src/crypto/blake/blake3/compress.bend

bend-collections-laws-crypto@1.0.0.0 · 121 lines · 11 definitions

1import Base
2import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake3/types.bend as T
3
4# Generated by tools/generators/blake3/gen.py; do not edit by hand.
5
6def rot16(+x: U32) -> U32:
7  U32.or(U32.shrn(x,16n),U32.shln(x,16n))
8
9def rot12(+x: U32) -> U32:
10  U32.or(U32.shrn(x,12n),U32.shln(x,20n))
11
12def rot8(+x: U32) -> U32:
13  U32.or(U32.shrn(x,8n),U32.shln(x,24n))
14
15def rot7(+x: U32) -> U32:
16  U32.or(U32.shrn(x,7n),U32.shln(x,25n))
17
18# G on the four columns, message words m0..m7.
19def column(s: T.St, +m0: U32, +m1: U32, +m2: U32, +m3: U32, +m4: U32, +m5: U32, +m6: U32, +m7: U32) -> T.St:
20  match s:
21    case T.St{+v0,+v1,+v2,+v3,+v4,+v5,+v6,+v7,+v8,+v9,+v10,+v11,+v12,+v13,+v14,+v15}:
22      +t0 = U32.add(U32.add(v0,v4),m0)
23      +t1 = rot16(U32.xor(v12,t0))
24      +t2 = U32.add(v8,t1)
25      +t3 = rot12(U32.xor(v4,t2))
26      +t4 = U32.add(U32.add(t0,t3),m1)
27      +t5 = rot8(U32.xor(t1,t4))
28      +t6 = U32.add(t2,t5)
29      +t7 = rot7(U32.xor(t3,t6))
30      +t8 = U32.add(U32.add(v1,v5),m2)
31      +t9 = rot16(U32.xor(v13,t8))
32      +t10 = U32.add(v9,t9)
33      +t11 = rot12(U32.xor(v5,t10))
34      +t12 = U32.add(U32.add(t8,t11),m3)
35      +t13 = rot8(U32.xor(t9,t12))
36      +t14 = U32.add(t10,t13)
37      +t15 = rot7(U32.xor(t11,t14))
38      +t16 = U32.add(U32.add(v2,v6),m4)
39      +t17 = rot16(U32.xor(v14,t16))
40      +t18 = U32.add(v10,t17)
41      +t19 = rot12(U32.xor(v6,t18))
42      +t20 = U32.add(U32.add(t16,t19),m5)
43      +t21 = rot8(U32.xor(t17,t20))
44      +t22 = U32.add(t18,t21)
45      +t23 = rot7(U32.xor(t19,t22))
46      +t24 = U32.add(U32.add(v3,v7),m6)
47      +t25 = rot16(U32.xor(v15,t24))
48      +t26 = U32.add(v11,t25)
49      +t27 = rot12(U32.xor(v7,t26))
50      +t28 = U32.add(U32.add(t24,t27),m7)
51      +t29 = rot8(U32.xor(t25,t28))
52      +t30 = U32.add(t26,t29)
53      +t31 = rot7(U32.xor(t27,t30))
54      T.St{t4,t12,t20,t28,t7,t15,t23,t31,t6,t14,t22,t30,t5,t13,t21,t29}
55
56# G on the four diagonals, message words m8..m15.
57def diagonal(s: T.St, +m8: U32, +m9: U32, +m10: U32, +m11: U32, +m12: U32, +m13: U32, +m14: U32, +m15: U32) -> T.St:
58  match s:
59    case T.St{+v0,+v1,+v2,+v3,+v4,+v5,+v6,+v7,+v8,+v9,+v10,+v11,+v12,+v13,+v14,+v15}:
60      +t0 = U32.add(U32.add(v0,v5),m8)
61      +t1 = rot16(U32.xor(v15,t0))
62      +t2 = U32.add(v10,t1)
63      +t3 = rot12(U32.xor(v5,t2))
64      +t4 = U32.add(U32.add(t0,t3),m9)
65      +t5 = rot8(U32.xor(t1,t4))
66      +t6 = U32.add(t2,t5)
67      +t7 = rot7(U32.xor(t3,t6))
68      +t8 = U32.add(U32.add(v1,v6),m10)
69      +t9 = rot16(U32.xor(v12,t8))
70      +t10 = U32.add(v11,t9)
71      +t11 = rot12(U32.xor(v6,t10))
72      +t12 = U32.add(U32.add(t8,t11),m11)
73      +t13 = rot8(U32.xor(t9,t12))
74      +t14 = U32.add(t10,t13)
75      +t15 = rot7(U32.xor(t11,t14))
76      +t16 = U32.add(U32.add(v2,v7),m12)
77      +t17 = rot16(U32.xor(v13,t16))
78      +t18 = U32.add(v8,t17)
79      +t19 = rot12(U32.xor(v7,t18))
80      +t20 = U32.add(U32.add(t16,t19),m13)
81      +t21 = rot8(U32.xor(t17,t20))
82      +t22 = U32.add(t18,t21)
83      +t23 = rot7(U32.xor(t19,t22))
84      +t24 = U32.add(U32.add(v3,v4),m14)
85      +t25 = rot16(U32.xor(v14,t24))
86      +t26 = U32.add(v9,t25)
87      +t27 = rot12(U32.xor(v4,t26))
88      +t28 = U32.add(U32.add(t24,t27),m15)
89      +t29 = rot8(U32.xor(t25,t28))
90      +t30 = U32.add(t26,t29)
91      +t31 = rot7(U32.xor(t27,t30))
92      T.St{t4,t12,t20,t28,t31,t7,t15,t23,t22,t30,t6,t14,t13,t21,t29,t5}
93
94# One round: the column step then the diagonal step.
95def round(s: T.St, +m0: U32, +m1: U32, +m2: U32, +m3: U32, +m4: U32, +m5: U32, +m6: U32, +m7: U32, +m8: U32, +m9: U32, +m10: U32, +m11: U32, +m12: U32, +m13: U32, +m14: U32, +m15: U32) -> T.St:
96  diagonal(column(s,m0,m1,m2,m3,m4,m5,m6,m7),m8,m9,m10,m11,m12,m13,m14,m15)
97
98def fold(s: T.St) -> T.CV:
99  match s:
100    case T.St{v0,v1,v2,v3,v4,v5,v6,v7,v8,v9,v10,v11,v12,v13,v14,v15}:
101      T.CV{U32.xor(v0,v8),U32.xor(v1,v9),U32.xor(v2,v10),U32.xor(v3,v11),U32.xor(v4,v12),U32.xor(v5,v13),U32.xor(v6,v14),U32.xor(v7,v15)}
102
103# The initial state: the chaining value, IV[0..3], the counter (low word,
104# then the high word, 0: an input has fewer than 2^32 chunks), the block
105# length and the flags.
106def init(cv: T.CV, +t: U32, +len: U32, +flags: U32) -> T.St:
107  match cv:
108    case T.CV{h0,h1,h2,h3,h4,h5,h6,h7}:
109      T.St{h0,h1,h2,h3,h4,h5,h6,h7,1779033703,3144134277,1013904242,2773480762,t,0,len,flags}
110
111# Seven rounds; round r takes the message words in the order of the
112# permutation applied r times (the fixed BLAKE3 schedule).
113def rounds7(s: T.St, b: T.Block) -> T.St:
114  match b:
115    case T.B{+m0,+m1,+m2,+m3,+m4,+m5,+m6,+m7,+m8,+m9,+m10,+m11,+m12,+m13,+m14,+m15}:
116      round(round(round(round(round(round(round(s,m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,m10,m11,m12,m13,m14,m15),m2,m6,m3,m10,m7,m0,m4,m13,m1,m11,m12,m5,m9,m14,m15,m8),m3,m4,m10,m12,m13,m2,m7,m14,m6,m5,m9,m0,m11,m15,m8,m1),m10,m7,m12,m9,m14,m3,m13,m15,m4,m0,m11,m2,m5,m8,m1,m6),m12,m13,m9,m11,m15,m10,m14,m8,m7,m2,m5,m3,m0,m1,m6,m4),m9,m14,m11,m5,m8,m12,m15,m1,m13,m3,m0,m10,m2,m6,m4,m7),m11,m15,m5,m0,m1,m9,m8,m6,m14,m10,m2,m12,m3,m4,m7,m13)
117
118# The compression function (hash mode, 32-byte output): the new chaining
119# value is the low half of the final state xor its high half.
120def compress(cv: T.CV, b: T.Block, +t: U32, +len: U32, +flags: U32) -> T.CV:
121  fold(rounds7(init(cv,t,len,flags),b))