@cryptotaxi247 / kubo / commits / 84262be07

godep&x/crypto: updated multihash and moved to x/crypto for blowfish

Henry committed Mar 1, 2015 at 00:49 UTC 84262be070e5d5ad12827a4105cd8ca2b244fe28

20 files changed +458 -337

Godeps/Godeps.json

+10 -12

@@ -14,16 +14,6 @@

14 "Comment": "null-15",

15 "Rev": "35bc42037350f0078e3c974c6ea690f1926603ab"

16 },

17 - {

18 - "ImportPath": "code.google.com/p/go.crypto/blowfish",

19 - "Comment": "null-236",

20 - "Rev": "69e2a90ed92d03812364aeb947b7068dc42e561e"

21 - },

22 - {

23 - "ImportPath": "code.google.com/p/go.crypto/sha3",

24 - "Comment": "null-236",

25 - "Rev": "69e2a90ed92d03812364aeb947b7068dc42e561e"

26 - },

17 {

18 "ImportPath": "code.google.com/p/gogoprotobuf/io",

19 "Rev": "6c980277330804e94257ac7ef70a3adbe1641059"

@@ -188,8 +178,8 @@

178 },

179 {

180 "ImportPath": "github.com/jbenet/go-multihash",

191 - "Comment": "0.1.0-33-g4e09420",

192 - "Rev": "4e09420ceb2db37a5fbb149821b9e63d88d47218"

181 + "Comment": "0.1.0-36-g87e53a9",

182 + "Rev": "87e53a9d2875a18a7863b351d22f912545e6b3a3"

183 },

184 {

185 "ImportPath": "github.com/jbenet/go-peerstream",

@@ -235,6 +225,14 @@

225 "ImportPath": "github.com/syndtr/gosnappy/snappy",

226 "Rev": "ce8acff4829e0c2458a67ead32390ac0a381c862"

227 },

228 + {

229 + "ImportPath": "golang.org/x/crypto/blowfish",

230 + "Rev": "1351f936d976c60a0a48d728281922cf63eafb8d"

231 + },

232 + {

233 + "ImportPath": "golang.org/x/crypto/sha3",

234 + "Rev": "1351f936d976c60a0a48d728281922cf63eafb8d"

235 + },

236 {

237 "ImportPath": "golang.org/x/net/context",

238 "Rev": "b6fdb7d8a4ccefede406f8fe0f017fb58265054c"

Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/sha3_test.go deleted

-249

@@ -1,249 +0,0 @@

2 -// Use of this source code is governed by a BSD-style

3 -// license that can be found in the LICENSE file.

4 -

5 -package sha3

6 -

7 -// Tests include all the ShortMsgKATs provided by the Keccak team at

8 -// https://github.com/gvanas/KeccakCodePackage

9 -//

10 -// They only include the zero-bit case of the utterly useless bitwise

11 -// testvectors published by NIST in the draft of FIPS-202.

12 -

13 -import (

14 - "bytes"

15 - "compress/flate"

16 - "encoding/hex"

17 - "encoding/json"

18 - "hash"

19 - "os"

20 - "strings"

21 - "testing"

22 -)

23 -

24 -const (

25 - testString = "brekeccakkeccak koax koax"

26 - katFilename = "keccakKats.json.deflate"

27 -)

28 -

29 -// Internal-use instances of SHAKE used to test against KATs.

30 -func newHashShake128() hash.Hash {

31 - return &state{rate: 168, dsbyte: 0x1f, outputLen: 512}

32 -}

33 -func newHashShake256() hash.Hash {

34 - return &state{rate: 136, dsbyte: 0x1f, outputLen: 512}

35 -}

36 -

37 -// testDigests contains functions returning hash.Hash instances

38 -// with output-length equal to the KAT length for both SHA-3 and

39 -// SHAKE instances.

40 -var testDigests = map[string]func() hash.Hash{

41 - "SHA3-224": New224,

42 - "SHA3-256": New256,

43 - "SHA3-384": New384,

44 - "SHA3-512": New512,

45 - "SHAKE128": newHashShake128,

46 - "SHAKE256": newHashShake256,

47 -}

48 -

49 -// testShakes contains functions returning ShakeHash instances for

50 -// testing the ShakeHash-specific interface.

51 -var testShakes = map[string]func() ShakeHash{

52 - "SHAKE128": NewShake128,

53 - "SHAKE256": NewShake256,

54 -}

55 -

56 -// decodeHex converts an hex-encoded string into a raw byte string.

57 -func decodeHex(s string) []byte {

58 - b, err := hex.DecodeString(s)

59 - if err != nil {

60 - panic(err)

61 - }

62 - return b

63 -}

64 -

65 -// structs used to marshal JSON test-cases.

66 -type KeccakKats struct {

67 - Kats map[string][]struct {

68 - Digest string `json:"digest"`

69 - Length int64 `json:"length"`

70 - Message string `json:"message"`

71 - }

72 -}

73 -

74 -// TestKeccakKats tests the SHA-3 and Shake implementations against all the

75 -// ShortMsgKATs from https://github.com/gvanas/KeccakCodePackage

76 -// (The testvectors are stored in keccakKats.json.deflate due to their length.)

77 -func TestKeccakKats(t *testing.T) {

78 - // Read the KATs.

79 - deflated, err := os.Open(katFilename)

80 - if err != nil {

81 - t.Errorf("Error opening %s: %s", katFilename, err)

82 - }

83 - file := flate.NewReader(deflated)

84 - dec := json.NewDecoder(file)

85 - var katSet KeccakKats

86 - err = dec.Decode(&katSet)

87 - if err != nil {

88 - t.Errorf("%s", err)

89 - }

90 -

91 - // Do the KATs.

92 - for functionName, kats := range katSet.Kats {

93 - d := testDigests[functionName]()

94 - t.Logf("%s", functionName)

95 - for _, kat := range kats {

96 - d.Reset()

97 - in, err := hex.DecodeString(kat.Message)

98 - if err != nil {

99 - t.Errorf("%s", err)

100 - }

101 - d.Write(in[:kat.Length/8])

102 - got := strings.ToUpper(hex.EncodeToString(d.Sum(nil)))

103 - want := kat.Digest

104 - if got != want {

105 - t.Errorf("function=%s, length=%d\nmessage:\n %s\ngot:\n %s\nwanted:\n %s",

106 - functionName, kat.Length, kat.Message, got, want)

107 - t.Logf("wanted %+v", kat)

108 - t.FailNow()

109 - }

110 - }

111 - }

112 -}

113 -

114 -// TestUnalignedWrite tests that writing data in an arbitrary pattern with

115 -// small input buffers.

116 -func TestUnalignedWrite(t *testing.T) {

117 - buf := sequentialBytes(0x10000)

118 - for alg, df := range testDigests {

119 - d := df()

120 - d.Reset()

121 - d.Write(buf)

122 - want := d.Sum(nil)

123 - d.Reset()

124 - for i := 0; i < len(buf); {

125 - // Cycle through offsets which make a 137 byte sequence.

126 - // Because 137 is prime this sequence should exercise all corner cases.

127 - offsets := [17]int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 1}

128 - for _, j := range offsets {

129 - if v := len(buf) - i; v < j {

130 - j = v

131 - }

132 - d.Write(buf[i : i+j])

133 - i += j

134 - }

135 - }

136 - got := d.Sum(nil)

137 - if !bytes.Equal(got, want) {

138 - t.Errorf("Unaligned writes, alg=%s\ngot %q, want %q", alg, got, want)

139 - }

140 - }

141 -}

142 -

143 -// Test that appending works when reallocation is necessary.

144 -func TestAppend(t *testing.T) {

145 - d := New224()

146 -

147 - for capacity := 2; capacity < 64; capacity += 64 {

148 - // The first time around the loop, Sum will have to reallocate.

149 - // The second time, it will not.

150 - buf := make([]byte, 2, capacity)

151 - d.Reset()

152 - d.Write([]byte{0xcc})

153 - buf = d.Sum(buf)

154 - expected := "0000DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"

155 - if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {

156 - t.Errorf("got %s, want %s", got, expected)

157 - }

158 - }

159 -}

160 -

161 -// Test that appending works when no reallocation is necessary.

162 -func TestAppendNoRealloc(t *testing.T) {

163 - buf := make([]byte, 1, 200)

164 - d := New224()

165 - d.Write([]byte{0xcc})

166 - buf = d.Sum(buf)

167 - expected := "00DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"

168 - if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {

169 - t.Errorf("got %s, want %s", got, expected)

170 - }

171 -}

172 -

173 -// TestSqueezing checks that squeezing the full output a single time produces

174 -// the same output as repeatedly squeezing the instance.

175 -func TestSqueezing(t *testing.T) {

176 - for functionName, newShakeHash := range testShakes {

177 - t.Logf("%s", functionName)

178 - d0 := newShakeHash()

179 - d0.Write([]byte(testString))

180 - ref := make([]byte, 32)

181 - d0.Read(ref)

182 -

183 - d1 := newShakeHash()

184 - d1.Write([]byte(testString))

185 - var multiple []byte

186 - for _ = range ref {

187 - one := make([]byte, 1)

188 - d1.Read(one)

189 - multiple = append(multiple, one...)

190 - }

191 - if !bytes.Equal(ref, multiple) {

192 - t.Errorf("squeezing %d bytes one at a time failed", len(ref))

193 - }

194 - }

195 -}

196 -

197 -func TestReadSimulation(t *testing.T) {

198 - d := NewShake256()

199 - d.Write(nil)

200 - dwr := make([]byte, 32)

201 - d.Read(dwr)

202 -

203 -}

204 -

205 -// sequentialBytes produces a buffer of size consecutive bytes 0x00, 0x01, ..., used for testing.

206 -func sequentialBytes(size int) []byte {

207 - result := make([]byte, size)

208 - for i := range result {

209 - result[i] = byte(i)

210 - }

211 - return result

212 -}

213 -

214 -// BenchmarkPermutationFunction measures the speed of the permutation function

215 -// with no input data.

216 -func BenchmarkPermutationFunction(b *testing.B) {

217 - b.SetBytes(int64(200))

218 - var lanes [25]uint64

219 - for i := 0; i < b.N; i++ {

220 - keccakF1600(&lanes)

221 - }

222 -}

223 -

224 -// benchmarkBulkHash tests the speed to hash a buffer of buflen.

225 -func benchmarkBulkHash(b *testing.B, h hash.Hash, size int) {

226 - b.StopTimer()

227 - h.Reset()

228 - data := sequentialBytes(size)

229 - b.SetBytes(int64(size))

230 - b.StartTimer()

231 -

232 - var state []byte

233 - for i := 0; i < b.N; i++ {

234 - h.Write(data)

235 - state = h.Sum(state[:0])

236 - }

237 - b.StopTimer()

238 - h.Reset()

239 -}

240 -

241 -func BenchmarkSha3_512_MTU(b *testing.B) { benchmarkBulkHash(b, New512(), 1350) }

242 -func BenchmarkSha3_384_MTU(b *testing.B) { benchmarkBulkHash(b, New384(), 1350) }

243 -func BenchmarkSha3_256_MTU(b *testing.B) { benchmarkBulkHash(b, New256(), 1350) }

244 -func BenchmarkSha3_224_MTU(b *testing.B) { benchmarkBulkHash(b, New224(), 1350) }

245 -func BenchmarkShake256_MTU(b *testing.B) { benchmarkBulkHash(b, newHashShake256(), 1350) }

246 -func BenchmarkShake128_MTU(b *testing.B) { benchmarkBulkHash(b, newHashShake128(), 1350) }

247 -

248 -func BenchmarkSha3_512_1MiB(b *testing.B) { benchmarkBulkHash(b, New512(), 1<<20) }

249 -func BenchmarkShake256_1MiB(b *testing.B) { benchmarkBulkHash(b, newHashShake256(), 1<<20) }

Godeps/_workspace/src/github.com/jbenet/go-multihash/Makefile

+1 -1

@@ -7,5 +7,5 @@ go_test: go_deps

7 go test -race -cpu=5 -v ./...

9 go_deps:

10 - go get code.google.com/p/go.crypto/sha3

10 + go get golang.org/x/crypto/sha3

11 go get github.com/jbenet/go-base58

Godeps/_workspace/src/github.com/jbenet/go-multihash/sum.go

+1 -1

@@ -7,7 +7,7 @@ import (

7 "errors"

8 "fmt"

10 - sha3 "github.com/jbenet/go-ipfs/Godeps/_workspace/src/code.google.com/p/go.crypto/sha3"

10 + sha3 "github.com/jbenet/go-ipfs/Godeps/_workspace/src/golang.org/x/crypto/sha3"

11 )

13 var ErrSumNotSupported = errors.New("Function not implemented. Complain to lib maintainer.")

Godeps/_workspace/src/golang.org/x/crypto/blowfish/block.go renamed

Godeps/_workspace/src/golang.org/x/crypto/blowfish/blowfish_test.go renamed

Godeps/_workspace/src/golang.org/x/crypto/blowfish/cipher.go renamed

Godeps/_workspace/src/golang.org/x/crypto/blowfish/const.go renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/doc.go renamed

+20 -22

@@ -12,7 +12,8 @@

12 // Guidance

13 //

14 // If you aren't sure what function you need, use SHAKE256 with at least 64

15 -// bytes of output.

15 +// bytes of output. The SHAKE instances are faster than the SHA3 instances;

16 +// the latter have to allocate memory to conform to the hash.Hash interface.

17 //

18 // If you need a secret-key MAC (message authentication code), prepend the

19 // secret key to the input, hash with SHAKE256 and read at least 32 bytes of

@@ -21,45 +22,42 @@

22 //

23 // Security strengths

24 //

24 -// The SHA3-x functions have a security strength against preimage attacks of x

25 -// bits. Since they only produce x bits of output, their collision-resistance

26 -// is only x/2 bits.

25 +// The SHA3-x (x equals 224, 256, 384, or 512) functions have a security

26 +// strength against preimage attacks of x bits. Since they only produce "x"

27 +// bits of output, their collision-resistance is only "x/2" bits.

28 //

28 -// The SHAKE-x functions have a generic security strength of x bits against

29 -// all attacks, provided that at least 2x bits of their output is used.

30 -// Requesting more than 2x bits of output does not increase the collision-

31 -// resistance of the SHAKE functions.

29 +// The SHAKE-256 and -128 functions have a generic security strength of 256 and

30 +// 128 bits against all attacks, provided that at least 2x bits of their output

31 +// is used. Requesting more than 64 or 32 bytes of output, respectively, does

32 +// not increase the collision-resistance of the SHAKE functions.

33 //

34 //

35 // The sponge construction

36 //

36 -// A sponge builds a pseudo-random function from a pseudo-random permutation,

37 -// by applying the permutation to a state of "rate + capacity" bytes, but

38 -// hiding "capacity" of the bytes.

37 +// A sponge builds a pseudo-random function from a public pseudo-random

38 +// permutation, by applying the permutation to a state of "rate + capacity"

39 +// bytes, but hiding "capacity" of the bytes.

40 //

41 // A sponge starts out with a zero state. To hash an input using a sponge, up

42 // to "rate" bytes of the input are XORed into the sponge's state. The sponge

42 -// has thus been "filled up" and the permutation is applied. This process is

43 +// is then "full" and the permutation is applied to "empty" it. This process is

44 // repeated until all the input has been "absorbed". The input is then padded.

44 -// The digest is "squeezed" from the sponge by the same method, except that

45 -// output is copied out.

45 +// The digest is "squeezed" from the sponge in the same way, except that output

46 +// output is copied out instead of input being XORed in.

47 //

48 // A sponge is parameterized by its generic security strength, which is equal

49 // to half its capacity; capacity + rate is equal to the permutation's width.

49 -//

50 // Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means

51 -// that security_strength == (1600 - bitrate) / 2.

51 +// that the security strength of a sponge instance is equal to (1600 - bitrate) / 2.

52 //

53 //

54 -// Recommendations, detailed

54 +// Recommendations

55 //

56 // The SHAKE functions are recommended for most new uses. They can produce

57 // output of arbitrary length. SHAKE256, with an output length of at least

58 -// 64 bytes, provides 256-bit security against all attacks.

59 -//

60 -// The Keccak team recommends SHAKE256 for most applications upgrading from

61 -// SHA2-512. (NIST chose a much stronger, but much slower, sponge instance

62 -// for SHA3-512.)

58 +// 64 bytes, provides 256-bit security against all attacks. The Keccak team

59 +// recommends it for most applications upgrading from SHA2-512. (NIST chose a

60 +// much stronger, but much slower, sponge instance for SHA3-512.)

61 //

62 // The SHA-3 functions are "drop-in" replacements for the SHA-2 functions.

63 // They produce output of the same length, with the same security strengths

Godeps/_workspace/src/golang.org/x/crypto/sha3/hashes.go renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/keccakf.go renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/register.go renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/sha3.go renamed

+17 -50

@@ -4,10 +4,6 @@

5 package sha3

7 -import (

8 - "encoding/binary"

9 -)

10 -

7 // spongeDirection indicates the direction bytes are flowing through the sponge.

8 type spongeDirection int

@@ -30,25 +26,25 @@ type state struct {

26 buf []byte // points into storage

27 rate int // the number of bytes of state to use

33 - // dsbyte contains the "domain separation" value and the first bit of

34 - // the padding. In sections 6.1 and 6.2 of [1], the SHA-3 and SHAKE

35 - // functions are defined with bits appended to the message: SHA-3

36 - // functions have 01 and SHAKE functions have 1111. Because of the way

37 - // that bits are numbered from the LSB upwards, that ends up as

38 - // 00000010b and 00001111b, respectively. Then the padding rule from

39 - // section 5.1 is applied to pad to a multiple of the rate, which

40 - // involves adding a 1 bit, zero or more zero bits and then a final one

41 - // bit. The first one bit from the padding is merged into the dsbyte

42 - // value giving 00000110b (0x06) and 00011111b (0x1f), respectively.

43 - //

44 - // [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf,

29 + // dsbyte contains the "domain separation" bits and the first bit of

30 + // the padding. Sections 6.1 and 6.2 of [1] separate the outputs of the

31 + // SHA-3 and SHAKE functions by appending bitstrings to the message.

32 + // Using a little-endian bit-ordering convention, these are "01" for SHA-3

33 + // and "1111" for SHAKE, or 00000010b and 00001111b, respectively. Then the

34 + // padding rule from section 5.1 is applied to pad the message to a multiple

35 + // of the rate, which involves adding a "1" bit, zero or more "0" bits, and

36 + // a final "1" bit. We merge the first "1" bit from the padding into dsbyte,

37 + // giving 00000110b (0x06) and 00011111b (0x1f).

38 + // [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf

39 + // "Draft FIPS 202: SHA-3 Standard: Permutation-Based Hash and

40 + // Extendable-Output Functions (May 2014)"

41 dsbyte byte

42 storage [maxRate]byte

44 // Specific to SHA-3 and SHAKE.

45 fixedOutput bool // whether this is a fixed-ouput-length instance

46 outputLen int // the default output size in bytes

51 - state spongeDirection // current direction of the sponge

47 + state spongeDirection // whether the sponge is absorbing or squeezing

48 }

50 // BlockSize returns the rate of sponge underlying this hash function.

@@ -79,35 +75,6 @@ func (d *state) clone() *state {

75 return &ret

76 }

82 -// xorIn xors a buffer into the state, byte-swapping to

83 -// little-endian as necessary; it returns the number of bytes

84 -// copied, including any zeros appended to the bytestring.

85 -func (d *state) xorIn(buf []byte) {

86 - n := len(buf) / 8

87 -

88 - for i := 0; i < n; i++ {

89 - a := binary.LittleEndian.Uint64(buf)

90 - d.a[i] ^= a

91 - buf = buf[8:]

92 - }

93 - if len(buf) != 0 {

94 - // XOR in the last partial ulint64.

95 - a := uint64(0)

96 - for i, v := range buf {

97 - a |= uint64(v) << uint64(8*i)

98 - }

99 - d.a[n] ^= a

100 - }

101 -}

102 -

103 -// copyOut copies ulint64s to a byte buffer.

104 -func (d *state) copyOut(b []byte) {

105 - for i := 0; len(b) >= 8; i++ {

106 - binary.LittleEndian.PutUint64(b, d.a[i])

107 - b = b[8:]

108 - }

109 -}

110 -

78 // permute applies the KeccakF-1600 permutation. It handles

79 // any input-output buffering.

80 func (d *state) permute() {

@@ -115,7 +82,7 @@ func (d *state) permute() {

82 case spongeAbsorbing:

83 // If we're absorbing, we need to xor the input into the state

84 // before applying the permutation.

118 - d.xorIn(d.buf)

85 + xorIn(d, d.buf)

86 d.buf = d.storage[:0]

87 keccakF1600(&d.a)

88 case spongeSqueezing:

@@ -123,7 +90,7 @@ func (d *state) permute() {

90 // copying more output.

91 keccakF1600(&d.a)

92 d.buf = d.storage[:d.rate]

126 - d.copyOut(d.buf)

93 + copyOut(d, d.buf)

94 }

95 }

@@ -151,7 +118,7 @@ func (d *state) padAndPermute(dsbyte byte) {

118 d.permute()

119 d.state = spongeSqueezing

120 d.buf = d.storage[:d.rate]

154 - d.copyOut(d.buf)

121 + copyOut(d, d.buf)

122 }

123

124 // Write absorbs more data into the hash's state. It produces an error

@@ -168,7 +135,7 @@ func (d *state) Write(p []byte) (written int, err error) {

135 for len(p) > 0 {

136 if len(d.buf) == 0 && len(p) >= d.rate {

137 // The fast path; absorb a full "rate" bytes of input and apply the permutation.

171 - d.xorIn(p[:d.rate])

138 + xorIn(d, p[:d.rate])

139 p = p[d.rate:]

140 keccakF1600(&d.a)

141 } else {

Godeps/_workspace/src/golang.org/x/crypto/sha3/sha3_test.go new

+306

@@ -0,0 +1,306 @@

2 +// Use of this source code is governed by a BSD-style

3 +// license that can be found in the LICENSE file.

4 +

5 +package sha3

6 +

7 +// Tests include all the ShortMsgKATs provided by the Keccak team at

8 +// https://github.com/gvanas/KeccakCodePackage

9 +//

10 +// They only include the zero-bit case of the bitwise testvectors

11 +// published by NIST in the draft of FIPS-202.

12 +

13 +import (

14 + "bytes"

15 + "compress/flate"

16 + "encoding/hex"

17 + "encoding/json"

18 + "hash"

19 + "os"

20 + "strings"

21 + "testing"

22 +)

23 +

24 +const (

25 + testString = "brekeccakkeccak koax koax"

26 + katFilename = "testdata/keccakKats.json.deflate"

27 +)

28 +

29 +// Internal-use instances of SHAKE used to test against KATs.

30 +func newHashShake128() hash.Hash {

31 + return &state{rate: 168, dsbyte: 0x1f, outputLen: 512}

32 +}

33 +func newHashShake256() hash.Hash {

34 + return &state{rate: 136, dsbyte: 0x1f, outputLen: 512}

35 +}

36 +

37 +// testDigests contains functions returning hash.Hash instances

38 +// with output-length equal to the KAT length for both SHA-3 and

39 +// SHAKE instances.

40 +var testDigests = map[string]func() hash.Hash{

41 + "SHA3-224": New224,

42 + "SHA3-256": New256,

43 + "SHA3-384": New384,

44 + "SHA3-512": New512,

45 + "SHAKE128": newHashShake128,

46 + "SHAKE256": newHashShake256,

47 +}

48 +

49 +// testShakes contains functions that return ShakeHash instances for

50 +// testing the ShakeHash-specific interface.

51 +var testShakes = map[string]func() ShakeHash{

52 + "SHAKE128": NewShake128,

53 + "SHAKE256": NewShake256,

54 +}

55 +

56 +// decodeHex converts a hex-encoded string into a raw byte string.

57 +func decodeHex(s string) []byte {

58 + b, err := hex.DecodeString(s)

59 + if err != nil {

60 + panic(err)

61 + }

62 + return b

63 +}

64 +

65 +// structs used to marshal JSON test-cases.

66 +type KeccakKats struct {

67 + Kats map[string][]struct {

68 + Digest string `json:"digest"`

69 + Length int64 `json:"length"`

70 + Message string `json:"message"`

71 + }

72 +}

73 +

74 +func testUnalignedAndGeneric(t *testing.T, testf func(impl string)) {

75 + xorInOrig, copyOutOrig := xorIn, copyOut

76 + xorIn, copyOut = xorInGeneric, copyOutGeneric

77 + testf("generic")

78 + if xorImplementationUnaligned != "generic" {

79 + xorIn, copyOut = xorInUnaligned, copyOutUnaligned

80 + testf("unaligned")

81 + }

82 + xorIn, copyOut = xorInOrig, copyOutOrig

83 +}

84 +

85 +// TestKeccakKats tests the SHA-3 and Shake implementations against all the

86 +// ShortMsgKATs from https://github.com/gvanas/KeccakCodePackage

87 +// (The testvectors are stored in keccakKats.json.deflate due to their length.)

88 +func TestKeccakKats(t *testing.T) {

89 + testUnalignedAndGeneric(t, func(impl string) {

90 + // Read the KATs.

91 + deflated, err := os.Open(katFilename)

92 + if err != nil {

93 + t.Errorf("error opening %s: %s", katFilename, err)

94 + }

95 + file := flate.NewReader(deflated)

96 + dec := json.NewDecoder(file)

97 + var katSet KeccakKats

98 + err = dec.Decode(&katSet)

99 + if err != nil {

100 + t.Errorf("error decoding KATs: %s", err)

101 + }

102 +

103 + // Do the KATs.

104 + for functionName, kats := range katSet.Kats {

105 + d := testDigests[functionName]()

106 + for _, kat := range kats {

107 + d.Reset()

108 + in, err := hex.DecodeString(kat.Message)

109 + if err != nil {

110 + t.Errorf("error decoding KAT: %s", err)

111 + }

112 + d.Write(in[:kat.Length/8])

113 + got := strings.ToUpper(hex.EncodeToString(d.Sum(nil)))

114 + if got != kat.Digest {

115 + t.Errorf("function=%s, implementation=%s, length=%d\nmessage:\n %s\ngot:\n %s\nwanted:\n %s",

116 + functionName, impl, kat.Length, kat.Message, got, kat.Digest)

117 + t.Logf("wanted %+v", kat)

118 + t.FailNow()

119 + }

120 + continue

121 + }

122 + }

123 + })

124 +}

125 +

126 +// TestUnalignedWrite tests that writing data in an arbitrary pattern with

127 +// small input buffers.

128 +func testUnalignedWrite(t *testing.T) {

129 + testUnalignedAndGeneric(t, func(impl string) {

130 + buf := sequentialBytes(0x10000)

131 + for alg, df := range testDigests {

132 + d := df()

133 + d.Reset()

134 + d.Write(buf)

135 + want := d.Sum(nil)

136 + d.Reset()

137 + for i := 0; i < len(buf); {

138 + // Cycle through offsets which make a 137 byte sequence.

139 + // Because 137 is prime this sequence should exercise all corner cases.

140 + offsets := [17]int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 1}

141 + for _, j := range offsets {

142 + if v := len(buf) - i; v < j {

143 + j = v

144 + }

145 + d.Write(buf[i : i+j])

146 + i += j

147 + }

148 + }

149 + got := d.Sum(nil)

150 + if !bytes.Equal(got, want) {

151 + t.Errorf("Unaligned writes, implementation=%s, alg=%s\ngot %q, want %q", impl, alg, got, want)

152 + }

153 + }

154 + })

155 +}

156 +

157 +// TestAppend checks that appending works when reallocation is necessary.

158 +func TestAppend(t *testing.T) {

159 + testUnalignedAndGeneric(t, func(impl string) {

160 + d := New224()

161 +

162 + for capacity := 2; capacity < 64; capacity += 64 {

163 + // The first time around the loop, Sum will have to reallocate.

164 + // The second time, it will not.

165 + buf := make([]byte, 2, capacity)

166 + d.Reset()

167 + d.Write([]byte{0xcc})

168 + buf = d.Sum(buf)

169 + expected := "0000DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"

170 + if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {

171 + t.Errorf("got %s, want %s", got, expected)

172 + }

173 + }

174 + })

175 +}

176 +

177 +// TestAppendNoRealloc tests that appending works when no reallocation is necessary.

178 +func TestAppendNoRealloc(t *testing.T) {

179 + testUnalignedAndGeneric(t, func(impl string) {

180 + buf := make([]byte, 1, 200)

181 + d := New224()

182 + d.Write([]byte{0xcc})

183 + buf = d.Sum(buf)

184 + expected := "00DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"

185 + if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {

186 + t.Errorf("%s: got %s, want %s", impl, got, expected)

187 + }

188 + })

189 +}

190 +

191 +// TestSqueezing checks that squeezing the full output a single time produces

192 +// the same output as repeatedly squeezing the instance.

193 +func TestSqueezing(t *testing.T) {

194 + testUnalignedAndGeneric(t, func(impl string) {

195 + for functionName, newShakeHash := range testShakes {

196 + d0 := newShakeHash()

197 + d0.Write([]byte(testString))

198 + ref := make([]byte, 32)

199 + d0.Read(ref)

200 +

201 + d1 := newShakeHash()

202 + d1.Write([]byte(testString))

203 + var multiple []byte

204 + for _ = range ref {

205 + one := make([]byte, 1)

206 + d1.Read(one)

207 + multiple = append(multiple, one...)

208 + }

209 + if !bytes.Equal(ref, multiple) {

210 + t.Errorf("%s (%s): squeezing %d bytes one at a time failed", functionName, impl, len(ref))

211 + }

212 + }

213 + })

214 +}

215 +

216 +// sequentialBytes produces a buffer of size consecutive bytes 0x00, 0x01, ..., used for testing.

217 +func sequentialBytes(size int) []byte {

218 + result := make([]byte, size)

219 + for i := range result {

220 + result[i] = byte(i)

221 + }

222 + return result

223 +}

224 +

225 +// BenchmarkPermutationFunction measures the speed of the permutation function

226 +// with no input data.

227 +func BenchmarkPermutationFunction(b *testing.B) {

228 + b.SetBytes(int64(200))

229 + var lanes [25]uint64

230 + for i := 0; i < b.N; i++ {

231 + keccakF1600(&lanes)

232 + }

233 +}

234 +

235 +// benchmarkHash tests the speed to hash num buffers of buflen each.

236 +func benchmarkHash(b *testing.B, h hash.Hash, size, num int) {

237 + b.StopTimer()

238 + h.Reset()

239 + data := sequentialBytes(size)

240 + b.SetBytes(int64(size * num))

241 + b.StartTimer()

242 +

243 + var state []byte

244 + for i := 0; i < b.N; i++ {

245 + for j := 0; j < num; j++ {

246 + h.Write(data)

247 + }

248 + state = h.Sum(state[:0])

249 + }

250 + b.StopTimer()

251 + h.Reset()

252 +}

253 +

254 +// benchmarkShake is specialized to the Shake instances, which don't

255 +// require a copy on reading output.

256 +func benchmarkShake(b *testing.B, h ShakeHash, size, num int) {

257 + b.StopTimer()

258 + h.Reset()

259 + data := sequentialBytes(size)

260 + d := make([]byte, 32)

261 +

262 + b.SetBytes(int64(size * num))

263 + b.StartTimer()

264 +

265 + for i := 0; i < b.N; i++ {

266 + h.Reset()

267 + for j := 0; j < num; j++ {

268 + h.Write(data)

269 + }

270 + h.Read(d)

271 + }

272 +}

273 +

274 +func BenchmarkSha3_512_MTU(b *testing.B) { benchmarkHash(b, New512(), 1350, 1) }

275 +func BenchmarkSha3_384_MTU(b *testing.B) { benchmarkHash(b, New384(), 1350, 1) }

276 +func BenchmarkSha3_256_MTU(b *testing.B) { benchmarkHash(b, New256(), 1350, 1) }

277 +func BenchmarkSha3_224_MTU(b *testing.B) { benchmarkHash(b, New224(), 1350, 1) }

278 +

279 +func BenchmarkShake128_MTU(b *testing.B) { benchmarkShake(b, NewShake128(), 1350, 1) }

280 +func BenchmarkShake256_MTU(b *testing.B) { benchmarkShake(b, NewShake256(), 1350, 1) }

281 +func BenchmarkShake256_16x(b *testing.B) { benchmarkShake(b, NewShake256(), 16, 1024) }

282 +func BenchmarkShake256_1MiB(b *testing.B) { benchmarkShake(b, NewShake256(), 1024, 1024) }

283 +

284 +func BenchmarkSha3_512_1MiB(b *testing.B) { benchmarkHash(b, New512(), 1024, 1024) }

285 +

286 +func Example_sum() {

287 + buf := []byte("some data to hash")

288 + // A hash needs to be 64 bytes long to have 256-bit collision resistance.

289 + h := make([]byte, 64)

290 + // Compute a 64-byte hash of buf and put it in h.

291 + ShakeSum256(h, buf)

292 +}

293 +

294 +func Example_mac() {

295 + k := []byte("this is a secret key; you should generate a strong random key that's at least 32 bytes long")

296 + buf := []byte("and this is some data to authenticate")

297 + // A MAC with 32 bytes of output has 256-bit security strength -- if you use at least a 32-byte-long key.

298 + h := make([]byte, 32)

299 + d := NewShake256()

300 + // Write the key into the hash.

301 + d.Write(k)

302 + // Now write the data.

303 + d.Write(buf)

304 + // Read 32 bytes of output from the hash into h.

305 + d.Read(h)

306 +}

Godeps/_workspace/src/golang.org/x/crypto/sha3/shake.go renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/testdata/keccakKats.json.deflate renamed

Godeps/_workspace/src/golang.org/x/crypto/sha3/xor.go new

+16

@@ -0,0 +1,16 @@

2 +// Use of this source code is governed by a BSD-style

3 +// license that can be found in the LICENSE file.

4 +

5 +// +build !amd64,!386 appengine

6 +

7 +package sha3

8 +

9 +var (

10 + xorIn = xorInGeneric

11 + copyOut = copyOutGeneric

12 + xorInUnaligned = xorInGeneric

13 + copyOutUnaligned = copyOutGeneric

14 +)

15 +

16 +const xorImplementationUnaligned = "generic"

Godeps/_workspace/src/golang.org/x/crypto/sha3/xor_generic.go new

+28

@@ -0,0 +1,28 @@

2 +// Use of this source code is governed by a BSD-style

3 +// license that can be found in the LICENSE file.

4 +

5 +package sha3

6 +

7 +import "encoding/binary"

8 +

9 +// xorInGeneric xors the bytes in buf into the state; it

10 +// makes no non-portable assumptions about memory layout

11 +// or alignment.

12 +func xorInGeneric(d *state, buf []byte) {

13 + n := len(buf) / 8

14 +

15 + for i := 0; i < n; i++ {

16 + a := binary.LittleEndian.Uint64(buf)

17 + d.a[i] ^= a

18 + buf = buf[8:]

19 + }

20 +}

21 +

22 +// copyOutGeneric copies ulint64s to a byte buffer.

23 +func copyOutGeneric(d *state, b []byte) {

24 + for i := 0; len(b) >= 8; i++ {

25 + binary.LittleEndian.PutUint64(b, d.a[i])

26 + b = b[8:]

27 + }

28 +}

Godeps/_workspace/src/golang.org/x/crypto/sha3/xor_unaligned.go new

+58

@@ -0,0 +1,58 @@

2 +// Use of this source code is governed by a BSD-style

3 +// license that can be found in the LICENSE file.

4 +

5 +// +build amd64 386

6 +// +build !appengine

7 +

8 +package sha3

9 +

10 +import "unsafe"

11 +

12 +func xorInUnaligned(d *state, buf []byte) {

13 + bw := (*[maxRate / 8]uint64)(unsafe.Pointer(&buf[0]))

14 + n := len(buf)

15 + if n >= 72 {

16 + d.a[0] ^= bw[0]

17 + d.a[1] ^= bw[1]

18 + d.a[2] ^= bw[2]

19 + d.a[3] ^= bw[3]

20 + d.a[4] ^= bw[4]

21 + d.a[5] ^= bw[5]

22 + d.a[6] ^= bw[6]

23 + d.a[7] ^= bw[7]

24 + d.a[8] ^= bw[8]

25 + }

26 + if n >= 104 {

27 + d.a[9] ^= bw[9]

28 + d.a[10] ^= bw[10]

29 + d.a[11] ^= bw[11]

30 + d.a[12] ^= bw[12]

31 + }

32 + if n >= 136 {

33 + d.a[13] ^= bw[13]

34 + d.a[14] ^= bw[14]

35 + d.a[15] ^= bw[15]

36 + d.a[16] ^= bw[16]

37 + }

38 + if n >= 144 {

39 + d.a[17] ^= bw[17]

40 + }

41 + if n >= 168 {

42 + d.a[18] ^= bw[18]

43 + d.a[19] ^= bw[19]

44 + d.a[20] ^= bw[20]

45 + }

46 +}

47 +

48 +func copyOutUnaligned(d *state, buf []byte) {

49 + ab := (*[maxRate]uint8)(unsafe.Pointer(&d.a[0]))

50 + copy(buf, ab[:])

51 +}

52 +

53 +var (

54 + xorIn = xorInUnaligned

55 + copyOut = copyOutUnaligned

56 +)

57 +

58 +const xorImplementationUnaligned = "unaligned"

p2p/crypto/secio/al.go

+1 -2

@@ -13,8 +13,7 @@ import (

13 "crypto/sha512"

14 "hash"

16 - bfish "github.com/jbenet/go-ipfs/Godeps/_workspace/src/code.google.com/p/go.crypto/blowfish"

17 -

16 + bfish "github.com/jbenet/go-ipfs/Godeps/_workspace/src/golang.org/x/crypto/blowfish"

17 ci "github.com/jbenet/go-ipfs/p2p/crypto"

18 )