1// Copyright (c) 2019-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#ifndef BITCOIN_CRYPTO_POLY1305_H
6#define BITCOIN_CRYPTO_POLY1305_H
7
8#include <span.h>
9
10#include <cassert>
11#include <cstddef>
12#include <cstdint>
13#include <span>
14
15#define POLY1305_BLOCK_SIZE 16
16
17namespace poly1305_donna {
18
19// Based on the public domain implementation by Andrew Moon
20// poly1305-donna-32.h from https://github.com/floodyberry/poly1305-donna
21
22typedef struct {
23    uint32_t r[5];
24    uint32_t h[5];
25    uint32_t pad[4];
26    size_t leftover;
27    unsigned char buffer[POLY1305_BLOCK_SIZE];
28    unsigned char final;
29} poly1305_context;
30
31void poly1305_init(poly1305_context *st, const unsigned char key[32]) noexcept;
32void poly1305_update(poly1305_context *st, const unsigned char *m, size_t bytes) noexcept;
33void poly1305_finish(poly1305_context *st, unsigned char mac[16]) noexcept;
34
35}  // namespace poly1305_donna
36
37/** C++ wrapper with std::byte span interface around poly1305_donna code. */
38class Poly1305
39{
40    poly1305_donna::poly1305_context m_ctx;
41
42public:
43    /** Length of the output produced by Finalize(). */
44    static constexpr unsigned TAGLEN{16};
45
46    /** Length of the keys expected by the constructor. */
47    static constexpr unsigned KEYLEN{32};
48
49    /** Construct a Poly1305 object with a given 32-byte key. */
50    Poly1305(std::span<const std::byte> key) noexcept
51    {
52        assert(key.size() == KEYLEN);
53        poly1305_donna::poly1305_init(&m_ctx, UCharCast(key.data()));
54    }
55
56    /** Process message bytes. */
57    Poly1305& Update(std::span<const std::byte> msg) noexcept
58    {
59        poly1305_donna::poly1305_update(&m_ctx, UCharCast(msg.data()), msg.size());
60        return *this;
61    }
62
63    /** Write authentication tag to 16-byte out. */
64    void Finalize(std::span<std::byte> out) noexcept
65    {
66        assert(out.size() == TAGLEN);
67        poly1305_donna::poly1305_finish(&m_ctx, UCharCast(out.data()));
68    }
69};
70
71#endif // BITCOIN_CRYPTO_POLY1305_H
72