x9f\x74\x7a\x8a\xfd\x1b\x13\x0e\x94\xbf\xf9\x4e\xff\xd0\x1a\x91\x73\x5c\xa1\x72\x6a\xcd\x0b\x19\x7c\x4e\x5b\x03\x39\x36\x97\xe1\x26\x82\x6f\xb6\xbb\xde\x8e\xcc\x1e\x08\x29\x85\x16\xe2\xc9\xed\x03\xff\x3c\x1b\x78\x60\xf6\xde\x76\xd4\xce\xcd\x94\xc8\x11\x98\x55\xef\x52\x97\xca\x67\xe9\xf3\xe7\xff\x72\xb1\xe9\x97\x85\xca\x0a\x7e\x77\x20\xc5\xb3\x6d\xc6\xd7\x2c\xac\x95\x74\xc8\xcb\xbc\x2f\x80\x1e\x23\xe5\x6f\xd3\x44\xb0\x7f\x22\x15\x4b\xeb\xa0\xf0\x8c\xe8\x89\x1e\x64\x3e\xd9\x95\xc9\x4d\x9a\x69\xc9\xf1\xb5\xf4\x99\x02\x7a\x78\x57\x2a\xee\xbd\x74\xd2\x0c\xc3\x98\x81\xc2\x13\xee\x77\x0b\x10\x10\xe4\xbe\xa7\x18\x84\x69\x77\xae\x11\x9f\x7a\x02\x3a\xb5\x8c\xca\x0a\xd7\x52\xaf\xe6\x56\xbb\x3c\x17\x25\x6a\x9f\x6e\x9b\xf1\x9f\xdd\x5a\x38\xfc\x82\xbb\xe8\x72\xc5\x53\x9e\xdb\x60\x9e\xf4\xf7\x9c\x20\x3e\xbb\x14\x0f\x2e\x58\x3c\xb2\xad\x15\xb4\xaa\x5b\x65\x50\x16\xa8\x44\x92\x77\xdb\xd4\x77\xef\x2c\x8d\x6c\x01\x7d\xb7\x38\xb1\x8d\xeb\x4a\x42\x7d\x19\x23\xce\x3f\xf2\x62\x73\x57\x79\xa4\x18\xf2\x0a\x28\x2d\xf9\x20\x14\x7b\xea\xbe\x42\x1e\xe5\x31\x9d\x05\x68"+        )+    ]++vectors_aes128_dec =+    []++vectors_aes256_enc =+    [+        ( "\x27\x18\x28\x18\x28\x45\x90\x45\x23\x53\x60\x28\x74\x71\x35\x26\x62\x49\x77\x57\x24\x70\x93\x69\x99\x59\x57\x49\x66\x96\x76\x27"+        , "\x31\x41\x59\x26\x53\x58\x97\x93\x23\x84\x62\x64\x33\x83\x27\x95\x02\x88\x41\x97\x16\x93\x99\x37\x51\x05\x82\x09\x74\x94\x45\x92"+        , "\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+        , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"+        , ""+        , "\x1c\x3b\x3a\x10\x2f\x77\x03\x86\xe4\x83\x6c\x99\xe3\x70\xcf\x9b\xea\x00\x80\x3f\x5e\x48\x23\x57\xa4\xae\x12\xd4\x14\xa3\xe6\x3b\x5d\x31\xe2\x76\xf8\xfe\x4a\x8d\x66\xb3\x17\xf9\xac\x68\x3f\x44\x68\x0a\x86\xac\x35\xad\xfc\x33\x45\xbe\xfe\xcb\x4b\xb1\x88\xfd\x57\x76\x92\x6c\x49\xa3\x09\x5e\xb1\x08\xfd\x10\x98\xba\xec\x70\xaa\xa6\x69\x99\xa7\x2a\x82\xf2\x7d\x84\x8b\x21\xd4\xa7\x41\xb0\xc5\xcd\x4d\x5f\xff\x9d\xac\x89\xae\xba\x12\x29\x61\xd0\x3a\x75\x71\x23\xe9\x87\x0f\x8a\xcf\x10\x00\x02\x08\x87\x89\x14\x29\xca\x2a\x3e\x7a\x7d\x7d\xf7\xb1\x03\x55\x16\x5c\x8b\x9a\x6d\x0a\x7d\xe8\xb0\x62\xc4\x50\x0d\xc4\xcd\x12\x0c\x0f\x74\x18\xda\xe3\xd0\xb5\x78\x1c\x34\x80\x3f\xa7\x54\x21\xc7\x90\xdf\xe1\xde\x18\x34\xf2\x80\xd7\x66\x7b\x32\x7f\x6c\x8c\xd7\x55\x7e\x12\xac\x3a\x0f\x93\xec\x05\xc5\x2e\x04\x93\xef\x31\xa1\x2d\x3d\x92\x60\xf7\x9a\x28\x9d\x6a\x37\x9b\xc7\x0c\x50\x84\x14\x73\xd1\xa8\xcc\x81\xec\x58\x3e\x96\x45\xe0\x7b\x8d\x96\x70\x65\x5b\xa5\xbb\xcf\xec\xc6\xdc\x39\x66\x38\x0a\xd8\xfe\xcb\x17\xb6\xba\x02\x46\x9a\x02\x0a\x84\xe1\x8e\x8f\x84\x25\x20\x70\xc1\x3e\x9f\x1f\x28\x9b\xe5\x4f\xbc\x48\x14\x57\x77\x8f\x61\x60\x15\xe1\x32\x7a\x02\xb1\x40\xf1\x50\x5e\xb3\x09\x32\x6d\x68\x37\x8f\x83\x74\x59\x5c\x84\x9d\x84\xf4\xc3\x33\xec\x44\x23\x88\x51\x43\xcb\x47\xbd\x71\xc5\xed\xae\x9b\xe6\x9a\x2f\xfe\xce\xb1\xbe\xc9\xde\x24\x4f\xbe\x15\x99\x2b\x11\xb7\x7c\x04\x0f\x12\xbd\x8f\x6a\x97\x5a\x44\xa0\xf9\x0c\x29\xa9\xab\xc3\xd4\xd8\x93\x92\x72\x84\xc5\x87\x54\xcc\xe2\x94\x52\x9f\x86\x14\xdc\xd2\xab\xa9\x91\x92\x5f\xed\xc4\xae\x74\xff\xac\x6e\x33\x3b\x93\xeb\x4a\xff\x04\x79\xda\x9a\x41\x0e\x44\x50\xe0\xdd\x7a\xe4\xc6\xe2\x91\x09\x00\x57\x5d\xa4\x01\xfc\x07\x05\x9f\x64\x5e\x8b\x7e\x9b\xfd\xef\x33\x94\x30\x54\xff\x84\x01\x14\x93\xc2\x7b\x34\x29\xea\xed\xb4\xed\x53\x76\x44\x1a\x77\xed\x43\x85\x1a\xd7\x7f\x16\xf5\x41\xdf\xd2\x69\xd5\x0d\x6a\x5f\x14\xfb\x0a\xab\x1c\xbb\x4c\x15\x50\xbe\x97\xf7\xab\x40\x66\x19\x3c\x4c\xaa\x77\x3d\xad\x38\x01\x4b\xd2\x09\x2f\xa7\x55\xc8\x24\xbb\x5e\x54\xc4\xf3\x6f\xfd\xa9\xfc\xea\x70\xb9\xc6\xe6\x93\xe1\x48\xc1\x51"+        )+    ]++vectors_aes256_dec = []
+ tests/KAT_AFIS.hs view
@@ -0,0 +1,44 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ExistentialQuantification #-}+module KAT_AFIS (tests) where++import Imports++import Crypto.Hash+import Crypto.Random+import qualified Crypto.Data.AFIS as AFIS+import qualified Data.ByteString as B++mergeVec :: [ (Int, SHA1, B.ByteString, B.ByteString) ]+mergeVec =+    [ (3+      , SHA1+      , "\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02\x02"+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\xd4\x76\xc8\x58\xbd\xf0\x15\xbe\x9f\x40\xe3\x65\x20\x1c\x9c\xb8\xd8\x1c\x16\x64"+      )+    , (3+      , SHA1+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17"+      , "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\xd6\x75\xc8\x59\xbb\xf7\x11\xbb\x95\x4b\xeb\x6c\x2e\x13\x90\xb5\xca\x0f\x06\x75\x17\x70\x39\x28"+      )+    ]++mergeKATs = map toProp $ zip mergeVec [(0 :: Int)..]+  where toProp ((nbExpands, hashAlg, expected, dat), i) =+            testCase ("merge " ++ show i) (expected @=? AFIS.merge hashAlg nbExpands dat)++data AFISParams = AFISParams B.ByteString Int SHA1 ChaChaDRG++instance Show AFISParams where+    show (AFISParams dat expand _ _) = "data: " ++ show dat ++ " expanded: " ++ show expand++instance Arbitrary AFISParams where+    arbitrary = AFISParams <$> arbitraryBSof 3 46 <*> choose (2,2) <*> elements [SHA1] <*> arbitrary++instance Arbitrary ChaChaDRG where+    arbitrary = drgNewTest <$> arbitrary++tests = testGroup "AFIS"+    [ testGroup "KAT merge" mergeKATs+    , testProperty "merge.split == id" $ \(AFISParams bs e hf rng) -> bs == (AFIS.merge hf e $ fst (AFIS.split hf rng e bs))+    ]
+ tests/KAT_Blowfish.hs view
@@ -0,0 +1,47 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_Blowfish where++import Crypto.Cipher.Blowfish+import Imports ()+import BlockCipher++vectors_ecb = -- key plaintext cipher+    [ KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x4E\xF9\x97\x45\x61\x98\xDD\x78"+    , KAT_ECB "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x51\x86\x6F\xD5\xB8\x5E\xCB\x8A"+    , KAT_ECB "\x30\x00\x00\x00\x00\x00\x00\x00" "\x10\x00\x00\x00\x00\x00\x00\x01" "\x7D\x85\x6F\x9A\x61\x30\x63\xF2"+    , KAT_ECB "\x11\x11\x11\x11\x11\x11\x11\x11" "\x11\x11\x11\x11\x11\x11\x11\x11" "\x24\x66\xDD\x87\x8B\x96\x3C\x9D"+    , KAT_ECB "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x11\x11\x11\x11\x11\x11\x11\x11" "\x61\xF9\xC3\x80\x22\x81\xB0\x96"+    , KAT_ECB "\x11\x11\x11\x11\x11\x11\x11\x11" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x7D\x0C\xC6\x30\xAF\xDA\x1E\xC7"+    , KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x4E\xF9\x97\x45\x61\x98\xDD\x78"+    , KAT_ECB "\xFE\xDC\xBA\x98\x76\x54\x32\x10" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x0A\xCE\xAB\x0F\xC6\xA0\xA2\x8D"+    , KAT_ECB "\x7C\xA1\x10\x45\x4A\x1A\x6E\x57" "\x01\xA1\xD6\xD0\x39\x77\x67\x42" "\x59\xC6\x82\x45\xEB\x05\x28\x2B"+    , KAT_ECB "\x01\x31\xD9\x61\x9D\xC1\x37\x6E" "\x5C\xD5\x4C\xA8\x3D\xEF\x57\xDA" "\xB1\xB8\xCC\x0B\x25\x0F\x09\xA0"+    , KAT_ECB "\x07\xA1\x13\x3E\x4A\x0B\x26\x86" "\x02\x48\xD4\x38\x06\xF6\x71\x72" "\x17\x30\xE5\x77\x8B\xEA\x1D\xA4"+    , KAT_ECB "\x38\x49\x67\x4C\x26\x02\x31\x9E" "\x51\x45\x4B\x58\x2D\xDF\x44\x0A" "\xA2\x5E\x78\x56\xCF\x26\x51\xEB"+    , KAT_ECB "\x04\xB9\x15\xBA\x43\xFE\xB5\xB6" "\x42\xFD\x44\x30\x59\x57\x7F\xA2" "\x35\x38\x82\xB1\x09\xCE\x8F\x1A"+    , KAT_ECB "\x01\x13\xB9\x70\xFD\x34\xF2\xCE" "\x05\x9B\x5E\x08\x51\xCF\x14\x3A" "\x48\xF4\xD0\x88\x4C\x37\x99\x18"+    , KAT_ECB "\x01\x70\xF1\x75\x46\x8F\xB5\xE6" "\x07\x56\xD8\xE0\x77\x47\x61\xD2" "\x43\x21\x93\xB7\x89\x51\xFC\x98"+    , KAT_ECB "\x43\x29\x7F\xAD\x38\xE3\x73\xFE" "\x76\x25\x14\xB8\x29\xBF\x48\x6A" "\x13\xF0\x41\x54\xD6\x9D\x1A\xE5"+    , KAT_ECB "\x07\xA7\x13\x70\x45\xDA\x2A\x16" "\x3B\xDD\x11\x90\x49\x37\x28\x02" "\x2E\xED\xDA\x93\xFF\xD3\x9C\x79"+    , KAT_ECB "\x04\x68\x91\x04\xC2\xFD\x3B\x2F" "\x26\x95\x5F\x68\x35\xAF\x60\x9A" "\xD8\x87\xE0\x39\x3C\x2D\xA6\xE3"+    , KAT_ECB "\x37\xD0\x6B\xB5\x16\xCB\x75\x46" "\x16\x4D\x5E\x40\x4F\x27\x52\x32" "\x5F\x99\xD0\x4F\x5B\x16\x39\x69"+    , KAT_ECB "\x1F\x08\x26\x0D\x1A\xC2\x46\x5E" "\x6B\x05\x6E\x18\x75\x9F\x5C\xCA" "\x4A\x05\x7A\x3B\x24\xD3\x97\x7B"+    , KAT_ECB "\x58\x40\x23\x64\x1A\xBA\x61\x76" "\x00\x4B\xD6\xEF\x09\x17\x60\x62" "\x45\x20\x31\xC1\xE4\xFA\xDA\x8E"+    , KAT_ECB "\x02\x58\x16\x16\x46\x29\xB0\x07" "\x48\x0D\x39\x00\x6E\xE7\x62\xF2" "\x75\x55\xAE\x39\xF5\x9B\x87\xBD"+    , KAT_ECB "\x49\x79\x3E\xBC\x79\xB3\x25\x8F" "\x43\x75\x40\xC8\x69\x8F\x3C\xFA" "\x53\xC5\x5F\x9C\xB4\x9F\xC0\x19"+    , KAT_ECB "\x4F\xB0\x5E\x15\x15\xAB\x73\xA7" "\x07\x2D\x43\xA0\x77\x07\x52\x92" "\x7A\x8E\x7B\xFA\x93\x7E\x89\xA3"+    , KAT_ECB "\x49\xE9\x5D\x6D\x4C\xA2\x29\xBF" "\x02\xFE\x55\x77\x81\x17\xF1\x2A" "\xCF\x9C\x5D\x7A\x49\x86\xAD\xB5"+    , KAT_ECB "\x01\x83\x10\xDC\x40\x9B\x26\xD6" "\x1D\x9D\x5C\x50\x18\xF7\x28\xC2" "\xD1\xAB\xB2\x90\x65\x8B\xC7\x78"+    , KAT_ECB "\x1C\x58\x7F\x1C\x13\x92\x4F\xEF" "\x30\x55\x32\x28\x6D\x6F\x29\x5A" "\x55\xCB\x37\x74\xD1\x3E\xF2\x01"+    , KAT_ECB "\x01\x01\x01\x01\x01\x01\x01\x01" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xFA\x34\xEC\x48\x47\xB2\x68\xB2"+    , KAT_ECB "\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xA7\x90\x79\x51\x08\xEA\x3C\xAE"+    , KAT_ECB "\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xC3\x9E\x07\x2D\x9F\xAC\x63\x1D"+    , KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x01\x49\x33\xE0\xCD\xAF\xF6\xE4"+    , KAT_ECB "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x00\x00\x00\x00\x00\x00\x00\x00" "\xF2\x1E\x9A\x77\xB7\x1C\x49\xBC"+    , KAT_ECB "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x24\x59\x46\x88\x57\x54\x36\x9A"+    , KAT_ECB "\xFE\xDC\xBA\x98\x76\x54\x32\x10" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x6B\x5C\x5A\x9C\x5D\x9E\x0A\x5A"+    ]++kats = defaultKATs { kat_ECB = vectors_ecb }++tests = testBlockCipher kats (undefined :: Blowfish64)
+ tests/KAT_Camellia.hs view
@@ -0,0 +1,34 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ViewPatterns #-}+{-# OPTIONS_GHC -fno-warn-unused-binds #-}+{-# OPTIONS_GHC -fno-warn-unused-matches #-}+module KAT_Camellia (tests) where++import Imports ()+import BlockCipher++import qualified Data.ByteString as B+import Crypto.Cipher.Camellia++vectors_camellia128 =+    [ KAT_ECB (B.replicate 16 0) (B.replicate 16 0) (B.pack [0x3d,0x02,0x80,0x25,0xb1,0x56,0x32,0x7c,0x17,0xf7,0x62,0xc1,0xf2,0xcb,0xca,0x71])+    , KAT_ECB (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10])+              (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10])+              (B.pack [0x67,0x67,0x31,0x38,0x54,0x96,0x69,0x73,0x08,0x57,0x06,0x56,0x48,0xea,0xbe,0x43])+    ]++vectors_camellia192 =+    [ KAT_ECB (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77]) (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10]) (B.pack [0xb4,0x99,0x34,0x01,0xb3,0xe9,0x96,0xf8,0x4e,0xe5,0xce,0xe7,0xd7,0x9b,0x09,0xb9])+    ]++vectors_camellia256 =+    [ KAT_ECB (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10 ,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff])+              (B.pack [0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10])+              (B.pack [0x9a,0xcc,0x23,0x7d,0xff,0x16,0xd7,0x6c,0x20,0xef,0x7c,0x91,0x9e,0x3a,0x75,0x09])+    ]++kats128 = defaultKATs { kat_ECB = vectors_camellia128 }+kats192 = defaultKATs { kat_ECB = vectors_camellia192 }+kats256 = defaultKATs { kat_ECB = vectors_camellia256 }++tests = testBlockCipher kats128 (undefined :: Camellia128)
+ tests/KAT_Curve25519.hs view
@@ -0,0 +1,22 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_Curve25519 ( tests ) where++import qualified Crypto.PubKey.Curve25519 as Curve25519+import           Data.ByteArray as B+import           Imports++alicePrivate = either error id $ Curve25519.secretKey ("\x77\x07\x6d\x0a\x73\x18\xa5\x7d\x3c\x16\xc1\x72\x51\xb2\x66\x45\xdf\x4c\x2f\x87\xeb\xc0\x99\x2a\xb1\x77\xfb\xa5\x1d\xb9\x2c\x2a" :: ByteString)+alicePublic  = either error id $ Curve25519.publicKey ("\x85\x20\xf0\x09\x89\x30\xa7\x54\x74\x8b\x7d\xdc\xb4\x3e\xf7\x5a\x0d\xbf\x3a\x0d\x26\x38\x1a\xf4\xeb\xa4\xa9\x8e\xaa\x9b\x4e\x6a" :: ByteString)+bobPrivate   = either error id $ Curve25519.secretKey ("\x5d\xab\x08\x7e\x62\x4a\x8a\x4b\x79\xe1\x7f\x8b\x83\x80\x0e\xe6\x6f\x3b\xb1\x29\x26\x18\xb6\xfd\x1c\x2f\x8b\x27\xff\x88\xe0\xeb" :: ByteString)+bobPublic    = either error id $ Curve25519.publicKey ("\xde\x9e\xdb\x7d\x7b\x7d\xc1\xb4\xd3\x5b\x61\xc2\xec\xe4\x35\x37\x3f\x83\x43\xc8\x5b\x78\x67\x4d\xad\xfc\x7e\x14\x6f\x88\x2b\x4f" :: ByteString)+aliceMultBob = "\x4a\x5d\x9d\x5b\xa4\xce\x2d\xe1\x72\x8e\x3b\xf4\x80\x35\x0f\x25\xe0\x7e\x21\xc9\x47\xd1\x9e\x33\x76\xf0\x9b\x3c\x1e\x16\x17\x42" :: ByteString++katTests :: [TestTree]+katTests =+    [ testCase "0" (aliceMultBob @=? B.convert (Curve25519.dh alicePublic bobPrivate))+    , testCase "1" (aliceMultBob @=? B.convert (Curve25519.dh bobPublic alicePrivate))+    ]++tests = testGroup "Curve25519"+    [ testGroup "KATs" katTests+    ]
+ tests/KAT_DES.hs view
@@ -0,0 +1,49 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ViewPatterns #-}+module KAT_DES (tests) where++import Imports+import BlockCipher+import qualified Crypto.Cipher.DES as DES++vectors_ecb = -- key plaintext ciphertext+    [ KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x8C\xA6\x4D\xE9\xC1\xB1\x23\xA7"+    , KAT_ECB "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x73\x59\xB2\x16\x3E\x4E\xDC\x58"+    , KAT_ECB "\x30\x00\x00\x00\x00\x00\x00\x00" "\x10\x00\x00\x00\x00\x00\x00\x01" "\x95\x8E\x6E\x62\x7A\x05\x55\x7B"+    , KAT_ECB "\x11\x11\x11\x11\x11\x11\x11\x11" "\x11\x11\x11\x11\x11\x11\x11\x11" "\xF4\x03\x79\xAB\x9E\x0E\xC5\x33"+    , KAT_ECB "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x11\x11\x11\x11\x11\x11\x11\x11" "\x17\x66\x8D\xFC\x72\x92\x53\x2D"+    , KAT_ECB "\x11\x11\x11\x11\x11\x11\x11\x11" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x8A\x5A\xE1\xF8\x1A\xB8\xF2\xDD"+    , KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\x8C\xA6\x4D\xE9\xC1\xB1\x23\xA7"+    , KAT_ECB "\xFE\xDC\xBA\x98\x76\x54\x32\x10" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xED\x39\xD9\x50\xFA\x74\xBC\xC4"+    , KAT_ECB "\x7C\xA1\x10\x45\x4A\x1A\x6E\x57" "\x01\xA1\xD6\xD0\x39\x77\x67\x42" "\x69\x0F\x5B\x0D\x9A\x26\x93\x9B"+    , KAT_ECB "\x01\x31\xD9\x61\x9D\xC1\x37\x6E" "\x5C\xD5\x4C\xA8\x3D\xEF\x57\xDA" "\x7A\x38\x9D\x10\x35\x4B\xD2\x71"+    , KAT_ECB "\x07\xA1\x13\x3E\x4A\x0B\x26\x86" "\x02\x48\xD4\x38\x06\xF6\x71\x72" "\x86\x8E\xBB\x51\xCA\xB4\x59\x9A"+    , KAT_ECB "\x38\x49\x67\x4C\x26\x02\x31\x9E" "\x51\x45\x4B\x58\x2D\xDF\x44\x0A" "\x71\x78\x87\x6E\x01\xF1\x9B\x2A"+    , KAT_ECB "\x04\xB9\x15\xBA\x43\xFE\xB5\xB6" "\x42\xFD\x44\x30\x59\x57\x7F\xA2" "\xAF\x37\xFB\x42\x1F\x8C\x40\x95"+    , KAT_ECB "\x01\x13\xB9\x70\xFD\x34\xF2\xCE" "\x05\x9B\x5E\x08\x51\xCF\x14\x3A" "\x86\xA5\x60\xF1\x0E\xC6\xD8\x5B"+    , KAT_ECB "\x01\x70\xF1\x75\x46\x8F\xB5\xE6" "\x07\x56\xD8\xE0\x77\x47\x61\xD2" "\x0C\xD3\xDA\x02\x00\x21\xDC\x09"+    , KAT_ECB "\x43\x29\x7F\xAD\x38\xE3\x73\xFE" "\x76\x25\x14\xB8\x29\xBF\x48\x6A" "\xEA\x67\x6B\x2C\xB7\xDB\x2B\x7A"+    , KAT_ECB "\x07\xA7\x13\x70\x45\xDA\x2A\x16" "\x3B\xDD\x11\x90\x49\x37\x28\x02" "\xDF\xD6\x4A\x81\x5C\xAF\x1A\x0F"+    , KAT_ECB "\x04\x68\x91\x04\xC2\xFD\x3B\x2F" "\x26\x95\x5F\x68\x35\xAF\x60\x9A" "\x5C\x51\x3C\x9C\x48\x86\xC0\x88"+    , KAT_ECB "\x37\xD0\x6B\xB5\x16\xCB\x75\x46" "\x16\x4D\x5E\x40\x4F\x27\x52\x32" "\x0A\x2A\xEE\xAE\x3F\xF4\xAB\x77"+    , KAT_ECB "\x1F\x08\x26\x0D\x1A\xC2\x46\x5E" "\x6B\x05\x6E\x18\x75\x9F\x5C\xCA" "\xEF\x1B\xF0\x3E\x5D\xFA\x57\x5A"+    , KAT_ECB "\x58\x40\x23\x64\x1A\xBA\x61\x76" "\x00\x4B\xD6\xEF\x09\x17\x60\x62" "\x88\xBF\x0D\xB6\xD7\x0D\xEE\x56"+    , KAT_ECB "\x02\x58\x16\x16\x46\x29\xB0\x07" "\x48\x0D\x39\x00\x6E\xE7\x62\xF2" "\xA1\xF9\x91\x55\x41\x02\x0B\x56"+    , KAT_ECB "\x49\x79\x3E\xBC\x79\xB3\x25\x8F" "\x43\x75\x40\xC8\x69\x8F\x3C\xFA" "\x6F\xBF\x1C\xAF\xCF\xFD\x05\x56"+    , KAT_ECB "\x4F\xB0\x5E\x15\x15\xAB\x73\xA7" "\x07\x2D\x43\xA0\x77\x07\x52\x92" "\x2F\x22\xE4\x9B\xAB\x7C\xA1\xAC"+    , KAT_ECB "\x49\xE9\x5D\x6D\x4C\xA2\x29\xBF" "\x02\xFE\x55\x77\x81\x17\xF1\x2A" "\x5A\x6B\x61\x2C\xC2\x6C\xCE\x4A"+    , KAT_ECB "\x01\x83\x10\xDC\x40\x9B\x26\xD6" "\x1D\x9D\x5C\x50\x18\xF7\x28\xC2" "\x5F\x4C\x03\x8E\xD1\x2B\x2E\x41"+    , KAT_ECB "\x1C\x58\x7F\x1C\x13\x92\x4F\xEF" "\x30\x55\x32\x28\x6D\x6F\x29\x5A" "\x63\xFA\xC0\xD0\x34\xD9\xF7\x93"+    , KAT_ECB "\x01\x01\x01\x01\x01\x01\x01\x01" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x61\x7B\x3A\x0C\xE8\xF0\x71\x00"+    , KAT_ECB "\x1F\x1F\x1F\x1F\x0E\x0E\x0E\x0E" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xDB\x95\x86\x05\xF8\xC8\xC6\x06"+    , KAT_ECB "\xE0\xFE\xE0\xFE\xF1\xFE\xF1\xFE" "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\xED\xBF\xD1\xC6\x6C\x29\xCC\xC7"+    , KAT_ECB "\x00\x00\x00\x00\x00\x00\x00\x00" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x35\x55\x50\xB2\x15\x0E\x24\x51"+    , KAT_ECB "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x00\x00\x00\x00\x00\x00\x00\x00" "\xCA\xAA\xAF\x4D\xEA\xF1\xDB\xAE"+    , KAT_ECB "\x01\x23\x45\x67\x89\xAB\xCD\xEF" "\x00\x00\x00\x00\x00\x00\x00\x00" "\xD5\xD4\x4F\xF7\x20\x68\x3D\x0D"+    , KAT_ECB "\xFE\xDC\xBA\x98\x76\x54\x32\x10" "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF" "\x2A\x2B\xB0\x08\xDF\x97\xC2\xF2"+    ]++kats = defaultKATs { kat_ECB = vectors_ecb }++tests = localOption (QuickCheckTests 5)+      $ testBlockCipher kats (undefined :: DES.DES)
+ tests/KAT_Ed25519.hs view
@@ -0,0 +1,38 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE BangPatterns #-}+module KAT_Ed25519 ( tests ) where++import           Crypto.Error+import qualified Crypto.PubKey.Ed25519 as Ed25519+import           Imports++data Vec = Vec+    { vecSec :: ByteString+    , vecPub :: ByteString+    , vecMsg :: ByteString+    , vecSig :: ByteString+    } deriving (Show,Eq)++vec1 = Vec+    { vecSec = "\x4c\xcd\x08\x9b\x28\xff\x96\xda\x9d\xb6\xc3\x46\xec\x11\x4e\x0f\x5b\x8a\x31\x9f\x35\xab\xa6\x24\xda\x8c\xf6\xed\x4f\xb8\xa6\xfb"+    , vecPub = "\x3d\x40\x17\xc3\xe8\x43\x89\x5a\x92\xb7\x0a\xa7\x4d\x1b\x7e\xbc\x9c\x98\x2c\xcf\x2e\xc4\x96\x8c\xc0\xcd\x55\xf1\x2a\xf4\x66\x0c"+    , vecMsg = "\x72"+    , vecSig = "\x92\xa0\x09\xa9\xf0\xd4\xca\xb8\x72\x0e\x82\x0b\x5f\x64\x25\x40\xa2\xb2\x7b\x54\x16\x50\x3f\x8f\xb3\x76\x22\x23\xeb\xdb\x69\xda\x08\x5a\xc1\xe4\x3e\x15\x99\x6e\x45\x8f\x36\x13\xd0\xf1\x1d\x8c\x38\x7b\x2e\xae\xb4\x30\x2a\xee\xb0\x0d\x29\x16\x12\xbb\x0c\x00"+    }++testVec :: String -> Vec -> [TestTree]+testVec s vec =+    [ testCase (s ++ " gen publickey") (pub @=? Ed25519.toPublic sec)+    , testCase (s ++ " gen signature") (sig @=? Ed25519.sign sec pub (vecMsg vec))+    ]+  where+        !sig = throwCryptoError $ Ed25519.signature (vecSig vec)+        !pub = throwCryptoError $ Ed25519.publicKey (vecPub vec)+        !sec = throwCryptoError $ Ed25519.secretKey (vecSec vec)++katTests :: [TestTree]+katTests = testVec "vec 1" vec1++tests = testGroup "Ed25519"+    [ testGroup "KATs" katTests+    ]
+ tests/KAT_HMAC.hs view
@@ -0,0 +1,161 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_HMAC (tests) where++import qualified Crypto.MAC.HMAC as HMAC+import Crypto.Hash (MD5(..), SHA1(..), SHA256(..)+                   , Kekkak_224(..), Kekkak_256(..), Kekkak_384(..), Kekkak_512(..)+                   , SHA3_224(..), SHA3_256(..), SHA3_384(..), SHA3_512(..)+                   , HashAlgorithm, digestFromByteString)+import qualified Data.ByteString as B++import Imports++data MACVector hash = MACVector+    { macKey :: ByteString+    , macSecret :: ByteString+    , macResult :: HMAC.HMAC hash+    }++instance Show (HMAC.HMAC a) where+    show (HMAC.HMAC d) = show d++digest :: HashAlgorithm hash => ByteString -> HMAC.HMAC hash+digest = maybe (error "cannot get digest") HMAC.HMAC . digestFromByteString++v1 :: ByteString+v1 = "The quick brown fox jumps over the lazy dog"++md5MACVectors :: [MACVector MD5]+md5MACVectors =+    [ MACVector B.empty B.empty $ digest "\x74\xe6\xf7\x29\x8a\x9c\x2d\x16\x89\x35\xf5\x8c\x00\x1b\xad\x88"+    , MACVector "key"   v1      $ digest "\x80\x07\x07\x13\x46\x3e\x77\x49\xb9\x0c\x2d\xc2\x49\x11\xe2\x75"+    ]++sha1MACVectors :: [MACVector SHA1]+sha1MACVectors =+    [ MACVector B.empty B.empty $ digest "\xfb\xdb\x1d\x1b\x18\xaa\x6c\x08\x32\x4b\x7d\x64\xb7\x1f\xb7\x63\x70\x69\x0e\x1d"+    , MACVector "key"   v1      $ digest "\xde\x7c\x9b\x85\xb8\xb7\x8a\xa6\xbc\x8a\x7a\x36\xf7\x0a\x90\x70\x1c\x9d\xb4\xd9"+    ]++sha256MACVectors :: [MACVector SHA256]+sha256MACVectors =+    [ MACVector B.empty B.empty $ digest "\xb6\x13\x67\x9a\x08\x14\xd9\xec\x77\x2f\x95\xd7\x78\xc3\x5f\xc5\xff\x16\x97\xc4\x93\x71\x56\x53\xc6\xc7\x12\x14\x42\x92\xc5\xad"+    , MACVector "key"   v1      $ digest "\xf7\xbc\x83\xf4\x30\x53\x84\x24\xb1\x32\x98\xe6\xaa\x6f\xb1\x43\xef\x4d\x59\xa1\x49\x46\x17\x59\x97\x47\x9d\xbc\x2d\x1a\x3c\xd8"+    ]++kekkak_key1 = "\x4a\x65\x66\x65"+kekkak_data1 = "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f"++kekkak_224_MAC_Vectors :: [MACVector Kekkak_224]+kekkak_224_MAC_Vectors =+    [ MACVector kekkak_key1 kekkak_data1 $ digest "\xe8\x24\xfe\xc9\x6c\x07\x4f\x22\xf9\x92\x35\xbb\x94\x2d\xa1\x98\x26\x64\xab\x69\x2c\xa8\x50\x10\x53\xcb\xd4\x14"+    ]++kekkak_256_MAC_Vectors :: [MACVector Kekkak_256]+kekkak_256_MAC_Vectors =+    [  MACVector kekkak_key1 kekkak_data1 $ digest "\xaa\x9a\xed\x44\x8c\x7a\xbc\x8b\x5e\x32\x6f\xfa\x6a\x01\xcd\xed\xf7\xb4\xb8\x31\x88\x14\x68\xc0\x44\xba\x8d\xd4\x56\x63\x69\xa1"+    ]++kekkak_384_MAC_Vectors :: [MACVector Kekkak_384]+kekkak_384_MAC_Vectors =+    [ MACVector kekkak_key1 kekkak_data1 $ digest "\x5a\xf5\xc9\xa7\x7a\x23\xa6\xa9\x3d\x80\x64\x9e\x56\x2a\xb7\x7f\x4f\x35\x52\xe3\xc5\xca\xff\xd9\x3b\xdf\x8b\x3c\xfc\x69\x20\xe3\x02\x3f\xc2\x67\x75\xd9\xdf\x1f\x3c\x94\x61\x31\x46\xad\x2c\x9d"+    ]++kekkak_512_MAC_Vectors :: [MACVector Kekkak_512]+kekkak_512_MAC_Vectors =+    [ MACVector kekkak_key1 kekkak_data1 $ digest "\xc2\x96\x2e\x5b\xbe\x12\x38\x00\x78\x52\xf7\x9d\x81\x4d\xbb\xec\xd4\x68\x2e\x6f\x09\x7d\x37\xa3\x63\x58\x7c\x03\xbf\xa2\xeb\x08\x59\xd8\xd9\xc7\x01\xe0\x4c\xec\xec\xfd\x3d\xd7\xbf\xd4\x38\xf2\x0b\x8b\x64\x8e\x01\xbf\x8c\x11\xd2\x68\x24\xb9\x6c\xeb\xbd\xcb"+    ]++sha3_key1 = "\x4a\x65\x66\x65"+sha3_data1 = "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f"++sha3_224_MAC_Vectors :: [MACVector SHA3_224]+sha3_224_MAC_Vectors =+    [ MACVector sha3_key1 sha3_data1 $ digest "\x7f\xdb\x8d\xd8\x8b\xd2\xf6\x0d\x1b\x79\x86\x34\xad\x38\x68\x11\xc2\xcf\xc8\x5b\xfa\xf5\xd5\x2b\xba\xce\x5e\x66"+    ]++sha3_256_MAC_Vectors :: [MACVector SHA3_256]+sha3_256_MAC_Vectors =+    [  MACVector sha3_key1 sha3_data1 $ digest "\xc7\xd4\x07\x2e\x78\x88\x77\xae\x35\x96\xbb\xb0\xda\x73\xb8\x87\xc9\x17\x1f\x93\x09\x5b\x29\x4a\xe8\x57\xfb\xe2\x64\x5e\x1b\xa5"+    ]++sha3_384_MAC_Vectors :: [MACVector SHA3_384]+sha3_384_MAC_Vectors =+    [ MACVector sha3_key1 sha3_data1 $ digest "\xf1\x10\x1f\x8c\xbf\x97\x66\xfd\x67\x64\xd2\xed\x61\x90\x3f\x21\xca\x9b\x18\xf5\x7c\xf3\xe1\xa2\x3c\xa1\x35\x08\xa9\x32\x43\xce\x48\xc0\x45\xdc\x00\x7f\x26\xa2\x1b\x3f\x5e\x0e\x9d\xf4\xc2\x0a"+    ]++sha3_512_MAC_Vectors :: [MACVector SHA3_512]+sha3_512_MAC_Vectors =+    [ MACVector sha3_key1 sha3_data1 $ digest "\x5a\x4b\xfe\xab\x61\x66\x42\x7c\x7a\x36\x47\xb7\x47\x29\x2b\x83\x84\x53\x7c\xdb\x89\xaf\xb3\xbf\x56\x65\xe4\xc5\xe7\x09\x35\x0b\x28\x7b\xae\xc9\x21\xfd\x7c\xa0\xee\x7a\x0c\x31\xd0\x22\xa9\x5e\x1f\xc9\x2b\xa9\xd7\x7d\xf8\x83\x96\x02\x75\xbe\xb4\xe6\x20\x24"+    ]+++macTests :: [TestTree]+macTests =+    [ testGroup "md5" $ concatMap toMACTest $ zip is md5MACVectors+    , testGroup "sha1" $ concatMap toMACTest $ zip is sha1MACVectors+    , testGroup "sha256" $ concatMap toMACTest $ zip is sha256MACVectors+    , testGroup "kekkak-224" $ concatMap toMACTest $ zip is kekkak_224_MAC_Vectors+    , testGroup "kekkak-256" $ concatMap toMACTest $ zip is kekkak_256_MAC_Vectors+    , testGroup "kekkak-384" $ concatMap toMACTest $ zip is kekkak_384_MAC_Vectors+    , testGroup "kekkak-512" $ concatMap toMACTest $ zip is kekkak_512_MAC_Vectors+    , testGroup "sha3-224" $ concatMap toMACTest $ zip is sha3_224_MAC_Vectors+    , testGroup "sha3-256" $ concatMap toMACTest $ zip is sha3_256_MAC_Vectors+    , testGroup "sha3-384" $ concatMap toMACTest $ zip is sha3_384_MAC_Vectors+    , testGroup "sha3-512" $ concatMap toMACTest $ zip is sha3_512_MAC_Vectors+    ]+    where toMACTest (i, macVector) =+            [ testCase (show i) (macResult macVector @=? HMAC.hmac (macKey macVector) (macSecret macVector))+            , testCase ("incr-" ++ show i) (macResult macVector @=?+                        HMAC.finalize (HMAC.update (HMAC.initialize (macKey macVector)) (macSecret macVector)))+            ]+          is :: [Int]+          is = [1..]++data MacIncremental a = MacIncremental ByteString ByteString (HMAC.HMAC a)+    deriving (Show,Eq)++instance HashAlgorithm a => Arbitrary (MacIncremental a) where+    arbitrary = do+        key <- arbitraryBSof 1 89+        msg <- arbitraryBSof 1 99+        return $ MacIncremental key msg (HMAC.hmac key msg)++data MacIncrementalList a = MacIncrementalList ByteString [ByteString] (HMAC.HMAC a)+    deriving (Show,Eq)++instance HashAlgorithm a => Arbitrary (MacIncrementalList a) where+    arbitrary = do+        key  <- arbitraryBSof 1 89+        msgs <- choose (1,20) >>= \n -> replicateM n (arbitraryBSof 1 99)+        return $ MacIncrementalList key msgs (HMAC.hmac key (B.concat msgs))++macIncrementalTests :: [TestTree]+macIncrementalTests =+    [ testProperties MD5+    , testProperties SHA1+    , testProperties SHA256+    , testProperties SHA3_224+    , testProperties SHA3_256+    , testProperties SHA3_384+    , testProperties SHA3_512+    ]+  where+        --testProperties :: HashAlgorithm a => a -> [Property]+        testProperties a = testGroup (show a)+            [ testProperty "list-one" (prop_inc0 a)+            , testProperty "list-multi" (prop_inc1 a)+            ]++        prop_inc0 :: HashAlgorithm a => a -> MacIncremental a -> Bool+        prop_inc0 _ (MacIncremental secret msg result) =+            result `assertEq` HMAC.finalize (HMAC.update (HMAC.initialize secret) msg)++        prop_inc1 :: HashAlgorithm a => a -> MacIncrementalList a -> Bool+        prop_inc1 _ (MacIncrementalList secret msgs result) =+            result `assertEq` HMAC.finalize (foldl' HMAC.update (HMAC.initialize secret) msgs)++tests = testGroup "HMAC"+    [ testGroup "KATs" macTests+    , testGroup "properties" macIncrementalTests+    ]
+ tests/KAT_PBKDF2.hs view
@@ -0,0 +1,55 @@+{-# LANGUAGE OverloadedStrings #-}++-- from <http://www.ietf.org/rfc/rfc6070.txt>+module KAT_PBKDF2 (tests) where++import Crypto.Hash (SHA1(..), SHA256(..))+import qualified Crypto.KDF.PBKDF2 as PBKDF2++import Data.ByteString (ByteString)+import Data.ByteString.Char8 ()++import Test.Tasty+import Test.Tasty.HUnit++type VectParams = (ByteString, ByteString, Int, Int)++vectors_hmac_sha1 :: [ (VectParams, ByteString) ]+vectors_hmac_sha1 =+    [+        ( ("password","salt",2,20)+        , "\xea\x6c\x01\x4d\xc7\x2d\x6f\x8c\xcd\x1e\xd9\x2a\xce\x1d\x41\xf0\xd8\xde\x89\x57"+        )+    ,   ( ("password","salt",4096,20)+        , "\x4b\x00\x79\x01\xb7\x65\x48\x9a\xbe\xad\x49\xd9\x26\xf7\x21\xd0\x65\xa4\x29\xc1"+        )++    ,   ( ("passwordPASSWORDpassword", "saltSALTsaltSALTsaltSALTsaltSALTsalt", 4096, 25)+        , "\x3d\x2e\xec\x4f\xe4\x1c\x84\x9b\x80\xc8\xd8\x36\x62\xc0\xe4\x4a\x8b\x29\x1a\x96\x4c\xf2\xf0\x70\x38"+        )+    ,   ( ("pass\0word", "sa\0lt", 4096, 16)+        , "\x56\xfa\x6a\xa7\x55\x48\x09\x9d\xcc\x37\xd7\xf0\x34\x25\xe0\xc3"+        )+    ]++vectors_hmac_sha256 :: [ (VectParams, ByteString) ]+vectors_hmac_sha256 =+    [   ( ("password", "salt", 2, 32)+        , "\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e\xf3\xc2\x51\xdf\xd6\xe2\xd8\x5a\x95\x47\x4c\x43"+        )+    ,   ( ("passwordPASSWORDpassword", "saltSALTsaltSALTsaltSALTsaltSALTsalt", 4096, 40)+        , "\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11\x6e\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c\x4e\x2a\x1f\xb8\xdd\x53\xe1\xc6\x35\x51\x8c\x7d\xac\x47\xe9"+        )+    ]++tests = testGroup "PBKDF2"+    [ testGroup "KATs-HMAC-SHA1" (katTests (PBKDF2.prfHMAC SHA1) vectors_hmac_sha1)+    , testGroup "KATs-HMAC-SHA256" (katTests (PBKDF2.prfHMAC SHA256) vectors_hmac_sha256)+    ]+  where katTests prf vects = map (toKatTest prf) $ zip is vects++        toKatTest prf (i, ((pass, salt, iter, dkLen), output)) =+            testCase (show i) (output @=? PBKDF2.generate prf (PBKDF2.Parameters iter dkLen) pass salt)++        is :: [Int]+        is = [1..]
+ tests/KAT_PubKey.hs view
@@ -0,0 +1,44 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey (tests) where++import Test.Tasty+import Test.Tasty.HUnit++import Data.ByteString (ByteString)+import qualified Data.ByteString as B+import Data.ByteString.Char8 ()++import Crypto.PubKey.MaskGenFunction+import Crypto.Hash++import KAT_PubKey.OAEP+import KAT_PubKey.PSS+import KAT_PubKey.DSA+import KAT_PubKey.ECC+import KAT_PubKey.ECDSA+import Utils++data VectorMgf = VectorMgf { seed :: ByteString+                           , dbMask :: ByteString+                           }++doMGFTest (i, vmgf) = testCase (show i) (dbMask vmgf @=? actual)+    where actual = mgf1 SHA1 (seed vmgf) (B.length $ dbMask vmgf)++vectorsMGF =+    [ VectorMgf+        { seed = "\xdf\x1a\x89\x6f\x9d\x8b\xc8\x16\xd9\x7c\xd7\xa2\xc4\x3b\xad\x54\x6f\xbe\x8c\xfe"+        , dbMask = "\x66\xe4\x67\x2e\x83\x6a\xd1\x21\xba\x24\x4b\xed\x65\x76\xb8\x67\xd9\xa4\x47\xc2\x8a\x6e\x66\xa5\xb8\x7d\xee\x7f\xbc\x7e\x65\xaf\x50\x57\xf8\x6f\xae\x89\x84\xd9\xba\x7f\x96\x9a\xd6\xfe\x02\xa4\xd7\x5f\x74\x45\xfe\xfd\xd8\x5b\x6d\x3a\x47\x7c\x28\xd2\x4b\xa1\xe3\x75\x6f\x79\x2d\xd1\xdc\xe8\xca\x94\x44\x0e\xcb\x52\x79\xec\xd3\x18\x3a\x31\x1f\xc8\x97\x39\xa9\x66\x43\x13\x6e\x8b\x0f\x46\x5e\x87\xa4\x53\x5c\xd4\xc5\x9b\x10\x02\x8d"+        }+    ]++tests = testGroup "PubKey"+    [ testGroup "MGF1" $ map doMGFTest (zip [katZero..] vectorsMGF)+    , pssTests+    , oaepTests+    , dsaTests+    , eccTests+    , ecdsaTests+    ]++--newKats = [ eccKatTests ]
+ tests/KAT_PubKey/DSA.hs view
@@ -0,0 +1,142 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey.DSA (dsaTests) where++import qualified Crypto.PubKey.DSA as DSA+import Crypto.Hash++import Imports++data VectorDSA = VectorDSA+    { pgq :: DSA.Params+    , msg :: ByteString+    , x :: Integer+    , y :: Integer+    , k :: Integer+    , r :: Integer+    , s :: Integer+    }++vectorsSHA1 =+    [ VectorDSA+        { msg = "\x3b\x46\x73\x6d\x55\x9b\xd4\xe0\xc2\xc1\xb2\x55\x3a\x33\xad\x3c\x6c\xf2\x3c\xac\x99\x8d\x3d\x0c\x0e\x8f\xa4\xb1\x9b\xca\x06\xf2\xf3\x86\xdb\x2d\xcf\xf9\xdc\xa4\xf4\x0a\xd8\xf5\x61\xff\xc3\x08\xb4\x6c\x5f\x31\xa7\x73\x5b\x5f\xa7\xe0\xf9\xe6\xcb\x51\x2e\x63\xd7\xee\xa0\x55\x38\xd6\x6a\x75\xcd\x0d\x42\x34\xb5\xcc\xf6\xc1\x71\x5c\xca\xaf\x9c\xdc\x0a\x22\x28\x13\x5f\x71\x6e\xe9\xbd\xee\x7f\xc1\x3e\xc2\x7a\x03\xa6\xd1\x1c\x5c\x5b\x36\x85\xf5\x19\x00\xb1\x33\x71\x53\xbc\x6c\x4e\x8f\x52\x92\x0c\x33\xfa\x37\xf4\xe7"+        , x = 0xc53eae6d45323164c7d07af5715703744a63fc3a+        , y = 0x313fd9ebca91574e1c2eebe1517c57e0c21b0209872140c5328761bbb2450b33f1b18b409ce9ab7c4cd8fda3391e8e34868357c199e16a6b2eba06d6749def791d79e95d3a4d09b24c392ad89dbf100995ae19c01062056bb14bce005e8731efde175f95b975089bdcdaea562b32786d96f5a31aedf75364008ad4fffebb970b+        , k = 0x98cbcc4969d845e2461b5f66383dd503712bbcfa+        , r = 0x50ed0e810e3f1c7cb6ac62332058448bd8b284c0+        , s = 0xc6aded17216b46b7e4b6f2a97c1ad7cc3da83fde+        , pgq = dsaParams+        }+    , VectorDSA+        { msg = "\xd2\xbc\xb5\x3b\x04\x4b\x3e\x2e\x4b\x61\xba\x2f\x91\xc0\x99\x5f\xb8\x3a\x6a\x97\x52\x5e\x66\x44\x1a\x3b\x48\x9d\x95\x94\x23\x8b\xc7\x40\xbd\xee\xa0\xf7\x18\xa7\x69\xc9\x77\xe2\xde\x00\x38\x77\xb5\xd7\xdc\x25\xb1\x82\xae\x53\x3d\xb3\x3e\x78\xf2\xc3\xff\x06\x45\xf2\x13\x7a\xbc\x13\x7d\x4e\x7d\x93\xcc\xf2\x4f\x60\xb1\x8a\x82\x0b\xc0\x7c\x7b\x4b\x5f\xe0\x8b\x4f\x9e\x7d\x21\xb2\x56\xc1\x8f\x3b\x9d\x49\xac\xc4\xf9\x3e\x2c\xe6\xf3\x75\x4c\x78\x07\x75\x7d\x2e\x11\x76\x04\x26\x12\xcb\x32\xfc\x3f\x4f\x70\x70\x0e\x25"+        , x = 0xe65131d73470f6ad2e5878bdc9bef536faf78831+        , y = 0x29bdd759aaa62d4bf16b4861c81cf42eac2e1637b9ecba512bdbc13ac12a80ae8de2526b899ae5e4a231aef884197c944c732693a634d7659abc6975a773f8d3cd5a361fe2492386a3c09aaef12e4a7e73ad7dfc3637f7b093f2c40d6223a195c136adf2ea3fbf8704a675aa7817aa7ec7f9adfb2854d4e05c3ce7f76560313b+        , k = 0x87256a64e98cf5be1034ecfa766f9d25d1ac7ceb+        , r = 0xa26c00b5750a2d27fe7435b93476b35438b4d8ab+        , s = 0x61c9bfcb2938755afa7dad1d1e07c6288617bf70+        , pgq = dsaParams+        }+    , VectorDSA+        { msg = "\xd5\x43\x1e\x6b\x16\xfd\xae\x31\x48\x17\x42\xbd\x39\x47\x58\xbe\xb8\xe2\x4f\x31\x94\x7e\x19\xb7\xea\x7b\x45\x85\x21\x88\x22\x70\xc1\xf4\x31\x92\xaa\x05\x0f\x44\x85\x14\x5a\xf8\xf3\xf9\xc5\x14\x2d\x68\xb8\x50\x18\xd2\xec\x9c\xb7\xa3\x7b\xa1\x2e\xd2\x3e\x73\xb9\x5f\xd6\x80\xfb\xa3\xc6\x12\x65\xe9\xf5\xa0\xa0\x27\xd7\x0f\xad\x0c\x8a\xa0\x8a\x3c\xbf\xbe\x99\x01\x8d\x00\x45\x38\x61\x73\xe5\xfa\xe2\x25\xfa\xeb\xe0\xce\xf5\xdd\x45\x91\x0f\x40\x0a\x86\xc2\xbe\x4e\x15\x25\x2a\x16\xde\x41\x20\xa2\x67\xbe\x2b\x59\x4d"+        , x = 0x20bcabc6d9347a6e79b8e498c60c44a19c73258c+        , y = 0x23b4f404aa3c575e550bb320fdb1a085cd396a10e5ebc6771da62f037cab19eacd67d8222b6344038c4f7af45f5e62b55480cbe2111154ca9697ca76d87b56944138084e74c6f90a05cf43660dff8b8b3fabfcab3f0e4416775fdf40055864be102b4587392e77752ed2aeb182ee4f70be4a291dbe77b84a44ee34007957b1e0+        , k = 0x7d9bcfc9225432de9860f605a38d389e291ca750+        , r = 0x3f0a4ad32f0816821b8affb518e9b599f35d57c2+        , s = 0xea06638f2b2fc9d1dfe99c2a492806b497e2b0ea+        , pgq = dsaParams+        }+    , VectorDSA+        { msg = "\x85\x66\x2b\x69\x75\x50\xe4\x91\x5c\x29\xe3\x38\xb6\x24\xb9\x12\x84\x5d\x6d\x1a\x92\x0d\x9e\x4c\x16\x04\xdd\x47\xd6\x92\xbc\x7c\x0f\xfb\x95\xae\x61\x4e\x85\x2b\xeb\xaf\x15\x73\x75\x8a\xd0\x1c\x71\x3c\xac\x0b\x47\x6e\x2f\x12\x17\x45\xa3\xcf\xee\xff\xb2\x44\x1f\xf6\xab\xfb\x9b\xbe\xb9\x8a\xa6\x34\xca\x6f\xf5\x41\x94\x7d\xcc\x99\x27\x65\x9d\x44\xf9\x5c\x5f\xf9\x17\x0f\xdc\x3c\x86\x47\x3c\xb6\x01\xba\x31\xb4\x87\xfe\x59\x36\xba\xc5\xd9\xc6\x32\xcb\xcc\x3d\xb0\x62\x46\xba\x01\xc5\x5a\x03\x8d\x79\x7f\xe3\xf6\xc3"+        , x = 0x52d1fbe687aa0702a51a5bf9566bd51bd569424c+        , y = 0x6bc36cb3fa61cecc157be08639a7ca9e3de073b8a0ff23574ce5ab0a867dfd60669a56e60d1c989b3af8c8a43f5695d503e3098963990e12b63566784171058eace85c728cd4c08224c7a6efea75dca20df461013c75f40acbc23799ebee7f3361336dadc4a56f305708667bfe602b8ea75a491a5cf0c06ebd6fdc7161e10497+        , k = 0x960c211891c090d05454646ebac1bfe1f381e82b+        , r = 0x3bc29dee96957050ba438d1b3e17b02c1725d229+        , s = 0x0af879cf846c434e08fb6c63782f4d03e0d88865+        , pgq = dsaParams+        }+    , VectorDSA+        { msg = "\x87\xb6\xe7\x5b\x9f\x8e\x99\xc4\xdd\x62\xad\xb6\x93\xdd\x58\x90\xed\xff\x1b\xd0\x02\x8f\x4e\xf8\x49\xdf\x0f\x1d\x2c\xe6\xb1\x81\xfc\x3a\x55\xae\xa6\xd0\xa1\xf0\xae\xca\xb8\xed\x9e\x24\x8a\x00\xe9\x6b\xe7\x94\xa7\xcf\xba\x12\x46\xef\xb7\x10\xef\x4b\x37\x47\x1c\xef\x0a\x1b\xcf\x55\xce\xbc\x8d\x5a\xd0\x71\x61\x2b\xd2\x37\xef\xed\xd5\x10\x23\x62\xdb\x07\xa1\xe2\xc7\xa6\xf1\x5e\x09\xfe\x64\xba\x42\xb6\x0a\x26\x28\xd8\x69\xae\x05\xef\x61\x1f\xe3\x8d\x9c\xe1\x5e\xee\xc9\xbb\x3d\xec\xc8\xdc\x17\x80\x9f\x3b\x6e\x95"+        , x = 0xc86a54ec5c4ec63d7332cf43ddb082a34ed6d5f5+        , y = 0x014ac746d3605efcb8a2c7dae1f54682a262e27662b252c09478ce87d0aaa522d7c200043406016c0c42896d21750b15dbd57f9707ec37dcea5651781b67ad8d01f5099fe7584b353b641bb159cc717d8ceb18b66705e656f336f1214b34f0357e577ab83641969e311bf40bdcb3ffd5e0bb59419f229508d2f432cc2859ff75+        , k = 0x6c445cee68042553fbe63be61be4ddb99d8134af+        , r = 0x637e07a5770f3dc65e4506c68c770e5ef6b8ced3+        , s = 0x7dfc6f83e24f09745e01d3f7ae0ed1474e811d47+        , pgq = dsaParams+        }+    , VectorDSA+        { msg = "\x22\x59\xee\xad\x2d\x6b\xbc\x76\xd4\x92\x13\xea\x0d\xc8\xb7\x35\x0a\x97\x69\x9f\x22\x34\x10\x44\xc3\x94\x07\x82\x36\x4a\xc9\xea\x68\x31\x79\xa4\x38\xa5\xea\x45\x99\x8d\xf9\x7c\x29\x72\xda\xe0\x38\x51\xf5\xbe\x23\xfa\x9f\x04\x18\x2e\x79\xdd\xb2\xb5\x6d\xc8\x65\x23\x93\xec\xb2\x7f\x3f\x3b\x7c\x8a\x8d\x76\x1a\x86\xb3\xb8\xf4\xd4\x1a\x07\xb4\xbe\x7d\x02\xfd\xde\xfc\x42\xb9\x28\x12\x4a\x5a\x45\xb9\xf4\x60\x90\x42\x20\x9b\x3a\x7f\x58\x5b\xd5\x14\xcc\x39\xc0\x0e\xff\xcc\x42\xc7\xfe\x70\xfa\x83\xed\xf8\xa3\x2b\xf4"+        , x = 0xaee6f213b9903c8069387e64729a08999e5baf65+        , y = 0x0fe74045d7b0d472411202831d4932396f242a9765e92be387fd81bbe38d845054528b348c03984179b8e505674cb79d88cc0d8d3e8d7392f9aa773b29c29e54a9e326406075d755c291fcedbcc577934c824af988250f64ed5685fce726cff65e92d708ae11cbfaa958ab8d8b15340a29a137b5b4357f7ed1c7a5190cbf98a4+        , k = 0xe1704bae025942e2e63c6d76bab88da79640073a+        , r = 0x83366ba3fed93dfb38d541203ecbf81c363998e2+        , s = 0x1fe299c36a1332f23bf2e10a6c6a4e0d3cdd2bf4+        , pgq = dsaParams+        } +    , VectorDSA+        { msg = "\x21\x9e\x8d\xf5\xbf\x88\x15\x90\x43\x0e\xce\x60\x82\x50\xf7\x67\x0d\xc5\x65\x37\x24\x93\x02\x42\x9e\x28\xec\xfe\xb9\xce\xaa\xa5\x49\x10\xa6\x94\x90\xf7\x65\xf3\xdf\x82\xe8\xb0\x1c\xd7\xd7\x6e\x56\x1d\x0f\x6c\xe2\x26\xef\x3c\xf7\x52\xca\xda\x6f\xeb\xdc\x5b\xf0\x0d\x67\x94\x7f\x92\xd4\x20\x51\x6b\x9e\x37\xc9\x6c\x8f\x1f\x2d\xa0\xb0\x75\x09\x7c\x3b\xda\x75\x8a\x8d\x91\xbd\x2e\xbe\x9c\x75\xcf\x14\x7f\x25\x4c\x25\x69\x63\xb3\x3b\x67\xd0\x2b\x6a\xa0\x9e\x7d\x74\x65\xd0\x38\xe5\x01\x95\xec\xe4\x18\x9b\x41\xe7\x68"+        , x = 0x699f1c07aa458c6786e770b40197235fe49cf21a+        , y = 0x3a41b0678ff3c4dde20fa39772bac31a2f18bae4bedec9e12ee8e02e30e556b1a136013bef96b0d30b568233dcecc71e485ed75c922afb4d0654e709bee84993792130220e3005fdb06ebdfc0e2df163b5ec424e836465acd6d92e243c86f2b94b26b8d73bd9cf722c757e0b80b0af16f185de70e8ca850b1402d126ea60f309+        , k = 0x5bbb795bfa5fa72191fed3434a08741410367491+        , r = 0x579761039ae0ddb81106bf4968e320083bbcb947+        , s = 0x503ea15dbac9dedeba917fa8e9f386b93aa30353+        , pgq = dsaParams+        } +    , VectorDSA+        { msg = "\x2d\xa7\x9d\x06\x78\x85\xeb\x3c\xcf\x5e\x29\x3a\xe3\xb1\xd8\x22\x53\x22\x20\x3a\xbb\x5a\xdf\xde\x3b\x0f\x53\xbb\xe2\x4c\x4f\xe0\x01\x54\x1e\x11\x83\xd8\x70\xa9\x97\xf1\xf9\x46\x01\x00\xb5\xd7\x11\x92\x31\x80\x15\x43\x45\x28\x7a\x02\x14\xcf\x1c\xac\x37\xb7\xa4\x7d\xfb\xb2\xa0\xe8\xce\x49\x16\xf9\x4e\xbd\x6f\xa5\x4e\x31\x5b\x7a\x8e\xb5\xb6\x3c\xd9\x54\xc5\xba\x05\xc1\xbf\x7e\x33\xa4\xe8\xa1\x51\xf3\x2d\x28\x77\xb0\x17\x29\xc1\xad\x0e\x7c\x01\xbb\x8a\xe7\x23\xc9\x95\x18\x38\x03\xe4\x56\x36\x52\x0e\xa3\x8c\xa1"+        , x = 0xd6e08c20c82949ddba93ea81eb2fea8c595894dc+        , y = 0x56f7272210f316c51af8bfc45a421fd4e9b1043853271b7e79f40936f0adcf262a86097aa86e19e6cb5307685d863dba761342db6c973b3849b1e060aca926f41fe07323601062515ae85f3172b8f34899c621d59fa21f73d5ae97a3deb5e840b25a18fd580862fd7b1cf416c7ae9fc5842a0197fdb0c5173ff4a4f102a8cf89+        , k = 0x6d72c30d4430959800740f2770651095d0c181c2+        , r = 0x5dd90d69add67a5fae138eec1aaff0229aa4afc4+        , s = 0x47f39c4db2387f10762f45b80dfd027906d7ef04+        , pgq = dsaParams+        } +    , VectorDSA+        { msg = "\xba\x30\xd8\x5b\xe3\x57\xe7\xfb\x29\xf8\xa0\x7e\x1f\x12\x7b\xaa\xa2\x4b\x2e\xe0\x27\xf6\x4c\xb5\xef\xee\xc6\xaa\xea\xbc\xc7\x34\x5c\x5d\x55\x6e\xbf\x4b\xdc\x7a\x61\xc7\x7c\x7b\x7e\xa4\x3c\x73\xba\xbc\x18\xf7\xb4\x80\x77\x22\xda\x23\x9e\x45\xdd\xf2\x49\x84\x9c\xbb\xfe\x35\x07\x11\x2e\xbf\x87\xd7\xef\x56\x0c\x2e\x7d\x39\x1e\xd8\x42\x4f\x87\x10\xce\xa4\x16\x85\x14\x3e\x30\x06\xf8\x1b\x68\xfb\xb4\xd5\xf9\x64\x4c\x7c\xd1\x0f\x70\x92\xef\x24\x39\xb8\xd1\x8c\x0d\xf6\x55\xe0\x02\x89\x37\x2a\x41\x66\x38\x5d\x64\x0c"+        , x = 0x50018482864c1864e9db1f04bde8dbfd3875c76d+        , y = 0x0942a5b7a72ab116ead29308cf658dfe3d55d5d61afed9e3836e64237f9d6884fdd827d2d5890c9a41ae88e7a69fc9f345ade9c480c6f08cff067c183214c227236cedb6dd1283ca2a602574e8327510221d4c27b162143b7002d8c726916826265937b87be9d5ec6d7bd28fb015f84e0ab730da7a4eaf4ef3174bf0a22a6392+        , k = 0xdf3a9348f37b5d2d4c9176db266ae388f1fa7e0f+        , r = 0x448434b214eee38bde080f8ec433e8d19b3ddf0d+        , s = 0x0c02e881b777923fe0ea674f2621298e00199d5f+        , pgq = dsaParams+        } +    , VectorDSA+        { msg = "\x83\x49\x9e\xfb\x06\xbb\x7f\xf0\x2f\xfb\x46\xc2\x78\xa5\xe9\x26\x30\xac\x5b\xc3\xf9\xe5\x3d\xd2\xe7\x8f\xf1\x5e\x36\x8c\x7e\x31\xaa\xd7\x7c\xf7\x71\xf3\x5f\xa0\x2d\x0b\x5f\x13\x52\x08\xa4\xaf\xdd\x86\x7b\xb2\xec\x26\xea\x2e\x7d\xd6\x4c\xde\xf2\x37\x50\x8a\x38\xb2\x7f\x39\xd8\xb2\x2d\x45\xca\xc5\xa6\x8a\x90\xb6\xea\x76\x05\x86\x45\xf6\x35\x6a\x93\x44\xd3\x6f\x00\xec\x66\x52\xea\xa4\xe9\xba\xe7\xb6\x94\xf9\xf1\xfc\x8c\x6c\x5e\x86\xfa\xdc\x7b\x27\xa2\x19\xb5\xc1\xb2\xae\x80\xa7\x25\xe5\xf6\x11\x65\xfe\x2e\xdc"+        , x = 0xae56f66b0a9405b9cca54c60ec4a3bb5f8be7c3f+        , y = 0xa01542c3da410dd57930ca724f0f507c4df43d553c7f69459939685941ceb95c7dcc3f175a403b359621c0d4328e98f15f330a63865baf3e7eb1604a0715e16eed64fd14b35d3a534259a6a7ddf888c4dbb5f51bbc6ed339e5bb2a239d5cfe2100ac8e2f9c16e536f25119ab435843af27dc33414a9e4602f96d7c94d6021cec+        , k = 0x8857ff301ad0169d164fa269977a116e070bac17+        , r = 0x8c2fab489c34672140415d41a65cef1e70192e23+        , s = 0x3df86a9e2efe944a1c7ea9c30cac331d00599a0e+        , pgq = dsaParams+        } +    ]+    where -- (p,g,q)+          dsaParams = DSA.Params+            { DSA.params_p = 0xa8f9cd201e5e35d892f85f80e4db2599a5676a3b1d4f190330ed3256b26d0e80a0e49a8fffaaad2a24f472d2573241d4d6d6c7480c80b4c67bb4479c15ada7ea8424d2502fa01472e760241713dab025ae1b02e1703a1435f62ddf4ee4c1b664066eb22f2e3bf28bb70a2a76e4fd5ebe2d1229681b5b06439ac9c7e9d8bde283+            , DSA.params_g = 0x2b3152ff6c62f14622b8f48e59f8af46883b38e79b8c74deeae9df131f8b856e3ad6c8455dab87cc0da8ac973417ce4f7878557d6cdf40b35b4a0ca3eb310c6a95d68ce284ad4e25ea28591611ee08b8444bd64b25f3f7c572410ddfb39cc728b9c936f85f419129869929cdb909a6a3a99bbe089216368171bd0ba81de4fe33+            , DSA.params_q = 0xf85f0f83ac4df7ea0cdf8f469bfeeaea14156495+            }++vectorToPrivate :: VectorDSA -> DSA.PrivateKey+vectorToPrivate vector = DSA.PrivateKey+    { DSA.private_x      = x vector+    , DSA.private_params = pgq vector+    }++vectorToPublic :: VectorDSA -> DSA.PublicKey+vectorToPublic vector = DSA.PublicKey+    { DSA.public_y      = y vector+    , DSA.public_params = pgq vector+    }++doSignatureTest (i, vector) = testCase (show i) (expected @=? actual)+    where expected = Just $ DSA.Signature (r vector) (s vector)+          actual   = DSA.signWith (k vector) (vectorToPrivate vector) SHA1 (msg vector)++doVerifyTest (i, vector) = testCase (show i) (True @=? actual)+    where actual = DSA.verify SHA1 (vectorToPublic vector) (DSA.Signature (r vector) (s vector)) (msg vector)++dsaTests = testGroup "DSA"+    [ testGroup "SHA1"+        [ testGroup "signature" $ map doSignatureTest (zip [katZero..] vectorsSHA1)+        , testGroup "verify" $ map doVerifyTest (zip [katZero..] vectorsSHA1)+        ]+    ]
+ tests/KAT_PubKey/ECC.hs view
@@ -0,0 +1,141 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey.ECC (eccTests, eccKatTests) where++import Control.Arrow (second)++import qualified Crypto.PubKey.ECC.Types as ECC+import qualified Crypto.PubKey.ECC.Prim as ECC++import Test.Tasty.KAT+import Test.Tasty.KAT.FileLoader++import Imports++data VectorPoint = VectorPoint+    { curve :: ECC.Curve+    , x     :: Integer+    , y     :: Integer+    , valid :: Bool+    }++vectorsPoint =+    [ VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x     = 0x491c0c4761b0a4a147b5e4ce03a531546644f5d1e3d05e57+        , y     = 0x6fa5addd47c5d6be3933fbff88f57a6c8ca0232c471965de+        , valid = False -- point not on curve+        }+    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x646c22e8aa5f7833390e0399155ac198ae42470bba4fc834+        , y    = 0x8d4afcfffd80e69a4d180178b37c44572495b7b267ee32a9+        , valid = True+        }+    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x4c6b9ea0dec92ecfff7799470be6a2277b9169daf45d54bb+        , y    = 0xf0eab42826704f51b26ae98036e83230becb639dd1964627+        , valid = False -- point not on curve+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x0673c8bb717b055c3d6f55c06acfcfb7260361ed3ec0f414+        , y    = 0xba8b172826eb0b854026968d2338a180450a27906f6eddea+        , valid = True+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x82c949295156192df0b52480e38c810751ac570daec460a3+        , y    = 0x200057ada615c80b8ff256ce8d47f2562b74a438f1921ac3+        , valid = False -- point not on curve+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x284fbaa76ce0faae2ca4867d01092fa1ace5724cd12c8dd0+        , y    = 0xe42af3dbf3206be3fcbcc3a7ccaf60c73dc29e7bb9b44fca+        , valid = True+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x1b574acd4fb0f60dde3e3b5f3f0e94211f95112e43cba6fd2+        , y    = 0xbcc1b8a770f01a22e84d7f14e44932ffe094d8e3b1e6ac26+        , valid = False -- x or y out of range+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x16ba109f1f1bb44e0d05b80181c03412ea764a59601d17e9f+        , y    = 0x0569a843dbb4e287db420d6b9fe30cd7b5d578b052315f56+        , valid = False -- x or y out of range+        }++    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x1333308a7c833ede5189d25ea3525919c9bd16370d904938d+        , y    = 0xb10fd01d67df75ff9b726c700c1b50596c9f0766ea56f80e+        , valid = False -- x or y out of range+        }+    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x    = 0x9671ec444cff24c8a5be80b018fa505ed6109a731e88c91a+        , y    = 0xfe79dae23008e46bf4230c895aab261a95845a77f06d0655+        , valid = True+        }+    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x     = 0x158e8b6f0b14216bc52fe8897b4305d870ede70436a96741d+        , y     = 0xfb3f970b19a313571a1a23be310923f85acc1cab0a157cbd+        , valid = False -- x or y out of range+        }+    , VectorPoint+        { curve = ECC.getCurveByName ECC.SEC_p192r1+        , x     = 0xace95b650c08f73dbb4fa7b4bbdebd6b809a25b28ed135ef+        , y     = 0xe9b8679404166d1329dd539ad52aad9a1b6681f5f26bb9aa+        , valid = False -- point not on curve+        }+    ]++doPointValidTest (i, vector) = testCase (show i) (valid vector @=? ECC.isPointValid (curve vector) (ECC.Point (x vector) (y vector)))++eccTests = testGroup "ECC"+    [ testGroup "valid-point" $ map doPointValidTest (zip [katZero..] vectorsPoint)+    ]++eccKatTests = do+    res <- testKatLoad "KATs/ECC-PKV.txt" (map (second (map toVector)) . katLoaderSimple)+    return $ testKatDetailed {-Grouped-} "ECC/valid-point" res (\g vect -> do+        let mCurve = ECC.getCurveByName <$> case g of+                        "P-192" -> Just ECC.SEC_p192r1+                        "P-224" -> Just ECC.SEC_p224r1+                        "P-256" -> Just ECC.SEC_p256r1+                        "P-384" -> Just ECC.SEC_p384r1+                        "P-521" -> Just ECC.SEC_p521r1+                        "B-163" -> Just ECC.SEC_t163r2+                        "B-233" -> Just ECC.SEC_t233r1+                        "B-283" -> Just ECC.SEC_t283r1+                        "B-409" -> Just ECC.SEC_t409r1+                        "B-571" -> Just ECC.SEC_t571r1+                        ""      -> Nothing+                        _       -> Nothing+{-+                        "K-163" -> Just ECC.SEC_t163k1+                        "K-233" -> Just ECC.SEC_t233k1+                        "K-283" -> Just ECC.SEC_t283k1+                        "K-409" -> Just ECC.SEC_t409k1+                        "K-571" -> Just ECC.SEC_t571k1+-}+        case mCurve of+            Nothing -> return True+            Just c  -> do+                return (ECC.isPointValid c (ECC.Point (x vect) (y vect)) == valid vect)+        )++  where toVector kvs =+            case sequence $ map (flip lookup kvs) [ "Qx", "Qy", "Result" ] of+                Just [qx,qy,res] -> VectorPoint undefined (valueHexInteger qx) (valueHexInteger qy) (head res /= 'F')+                Just _           -> error ("ERROR: " ++ show kvs)+                Nothing          -> error ("ERROR: " ++ show kvs) -- VectorPoint undefined 0 0 True
+ tests/KAT_PubKey/ECDSA.hs view
@@ -0,0 +1,92 @@+-- Test vectors are taken from GEC2: www.secg.org/collateral/gec2.pdf+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey.ECDSA (ecdsaTests) where++import Crypto.Number.Serialize++import qualified Crypto.PubKey.ECC.ECDSA as ECDSA+import qualified Crypto.PubKey.ECC.Types as ECC+import Crypto.Hash (SHA1(..))++import Imports++data VectorECDSA = VectorECDSA+    { curve :: ECC.Curve+    , msg   :: ByteString+    , d     :: Integer+    , q     :: ECC.Point+    , k     :: Integer+    , r     :: Integer+    , s     :: Integer+    }++vectorsSHA1 =+    [ VectorECDSA+        { curve = ECC.getCurveByName ECC.SEC_p160r1+        , msg   = "abc"+        , d     = 971761939728640320549601132085879836204587084162+        , q     = ECC.Point 466448783855397898016055842232266600516272889280+                            1110706324081757720403272427311003102474457754220+        , k     = 702232148019446860144825009548118511996283736794+        , r     = 1176954224688105769566774212902092897866168635793+        , s     = 299742580584132926933316745664091704165278518100+        }+    -- from official ECDSA KATs+    , VectorECDSA+        { curve = ECC.getCurveByName ECC.SEC_t163k1+        , msg   = i2osp 0xa2c1a03fdd00521bb08fc88d20344321977aaf637ef9d5470dd7d2c8628fc8d0d1f1d3587c6b3fd02386f8c13db341b14748a9475cc63baf065df64054b27d5c2cdf0f98e3bbb81d0b5dc94f8cdb87acf75720f6163de394c8c6af360bc1acb85b923a493b7b27cc111a257e36337bd94eb0fab9d5e633befb1ae7f1b244bfaa+        , d     = 0x00000011f2626d90d26cb4c0379043b26e64107fc+        , q     = ECC.Point 0x0389fa5ad7f8304325a8c060ef7dcb83042c045bc+                            0x0eefa094a5054da196943cc80509dcb9f59e5bc2e+        , k     = 0x0000000c3a4ff97286126dab1e5089395fcc47ebb+        , r     = 0x0dbe6c3a1dc851e7f2338b5c26c62b4b37bf8035c+        , s     = 0x1c76458135b1ff9fbd23009b8414a47996126b56a+        }+    , VectorECDSA+        { curve = ECC.getCurveByName ECC.SEC_t163k1+        , msg   = i2osp 0x67048080daaeb77d3ac31babdf8be23dbe75ceb4dfb94aa8113db5c5dcb6fe14b70f717b7b0ed0881835a66a86e6d840ffcb7d976c75ef2d1d4322fbbc86357384e24707aef88cea2c41a01a9a3d1b9e72ce650c7fdecc4f9448d3a77df6cdf13647ab295bb3132de0b1b2c402d8d2de7d452f1e003e0695de1470d1064eee16+        , d     = 0x00000006a3803301daee9af09bb5b6c991a4f49a4+        , q     = ECC.Point 0x4b500f555e857da8c299780130c5c3f48f02ee322 0x5c1c0ae25b47f06cc46fb86b12d2d8c0ba6a4bf07+        , k     = 0x0000002f39fbf77f3e0dc046116de692b6cf91b16+        , r     = 0x3d3eeda42f65d727f4a564f1415654356c6c57a6c+        , s     = 0x35e4d43c5f08baddf138449db1ad0b7872552b7cd+        }+    , VectorECDSA+        { curve = ECC.getCurveByName ECC.SEC_t163k1+        , msg   = i2osp 0x77e007dc2acd7248256165a4b30e98986f51a81efd926b85f74c81bc2a6d2bcd030060a844091e22fbb0ff3db5a20caaefb5d58ccdcbc27f0ff8a4d940e78f303079ec1ca5b0ca3d4ecc7580f8b34a9f0496c9e719d2ec3e1614b7644bc11179e895d2c0b58a1da204fbf0f6e509f97f983eacb6487092caf6e8e4e6b3c458b2+        , d     = 0x0000002e28676514bd93fea11b62db0f6e324b18d+        , q     = ECC.Point 0x3f9c90b71f6a1de20a2716f38ef1b5f98c757bd42 0x2ff0a5d266d447ef62d43fbca6c34c08c1ce35a40+        , k     = 0x00000001233ae699883e74e7f4dfb5279ff22280a+        , r     = 0x39de3cd2cf04145e522b8fba3f23e9218226e0860+        , s     = 0x2af62bfb3cfa202e2342606ee5bb0934c3b0375b6+        }+    , VectorECDSA+        { curve = ECC.getCurveByName ECC.SEC_t163k1+        , msg   = i2osp 0xfbacfcce4688748406ddf5c3495021eef8fb399865b649eb2395a04a1ab28335da2c236d306fcc59f7b65ea931cf0139571e1538ede5688958c3ac69f47a285362f5ad201f89cc735b7b465408c2c41b310fc8908d0be45054df2a7351fae36b390e842f3b5cdd9ad832940df5b2d25c2ed43ce86eaf2508bcf401ae58bb1d47+        , d     = 0x000000361dd088e3a6d3c910686c8dce57e5d4d8e+        , q     = ECC.Point 0x064f905c1da9d7e9c32d81890ae6f30dcc7839d32 0x06f1faedb6d9032016d3b681e7cf69c29d29eb27b+        , k     = 0x00000022f723e9f5da56d3d0837d5dca2f937395f+        , r     = 0x374cdc8571083fecfbd4e25e1cd69ecc66b715f2d+        , s     = 0x313b10949222929b2f20b15d446c27d6dcae3f086+        }+    ]++vectorToPrivate :: VectorECDSA -> ECDSA.PrivateKey+vectorToPrivate vector = ECDSA.PrivateKey (curve vector) (d vector)++vectorToPublic :: VectorECDSA -> ECDSA.PublicKey+vectorToPublic vector = ECDSA.PublicKey (curve vector) (q vector)++doSignatureTest (i, vector) = testCase (show i) (expected @=? actual)+  where expected = Just $ ECDSA.Signature (r vector) (s vector)+        actual   = ECDSA.signWith (k vector) (vectorToPrivate vector) SHA1 (msg vector)++doVerifyTest (i, vector) = testCase (show i) (True @=? actual)+  where actual = ECDSA.verify SHA1 (vectorToPublic vector) (ECDSA.Signature (r vector) (s vector)) (msg vector)++ecdsaTests = testGroup "ECDSA"+    [ testGroup "SHA1"+        [ testGroup "signature" $ map doSignatureTest (zip [katZero..] vectorsSHA1)+        , testGroup "verify" $ map doVerifyTest (zip [katZero..] vectorsSHA1)+        ]+    ]
+ tests/KAT_PubKey/OAEP.hs view
@@ -0,0 +1,97 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey.OAEP (oaepTests) where++import Crypto.PubKey.RSA+import qualified Crypto.PubKey.RSA.OAEP as OAEP+import Crypto.Hash++import Imports++rsaKeyInt = PrivateKey+    { private_pub = PublicKey+        { public_n = 0xbbf82f090682ce9c2338ac2b9da871f7368d07eed41043a440d6b6f07454f51fb8dfbaaf035c02ab61ea48ceeb6fcd4876ed520d60e1ec4619719d8a5b8b807fafb8e0a3dfc737723ee6b4b7d93a2584ee6a649d060953748834b2454598394ee0aab12d7b61a51f527a9a41f6c1687fe2537298ca2a8f5946f8e5fd091dbdcb+        , public_e = 0x11 +        , public_size = 128+        }+    , private_d = 0xa5dafc5341faf289c4b988db30c1cdf83f31251e0668b42784813801579641b29410b3c7998d6bc465745e5c392669d6870da2c082a939e37fdcb82ec93edac97ff3ad5950accfbc111c76f1a9529444e56aaf68c56c092cd38dc3bef5d20a939926ed4f74a13eddfbe1a1cecc4894af9428c2b7b8883fe4463a4bc85b1cb3c1+    , private_p = 0xeecfae81b1b9b3c908810b10a1b5600199eb9f44aef4fda493b81a9e3d84f632124ef0236e5d1e3b7e28fae7aa040a2d5b252176459d1f397541ba2a58fb6599+    , private_q = 0xc97fb1f027f453f6341233eaaad1d9353f6c42d08866b1d05a0f2035028b9d869840b41666b42e92ea0da3b43204b5cfce3352524d0416a5a441e700af461503+    , private_dP = 0x54494ca63eba0337e4e24023fcd69a5aeb07dddc0183a4d0ac9b54b051f2b13ed9490975eab77414ff59c1f7692e9a2e202b38fc910a474174adc93c1f67c981+    , private_dQ = 0x471e0290ff0af0750351b7f878864ca961adbd3a8a7e991c5c0556a94c3146a7f9803f8f6f8ae342e931fd8ae47a220d1b99a495849807fe39f9245a9836da3d+    , private_qinv = 0xb06c4fdabb6301198d265bdbae9423b380f271f73453885093077fcd39e2119fc98632154f5883b167a967bf402b4e9e2e0f9656e698ea3666edfb25798039f7+    }++rsaKey1 = PrivateKey+    { private_pub = PublicKey+        { public_n = 0xa8b3b284af8eb50b387034a860f146c4919f318763cd6c5598c8ae4811a1e0abc4c7e0b082d693a5e7fced675cf4668512772c0cbc64a742c6c630f533c8cc72f62ae833c40bf25842e984bb78bdbf97c0107d55bdb662f5c4e0fab9845cb5148ef7392dd3aaff93ae1e6b667bb3d4247616d4f5ba10d4cfd226de88d39f16fb+        , public_e = 0x010001+        , public_size = 128+        }+    , private_d = 0x53339cfdb79fc8466a655c7316aca85c55fd8f6dd898fdaf119517ef4f52e8fd8e258df93fee180fa0e4ab29693cd83b152a553d4ac4d1812b8b9fa5af0e7f55fe7304df41570926f3311f15c4d65a732c483116ee3d3d2d0af3549ad9bf7cbfb78ad884f84d5beb04724dc7369b31def37d0cf539e9cfcdd3de653729ead5d1+    , private_p = 0xd32737e7267ffe1341b2d5c0d150a81b586fb3132bed2f8d5262864a9cb9f30af38be448598d413a172efb802c21acf1c11c520c2f26a471dcad212eac7ca39d+    , private_q = 0xcc8853d1d54da630fac004f471f281c7b8982d8224a490edbeb33d3e3d5cc93c4765703d1dd791642f1f116a0dd852be2419b2af72bfe9a030e860b0288b5d77+    , private_dP = 0x0e12bf1718e9cef5599ba1c3882fe8046a90874eefce8f2ccc20e4f2741fb0a33a3848aec9c9305fbecbd2d76819967d4671acc6431e4037968db37878e695c1+    , private_dQ = 0x95297b0f95a2fa67d00707d609dfd4fc05c89dafc2ef6d6ea55bec771ea333734d9251e79082ecda866efef13c459e1a631386b7e354c899f5f112ca85d71583+    , private_qinv = 0x4f456c502493bdc0ed2ab756a3a6ed4d67352a697d4216e93212b127a63d5411ce6fa98d5dbefd73263e3728142743818166ed7dd63687dd2a8ca1d2f4fbd8e1+    }+++data VectorOAEP = VectorOAEP { seed :: ByteString+                             , message :: ByteString+                             , cipherText :: ByteString+                             }+vectorInt = VectorOAEP+    { message = "\xd4\x36\xe9\x95\x69\xfd\x32\xa7\xc8\xa0\x5b\xbc\x90\xd3\x2c\x49"+    , seed    = "\xaa\xfd\x12\xf6\x59\xca\xe6\x34\x89\xb4\x79\xe5\x07\x6d\xde\xc2\xf0\x6c\xb5\x8f"+    , cipherText = "\x12\x53\xe0\x4d\xc0\xa5\x39\x7b\xb4\x4a\x7a\xb8\x7e\x9b\xf2\xa0\x39\xa3\x3d\x1e\x99\x6f\xc8\x2a\x94\xcc\xd3\x00\x74\xc9\x5d\xf7\x63\x72\x20\x17\x06\x9e\x52\x68\xda\x5d\x1c\x0b\x4f\x87\x2c\xf6\x53\xc1\x1d\xf8\x23\x14\xa6\x79\x68\xdf\xea\xe2\x8d\xef\x04\xbb\x6d\x84\xb1\xc3\x1d\x65\x4a\x19\x70\xe5\x78\x3b\xd6\xeb\x96\xa0\x24\xc2\xca\x2f\x4a\x90\xfe\x9f\x2e\xf5\xc9\xc1\x40\xe5\xbb\x48\xda\x95\x36\xad\x87\x00\xc8\x4f\xc9\x13\x0a\xde\xa7\x4e\x55\x8d\x51\xa7\x4d\xdf\x85\xd8\xb5\x0d\xe9\x68\x38\xd6\x06\x3e\x09\x55"+    }++vectorsKey1 =+    [ VectorOAEP -- 1.1+        { message = "\x66\x28\x19\x4e\x12\x07\x3d\xb0\x3b\xa9\x4c\xda\x9e\xf9\x53\x23\x97\xd5\x0d\xba\x79\xb9\x87\x00\x4a\xfe\xfe\x34"+        , seed = "\x18\xb7\x76\xea\x21\x06\x9d\x69\x77\x6a\x33\xe9\x6b\xad\x48\xe1\xdd\xa0\xa5\xef"+        , cipherText = "\x35\x4f\xe6\x7b\x4a\x12\x6d\x5d\x35\xfe\x36\xc7\x77\x79\x1a\x3f\x7b\xa1\x3d\xef\x48\x4e\x2d\x39\x08\xaf\xf7\x22\xfa\xd4\x68\xfb\x21\x69\x6d\xe9\x5d\x0b\xe9\x11\xc2\xd3\x17\x4f\x8a\xfc\xc2\x01\x03\x5f\x7b\x6d\x8e\x69\x40\x2d\xe5\x45\x16\x18\xc2\x1a\x53\x5f\xa9\xd7\xbf\xc5\xb8\xdd\x9f\xc2\x43\xf8\xcf\x92\x7d\xb3\x13\x22\xd6\xe8\x81\xea\xa9\x1a\x99\x61\x70\xe6\x57\xa0\x5a\x26\x64\x26\xd9\x8c\x88\x00\x3f\x84\x77\xc1\x22\x70\x94\xa0\xd9\xfa\x1e\x8c\x40\x24\x30\x9c\xe1\xec\xcc\xb5\x21\x00\x35\xd4\x7a\xc7\x2e\x8a"+        }++    , VectorOAEP -- 1.2+        { message = "\x75\x0c\x40\x47\xf5\x47\xe8\xe4\x14\x11\x85\x65\x23\x29\x8a\xc9\xba\xe2\x45\xef\xaf\x13\x97\xfb\xe5\x6f\x9d\xd5"+        , seed = "\x0c\xc7\x42\xce\x4a\x9b\x7f\x32\xf9\x51\xbc\xb2\x51\xef\xd9\x25\xfe\x4f\xe3\x5f"+        , cipherText = "\x64\x0d\xb1\xac\xc5\x8e\x05\x68\xfe\x54\x07\xe5\xf9\xb7\x01\xdf\xf8\xc3\xc9\x1e\x71\x6c\x53\x6f\xc7\xfc\xec\x6c\xb5\xb7\x1c\x11\x65\x98\x8d\x4a\x27\x9e\x15\x77\xd7\x30\xfc\x7a\x29\x93\x2e\x3f\x00\xc8\x15\x15\x23\x6d\x8d\x8e\x31\x01\x7a\x7a\x09\xdf\x43\x52\xd9\x04\xcd\xeb\x79\xaa\x58\x3a\xdc\xc3\x1e\xa6\x98\xa4\xc0\x52\x83\xda\xba\x90\x89\xbe\x54\x91\xf6\x7c\x1a\x4e\xe4\x8d\xc7\x4b\xbb\xe6\x64\x3a\xef\x84\x66\x79\xb4\xcb\x39\x5a\x35\x2d\x5e\xd1\x15\x91\x2d\xf6\x96\xff\xe0\x70\x29\x32\x94\x6d\x71\x49\x2b\x44"+        }+    , VectorOAEP -- 1.3+        { message = "\xd9\x4a\xe0\x83\x2e\x64\x45\xce\x42\x33\x1c\xb0\x6d\x53\x1a\x82\xb1\xdb\x4b\xaa\xd3\x0f\x74\x6d\xc9\x16\xdf\x24\xd4\xe3\xc2\x45\x1f\xff\x59\xa6\x42\x3e\xb0\xe1\xd0\x2d\x4f\xe6\x46\xcf\x69\x9d\xfd\x81\x8c\x6e\x97\xb0\x51"+        , seed = "\x25\x14\xdf\x46\x95\x75\x5a\x67\xb2\x88\xea\xf4\x90\x5c\x36\xee\xc6\x6f\xd2\xfd"+        , cipherText = "\x42\x37\x36\xed\x03\x5f\x60\x26\xaf\x27\x6c\x35\xc0\xb3\x74\x1b\x36\x5e\x5f\x76\xca\x09\x1b\x4e\x8c\x29\xe2\xf0\xbe\xfe\xe6\x03\x59\x5a\xa8\x32\x2d\x60\x2d\x2e\x62\x5e\x95\xeb\x81\xb2\xf1\xc9\x72\x4e\x82\x2e\xca\x76\xdb\x86\x18\xcf\x09\xc5\x34\x35\x03\xa4\x36\x08\x35\xb5\x90\x3b\xc6\x37\xe3\x87\x9f\xb0\x5e\x0e\xf3\x26\x85\xd5\xae\xc5\x06\x7c\xd7\xcc\x96\xfe\x4b\x26\x70\xb6\xea\xc3\x06\x6b\x1f\xcf\x56\x86\xb6\x85\x89\xaa\xfb\x7d\x62\x9b\x02\xd8\xf8\x62\x5c\xa3\x83\x36\x24\xd4\x80\x0f\xb0\x81\xb1\xcf\x94\xeb"+        }+    , VectorOAEP+        { message = "\x52\xe6\x50\xd9\x8e\x7f\x2a\x04\x8b\x4f\x86\x85\x21\x53\xb9\x7e\x01\xdd\x31\x6f\x34\x6a\x19\xf6\x7a\x85"+        , seed = "\xc4\x43\x5a\x3e\x1a\x18\xa6\x8b\x68\x20\x43\x62\x90\xa3\x7c\xef\xb8\x5d\xb3\xfb"+        , cipherText = "\x45\xea\xd4\xca\x55\x1e\x66\x2c\x98\x00\xf1\xac\xa8\x28\x3b\x05\x25\xe6\xab\xae\x30\xbe\x4b\x4a\xba\x76\x2f\xa4\x0f\xd3\xd3\x8e\x22\xab\xef\xc6\x97\x94\xf6\xeb\xbb\xc0\x5d\xdb\xb1\x12\x16\x24\x7d\x2f\x41\x2f\xd0\xfb\xa8\x7c\x6e\x3a\xcd\x88\x88\x13\x64\x6f\xd0\xe4\x8e\x78\x52\x04\xf9\xc3\xf7\x3d\x6d\x82\x39\x56\x27\x22\xdd\xdd\x87\x71\xfe\xc4\x8b\x83\xa3\x1e\xe6\xf5\x92\xc4\xcf\xd4\xbc\x88\x17\x4f\x3b\x13\xa1\x12\xaa\xe3\xb9\xf7\xb8\x0e\x0f\xc6\xf7\x25\x5b\xa8\x80\xdc\x7d\x80\x21\xe2\x2a\xd6\xa8\x5f\x07\x55"+        }++    , VectorOAEP+        { message = "\x8d\xa8\x9f\xd9\xe5\xf9\x74\xa2\x9f\xef\xfb\x46\x2b\x49\x18\x0f\x6c\xf9\xe8\x02"+        , seed = "\xb3\x18\xc4\x2d\xf3\xbe\x0f\x83\xfe\xa8\x23\xf5\xa7\xb4\x7e\xd5\xe4\x25\xa3\xb5"+        , cipherText = "\x36\xf6\xe3\x4d\x94\xa8\xd3\x4d\xaa\xcb\xa3\x3a\x21\x39\xd0\x0a\xd8\x5a\x93\x45\xa8\x60\x51\xe7\x30\x71\x62\x00\x56\xb9\x20\xe2\x19\x00\x58\x55\xa2\x13\xa0\xf2\x38\x97\xcd\xcd\x73\x1b\x45\x25\x7c\x77\x7f\xe9\x08\x20\x2b\xef\xdd\x0b\x58\x38\x6b\x12\x44\xea\x0c\xf5\x39\xa0\x5d\x5d\x10\x32\x9d\xa4\x4e\x13\x03\x0f\xd7\x60\xdc\xd6\x44\xcf\xef\x20\x94\xd1\x91\x0d\x3f\x43\x3e\x1c\x7c\x6d\xd1\x8b\xc1\xf2\xdf\x7f\x64\x3d\x66\x2f\xb9\xdd\x37\xea\xd9\x05\x91\x90\xf4\xfa\x66\xca\x39\xe8\x69\xc4\xeb\x44\x9c\xbd\xc4\x39"+        }+    , VectorOAEP -- 1.6+        { message = "\x26\x52\x10\x50\x84\x42\x71"+        , seed = "\xe4\xec\x09\x82\xc2\x33\x6f\x3a\x67\x7f\x6a\x35\x61\x74\xeb\x0c\xe8\x87\xab\xc2"+        , cipherText = "\x42\xce\xe2\x61\x7b\x1e\xce\xa4\xdb\x3f\x48\x29\x38\x6f\xbd\x61\xda\xfb\xf0\x38\xe1\x80\xd8\x37\xc9\x63\x66\xdf\x24\xc0\x97\xb4\xab\x0f\xac\x6b\xdf\x59\x0d\x82\x1c\x9f\x10\x64\x2e\x68\x1a\xd0\x5b\x8d\x78\xb3\x78\xc0\xf4\x6c\xe2\xfa\xd6\x3f\x74\xe0\xad\x3d\xf0\x6b\x07\x5d\x7e\xb5\xf5\x63\x6f\x8d\x40\x3b\x90\x59\xca\x76\x1b\x5c\x62\xbb\x52\xaa\x45\x00\x2e\xa7\x0b\xaa\xce\x08\xde\xd2\x43\xb9\xd8\xcb\xd6\x2a\x68\xad\xe2\x65\x83\x2b\x56\x56\x4e\x43\xa6\xfa\x42\xed\x19\x9a\x09\x97\x69\x74\x2d\xf1\x53\x9e\x82\x55"+        }+    ]++doEncryptionTest key (i, vec) = testCase (show i) (Right (cipherText vec) @=? actual)+    where actual = OAEP.encryptWithSeed (seed vec) (OAEP.defaultOAEPParams SHA1) key (message vec) ++doDecryptionTest key (i, vec) = testCase (show i) (Right (message vec) @=? actual)+    where actual = OAEP.decrypt Nothing (OAEP.defaultOAEPParams SHA1) key (cipherText vec)++oaepTests = testGroup "RSA-OAEP"+    [ testGroup "internal"+        [ doEncryptionTest (private_pub rsaKeyInt) (0 :: Int, vectorInt)+        , doDecryptionTest rsaKeyInt (0 :: Int, vectorInt)+        ]+    , testGroup "encryption key 1024 bits" $ map (doEncryptionTest $ private_pub rsaKey1) (zip [katZero..] vectorsKey1)+    , testGroup "decryption key 1024 bits" $ map (doDecryptionTest rsaKey1) (zip [katZero..] vectorsKey1)+    ]
+ tests/KAT_PubKey/PSS.hs view
@@ -0,0 +1,473 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_PubKey.PSS (pssTests) where++import Crypto.PubKey.RSA+import qualified Crypto.PubKey.RSA.PSS as PSS++import Imports++data VectorPSS = VectorPSS { message :: ByteString+                           , salt :: ByteString+                           , signature :: ByteString+                           }++rsaKeyInt = PrivateKey+    { private_pub = PublicKey+        { public_n = 0xa2ba40ee07e3b2bd2f02ce227f36a195024486e49c19cb41bbbdfbba98b22b0e577c2eeaffa20d883a76e65e394c69d4b3c05a1e8fadda27edb2a42bc000fe888b9b32c22d15add0cd76b3e7936e19955b220dd17d4ea904b1ec102b2e4de7751222aa99151024c7cb41cc5ea21d00eeb41f7c800834d2c6e06bce3bce7ea9a5+        , public_e = 0x010001+        , public_size = 128+        }+    , private_d = 0x50e2c3e38d886110288dfc68a9533e7e12e27d2aa56d2cdb3fb6efa990bcff29e1d2987fb711962860e7391b1ce01ebadb9e812d2fbdfaf25df4ae26110a6d7a26f0b810f54875e17dd5c9fb6d641761245b81e79f8c88f0e55a6dcd5f133abd35f8f4ec80adf1bf86277a582894cb6ebcd2162f1c7534f1f4947b129151b71+    , private_p = 0xd17f655bf27c8b16d35462c905cc04a26f37e2a67fa9c0ce0dced472394a0df743fe7f929e378efdb368eddff453cf007af6d948e0ade757371f8a711e278f6b+    , private_q = 0xc6d92b6fee7414d1358ce1546fb62987530b90bd15e0f14963a5e2635adb69347ec0c01b2ab1763fd8ac1a592fb22757463a982425bb97a3a437c5bf86d03f2f+    , private_dP = 0x9d0dbf83e5ce9e4b1754dcd5cd05bcb7b55f1508330ea49f14d4e889550f8256cb5f806dff34b17ada44208853577d08e4262890acf752461cea05547601bc4f+    , private_dQ = 0x1291a524c6b7c059e90e46dc83b2171eb3fa98818fd179b6c8bf6cecaa476303abf283fe05769cfc495788fe5b1ddfde9e884a3cd5e936b7e955ebf97eb563b1+    , private_qinv = 0xa63f1da38b950c9ad1c67ce0d677ec2914cd7d40062df42a67eb198a176f9742aac7c5fea14f2297662b84812c4defc49a8025ab4382286be4c03788dd01d69f+    }++rsaKey1 = PrivateKey+    { private_pub = PublicKey+        { public_n = 0xa56e4a0e701017589a5187dc7ea841d156f2ec0e36ad52a44dfeb1e61f7ad991d8c51056ffedb162b4c0f283a12a88a394dff526ab7291cbb307ceabfce0b1dfd5cd9508096d5b2b8b6df5d671ef6377c0921cb23c270a70e2598e6ff89d19f105acc2d3f0cb35f29280e1386b6f64c4ef22e1e1f20d0ce8cffb2249bd9a2137+        , public_e = 0x010001+        , public_size = 128+        }+    , private_d = 0x33a5042a90b27d4f5451ca9bbbd0b44771a101af884340aef9885f2a4bbe92e894a724ac3c568c8f97853ad07c0266c8c6a3ca0929f1e8f11231884429fc4d9ae55fee896a10ce707c3ed7e734e44727a39574501a532683109c2abacaba283c31b4bd2f53c3ee37e352cee34f9e503bd80c0622ad79c6dcee883547c6a3b325+    , private_p = 0xe7e8942720a877517273a356053ea2a1bc0c94aa72d55c6e86296b2dfc967948c0a72cbccca7eacb35706e09a1df55a1535bd9b3cc34160b3b6dcd3eda8e6443+    , private_q = 0xb69dca1cf7d4d7ec81e75b90fcca874abcde123fd2700180aa90479b6e48de8d67ed24f9f19d85ba275874f542cd20dc723e6963364a1f9425452b269a6799fd+    , private_dP = 0x28fa13938655be1f8a159cbaca5a72ea190c30089e19cd274a556f36c4f6e19f554b34c077790427bbdd8dd3ede2448328f385d81b30e8e43b2fffa027861979+    , private_dQ = 0x1a8b38f398fa712049898d7fb79ee0a77668791299cdfa09efc0e507acb21ed74301ef5bfd48be455eaeb6e1678255827580a8e4e8e14151d1510a82a3f2e729+    , private_qinv = 0x27156aba4126d24a81f3a528cbfb27f56886f840a9f6e86e17a44b94fe9319584b8e22fdde1e5a2e3bd8aa5ba8d8584194eb2190acf832b847f13a3d24a79f4d+    }++vectorInt = VectorPSS+    { message = "\x85\x9e\xef\x2f\xd7\x8a\xca\x00\x30\x8b\xdc\x47\x11\x93\xbf\x55\xbf\x9d\x78\xdb\x8f\x8a\x67\x2b\x48\x46\x34\xf3\xc9\xc2\x6e\x64\x78\xae\x10\x26\x0f\xe0\xdd\x8c\x08\x2e\x53\xa5\x29\x3a\xf2\x17\x3c\xd5\x0c\x6d\x5d\x35\x4f\xeb\xf7\x8b\x26\x02\x1c\x25\xc0\x27\x12\xe7\x8c\xd4\x69\x4c\x9f\x46\x97\x77\xe4\x51\xe7\xf8\xe9\xe0\x4c\xd3\x73\x9c\x6b\xbf\xed\xae\x48\x7f\xb5\x56\x44\xe9\xca\x74\xff\x77\xa5\x3c\xb7\x29\x80\x2f\x6e\xd4\xa5\xff\xa8\xba\x15\x98\x90\xfc"+    , salt = "\xe3\xb5\xd5\xd0\x02\xc1\xbc\xe5\x0c\x2b\x65\xef\x88\xa1\x88\xd8\x3b\xce\x7e\x61"+    , signature = "\x8d\xaa\x62\x7d\x3d\xe7\x59\x5d\x63\x05\x6c\x7e\xc6\x59\xe5\x44\x06\xf1\x06\x10\x12\x8b\xaa\xe8\x21\xc8\xb2\xa0\xf3\x93\x6d\x54\xdc\x3b\xdc\xe4\x66\x89\xf6\xb7\x95\x1b\xb1\x8e\x84\x05\x42\x76\x97\x18\xd5\x71\x5d\x21\x0d\x85\xef\xbb\x59\x61\x92\x03\x2c\x42\xbe\x4c\x29\x97\x2c\x85\x62\x75\xeb\x6d\x5a\x45\xf0\x5f\x51\x87\x6f\xc6\x74\x3d\xed\xdd\x28\xca\xec\x9b\xb3\x0e\xa9\x9e\x02\xc3\x48\x82\x69\x60\x4f\xe4\x97\xf7\x4c\xcd\x7c\x7f\xca\x16\x71\x89\x71\x23\xcb\xd3\x0d\xef\x5d\x54\xa2\xb5\x53\x6a\xd9\x0a\x74\x7e"+    }++{-+# mHash    = Hash(M)+# salt     = random string of octets+# M'       = Padding || mHash || salt+# H        = Hash(M')+# DB       = Padding || salt +# dbMask   = MGF(H, length(DB))+# maskedDB = DB xor dbMask (leftmost bit set to+#            zero)+# EM       = maskedDB || H || 0xbc++# mHash:+37 b6 6a e0 44 58 43 35 3d 47 ec b0 b4 fd 14 c1 +10 e6 2d 6a ++# salt:++# M':+00 00 00 00 00 00 00 00 37 b6 6a e0 44 58 43 35 +3d 47 ec b0 b4 fd 14 c1 10 e6 2d 6a e3 b5 d5 d0 +02 c1 bc e5 0c 2b 65 ef 88 a1 88 d8 3b ce 7e 61 ++# H:+df 1a 89 6f 9d 8b c8 16 d9 7c d7 a2 c4 3b ad 54 +6f be 8c fe ++# DB:+00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +00 00 00 00 00 00 01 e3 b5 d5 d0 02 c1 bc e5 0c +2b 65 ef 88 a1 88 d8 3b ce 7e 61 ++# dbMask:+66 e4 67 2e 83 6a d1 21 ba 24 4b ed 65 76 b8 67 +d9 a4 47 c2 8a 6e 66 a5 b8 7d ee 7f bc 7e 65 af +50 57 f8 6f ae 89 84 d9 ba 7f 96 9a d6 fe 02 a4 +d7 5f 74 45 fe fd d8 5b 6d 3a 47 7c 28 d2 4b a1 +e3 75 6f 79 2d d1 dc e8 ca 94 44 0e cb 52 79 ec +d3 18 3a 31 1f c8 97 39 a9 66 43 13 6e 8b 0f 46 +5e 87 a4 53 5c d4 c5 9b 10 02 8d ++# maskedDB:+66 e4 67 2e 83 6a d1 21 ba 24 4b ed 65 76 b8 67 +d9 a4 47 c2 8a 6e 66 a5 b8 7d ee 7f bc 7e 65 af +50 57 f8 6f ae 89 84 d9 ba 7f 96 9a d6 fe 02 a4 +d7 5f 74 45 fe fd d8 5b 6d 3a 47 7c 28 d2 4b a1 +e3 75 6f 79 2d d1 dc e8 ca 94 44 0e cb 52 79 ec +d3 18 3a 31 1f c8 96 da 1c b3 93 11 af 37 ea 4a +75 e2 4b db fd 5c 1d a0 de 7c ec ++# Encoded message EM:+66 e4 67 2e 83 6a d1 21 ba 24 4b ed 65 76 b8 67 +d9 a4 47 c2 8a 6e 66 a5 b8 7d ee 7f bc 7e 65 af +50 57 f8 6f ae 89 84 d9 ba 7f 96 9a d6 fe 02 a4 +d7 5f 74 45 fe fd d8 5b 6d 3a 47 7c 28 d2 4b a1 +e3 75 6f 79 2d d1 dc e8 ca 94 44 0e cb 52 79 ec +d3 18 3a 31 1f c8 96 da 1c b3 93 11 af 37 ea 4a +75 e2 4b db fd 5c 1d a0 de 7c ec df 1a 89 6f 9d +8b c8 16 d9 7c d7 a2 c4 3b ad 54 6f be 8c fe bc +-}++vectorsKey1 =+    [+    -- Example 1.1+      VectorPSS+        { message = "\xcd\xc8\x7d\xa2\x23\xd7\x86\xdf\x3b\x45\xe0\xbb\xbc\x72\x13\x26\xd1\xee\x2a\xf8\x06\xcc\x31\x54\x75\xcc\x6f\x0d\x9c\x66\xe1\xb6\x23\x71\xd4\x5c\xe2\x39\x2e\x1a\xc9\x28\x44\xc3\x10\x10\x2f\x15\x6a\x0d\x8d\x52\xc1\xf4\xc4\x0b\xa3\xaa\x65\x09\x57\x86\xcb\x76\x97\x57\xa6\x56\x3b\xa9\x58\xfe\xd0\xbc\xc9\x84\xe8\xb5\x17\xa3\xd5\xf5\x15\xb2\x3b\x8a\x41\xe7\x4a\xa8\x67\x69\x3f\x90\xdf\xb0\x61\xa6\xe8\x6d\xfa\xae\xe6\x44\x72\xc0\x0e\x5f\x20\x94\x57\x29\xcb\xeb\xe7\x7f\x06\xce\x78\xe0\x8f\x40\x98\xfb\xa4\x1f\x9d\x61\x93\xc0\x31\x7e\x8b\x60\xd4\xb6\x08\x4a\xcb\x42\xd2\x9e\x38\x08\xa3\xbc\x37\x2d\x85\xe3\x31\x17\x0f\xcb\xf7\xcc\x72\xd0\xb7\x1c\x29\x66\x48\xb3\xa4\xd1\x0f\x41\x62\x95\xd0\x80\x7a\xa6\x25\xca\xb2\x74\x4f\xd9\xea\x8f\xd2\x23\xc4\x25\x37\x02\x98\x28\xbd\x16\xbe\x02\x54\x6f\x13\x0f\xd2\xe3\x3b\x93\x6d\x26\x76\xe0\x8a\xed\x1b\x73\x31\x8b\x75\x0a\x01\x67\xd0"+        , salt = "\xde\xe9\x59\xc7\xe0\x64\x11\x36\x14\x20\xff\x80\x18\x5e\xd5\x7f\x3e\x67\x76\xaf"+        , signature = "\x90\x74\x30\x8f\xb5\x98\xe9\x70\x1b\x22\x94\x38\x8e\x52\xf9\x71\xfa\xac\x2b\x60\xa5\x14\x5a\xf1\x85\xdf\x52\x87\xb5\xed\x28\x87\xe5\x7c\xe7\xfd\x44\xdc\x86\x34\xe4\x07\xc8\xe0\xe4\x36\x0b\xc2\x26\xf3\xec\x22\x7f\x9d\x9e\x54\x63\x8e\x8d\x31\xf5\x05\x12\x15\xdf\x6e\xbb\x9c\x2f\x95\x79\xaa\x77\x59\x8a\x38\xf9\x14\xb5\xb9\xc1\xbd\x83\xc4\xe2\xf9\xf3\x82\xa0\xd0\xaa\x35\x42\xff\xee\x65\x98\x4a\x60\x1b\xc6\x9e\xb2\x8d\xeb\x27\xdc\xa1\x2c\x82\xc2\xd4\xc3\xf6\x6c\xd5\x00\xf1\xff\x2b\x99\x4d\x8a\x4e\x30\xcb\xb3\x3c"+        }+    -- Example 1.2+    , VectorPSS+        { message = "\x85\x13\x84\xcd\xfe\x81\x9c\x22\xed\x6c\x4c\xcb\x30\xda\xeb\x5c\xf0\x59\xbc\x8e\x11\x66\xb7\xe3\x53\x0c\x4c\x23\x3e\x2b\x5f\x8f\x71\xa1\xcc\xa5\x82\xd4\x3e\xcc\x72\xb1\xbc\xa1\x6d\xfc\x70\x13\x22\x6b\x9e"+        , salt = "\xef\x28\x69\xfa\x40\xc3\x46\xcb\x18\x3d\xab\x3d\x7b\xff\xc9\x8f\xd5\x6d\xf4\x2d"+        , signature = "\x3e\xf7\xf4\x6e\x83\x1b\xf9\x2b\x32\x27\x41\x42\xa5\x85\xff\xce\xfb\xdc\xa7\xb3\x2a\xe9\x0d\x10\xfb\x0f\x0c\x72\x99\x84\xf0\x4e\xf2\x9a\x9d\xf0\x78\x07\x75\xce\x43\x73\x9b\x97\x83\x83\x90\xdb\x0a\x55\x05\xe6\x3d\xe9\x27\x02\x8d\x9d\x29\xb2\x19\xca\x2c\x45\x17\x83\x25\x58\xa5\x5d\x69\x4a\x6d\x25\xb9\xda\xb6\x60\x03\xc4\xcc\xcd\x90\x78\x02\x19\x3b\xe5\x17\x0d\x26\x14\x7d\x37\xb9\x35\x90\x24\x1b\xe5\x1c\x25\x05\x5f\x47\xef\x62\x75\x2c\xfb\xe2\x14\x18\xfa\xfe\x98\xc2\x2c\x4d\x4d\x47\x72\x4f\xdb\x56\x69\xe8\x43"+        }+    -- Example 1.3+    , VectorPSS+        { message = "\xa4\xb1\x59\x94\x17\x61\xc4\x0c\x6a\x82\xf2\xb8\x0d\x1b\x94\xf5\xaa\x26\x54\xfd\x17\xe1\x2d\x58\x88\x64\x67\x9b\x54\xcd\x04\xef\x8b\xd0\x30\x12\xbe\x8d\xc3\x7f\x4b\x83\xaf\x79\x63\xfa\xff\x0d\xfa\x22\x54\x77\x43\x7c\x48\x01\x7f\xf2\xbe\x81\x91\xcf\x39\x55\xfc\x07\x35\x6e\xab\x3f\x32\x2f\x7f\x62\x0e\x21\xd2\x54\xe5\xdb\x43\x24\x27\x9f\xe0\x67\xe0\x91\x0e\x2e\x81\xca\x2c\xab\x31\xc7\x45\xe6\x7a\x54\x05\x8e\xb5\x0d\x99\x3c\xdb\x9e\xd0\xb4\xd0\x29\xc0\x6d\x21\xa9\x4c\xa6\x61\xc3\xce\x27\xfa\xe1\xd6\xcb\x20\xf4\x56\x4d\x66\xce\x47\x67\x58\x3d\x0e\x5f\x06\x02\x15\xb5\x90\x17\xbe\x85\xea\x84\x89\x39\x12\x7b\xd8\xc9\xc4\xd4\x7b\x51\x05\x6c\x03\x1c\xf3\x36\xf1\x7c\x99\x80\xf3\xb8\xf5\xb9\xb6\x87\x8e\x8b\x79\x7a\xa4\x3b\x88\x26\x84\x33\x3e\x17\x89\x3f\xe9\xca\xa6\xaa\x29\x9f\x7e\xd1\xa1\x8e\xe2\xc5\x48\x64\xb7\xb2\xb9\x9b\x72\x61\x8f\xb0\x25\x74\xd1\x39\xef\x50\xf0\x19\xc9\xee\xf4\x16\x97\x13\x38\xe7\xd4\x70"+        , salt = "\x71\x0b\x9c\x47\x47\xd8\x00\xd4\xde\x87\xf1\x2a\xfd\xce\x6d\xf1\x81\x07\xcc\x77"+        , signature = "\x66\x60\x26\xfb\xa7\x1b\xd3\xe7\xcf\x13\x15\x7c\xc2\xc5\x1a\x8e\x4a\xa6\x84\xaf\x97\x78\xf9\x18\x49\xf3\x43\x35\xd1\x41\xc0\x01\x54\xc4\x19\x76\x21\xf9\x62\x4a\x67\x5b\x5a\xbc\x22\xee\x7d\x5b\xaa\xff\xaa\xe1\xc9\xba\xca\x2c\xc3\x73\xb3\xf3\x3e\x78\xe6\x14\x3c\x39\x5a\x91\xaa\x7f\xac\xa6\x64\xeb\x73\x3a\xfd\x14\xd8\x82\x72\x59\xd9\x9a\x75\x50\xfa\xca\x50\x1e\xf2\xb0\x4e\x33\xc2\x3a\xa5\x1f\x4b\x9e\x82\x82\xef\xdb\x72\x8c\xc0\xab\x09\x40\x5a\x91\x60\x7c\x63\x69\x96\x1b\xc8\x27\x0d\x2d\x4f\x39\xfc\xe6\x12\xb1"+        }+    -- Example 1.4+    , VectorPSS+        { message = "\xbc\x65\x67\x47\xfa\x9e\xaf\xb3\xf0"+        , salt = "\x05\x6f\x00\x98\x5d\xe1\x4d\x8e\xf5\xce\xa9\xe8\x2f\x8c\x27\xbe\xf7\x20\x33\x5e"+        , signature = "\x46\x09\x79\x3b\x23\xe9\xd0\x93\x62\xdc\x21\xbb\x47\xda\x0b\x4f\x3a\x76\x22\x64\x9a\x47\xd4\x64\x01\x9b\x9a\xea\xfe\x53\x35\x9c\x17\x8c\x91\xcd\x58\xba\x6b\xcb\x78\xbe\x03\x46\xa7\xbc\x63\x7f\x4b\x87\x3d\x4b\xab\x38\xee\x66\x1f\x19\x96\x34\xc5\x47\xa1\xad\x84\x42\xe0\x3d\xa0\x15\xb1\x36\xe5\x43\xf7\xab\x07\xc0\xc1\x3e\x42\x25\xb8\xde\x8c\xce\x25\xd4\xf6\xeb\x84\x00\xf8\x1f\x7e\x18\x33\xb7\xee\x6e\x33\x4d\x37\x09\x64\xca\x79\xfd\xb8\x72\xb4\xd7\x52\x23\xb5\xee\xb0\x81\x01\x59\x1f\xb5\x32\xd1\x55\xa6\xde\x87"+        }+    -- Example 1.5+    , VectorPSS+        { message = "\xb4\x55\x81\x54\x7e\x54\x27\x77\x0c\x76\x8e\x8b\x82\xb7\x55\x64\xe0\xea\x4e\x9c\x32\x59\x4d\x6b\xff\x70\x65\x44\xde\x0a\x87\x76\xc7\xa8\x0b\x45\x76\x55\x0e\xee\x1b\x2a\xca\xbc\x7e\x8b\x7d\x3e\xf7\xbb\x5b\x03\xe4\x62\xc1\x10\x47\xea\xdd\x00\x62\x9a\xe5\x75\x48\x0a\xc1\x47\x0f\xe0\x46\xf1\x3a\x2b\xf5\xaf\x17\x92\x1d\xc4\xb0\xaa\x8b\x02\xbe\xe6\x33\x49\x11\x65\x1d\x7f\x85\x25\xd1\x0f\x32\xb5\x1d\x33\xbe\x52\x0d\x3d\xdf\x5a\x70\x99\x55\xa3\xdf\xe7\x82\x83\xb9\xe0\xab\x54\x04\x6d\x15\x0c\x17\x7f\x03\x7f\xdc\xcc\x5b\xe4\xea\x5f\x68\xb5\xe5\xa3\x8c\x9d\x7e\xdc\xcc\xc4\x97\x5f\x45\x5a\x69\x09\xb4"+        , salt = "\x80\xe7\x0f\xf8\x6a\x08\xde\x3e\xc6\x09\x72\xb3\x9b\x4f\xbf\xdc\xea\x67\xae\x8e"+        , signature = "\x1d\x2a\xad\x22\x1c\xa4\xd3\x1d\xdf\x13\x50\x92\x39\x01\x93\x98\xe3\xd1\x4b\x32\xdc\x34\xdc\x5a\xf4\xae\xae\xa3\xc0\x95\xaf\x73\x47\x9c\xf0\xa4\x5e\x56\x29\x63\x5a\x53\xa0\x18\x37\x76\x15\xb1\x6c\xb9\xb1\x3b\x3e\x09\xd6\x71\xeb\x71\xe3\x87\xb8\x54\x5c\x59\x60\xda\x5a\x64\x77\x6e\x76\x8e\x82\xb2\xc9\x35\x83\xbf\x10\x4c\x3f\xdb\x23\x51\x2b\x7b\x4e\x89\xf6\x33\xdd\x00\x63\xa5\x30\xdb\x45\x24\xb0\x1c\x3f\x38\x4c\x09\x31\x0e\x31\x5a\x79\xdc\xd3\xd6\x84\x02\x2a\x7f\x31\xc8\x65\xa6\x64\xe3\x16\x97\x8b\x75\x9f\xad"+        }+    -- Example 1.6+    , VectorPSS+        { message = "\x10\xaa\xe9\xa0\xab\x0b\x59\x5d\x08\x41\x20\x7b\x70\x0d\x48\xd7\x5f\xae\xdd\xe3\xb7\x75\xcd\x6b\x4c\xc8\x8a\xe0\x6e\x46\x94\xec\x74\xba\x18\xf8\x52\x0d\x4f\x5e\xa6\x9c\xbb\xe7\xcc\x2b\xeb\xa4\x3e\xfd\xc1\x02\x15\xac\x4e\xb3\x2d\xc3\x02\xa1\xf5\x3d\xc6\xc4\x35\x22\x67\xe7\x93\x6c\xfe\xbf\x7c\x8d\x67\x03\x57\x84\xa3\x90\x9f\xa8\x59\xc7\xb7\xb5\x9b\x8e\x39\xc5\xc2\x34\x9f\x18\x86\xb7\x05\xa3\x02\x67\xd4\x02\xf7\x48\x6a\xb4\xf5\x8c\xad\x5d\x69\xad\xb1\x7a\xb8\xcd\x0c\xe1\xca\xf5\x02\x5a\xf4\xae\x24\xb1\xfb\x87\x94\xc6\x07\x0c\xc0\x9a\x51\xe2\xf9\x91\x13\x11\xe3\x87\x7d\x00\x44\xc7\x1c\x57\xa9\x93\x39\x50\x08\x80\x6b\x72\x3a\xc3\x83\x73\xd3\x95\x48\x18\x18\x52\x8c\x1e\x70\x53\x73\x92\x82\x05\x35\x29\x51\x0e\x93\x5c\xd0\xfa\x77\xb8\xfa\x53\xcc\x2d\x47\x4b\xd4\xfb\x3c\xc5\xc6\x72\xd6\xff\xdc\x90\xa0\x0f\x98\x48\x71\x2c\x4b\xcf\xe4\x6c\x60\x57\x36\x59\xb1\x1e\x64\x57\xe8\x61\xf0\xf6\x04\xb6\x13\x8d\x14\x4f\x8c\xe4\xe2\xda\x73"+        , salt = "\xa8\xab\x69\xdd\x80\x1f\x00\x74\xc2\xa1\xfc\x60\x64\x98\x36\xc6\x16\xd9\x96\x81"+        , signature = "\x2a\x34\xf6\x12\x5e\x1f\x6b\x0b\xf9\x71\xe8\x4f\xbd\x41\xc6\x32\xbe\x8f\x2c\x2a\xce\x7d\xe8\xb6\x92\x6e\x31\xff\x93\xe9\xaf\x98\x7f\xbc\x06\xe5\x1e\x9b\xe1\x4f\x51\x98\xf9\x1f\x3f\x95\x3b\xd6\x7d\xa6\x0a\x9d\xf5\x97\x64\xc3\xdc\x0f\xe0\x8e\x1c\xbe\xf0\xb7\x5f\x86\x8d\x10\xad\x3f\xba\x74\x9f\xef\x59\xfb\x6d\xac\x46\xa0\xd6\xe5\x04\x36\x93\x31\x58\x6f\x58\xe4\x62\x8f\x39\xaa\x27\x89\x82\x54\x3b\xc0\xee\xb5\x37\xdc\x61\x95\x80\x19\xb3\x94\xfb\x27\x3f\x21\x58\x58\xa0\xa0\x1a\xc4\xd6\x50\xb9\x55\xc6\x7f\x4c\x58"+        }+    ]++{-+# ===================================+# Example 10: A 2048-bit RSA Key Pair+# ===================================++# ------------------------------+# Components of the RSA Key Pair+# ------------------------------++# RSA modulus n: +a5 dd 86 7a c4 cb 02 f9 0b 94 57 d4 8c 14 a7 70 +ef 99 1c 56 c3 9c 0e c6 5f d1 1a fa 89 37 ce a5 +7b 9b e7 ac 73 b4 5c 00 17 61 5b 82 d6 22 e3 18 +75 3b 60 27 c0 fd 15 7b e1 2f 80 90 fe e2 a7 ad +cd 0e ef 75 9f 88 ba 49 97 c7 a4 2d 58 c9 aa 12 +cb 99 ae 00 1f e5 21 c1 3b b5 43 14 45 a8 d5 ae +4f 5e 4c 7e 94 8a c2 27 d3 60 40 71 f2 0e 57 7e +90 5f be b1 5d fa f0 6d 1d e5 ae 62 53 d6 3a 6a +21 20 b3 1a 5d a5 da bc 95 50 60 0e 20 f2 7d 37 +39 e2 62 79 25 fe a3 cc 50 9f 21 df f0 4e 6e ea +45 49 c5 40 d6 80 9f f9 30 7e ed e9 1f ff 58 73 +3d 83 85 a2 37 d6 d3 70 5a 33 e3 91 90 09 92 07 +0d f7 ad f1 35 7c f7 e3 70 0c e3 66 7d e8 3f 17 +b8 df 17 78 db 38 1d ce 09 cb 4a d0 58 a5 11 00 +1a 73 81 98 ee 27 cf 55 a1 3b 75 45 39 90 65 82 +ec 8b 17 4b d5 8d 5d 1f 3d 76 7c 61 37 21 ae 05 ++# RSA public exponent e: +01 00 01 ++# RSA private exponent d: +2d 2f f5 67 b3 fe 74 e0 61 91 b7 fd ed 6d e1 12 +29 0c 67 06 92 43 0d 59 69 18 40 47 da 23 4c 96 +93 de ed 16 73 ed 42 95 39 c9 69 d3 72 c0 4d 6b +47 e0 f5 b8 ce e0 84 3e 5c 22 83 5d bd 3b 05 a0 +99 79 84 ae 60 58 b1 1b c4 90 7c bf 67 ed 84 fa +9a e2 52 df b0 d0 cd 49 e6 18 e3 5d fd fe 59 bc +a3 dd d6 6c 33 ce bb c7 7a d4 41 aa 69 5e 13 e3 +24 b5 18 f0 1c 60 f5 a8 5c 99 4a d1 79 f2 a6 b5 +fb e9 34 02 b1 17 67 be 01 bf 07 34 44 d6 ba 1d +d2 bc a5 bd 07 4d 4a 5f ae 35 31 ad 13 03 d8 4b +30 d8 97 31 8c bb ba 04 e0 3c 2e 66 de 6d 91 f8 +2f 96 ea 1d 4b b5 4a 5a ae 10 2d 59 46 57 f5 c9 +78 95 53 51 2b 29 6d ea 29 d8 02 31 96 35 7e 3e +3a 6e 95 8f 39 e3 c2 34 40 38 ea 60 4b 31 ed c6 +f0 f7 ff 6e 71 81 a5 7c 92 82 6a 26 8f 86 76 8e +96 f8 78 56 2f c7 1d 85 d6 9e 44 86 12 f7 04 8f ++# Prime p: +cf d5 02 83 fe ee b9 7f 6f 08 d7 3c bc 7b 38 36 +f8 2b bc d4 99 47 9f 5e 6f 76 fd fc b8 b3 8c 4f +71 dc 9e 88 bd 6a 6f 76 37 1a fd 65 d2 af 18 62 +b3 2a fb 34 a9 5f 71 b8 b1 32 04 3f fe be 3a 95 +2b af 75 92 44 81 48 c0 3f 9c 69 b1 d6 8e 4c e5 +cf 32 c8 6b af 46 fe d3 01 ca 1a b4 03 06 9b 32 +f4 56 b9 1f 71 89 8a b0 81 cd 8c 42 52 ef 52 71 +91 5c 97 94 b8 f2 95 85 1d a7 51 0f 99 cb 73 eb ++# Prime q: +cc 4e 90 d2 a1 b3 a0 65 d3 b2 d1 f5 a8 fc e3 1b +54 44 75 66 4e ab 56 1d 29 71 b9 9f b7 be f8 44 +e8 ec 1f 36 0b 8c 2a c8 35 96 92 97 1e a6 a3 8f +72 3f cc 21 1f 5d bc b1 77 a0 fd ac 51 64 a1 d4 +ff 7f bb 4e 82 99 86 35 3c b9 83 65 9a 14 8c dd +42 0c 7d 31 ba 38 22 ea 90 a3 2b e4 6c 03 0e 8c +17 e1 fa 0a d3 78 59 e0 6b 0a a6 fa 3b 21 6d 9c +be 6c 0e 22 33 97 69 c0 a6 15 91 3e 5d a7 19 cf ++# p's CRT exponent dP: +1c 2d 1f c3 2f 6b c4 00 4f d8 5d fd e0 fb bf 9a +4c 38 f9 c7 c4 e4 1d ea 1a a8 82 34 a2 01 cd 92 +f3 b7 da 52 65 83 a9 8a d8 5b b3 60 fb 98 3b 71 +1e 23 44 9d 56 1d 17 78 d7 a5 15 48 6b cb f4 7b +46 c9 e9 e1 a3 a1 f7 70 00 ef be b0 9a 8a fe 47 +e5 b8 57 cd a9 9c b1 6d 7f ff 9b 71 2e 3b d6 0c +a9 6d 9c 79 73 d6 16 d4 69 34 a9 c0 50 28 1c 00 +43 99 ce ff 1d b7 dd a7 87 66 a8 a9 b9 cb 08 73 ++# q's CRT exponent dQ: +cb 3b 3c 04 ca a5 8c 60 be 7d 9b 2d eb b3 e3 96 +43 f4 f5 73 97 be 08 23 6a 1e 9e af aa 70 65 36 +e7 1c 3a cf e0 1c c6 51 f2 3c 9e 05 85 8f ee 13 +bb 6a 8a fc 47 df 4e dc 9a 4b a3 0b ce cb 73 d0 +15 78 52 32 7e e7 89 01 5c 2e 8d ee 7b 9f 05 a0 +f3 1a c9 4e b6 17 31 64 74 0c 5c 95 14 7c d5 f3 +b5 ae 2c b4 a8 37 87 f0 1d 8a b3 1f 27 c2 d0 ee +a2 dd 8a 11 ab 90 6a ba 20 7c 43 c6 ee 12 53 31 ++# CRT coefficient qInv: +12 f6 b2 cf 13 74 a7 36 fa d0 56 16 05 0f 96 ab +4b 61 d1 17 7c 7f 9d 52 5a 29 f3 d1 80 e7 76 67 +e9 9d 99 ab f0 52 5d 07 58 66 0f 37 52 65 5b 0f +25 b8 df 84 31 d9 a8 ff 77 c1 6c 12 a0 a5 12 2a +9f 0b f7 cf d5 a2 66 a3 5c 15 9f 99 12 08 b9 03 +16 ff 44 4f 3e 0b 6b d0 e9 3b 8a 7a 24 48 e9 57 +e3 dd a6 cf cf 22 66 b1 06 01 3a c4 68 08 d3 b3 +88 7b 3b 00 34 4b aa c9 53 0b 4c e7 08 fc 32 b6 ++# ---------------------------------+# RSASSA-PSS Signature Example 10.1+# ---------------------------------++# Message to be signed:+88 31 77 e5 12 6b 9b e2 d9 a9 68 03 27 d5 37 0c +6f 26 86 1f 58 20 c4 3d a6 7a 3a d6 09 ++# Salt:+04 e2 15 ee 6f f9 34 b9 da 70 d7 73 0c 87 34 ab +fc ec de 89 ++# Signature:+82 c2 b1 60 09 3b 8a a3 c0 f7 52 2b 19 f8 73 54 +06 6c 77 84 7a bf 2a 9f ce 54 2d 0e 84 e9 20 c5 +af b4 9f fd fd ac e1 65 60 ee 94 a1 36 96 01 14 +8e ba d7 a0 e1 51 cf 16 33 17 91 a5 72 7d 05 f2 +1e 74 e7 eb 81 14 40 20 69 35 d7 44 76 5a 15 e7 +9f 01 5c b6 6c 53 2c 87 a6 a0 59 61 c8 bf ad 74 +1a 9a 66 57 02 28 94 39 3e 72 23 73 97 96 c0 2a +77 45 5d 0f 55 5b 0e c0 1d df 25 9b 62 07 fd 0f +d5 76 14 ce f1 a5 57 3b aa ff 4e c0 00 69 95 16 +59 b8 5f 24 30 0a 25 16 0c a8 52 2d c6 e6 72 7e +57 d0 19 d7 e6 36 29 b8 fe 5e 89 e2 5c c1 5b eb +3a 64 75 77 55 92 99 28 0b 9b 28 f7 9b 04 09 00 +0b e2 5b bd 96 40 8b a3 b4 3c c4 86 18 4d d1 c8 +e6 25 53 fa 1a f4 04 0f 60 66 3d e7 f5 e4 9c 04 +38 8e 25 7f 1c e8 9c 95 da b4 8a 31 5d 9b 66 b1 +b7 62 82 33 87 6f f2 38 52 30 d0 70 d0 7e 16 66 ++# ---------------------------------+# RSASSA-PSS Signature Example 10.2+# ---------------------------------++# Message to be signed:+dd 67 0a 01 46 58 68 ad c9 3f 26 13 19 57 a5 0c +52 fb 77 7c db aa 30 89 2c 9e 12 36 11 64 ec 13 +97 9d 43 04 81 18 e4 44 5d b8 7b ee 58 dd 98 7b +34 25 d0 20 71 d8 db ae 80 70 8b 03 9d bb 64 db +d1 de 56 57 d9 fe d0 c1 18 a5 41 43 74 2e 0f f3 +c8 7f 74 e4 58 57 64 7a f3 f7 9e b0 a1 4c 9d 75 +ea 9a 1a 04 b7 cf 47 8a 89 7a 70 8f d9 88 f4 8e +80 1e db 0b 70 39 df 8c 23 bb 3c 56 f4 e8 21 ac ++# Salt:+8b 2b dd 4b 40 fa f5 45 c7 78 dd f9 bc 1a 49 cb +57 f9 b7 1b ++# Signature:+14 ae 35 d9 dd 06 ba 92 f7 f3 b8 97 97 8a ed 7c +d4 bf 5f f0 b5 85 a4 0b d4 6c e1 b4 2c d2 70 30 +53 bb 90 44 d6 4e 81 3d 8f 96 db 2d d7 00 7d 10 +11 8f 6f 8f 84 96 09 7a d7 5e 1f f6 92 34 1b 28 +92 ad 55 a6 33 a1 c5 5e 7f 0a 0a d5 9a 0e 20 3a +5b 82 78 ae c5 4d d8 62 2e 28 31 d8 71 74 f8 ca +ff 43 ee 6c 46 44 53 45 d8 4a 59 65 9b fb 92 ec +d4 c8 18 66 86 95 f3 47 06 f6 68 28 a8 99 59 63 +7f 2b f3 e3 25 1c 24 bd ba 4d 4b 76 49 da 00 22 +21 8b 11 9c 84 e7 9a 65 27 ec 5b 8a 5f 86 1c 15 +99 52 e2 3e c0 5e 1e 71 73 46 fa ef e8 b1 68 68 +25 bd 2b 26 2f b2 53 10 66 c0 de 09 ac de 2e 42 +31 69 07 28 b5 d8 5e 11 5a 2f 6b 92 b7 9c 25 ab +c9 bd 93 99 ff 8b cf 82 5a 52 ea 1f 56 ea 76 dd +26 f4 3b aa fa 18 bf a9 2a 50 4c bd 35 69 9e 26 +d1 dc c5 a2 88 73 85 f3 c6 32 32 f0 6f 32 44 c3 ++# ---------------------------------+# RSASSA-PSS Signature Example 10.3+# ---------------------------------++# Message to be signed:+48 b2 b6 a5 7a 63 c8 4c ea 85 9d 65 c6 68 28 4b +08 d9 6b dc aa be 25 2d b0 e4 a9 6c b1 ba c6 01 +93 41 db 6f be fb 8d 10 6b 0e 90 ed a6 bc c6 c6 +26 2f 37 e7 ea 9c 7e 5d 22 6b d7 df 85 ec 5e 71 +ef ff 2f 54 c5 db 57 7f f7 29 ff 91 b8 42 49 1d +e2 74 1d 0c 63 16 07 df 58 6b 90 5b 23 b9 1a f1 +3d a1 23 04 bf 83 ec a8 a7 3e 87 1f f9 db ++# Salt:+4e 96 fc 1b 39 8f 92 b4 46 71 01 0c 0d c3 ef d6 +e2 0c 2d 73 ++# Signature:+6e 3e 4d 7b 6b 15 d2 fb 46 01 3b 89 00 aa 5b bb +39 39 cf 2c 09 57 17 98 70 42 02 6e e6 2c 74 c5 +4c ff d5 d7 d5 7e fb bf 95 0a 0f 5c 57 4f a0 9d +3f c1 c9 f5 13 b0 5b 4f f5 0d d8 df 7e df a2 01 +02 85 4c 35 e5 92 18 01 19 a7 0c e5 b0 85 18 2a +a0 2d 9e a2 aa 90 d1 df 03 f2 da ae 88 5b a2 f5 +d0 5a fd ac 97 47 6f 06 b9 3b 5b c9 4a 1a 80 aa +91 16 c4 d6 15 f3 33 b0 98 89 2b 25 ff ac e2 66 +f5 db 5a 5a 3b cc 10 a8 24 ed 55 aa d3 5b 72 78 +34 fb 8c 07 da 28 fc f4 16 a5 d9 b2 22 4f 1f 8b +44 2b 36 f9 1e 45 6f de a2 d7 cf e3 36 72 68 de +03 07 a4 c7 4e 92 41 59 ed 33 39 3d 5e 06 55 53 +1c 77 32 7b 89 82 1b de df 88 01 61 c7 8c d4 19 +6b 54 19 f7 ac c3 f1 3e 5e bf 16 1b 6e 7c 67 24 +71 6c a3 3b 85 c2 e2 56 40 19 2a c2 85 96 51 d5 +0b de 7e b9 76 e5 1c ec 82 8b 98 b6 56 3b 86 bb ++# ---------------------------------+# RSASSA-PSS Signature Example 10.4+# ---------------------------------++# Message to be signed:+0b 87 77 c7 f8 39 ba f0 a6 4b bb db c5 ce 79 75 +5c 57 a2 05 b8 45 c1 74 e2 d2 e9 05 46 a0 89 c4 +e6 ec 8a df fa 23 a7 ea 97 ba e6 b6 5d 78 2b 82 +db 5d 2b 5a 56 d2 2a 29 a0 5e 7c 44 33 e2 b8 2a +62 1a bb a9 0a dd 05 ce 39 3f c4 8a 84 05 42 45 +1a ++# Salt:+c7 cd 69 8d 84 b6 51 28 d8 83 5e 3a 8b 1e b0 e0 +1c b5 41 ec ++# Signature:+34 04 7f f9 6c 4d c0 dc 90 b2 d4 ff 59 a1 a3 61 +a4 75 4b 25 5d 2e e0 af 7d 8b f8 7c 9b c9 e7 dd +ee de 33 93 4c 63 ca 1c 0e 3d 26 2c b1 45 ef 93 +2a 1f 2c 0a 99 7a a6 a3 4f 8e ae e7 47 7d 82 cc +f0 90 95 a6 b8 ac ad 38 d4 ee c9 fb 7e ab 7a d0 +2d a1 d1 1d 8e 54 c1 82 5e 55 bf 58 c2 a2 32 34 +b9 02 be 12 4f 9e 90 38 a8 f6 8f a4 5d ab 72 f6 +6e 09 45 bf 1d 8b ac c9 04 4c 6f 07 09 8c 9f ce +c5 8a 3a ab 10 0c 80 51 78 15 5f 03 0a 12 4c 45 +0e 5a cb da 47 d0 e4 f1 0b 80 a2 3f 80 3e 77 4d +02 3b 00 15 c2 0b 9f 9b be 7c 91 29 63 38 d5 ec +b4 71 ca fb 03 20 07 b6 7a 60 be 5f 69 50 4a 9f +01 ab b3 cb 46 7b 26 0e 2b ce 86 0b e8 d9 5b f9 +2c 0c 8e 14 96 ed 1e 52 85 93 a4 ab b6 df 46 2d +de 8a 09 68 df fe 46 83 11 68 57 a2 32 f5 eb f6 +c8 5b e2 38 74 5a d0 f3 8f 76 7a 5f db f4 86 fb ++# ---------------------------------+# RSASSA-PSS Signature Example 10.5+# ---------------------------------++# Message to be signed:+f1 03 6e 00 8e 71 e9 64 da dc 92 19 ed 30 e1 7f +06 b4 b6 8a 95 5c 16 b3 12 b1 ed df 02 8b 74 97 +6b ed 6b 3f 6a 63 d4 e7 78 59 24 3c 9c cc dc 98 +01 65 23 ab b0 24 83 b3 55 91 c3 3a ad 81 21 3b +b7 c7 bb 1a 47 0a ab c1 0d 44 25 6c 4d 45 59 d9 +16 ++# Salt:+ef a8 bf f9 62 12 b2 f4 a3 f3 71 a1 0d 57 41 52 +65 5f 5d fb ++# Signature:+7e 09 35 ea 18 f4 d6 c1 d1 7c e8 2e b2 b3 83 6c +55 b3 84 58 9c e1 9d fe 74 33 63 ac 99 48 d1 f3 +46 b7 bf dd fe 92 ef d7 8a db 21 fa ef c8 9a de +42 b1 0f 37 40 03 fe 12 2e 67 42 9a 1c b8 cb d1 +f8 d9 01 45 64 c4 4d 12 01 16 f4 99 0f 1a 6e 38 +77 4c 19 4b d1 b8 21 32 86 b0 77 b0 49 9d 2e 7b +3f 43 4a b1 22 89 c5 56 68 4d ee d7 81 31 93 4b +b3 dd 65 37 23 6f 7c 6f 3d cb 09 d4 76 be 07 72 +1e 37 e1 ce ed 9b 2f 7b 40 68 87 bd 53 15 73 05 +e1 c8 b4 f8 4d 73 3b c1 e1 86 fe 06 cc 59 b6 ed +b8 f4 bd 7f fe fd f4 f7 ba 9c fb 9d 57 06 89 b5 +a1 a4 10 9a 74 6a 69 08 93 db 37 99 25 5a 0c b9 +21 5d 2d 1c d4 90 59 0e 95 2e 8c 87 86 aa 00 11 +26 52 52 47 0c 04 1d fb c3 ee c7 c3 cb f7 1c 24 +86 9d 11 5c 0c b4 a9 56 f5 6d 53 0b 80 ab 58 9a +cf ef c6 90 75 1d df 36 e8 d3 83 f8 3c ed d2 cc ++# ---------------------------------+# RSASSA-PSS Signature Example 10.6+# ---------------------------------++# Message to be signed:+25 f1 08 95 a8 77 16 c1 37 45 0b b9 51 9d fa a1 +f2 07 fa a9 42 ea 88 ab f7 1e 9c 17 98 00 85 b5 +55 ae ba b7 62 64 ae 2a 3a b9 3c 2d 12 98 11 91 +dd ac 6f b5 94 9e b3 6a ee 3c 5d a9 40 f0 07 52 +c9 16 d9 46 08 fa 7d 97 ba 6a 29 15 b6 88 f2 03 +23 d4 e9 d9 68 01 d8 9a 72 ab 58 92 dc 21 17 c0 +74 34 fc f9 72 e0 58 cf 8c 41 ca 4b 4f f5 54 f7 +d5 06 8a d3 15 5f ce d0 f3 12 5b c0 4f 91 93 37 +8a 8f 5c 4c 3b 8c b4 dd 6d 1c c6 9d 30 ec ca 6e +aa 51 e3 6a 05 73 0e 9e 34 2e 85 5b af 09 9d ef +b8 af d7 ++# Salt:+ad 8b 15 23 70 36 46 22 4b 66 0b 55 08 85 91 7c +a2 d1 df 28 ++# Signature:+6d 3b 5b 87 f6 7e a6 57 af 21 f7 54 41 97 7d 21 +80 f9 1b 2c 5f 69 2d e8 29 55 69 6a 68 67 30 d9 +b9 77 8d 97 07 58 cc b2 60 71 c2 20 9f fb d6 12 +5b e2 e9 6e a8 1b 67 cb 9b 93 08 23 9f da 17 f7 +b2 b6 4e cd a0 96 b6 b9 35 64 0a 5a 1c b4 2a 91 +55 b1 c9 ef 7a 63 3a 02 c5 9f 0d 6e e5 9b 85 2c +43 b3 50 29 e7 3c 94 0f f0 41 0e 8f 11 4e ed 46 +bb d0 fa e1 65 e4 2b e2 52 8a 40 1c 3b 28 fd 81 +8e f3 23 2d ca 9f 4d 2a 0f 51 66 ec 59 c4 23 96 +d6 c1 1d bc 12 15 a5 6f a1 71 69 db 95 75 34 3e +f3 4f 9d e3 2a 49 cd c3 17 49 22 f2 29 c2 3e 18 +e4 5d f9 35 31 19 ec 43 19 ce dc e7 a1 7c 64 08 +8c 1f 6f 52 be 29 63 41 00 b3 91 9d 38 f3 d1 ed +94 e6 89 1e 66 a7 3b 8f b8 49 f5 87 4d f5 94 59 +e2 98 c7 bb ce 2e ee 78 2a 19 5a a6 6f e2 d0 73 +2b 25 e5 95 f5 7d 3e 06 1b 1f c3 e4 06 3b f9 8f ++-}++doSignTest key (i, vector) = testCase (show i) (Right (signature vector) @=? actual)+    where actual = PSS.signWithSalt (salt vector) Nothing PSS.defaultPSSParamsSHA1 key (message vector)++doVerifyTest key (i, vector) = testCase (show i) (True @=? actual)+    where actual = PSS.verify PSS.defaultPSSParamsSHA1 (private_pub key) (message vector) (signature vector)++pssTests = testGroup "RSA-PSS"+    [ testGroup "signature internal"+        [ doSignTest rsaKeyInt (katZero, vectorInt) ]+    , testGroup "verify internal"+        [ doVerifyTest rsaKeyInt (katZero, vectorInt) ]+    , testGroup "signature key 1024" $ map (doSignTest rsaKey1) (zip [katZero..] vectorsKey1)+    , testGroup "verify key 1024" $ map (doVerifyTest rsaKey1) (zip [katZero..] vectorsKey1)+    ]
+ tests/KAT_RC4.hs view
@@ -0,0 +1,34 @@+{-# LANGUAGE ViewPatterns #-}+{-# LANGUAGE OverloadedStrings #-}+module KAT_RC4 where++import Test.Tasty+import Test.Tasty.HUnit++import Data.ByteString (ByteString)+import Data.ByteString.Char8 ()+import qualified Crypto.Cipher.RC4 as RC4++-- taken from wikipedia pages+vectors :: [(ByteString, ByteString, ByteString)]+vectors =+    [   ("Key"+        ,"Plaintext"+        ,"\xBB\xF3\x16\xE8\xD9\x40\xAF\x0A\xD3"+        )+    ,   ("Wiki"+        ,"pedia"+        ,"\x10\x21\xBF\x04\x20"+        )+    ,   ("Secret"+        ,"Attack at dawn"+        ,"\x45\xA0\x1F\x64\x5F\xC3\x5B\x38\x35\x52\x54\x4B\x9B\xF5"+        )+    ]++tests = testGroup "RC4"+    $ map toKatTest $ zip is vectors+  where toKatTest (i, (key, plainText, cipherText)) =+            testCase (show i) (cipherText @=? snd (RC4.combine (RC4.initialize key) plainText))+        is :: [Int]+        is = [1..]
+ tests/KAT_Scrypt.hs view
@@ -0,0 +1,33 @@+{-# LANGUAGE OverloadedStrings #-}+module KAT_Scrypt (tests) where++import Data.ByteString (ByteString)+import Data.ByteString.Char8 ()++import Test.Tasty+import Test.Tasty.HUnit+import Data.Word++import qualified Crypto.KDF.Scrypt as Scrypt++vectors :: [ ((ByteString, ByteString, Word64, Int, Int, Int), ByteString) ]+vectors =+    [+        ( ("", "", 16, 1, 1, 64)+        , "\x77\xd6\x57\x62\x38\x65\x7b\x20\x3b\x19\xca\x42\xc1\x8a\x04\x97\xf1\x6b\x48\x44\xe3\x07\x4a\xe8\xdf\xdf\xfa\x3f\xed\xe2\x14\x42\xfc\xd0\x06\x9d\xed\x09\x48\xf8\x32\x6a\x75\x3a\x0f\xc8\x1f\x17\xe8\xd3\xe0\xfb\x2e\x0d\x36\x28\xcf\x35\xe2\x0c\x38\xd1\x89\x06"+        )+    ,   ( ("password", "NaCl", 1024, 8, 16, 64)+        , "\xfd\xba\xbe\x1c\x9d\x34\x72\x00\x78\x56\xe7\x19\x0d\x01\xe9\xfe\x7c\x6a\xd7\xcb\xc8\x23\x78\x30\xe7\x73\x76\x63\x4b\x37\x31\x62\x2e\xaf\x30\xd9\x2e\x22\xa3\x88\x6f\xf1\x09\x27\x9d\x98\x30\xda\xc7\x27\xaf\xb9\x4a\x83\xee\x6d\x83\x60\xcb\xdf\xa2\xcc\x06\x40"+        )+    ,   ( ("pleaseletmein", "SodiumChloride", 16384, 8, 1, 64)+        , "\x70\x23\xbd\xcb\x3a\xfd\x73\x48\x46\x1c\x06\xcd\x81\xfd\x38\xeb\xfd\xa8\xfb\xba\x90\x4f\x8e\x3e\xa9\xb5\x43\xf6\x54\x5d\xa1\xf2\xd5\x43\x29\x55\x61\x3f\x0f\xcf\x62\xd4\x97\x05\x24\x2a\x9a\xf9\xe6\x1e\x85\xdc\x0d\x65\x1e\x40\xdf\xcf\x01\x7b\x45\x57\x58\x87"+        )+    ,   ( ("pleaseletmein", "SodiumChloride", 1048576, 8, 1, 64)+        , "\x21\x01\xcb\x9b\x6a\x51\x1a\xae\xad\xdb\xbe\x09\xcf\x70\xf8\x81\xec\x56\x8d\x57\x4a\x2f\xfd\x4d\xab\xe5\xee\x98\x20\xad\xaa\x47\x8e\x56\xfd\x8f\x4b\xa5\xd0\x9f\xfa\x1c\x6d\x92\x7c\x40\xf4\xc3\x37\x30\x40\x49\xe8\xa9\x52\xfb\xcb\xf4\x5c\x6f\xa7\x7a\x41\xa4"+        )+    ]++tests = testGroup "Scrypt"+    $ map toCase $ zip [(1::Int)..] vectors+  where toCase (i, ((pass,salt,n,r,p,dklen), output)) =+            testCase (show i) (output @=? Scrypt.generate (Scrypt.Parameters n r p dklen) pass salt)
+ tests/KAT_TripleDES.hs view
@@ -0,0 +1,12 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ViewPatterns #-}+module KAT_TripleDES (tests) where++import Imports+import BlockCipher+import qualified Crypto.Cipher.TripleDES as TripleDES++kats = defaultKATs++tests = localOption (QuickCheckTests 5)+      $ testBlockCipher kats (undefined :: TripleDES.DES_EEE3)
+ tests/Number.hs view
@@ -0,0 +1,38 @@+module Number (tests) where++import Imports++import Crypto.Number.Basic+import Crypto.Number.Generate+import Crypto.Number.Prime+import Data.Bits++tests = testGroup "number"+    [ testProperty "num-bits" $ \(Positive i) ->+        and [ (numBits (2^i-1) == i)+            , (numBits (2^i) == i+1)+            , (numBits (2^i + (2^i-1)) == i+1)+            ]+    , testProperty "num-bits2" $ \(Positive i) ->+        not (i `testBit` numBits i) && (i `testBit` (numBits i - 1))+    , testProperty "generate-param" $ \testDRG (Positive bits)  ->+        let r = withTestDRG testDRG $ generateParams bits (Just SetHighest) False+         in r >= 0 && numBits r == bits && testBit r (bits-1)+    , testProperty "generate-param2" $ \testDRG (Positive m1bits) ->+        let bits = m1bits + 1 -- make sure minimum is 2+            r = withTestDRG testDRG $ generateParams bits (Just SetTwoHighest) False+         in r >= 0 && numBits r == bits && testBit r (bits-1) && testBit r (bits-2)+    , testProperty "generate-param-odd" $ \testDRG (Positive bits) ->+        let r = withTestDRG testDRG $ generateParams bits Nothing True+         in r >= 0 && odd r+    , testProperty "generate-range" $ \testDRG (Positive range) ->+        let r = withTestDRG testDRG $ generateMax range+         in 0 <= r && r < range+    , testProperty "generate-prime" $ \testDRG (Positive baseBits) ->+        let bits  = 48 + baseBits -- no point generating lower than 48 bits ..+            prime = withTestDRG testDRG $ generatePrime bits+        -- with small base bits numbers, the probability that we "cross" this bit size ness+        -- to the next is quite high, as the number generated has two highest bit set.+        --+         in bits == numBits prime || (if baseBits < 64 then (bits + 1) == numBits prime else False)+    ]
+ tests/Poly1305.hs view
@@ -0,0 +1,35 @@+{-# LANGUAGE OverloadedStrings #-}+module Poly1305 (tests) where++import qualified Data.ByteString as B+import qualified Data.ByteString.Char8 as B ()++import Imports++import qualified Crypto.MAC.Poly1305 as Poly1305+import qualified Data.ByteArray as B (convert)++instance Show Poly1305.Auth where+    show _ = "Auth"++data Chunking = Chunking Int Int+    deriving (Show,Eq)++instance Arbitrary Chunking where+    arbitrary = Chunking <$> choose (1,34) <*> choose (1,2048)++tests = testGroup "Poly1305"+    [ testCase "V0" $+        let key = "\x85\xd6\xbe\x78\x57\x55\x6d\x33\x7f\x44\x52\xfe\x42\xd5\x06\xa8\x01\x03\x80\x8a\xfb\x0d\xb2\xfd\x4a\xbf\xf6\xaf\x41\x49\xf5\x1b" :: ByteString+            msg = "Cryptographic Forum Research Group" :: ByteString+            tag = "\xa8\x06\x1d\xc1\x30\x51\x36\xc6\xc2\x2b\x8b\xaf\x0c\x01\x27\xa9" :: ByteString+         in tag @=? B.convert (Poly1305.auth key msg)+    , testProperty "Chunking" $ \(Chunking chunkLen totalLen) ->+        let key = B.replicate 32 0+            msg = B.pack $ take totalLen $ concat (replicate 10 [1..255])+         in Poly1305.auth key msg == Poly1305.finalize (foldr (flip Poly1305.update) (Poly1305.initialize key) (chunks chunkLen msg))+    ]+  where+        chunks i bs+            | B.length bs < i = [bs]+            | otherwise       = let (b1,b2) = B.splitAt i bs in b1 : chunks i b2
+ tests/Salsa.hs view
@@ -0,0 +1,100 @@+{-# LANGUAGE OverloadedStrings #-}+module Salsa (tests) where++import qualified Data.ByteString as B+import qualified Crypto.Cipher.Salsa as Salsa++import           Imports++type Vector = (Int, B.ByteString, B.ByteString, [(Int, B.ByteString)])++vectors :: [Vector]+vectors =+    [ (20, key, iv+      , [ (0, "\x99\xA8\xCC\xEC\x6C\x5B\x2A\x0B\x6E\x33\x6C\xB2\x06\x52\x24\x1C\x32\xB2\x4D\x34\xAC\xC0\x45\x7E\xF6\x79\x17\x8E\xDE\x7C\xF8\x05\x80\x5A\x93\x05\xC7\xC4\x99\x09\x68\x3B\xD1\xA8\x03\x32\x78\x17\x62\x7C\xA4\x6F\xE8\xB9\x29\xB6\xDF\x00\x12\xBD\x86\x41\x83\xBE")+        , (192, "\x2D\x22\x6C\x11\xF4\x7B\x3C\x0C\xCD\x09\x59\xB6\x1F\x59\xD5\xCC\x30\xFC\xEF\x6D\xBB\x8C\xBB\x3D\xCC\x1C\xC2\x52\x04\xFC\xD4\x49\x8C\x37\x42\x6A\x63\xBE\xA3\x28\x2B\x1A\x8A\x0D\x60\xE1\x3E\xB2\xFE\x59\x24\x1A\x9F\x6A\xF4\x26\x68\x98\x66\xED\xC7\x69\xE1\xE6\x48\x2F\xE1\xC1\x28\xA1\x5C\x11\x23\xB5\x65\x5E\xD5\x46\xDF\x01\x4C\xE0\xC4\x55\xDB\xF5\xD3\xA1\x3D\x9C\xD4\xF0\xE2\xD1\xDA\xB9\xF1\x2F\xB6\x8C\x54\x42\x61\xD7\xF8\x8E\xAC\x1C\x6C\xBF\x99\x3F\xBB\xB8\xE0\xAA\x85\x10\xBF\xF8\xE7\x38\x35\xA1\xE8\x6E\xAD\xBB")+        , (448, "\x05\x97\x18\x8A\x1C\x19\x25\x57\x69\xBE\x1C\x21\x03\x99\xAD\x17\x2E\xB4\x6C\x52\xF9\x2F\xD5\x41\xDF\x2E\xAD\x71\xB1\xFF\x8E\xA7\xAD\xD3\x80\xEC\x71\xA5\xFD\x7A\xDB\x51\x81\xEA\xDD\x18\x25\xEC\x02\x77\x9A\x45\x09\xBE\x58\x32\x70\x8C\xA2\x83\x6C\x16\x93\xA5")+        ])+    , (20+      , "\x00\x53\xA6\xF9\x4C\x9F\xF2\x45\x98\xEB\x3E\x91\xE4\x37\x8A\xDD\x30\x83\xD6\x29\x7C\xCF\x22\x75\xC8\x1B\x6E\xC1\x14\x67\xBA\x0D"+      , "\x0D\x74\xDB\x42\xA9\x10\x77\xDE"+      , [ (0, "\xF5\xFA\xD5\x3F\x79\xF9\xDF\x58\xC4\xAE\xA0\xD0\xED\x9A\x96\x01\xF2\x78\x11\x2C\xA7\x18\x0D\x56\x5B\x42\x0A\x48\x01\x96\x70\xEA\xF2\x4C\xE4\x93\xA8\x62\x63\xF6\x77\xB4\x6A\xCE\x19\x24\x77\x3D\x2B\xB2\x55\x71\xE1\xAA\x85\x93\x75\x8F\xC3\x82\xB1\x28\x0B\x71")+        , (65472, "\xB7\x0C\x50\x13\x9C\x63\x33\x2E\xF6\xE7\x7A\xC5\x43\x38\xA4\x07\x9B\x82\xBE\xC9\xF9\xA4\x03\xDF\xEA\x82\x1B\x83\xF7\x86\x07\x91\x65\x0E\xF1\xB2\x48\x9D\x05\x90\xB1\xDE\x77\x2E\xED\xA4\xE3\xBC\xD6\x0F\xA7\xCE\x9C\xD6\x23\xD9\xD2\xFD\x57\x58\xB8\x65\x3E\x70\x81\x58\x2C\x65\xD7\x56\x2B\x80\xAE\xC2\xF1\xA6\x73\xA9\xD0\x1C\x9F\x89\x2A\x23\xD4\x91\x9F\x6A\xB4\x7B\x91\x54\xE0\x8E\x69\x9B\x41\x17\xD7\xC6\x66\x47\x7B\x60\xF8\x39\x14\x81\x68\x2F\x5D\x95\xD9\x66\x23\xDB\xC4\x89\xD8\x8D\xAA\x69\x56\xB9\xF0\x64\x6B\x6E")+        , (131008, "\xA1\x3F\xFA\x12\x08\xF8\xBF\x50\x90\x08\x86\xFA\xAB\x40\xFD\x10\xE8\xCA\xA3\x06\xE6\x3D\xF3\x95\x36\xA1\x56\x4F\xB7\x60\xB2\x42\xA9\xD6\xA4\x62\x8C\xDC\x87\x87\x62\x83\x4E\x27\xA5\x41\xDA\x2A\x5E\x3B\x34\x45\x98\x9C\x76\xF6\x11\xE0\xFE\xC6\xD9\x1A\xCA\xCC")+        ])+    ]+  where+        key :: B.ByteString+        key = "\xEA\xEB\xEC\xED\xEE\xEF\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFF\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09"++        iv  = B.replicate 8 0++newtype RandomVector = RandomVector Vector+    deriving (Show,Eq)++instance Arbitrary RandomVector where+    arbitrary = RandomVector <$> elements vectors++tests = testGroup "Salsa"+    [ testGroup "KAT" $+        map (\(i,f) -> testCase (show (i :: Int)) f) $ zip [1..] $ map (\(r, k,i,e) -> salsaRunSimple e r k i) vectors+    , testProperty "generate-combine" salsaGenerateCombine+    , testProperty "chunking-generate" salsaGenerateChunks+    , testProperty "chunking-combine" salsaCombineChunks+    ]+  where+        salsaRunSimple expected rounds key nonce =+            let salsa = Salsa.initialize rounds key nonce+             in map snd expected @=? salsaLoop 0 salsa expected++        salsaLoop _       _     [] = []+        salsaLoop current salsa (r@(ofs,expectBs):rs)+            | current < ofs  =+                let (_, salsaNext) = Salsa.generate salsa (ofs - current) :: (ByteString, Salsa.State)+                 in salsaLoop ofs salsaNext (r:rs)+            | current == ofs =+                let (e, salsaNext) = Salsa.generate salsa (B.length expectBs)+                 in e : salsaLoop (current + B.length expectBs) salsaNext rs+            | otherwise = error "internal error in salsaLoop"++        salsaGenerateCombine :: ChunkingLen0_127 -> RandomVector -> Int0_2901 -> Bool+        salsaGenerateCombine (ChunkingLen0_127 ckLen) (RandomVector (rounds, key, iv, _)) (Int0_2901 nbBytes) =+            let initSalsa    = Salsa.initialize rounds key iv+             in loop nbBytes ckLen initSalsa+          where loop n []     salsa = loop n ckLen salsa+                loop 0 _      _     = True+                loop n (x:xs) salsa =+                    let len        = min x n+                        (c1, next) = Salsa.generate salsa len+                        (c2, _)    = Salsa.combine salsa (B.replicate len 0)+                     in if c1 == c2 then loop (n - len) xs next else False++        salsaGenerateChunks :: ChunkingLen -> RandomVector -> Bool+        salsaGenerateChunks (ChunkingLen ckLen) (RandomVector (rounds, key, iv, _)) =+            let initSalsa    = Salsa.initialize rounds key iv+                nbBytes      = 1048+                (expected,_) = Salsa.generate initSalsa nbBytes+                chunks       = loop nbBytes ckLen (Salsa.initialize rounds key iv)+             in expected == B.concat chunks++          where loop n []     salsa = loop n ckLen salsa+                loop 0 _      _     = []+                loop n (x:xs) salsa =+                    let len       = min x n+                        (c, next) = Salsa.generate salsa len+                     in c : loop (n - len) xs next++        salsaCombineChunks :: ChunkingLen -> RandomVector -> ArbitraryBS0_2901 -> Bool+        salsaCombineChunks (ChunkingLen ckLen) (RandomVector (rounds, key, iv, _)) (ArbitraryBS0_2901 wholebs) =+            let initSalsa    = Salsa.initialize rounds key iv+                (expected,_) = Salsa.combine initSalsa wholebs+                chunks       = loop wholebs ckLen initSalsa+             in expected `propertyEq` B.concat chunks++          where loop bs []     salsa = loop bs ckLen salsa+                loop bs (x:xs) salsa+                    | B.null bs = []+                    | otherwise =+                        let (bs1, bs2) = B.splitAt (min x (B.length bs)) bs+                            (c, next)  = Salsa.combine salsa bs1+                         in c : loop bs2 xs next
+ tests/Tests.hs view
@@ -0,0 +1,56 @@+{-# LANGUAGE OverloadedStrings #-}+module Main where++import Imports++import qualified Number+import qualified Hash+import qualified Poly1305+import qualified Salsa+import qualified ChaCha+import qualified KAT_HMAC+import qualified KAT_PBKDF2+import qualified KAT_Curve25519+import qualified KAT_Ed25519+import qualified KAT_PubKey+import qualified KAT_Scrypt+-- symmetric cipher --------------------+import qualified KAT_AES+import qualified KAT_Blowfish+import qualified KAT_Camellia+import qualified KAT_DES+import qualified KAT_RC4+import qualified KAT_TripleDES+-- misc --------------------------------+import qualified KAT_AFIS++tests = testGroup "cryptonite"+    [ Number.tests+    , Hash.tests+    , testGroup "MAC"+        [ Poly1305.tests+        , KAT_HMAC.tests+        ]+    , KAT_Curve25519.tests+    , KAT_Ed25519.tests+    , KAT_PubKey.tests+    , testGroup "KDF"+        [ KAT_PBKDF2.tests+        , KAT_Scrypt.tests+        ]+    , testGroup "block-cipher"+        [ KAT_AES.tests+        , KAT_Blowfish.tests+        , KAT_Camellia.tests+        , KAT_DES.tests+        , KAT_TripleDES.tests+        ]+    , testGroup "stream-cipher"+        [ KAT_RC4.tests+        , ChaCha.tests+        , Salsa.tests+        ]+    , KAT_AFIS.tests+    ]++main = defaultMain tests
+ tests/Utils.hs view
@@ -0,0 +1,99 @@+module Utils where++import Control.Monad (replicateM)+import Data.Char+import Data.Word+import Data.ByteString (ByteString)+import qualified Data.ByteString as B+import qualified Data.ByteString.Lazy as L+import Crypto.Random++import Test.Tasty.QuickCheck++newtype TestDRG = TestDRG (Word64, Word64, Word64, Word64, Word64)+    deriving (Show,Eq)++instance Arbitrary TestDRG where+    arbitrary = TestDRG `fmap` arbitrary++withTestDRG (TestDRG l) f = fst $ withDRG (drgNewTest l) f++newtype ChunkingLen = ChunkingLen [Int]+    deriving (Show,Eq)++instance Arbitrary ChunkingLen where+    arbitrary = ChunkingLen `fmap` replicateM 16 (choose (0,14))++newtype ChunkingLen0_127 = ChunkingLen0_127 [Int]+    deriving (Show,Eq)++instance Arbitrary ChunkingLen0_127 where+    arbitrary = ChunkingLen0_127 `fmap` replicateM 16 (choose (0,127))+++newtype ArbitraryBS0_2901 = ArbitraryBS0_2901 ByteString+    deriving (Show,Eq,Ord)++instance Arbitrary ArbitraryBS0_2901 where+    arbitrary = ArbitraryBS0_2901 `fmap` arbitraryBSof 0 2901++newtype Int0_2901 = Int0_2901 Int+    deriving (Show,Eq,Ord)++instance Arbitrary Int0_2901 where+    arbitrary = Int0_2901 `fmap` choose (0,2901)++arbitraryBS :: Int -> Gen ByteString+arbitraryBS n = B.pack `fmap` replicateM n arbitrary++arbitraryBSof :: Int -> Int -> Gen ByteString+arbitraryBSof minSize maxSize = choose (minSize, maxSize) >>= \n -> (B.pack `fmap` replicateM n arbitrary)++chunkS :: ChunkingLen -> ByteString -> [ByteString]+chunkS (ChunkingLen originalChunks) = loop originalChunks+  where loop l bs+            | B.null bs = []+            | otherwise =+                case l of+                    (x:xs) -> let (b1, b2) = B.splitAt x bs in b1 : loop xs b2+                    []     -> loop originalChunks bs++chunksL :: ChunkingLen -> L.ByteString -> L.ByteString+chunksL (ChunkingLen originalChunks) = L.fromChunks . loop originalChunks . L.toChunks+  where loop _ []       = []+        loop l (b:bs)+            | B.null b  = loop l bs+            | otherwise =+                case l of+                    (x:xs) -> let (b1, b2) = B.splitAt x b in b1 : loop xs (b2:bs)+                    []     -> loop originalChunks (b:bs)++katZero :: Int+katZero = 0++--hexalise :: String -> [Word8]+hexalise s = concatMap (\c -> [ hex $ c `div` 16, hex $ c `mod` 16 ]) s+  where hex i+            | i >= 0 && i <= 9   = fromIntegral (ord '0') + i+            | i >= 10 && i <= 15 = fromIntegral (ord 'a') + i - 10+            | otherwise          = 0++splitB :: Int -> ByteString -> [ByteString]+splitB l b =+    if B.length b > l+        then+            let (b1, b2) = B.splitAt l b in+            b1 : splitB l b2+        else    +            [ b ]++assertBytesEq :: ByteString -> ByteString -> Bool+assertBytesEq b1 b2 | b1 /= b2  = error ("expected: " ++ show b1 ++ " got: " ++ show b2)+                    | otherwise = True++assertEq :: (Show a, Eq a) => a -> a -> Bool+assertEq b1 b2 | b1 /= b2  = error ("expected: " ++ show b1 ++ " got: " ++ show b2)+               | otherwise = True++propertyEq :: (Show a, Eq a) => a -> a -> Bool+propertyEq = assertEq