/src/CMake/Utilities/cmlibarchive/libarchive/archive_blake2s_ref.c

Source
/*
   BLAKE2 reference source code package - reference C implementations

   Copyright 2012, Samuel Neves <sneves@dei.uc.pt>.  You may use this under the
   terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at
   your option.  The terms of these licenses can be found at:

   - CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
   - OpenSSL license   : https://www.openssl.org/source/license.html
   - Apache 2.0        : http://www.apache.org/licenses/LICENSE-2.0

   More information about the BLAKE2 hash function can be found at
   https://blake2.net.
*/

#include "archive_platform.h"

#include <stdint.h>
#include <string.h>
#include <stdio.h>

#include "archive_blake2.h"
#include "archive_blake2_impl.h"

static const uint32_t blake2s_IV[8] =
{
  0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
  0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
};

static const uint8_t blake2s_sigma[10][16] =
{
  {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 } ,
  { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 } ,
  { 11,  8, 12,  0,  5,  2, 15, 13, 10, 14,  3,  6,  7,  1,  9,  4 } ,
  {  7,  9,  3,  1, 13, 12, 11, 14,  2,  6,  5, 10,  4,  0, 15,  8 } ,
  {  9,  0,  5,  7,  2,  4, 10, 15, 14,  1, 11, 12,  6,  8,  3, 13 } ,
  {  2, 12,  6, 10,  0, 11,  8,  3,  4, 13,  7,  5, 15, 14,  1,  9 } ,
  { 12,  5,  1, 15, 14, 13,  4, 10,  0,  7,  6,  3,  9,  2,  8, 11 } ,
  { 13, 11,  7, 14, 12,  1,  3,  9,  5,  0, 15,  4,  8,  6,  2, 10 } ,
  {  6, 15, 14,  9, 11,  3,  0,  8, 12,  2, 13,  7,  1,  4, 10,  5 } ,
  { 10,  2,  8,  4,  7,  6,  1,  5, 15, 11,  9, 14,  3, 12, 13 , 0 } ,
};

static void blake2s_set_lastnode( blake2s_state *S )
{
  S->f[1] = (uint32_t)-1;
}

/* Some helper functions, not necessarily useful */
static int blake2s_is_lastblock( const blake2s_state *S )
{
  return S->f[0] != 0;
}

static void blake2s_set_lastblock( blake2s_state *S )
{
  if( S->last_node ) blake2s_set_lastnode( S );

  S->f[0] = (uint32_t)-1;
}

static void blake2s_increment_counter( blake2s_state *S, const uint32_t inc )
{
  S->t[0] += inc;
  S->t[1] += ( S->t[0] < inc );
}

static void blake2s_init0( blake2s_state *S )
{
  size_t i;
  memset( S, 0, sizeof( blake2s_state ) );

  for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
}

/* init2 xors IV with input parameter block */
int blake2s_init_param( blake2s_state *S, const blake2s_param *P )
{
  const unsigned char *p = ( const unsigned char * )( P );
  size_t i;

  blake2s_init0( S );

  /* IV XOR ParamBlock */
  for( i = 0; i < 8; ++i )
    S->h[i] ^= load32( &p[i * 4] );

  S->outlen = P->digest_length;
  return 0;
}


/* Sequential blake2s initialization */
int blake2s_init( blake2s_state *S, size_t outlen )
{
  blake2s_param P[1];

  /* Move interval verification here? */
  if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;

  P->digest_length = (uint8_t)outlen;
  P->key_length    = 0;
  P->fanout        = 1;
  P->depth         = 1;
  store32( &P->leaf_length, 0 );
  store32( &P->node_offset, 0 );
  store16( &P->xof_length, 0 );
  P->node_depth    = 0;
  P->inner_length  = 0;
  /* memset(P->reserved, 0, sizeof(P->reserved) ); */
  memset( P->salt,     0, sizeof( P->salt ) );
  memset( P->personal, 0, sizeof( P->personal ) );
  return blake2s_init_param( S, P );
}

int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
{
  blake2s_param P[1];

  if ( ( !outlen ) || ( outlen > BLAKE2S_OUTBYTES ) ) return -1;

  if ( !key || !keylen || keylen > BLAKE2S_KEYBYTES ) return -1;

  P->digest_length = (uint8_t)outlen;
  P->key_length    = (uint8_t)keylen;
  P->fanout        = 1;
  P->depth         = 1;
  store32( &P->leaf_length, 0 );
  store32( &P->node_offset, 0 );
  store16( &P->xof_length, 0 );
  P->node_depth    = 0;
  P->inner_length  = 0;
  /* memset(P->reserved, 0, sizeof(P->reserved) ); */
  memset( P->salt,     0, sizeof( P->salt ) );
  memset( P->personal, 0, sizeof( P->personal ) );

  if( blake2s_init_param( S, P ) < 0 ) return -1;

  {
    uint8_t block[BLAKE2S_BLOCKBYTES];
    memset( block, 0, BLAKE2S_BLOCKBYTES );
    memcpy( block, key, keylen );
    blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
    secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
  }
  return 0;
}

#define G(r,i,a,b,c,d)                      \
  do {                                      \
    a = a + b + m[blake2s_sigma[r][2*i+0]]; \
    d = rotr32(d ^ a, 16);                  \
    c = c + d;                              \
    b = rotr32(b ^ c, 12);                  \
    a = a + b + m[blake2s_sigma[r][2*i+1]]; \
    d = rotr32(d ^ a, 8);                   \
    c = c + d;                              \
    b = rotr32(b ^ c, 7);                   \
  } while(0)

#define ROUND(r)                    \
  do {                              \
    G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
    G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
    G(r,2,v[ 2],v[ 6],v[10],v[14]); \
    G(r,3,v[ 3],v[ 7],v[11],v[15]); \
    G(r,4,v[ 0],v[ 5],v[10],v[15]); \
    G(r,5,v[ 1],v[ 6],v[11],v[12]); \
    G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
    G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
  } while(0)

static void blake2s_compress( blake2s_state *S, const uint8_t in[BLAKE2S_BLOCKBYTES] )
{
  uint32_t m[16];
  uint32_t v[16];
  size_t i;

  for( i = 0; i < 16; ++i ) {
    m[i] = load32( in + i * sizeof( m[i] ) );
  }

  for( i = 0; i < 8; ++i ) {
    v[i] = S->h[i];
  }

  v[ 8] = blake2s_IV[0];
  v[ 9] = blake2s_IV[1];
  v[10] = blake2s_IV[2];
  v[11] = blake2s_IV[3];
  v[12] = S->t[0] ^ blake2s_IV[4];
  v[13] = S->t[1] ^ blake2s_IV[5];
  v[14] = S->f[0] ^ blake2s_IV[6];
  v[15] = S->f[1] ^ blake2s_IV[7];

  ROUND( 0 );
  ROUND( 1 );
  ROUND( 2 );
  ROUND( 3 );
  ROUND( 4 );
  ROUND( 5 );
  ROUND( 6 );
  ROUND( 7 );
  ROUND( 8 );
  ROUND( 9 );

  for( i = 0; i < 8; ++i ) {
    S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
  }
}

#undef G
#undef ROUND

int blake2s_update( blake2s_state *S, const void *pin, size_t inlen )
{
  const unsigned char * in = (const unsigned char *)pin;
  if( inlen > 0 )
  {
    size_t left = S->buflen;
    size_t fill = BLAKE2S_BLOCKBYTES - left;
    if( inlen > fill )
    {
      S->buflen = 0;
      memcpy( S->buf + left, in, fill ); /* Fill buffer */
      blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
      blake2s_compress( S, S->buf ); /* Compress */
      in += fill; inlen -= fill;
      while(inlen > BLAKE2S_BLOCKBYTES) {
        blake2s_increment_counter(S, BLAKE2S_BLOCKBYTES);
        blake2s_compress( S, in );
        in += BLAKE2S_BLOCKBYTES;
        inlen -= BLAKE2S_BLOCKBYTES;
      }
    }
    memcpy( S->buf + S->buflen, in, inlen );
    S->buflen += inlen;
  }
  return 0;
}

int blake2s_final( blake2s_state *S, void *out, size_t outlen )
{
  uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
  size_t i;

  if( out == NULL || outlen < S->outlen )
    return -1;

  if( blake2s_is_lastblock( S ) )
    return -1;

  blake2s_increment_counter( S, ( uint32_t )S->buflen );
  blake2s_set_lastblock( S );
  memset( S->buf + S->buflen, 0, BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */
  blake2s_compress( S, S->buf );

  for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
    store32( buffer + sizeof( S->h[i] ) * i, S->h[i] );

  memcpy( out, buffer, outlen );
  secure_zero_memory(buffer, sizeof(buffer));
  return 0;
}

int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
{
  blake2s_state S[1];

  /* Verify parameters */
  if ( NULL == in && inlen > 0 ) return -1;

  if ( NULL == out ) return -1;

  if ( NULL == key && keylen > 0) return -1;

  if( !outlen || outlen > BLAKE2S_OUTBYTES ) return -1;

  if( keylen > BLAKE2S_KEYBYTES ) return -1;

  if( keylen > 0 )
  {
    if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
  }
  else
  {
    if( blake2s_init( S, outlen ) < 0 ) return -1;
  }

  blake2s_update( S, ( const uint8_t * )in, inlen );
  blake2s_final( S, out, outlen );
  return 0;
}

#if defined(SUPERCOP)
int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
{
  return blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 );
}
#endif

#if defined(BLAKE2S_SELFTEST)
#include <string.h>
#include "blake2-kat.h"
int main( void )
{
  uint8_t key[BLAKE2S_KEYBYTES];
  uint8_t buf[BLAKE2_KAT_LENGTH];
  size_t i, step;

  for( i = 0; i < BLAKE2S_KEYBYTES; ++i )
    key[i] = ( uint8_t )i;

  for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
    buf[i] = ( uint8_t )i;

  /* Test simple API */
  for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
  {
    uint8_t hash[BLAKE2S_OUTBYTES];
    blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );

    if( 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
    {
      goto fail;
    }
  }

  /* Test streaming API */
  for(step = 1; step < BLAKE2S_BLOCKBYTES; ++step) {
    for (i = 0; i < BLAKE2_KAT_LENGTH; ++i) {
      uint8_t hash[BLAKE2S_OUTBYTES];
      blake2s_state S;
      uint8_t * p = buf;
      size_t mlen = i;
      int err = 0;

      if( (err = blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
        goto fail;
      }

      while (mlen >= step) {
        if ( (err = blake2s_update(&S, p, step)) < 0 ) {
          goto fail;
        }
        mlen -= step;
        p += step;
      }
      if ( (err = blake2s_update(&S, p, mlen)) < 0) {
        goto fail;
      }
      if ( (err = blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
        goto fail;
      }

      if (0 != memcmp(hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES)) {
        goto fail;
      }
    }
  }

  puts( "ok" );
  return 0;
fail:
  puts("error");
  return -1;
}
#endif

Coverage Report

Created: 2026-03-12 06:35

Line	Count	Source
1		/*
2		BLAKE2 reference source code package - reference C implementations
3
4		Copyright 2012, Samuel Neves <sneves@dei.uc.pt>. You may use this under the
5		terms of the CC0, the OpenSSL Licence, or the Apache Public License 2.0, at
6		your option. The terms of these licenses can be found at:
7
8		- CC0 1.0 Universal : http://creativecommons.org/publicdomain/zero/1.0
9		- OpenSSL license : https://www.openssl.org/source/license.html
10		- Apache 2.0 : http://www.apache.org/licenses/LICENSE-2.0
11
12		More information about the BLAKE2 hash function can be found at
13		https://blake2.net.
14		*/
15
16		#include "archive_platform.h"
17
18		#include <stdint.h>
19		#include <string.h>
20		#include <stdio.h>
21
22		#include "archive_blake2.h"
23		#include "archive_blake2_impl.h"
24
25		static const uint32_t blake2s_IV[8] =
26		{
27		0x6A09E667UL, 0xBB67AE85UL, 0x3C6EF372UL, 0xA54FF53AUL,
28		0x510E527FUL, 0x9B05688CUL, 0x1F83D9ABUL, 0x5BE0CD19UL
29		};
30
31		static const uint8_t blake2s_sigma[10][16] =
32		{
33		{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 } ,
34		{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 } ,
35		{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 } ,
36		{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 } ,
37		{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 } ,
38		{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 } ,
39		{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 } ,
40		{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 } ,
41		{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 } ,
42		{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13 , 0 } ,
43		};
44
45		static void blake2s_set_lastnode( blake2s_state *S )
46	0	{
47	0	S->f[1] = (uint32_t)-1;
48	0	}
49
50		/* Some helper functions, not necessarily useful */
51		static int blake2s_is_lastblock( const blake2s_state *S )
52	0	{
53	0	return S->f[0] != 0;
54	0	}
55
56		static void blake2s_set_lastblock( blake2s_state *S )
57	0	{
58	0	if( S->last_node ) blake2s_set_lastnode( S );
59
60	0	S->f[0] = (uint32_t)-1;
61	0	}
62
63		static void blake2s_increment_counter( blake2s_state *S, const uint32_t inc )
64	0	{
65	0	S->t[0] += inc;
66	0	S->t[1] += ( S->t[0] < inc );
67	0	}
68
69		static void blake2s_init0( blake2s_state *S )
70	0	{
71	0	size_t i;
72	0	memset( S, 0, sizeof( blake2s_state ) );
73
74	0	for( i = 0; i < 8; ++i ) S->h[i] = blake2s_IV[i];
75	0	}
76
77		/* init2 xors IV with input parameter block */
78		int blake2s_init_param( blake2s_state S, const blake2s_param P )
79	0	{
80	0	const unsigned char p = ( const unsigned char )( P );
81	0	size_t i;
82
83	0	blake2s_init0( S );
84
85		/* IV XOR ParamBlock */
86	0	for( i = 0; i < 8; ++i )
87	0	S->h[i] ^= load32( &p[i * 4] );
88
89	0	S->outlen = P->digest_length;
90	0	return 0;
91	0	}
92
93
94		/* Sequential blake2s initialization */
95		int blake2s_init( blake2s_state *S, size_t outlen )
96	0	{
97	0	blake2s_param P[1];
98
99		/* Move interval verification here? */
100	0	if ( ( !outlen ) \|\| ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
101
102	0	P->digest_length = (uint8_t)outlen;
103	0	P->key_length = 0;
104	0	P->fanout = 1;
105	0	P->depth = 1;
106	0	store32( &P->leaf_length, 0 );
107	0	store32( &P->node_offset, 0 );
108	0	store16( &P->xof_length, 0 );
109	0	P->node_depth = 0;
110	0	P->inner_length = 0;
111		/* memset(P->reserved, 0, sizeof(P->reserved) ); */
112	0	memset( P->salt, 0, sizeof( P->salt ) );
113	0	memset( P->personal, 0, sizeof( P->personal ) );
114	0	return blake2s_init_param( S, P );
115	0	}
116
117		int blake2s_init_key( blake2s_state S, size_t outlen, const void key, size_t keylen )
118	0	{
119	0	blake2s_param P[1];
120
121	0	if ( ( !outlen ) \|\| ( outlen > BLAKE2S_OUTBYTES ) ) return -1;
122
123	0	if ( !key \|\| !keylen \|\| keylen > BLAKE2S_KEYBYTES ) return -1;
124
125	0	P->digest_length = (uint8_t)outlen;
126	0	P->key_length = (uint8_t)keylen;
127	0	P->fanout = 1;
128	0	P->depth = 1;
129	0	store32( &P->leaf_length, 0 );
130	0	store32( &P->node_offset, 0 );
131	0	store16( &P->xof_length, 0 );
132	0	P->node_depth = 0;
133	0	P->inner_length = 0;
134		/* memset(P->reserved, 0, sizeof(P->reserved) ); */
135	0	memset( P->salt, 0, sizeof( P->salt ) );
136	0	memset( P->personal, 0, sizeof( P->personal ) );
137
138	0	if( blake2s_init_param( S, P ) < 0 ) return -1;
139
140	0	{
141	0	uint8_t block[BLAKE2S_BLOCKBYTES];
142	0	memset( block, 0, BLAKE2S_BLOCKBYTES );
143	0	memcpy( block, key, keylen );
144	0	blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
145	0	secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
146	0	}
147	0	return 0;
148	0	}
149
150		#define G(r,i,a,b,c,d) \
151	0	do { \
152	0	a = a + b + m[blake2s_sigma[r][2*i+0]]; \
153	0	d = rotr32(d ^ a, 16); \
154	0	c = c + d; \
155	0	b = rotr32(b ^ c, 12); \
156	0	a = a + b + m[blake2s_sigma[r][2*i+1]]; \
157	0	d = rotr32(d ^ a, 8); \
158	0	c = c + d; \
159	0	b = rotr32(b ^ c, 7); \
160	0	} while(0)
161
162		#define ROUND(r) \
163	0	do { \
164	0	G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
165	0	G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
166	0	G(r,2,v[ 2],v[ 6],v[10],v[14]); \
167	0	G(r,3,v[ 3],v[ 7],v[11],v[15]); \
168	0	G(r,4,v[ 0],v[ 5],v[10],v[15]); \
169	0	G(r,5,v[ 1],v[ 6],v[11],v[12]); \
170	0	G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
171	0	G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
172	0	} while(0)
173
174		static void blake2s_compress( blake2s_state *S, const uint8_t in[BLAKE2S_BLOCKBYTES] )
175	0	{
176	0	uint32_t m[16];
177	0	uint32_t v[16];
178	0	size_t i;
179
180	0	for( i = 0; i < 16; ++i ) {
181	0	m[i] = load32( in + i * sizeof( m[i] ) );
182	0	}
183
184	0	for( i = 0; i < 8; ++i ) {
185	0	v[i] = S->h[i];
186	0	}
187
188	0	v[ 8] = blake2s_IV[0];
189	0	v[ 9] = blake2s_IV[1];
190	0	v[10] = blake2s_IV[2];
191	0	v[11] = blake2s_IV[3];
192	0	v[12] = S->t[0] ^ blake2s_IV[4];
193	0	v[13] = S->t[1] ^ blake2s_IV[5];
194	0	v[14] = S->f[0] ^ blake2s_IV[6];
195	0	v[15] = S->f[1] ^ blake2s_IV[7];
196
197	0	ROUND( 0 );
198	0	ROUND( 1 );
199	0	ROUND( 2 );
200	0	ROUND( 3 );
201	0	ROUND( 4 );
202	0	ROUND( 5 );
203	0	ROUND( 6 );
204	0	ROUND( 7 );
205	0	ROUND( 8 );
206	0	ROUND( 9 );
207
208	0	for( i = 0; i < 8; ++i ) {
209	0	S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
210	0	}
211	0	}
212
213		#undef G
214		#undef ROUND
215
216		int blake2s_update( blake2s_state S, const void pin, size_t inlen )
217	0	{
218	0	const unsigned char * in = (const unsigned char *)pin;
219	0	if( inlen > 0 )
220	0	{
221	0	size_t left = S->buflen;
222	0	size_t fill = BLAKE2S_BLOCKBYTES - left;
223	0	if( inlen > fill )
224	0	{
225	0	S->buflen = 0;
226	0	memcpy( S->buf + left, in, fill ); /* Fill buffer */
227	0	blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
228	0	blake2s_compress( S, S->buf ); /* Compress */
229	0	in += fill; inlen -= fill;
230	0	while(inlen > BLAKE2S_BLOCKBYTES) {
231	0	blake2s_increment_counter(S, BLAKE2S_BLOCKBYTES);
232	0	blake2s_compress( S, in );
233	0	in += BLAKE2S_BLOCKBYTES;
234	0	inlen -= BLAKE2S_BLOCKBYTES;
235	0	}
236	0	}
237	0	memcpy( S->buf + S->buflen, in, inlen );
238	0	S->buflen += inlen;
239	0	}
240	0	return 0;
241	0	}
242
243		int blake2s_final( blake2s_state S, void out, size_t outlen )
244	0	{
245	0	uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
246	0	size_t i;
247
248	0	if( out == NULL \|\| outlen < S->outlen )
249	0	return -1;
250
251	0	if( blake2s_is_lastblock( S ) )
252	0	return -1;
253
254	0	blake2s_increment_counter( S, ( uint32_t )S->buflen );
255	0	blake2s_set_lastblock( S );
256	0	memset( S->buf + S->buflen, 0, BLAKE2S_BLOCKBYTES - S->buflen ); /* Padding */
257	0	blake2s_compress( S, S->buf );
258
259	0	for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
260	0	store32( buffer + sizeof( S->h[i] ) * i, S->h[i] );
261
262	0	memcpy( out, buffer, outlen );
263	0	secure_zero_memory(buffer, sizeof(buffer));
264	0	return 0;
265	0	}
266
267		int blake2s( void out, size_t outlen, const void in, size_t inlen, const void *key, size_t keylen )
268	0	{
269	0	blake2s_state S[1];
270
271		/* Verify parameters */
272	0	if ( NULL == in && inlen > 0 ) return -1;
273
274	0	if ( NULL == out ) return -1;
275
276	0	if ( NULL == key && keylen > 0) return -1;
277
278	0	if( !outlen \|\| outlen > BLAKE2S_OUTBYTES ) return -1;
279
280	0	if( keylen > BLAKE2S_KEYBYTES ) return -1;
281
282	0	if( keylen > 0 )
283	0	{
284	0	if( blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
285	0	}
286	0	else
287	0	{
288	0	if( blake2s_init( S, outlen ) < 0 ) return -1;
289	0	}
290
291	0	blake2s_update( S, ( const uint8_t * )in, inlen );
292	0	blake2s_final( S, out, outlen );
293	0	return 0;
294	0	}
295
296		#if defined(SUPERCOP)
297		int crypto_hash( unsigned char out, unsigned char in, unsigned long long inlen )
298		{
299		return blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 );
300		}
301		#endif
302
303		#if defined(BLAKE2S_SELFTEST)
304		#include <string.h>
305		#include "blake2-kat.h"
306		int main( void )
307		{
308		uint8_t key[BLAKE2S_KEYBYTES];
309		uint8_t buf[BLAKE2_KAT_LENGTH];
310		size_t i, step;
311
312		for( i = 0; i < BLAKE2S_KEYBYTES; ++i )
313		key[i] = ( uint8_t )i;
314
315		for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
316		buf[i] = ( uint8_t )i;
317
318		/* Test simple API */
319		for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
320		{
321		uint8_t hash[BLAKE2S_OUTBYTES];
322		blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
323
324		if( 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
325		{
326		goto fail;
327		}
328		}
329
330		/* Test streaming API */
331		for(step = 1; step < BLAKE2S_BLOCKBYTES; ++step) {
332		for (i = 0; i < BLAKE2_KAT_LENGTH; ++i) {
333		uint8_t hash[BLAKE2S_OUTBYTES];
334		blake2s_state S;
335		uint8_t * p = buf;
336		size_t mlen = i;
337		int err = 0;
338
339		if( (err = blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
340		goto fail;
341		}
342
343		while (mlen >= step) {
344		if ( (err = blake2s_update(&S, p, step)) < 0 ) {
345		goto fail;
346		}
347		mlen -= step;
348		p += step;
349		}
350		if ( (err = blake2s_update(&S, p, mlen)) < 0) {
351		goto fail;
352		}
353		if ( (err = blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
354		goto fail;
355		}
356
357		if (0 != memcmp(hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES)) {
358		goto fail;
359		}
360		}
361		}
362
363		puts( "ok" );
364		return 0;
365		fail:
366		puts("error");
367		return -1;
368		}
369		#endif