| 1 | #include <stdint.h> |
| 2 | #include <minilib.h> |
| 3 | |
| 4 | int main() |
| 5 | { |
| 6 | /* |
| 7 | * Test vector from QARMA paper (https://eprint.iacr.org/2016/444.pdf) |
| 8 | * to verify one computation of the pauth_computepac() function, |
| 9 | * which uses sbox2. |
| 10 | * |
| 11 | * Use PACGA, because it returns the most bits from ComputePAC. |
| 12 | * We still only get the most significant 32-bits of the result. |
| 13 | */ |
| 14 | |
| 15 | static const uint64_t d[5] = { |
| 16 | 0xfb623599da6e8127ull, |
| 17 | 0x477d469dec0b8762ull, |
| 18 | 0x84be85ce9804e94bull, |
| 19 | 0xec2802d4e0a488e9ull, |
| 20 | 0xc003b93999b33765ull & 0xffffffff00000000ull |
| 21 | }; |
| 22 | uint64_t r; |
| 23 | |
| 24 | asm("msr apgakeyhi_el1, %[w0]\n\t" |
| 25 | "msr apgakeylo_el1, %[k0]\n\t" |
| 26 | "pacga %[r], %[P], %[T]" |
| 27 | : [r] "=r"(r) |
| 28 | : [P] "r" (d[0]), |
| 29 | [T] "r" (d[1]), |
| 30 | [w0] "r" (d[2]), |
| 31 | [k0] "r" (d[3])); |
| 32 | |
| 33 | if (r == d[4]) { |
| 34 | ml_printf("OK\n"); |
| 35 | return 0; |
| 36 | } else { |
| 37 | ml_printf("FAIL: %lx != %lx\n", r, d[4]); |
| 38 | return 1; |
| 39 | } |
| 40 | } |