libgo/go/crypto/block/cmac.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 // CMAC message authentication code, defined in
   6 // NIST Special Publication SP 800-38B.
   7
   8 package block
   9
  10 import (
  11         "hash"
  12         "os"
  13 )
  14
  15 const (
  16         // minimal irreducible polynomial of degree b
  17         r64  = 0x1b
  18         r128 = 0x87
  19 )
  20
  21 type cmac struct {
  22         k1, k2, ci, digest []byte
  23         p                  int // position in ci
  24         c                  Cipher
  25 }
  26
  27 // TODO(rsc): Should this return an error instead of panic?
  28
  29 // NewCMAC returns a new instance of a CMAC message authentication code
  30 // digest using the given Cipher.
  31 func NewCMAC(c Cipher) hash.Hash {
  32         var r byte
  33         n := c.BlockSize()
  34         switch n {
  35         case 64 / 8:
  36                 r = r64
  37         case 128 / 8:
  38                 r = r128
  39         default:
  40                 panic("crypto/block: NewCMAC: invalid cipher block size")
  41         }
  42
  43         d := new(cmac)
  44         d.c = c
  45         d.k1 = make([]byte, n)
  46         d.k2 = make([]byte, n)
  47         d.ci = make([]byte, n)
  48         d.digest = make([]byte, n)
  49
  50         // Subkey generation, p. 7
  51         c.Encrypt(d.k1, d.k1)
  52         if shift1(d.k1, d.k1) != 0 {
  53                 d.k1[n-1] ^= r
  54         }
  55         if shift1(d.k2, d.k1) != 0 {
  56                 d.k2[n-1] ^= r
  57         }
  58
  59         return d
  60 }
  61
  62 // Reset clears the digest state, starting a new digest.
  63 func (d *cmac) Reset() {
  64         for i := range d.ci {
  65                 d.ci[i] = 0
  66         }
  67         d.p = 0
  68 }
  69
  70 // Write adds the given data to the digest state.
  71 func (d *cmac) Write(p []byte) (n int, err os.Error) {
  72         // Xor input into ci.
  73         for _, c := range p {
  74                 // If ci is full, encrypt and start over.
  75                 if d.p >= len(d.ci) {
  76                         d.c.Encrypt(d.ci, d.ci)
  77                         d.p = 0
  78                 }
  79                 d.ci[d.p] ^= c
  80                 d.p++
  81         }
  82         return len(p), nil
  83 }
  84
  85 // Sum returns the CMAC digest, one cipher block in length,
  86 // of the data written with Write.
  87 func (d *cmac) Sum() []byte {
  88         // Finish last block, mix in key, encrypt.
  89         // Don't edit ci, in case caller wants
  90         // to keep digesting after call to Sum.
  91         k := d.k1
  92         if d.p < len(d.digest) {
  93                 k = d.k2
  94         }
  95         for i := 0; i < len(d.ci); i++ {
  96                 d.digest[i] = d.ci[i] ^ k[i]
  97         }
  98         if d.p < len(d.digest) {
  99                 d.digest[d.p] ^= 0x80
 100         }
 101         d.c.Encrypt(d.digest, d.digest)
 102         return d.digest
 103 }
 104
 105 func (d *cmac) Size() int { return len(d.digest) }