1
// Copyright 2012 The Go Authors. All rights reserved.
2
// Use of this source code is governed by a BSD-style
3
// license that can be found in the LICENSE file.
9
// Based on original, public domain implementation from NaCl by D. J.
15
alpham80 = 0.00000000558793544769287109375
17
alpham16 = 103079215104.0
18
alpha0 = 6755399441055744.0
19
alpha18 = 1770887431076116955136.0
20
alpha32 = 29014219670751100192948224.0
21
alpha50 = 7605903601369376408980219232256.0
22
alpha64 = 124615124604835863084731911901282304.0
23
alpha82 = 32667107224410092492483962313449748299776.0
24
alpha96 = 535217884764734955396857238543560676143529984.0
25
alpha112 = 35076039295941670036888435985190792471742381031424.0
26
alpha130 = 9194973245195333150150082162901855101712434733101613056.0
27
scale = 0.0000000000000000000000000000000000000036734198463196484624023016788195177431833298649127735047148490821200539357960224151611328125
28
offset0 = 6755408030990331.0
29
offset1 = 29014256564239239022116864.0
30
offset2 = 124615283061160854719918951570079744.0
31
offset3 = 535219245894202480694386063513315216128475136.0
34
// Sum generates an authenticator for m using a one-time key and puts the
35
// 16-byte result into out. Authenticating two different messages with the same
36
// key allows an attacker to forge messages at will.
37
func Sum(out *[16]byte, m []byte, key *[32]byte) {
246
h0 := alpha32 - alpha32
249
h1 := alpha32 - alpha32
251
h2 := alpha32 - alpha32
253
h3 := alpha32 - alpha32
255
h4 := alpha32 - alpha32
257
r0low := math.Float64frombits(uint64(d0))
258
h5 := alpha32 - alpha32
260
r1low := math.Float64frombits(uint64(d1))
261
h6 := alpha32 - alpha32
263
r2low := math.Float64frombits(uint64(d2))
264
h7 := alpha32 - alpha32
272
r0high := r0low + alpha18
274
r3low := math.Float64frombits(uint64(d3))
276
r1high := r1low + alpha50
277
sr1low := scale * r1low
279
r2high := r2low + alpha82
280
sr2low := scale * r2low
283
r0high_stack := r0high
288
r1high_stack := r1high
290
sr1high := sr1low + alpham80
295
sr3low = scale * r3low
297
sr2high := sr2low + alpham48
303
sr1high_stack := sr1high
309
sr2high_stack := sr2high
311
r3high := r3low + alpha112
315
sr1low_stack := sr1low
317
sr3high := sr3low + alpham16
318
r2high_stack := r2high
321
sr2low_stack := sr2low
324
r3high_stack := r3high
327
sr3high_stack := sr3high
333
sr3low_stack := sr3low
336
goto addatmost15bytes
378
m22 = uint32(m[p+10])
382
m23 = uint32(m[p+11])
385
m30 = uint32(m[p+12])
389
m31 = uint32(m[p+13])
393
m32 = uint32(m[p+14])
397
m33 = uint64(m[p+15])
420
z0 = math.Float64frombits(uint64(d0))
422
z1 = math.Float64frombits(uint64(d1))
424
z2 = math.Float64frombits(uint64(d2))
426
z3 = math.Float64frombits(uint64(d3))
445
goto multiplyaddatmost15bytes
448
multiplyaddatleast16bytes:
461
m22 = uint32(m[p+10])
466
m23 = uint32(m[p+11])
470
m30 = uint32(m[p+12])
475
m31 = uint32(m[p+13])
480
m32 = uint32(m[p+14])
485
m33 = uint64(m[p+15])
565
r3high = r3high_stack
569
r0high = r0high_stack
572
r3highx0 = r3high * x0
573
sr1low = sr1low_stack
576
r0highx6 = r0high * x6
577
sr1high = sr1high_stack
583
h6 = r3lowx0 + r0lowx6
584
sr1lowx6 = sr1low * x6
585
r1high = r1high_stack
588
r0highx0 = r0high * x0
589
sr2low = sr2low_stack
591
h7 = r3highx0 + r0highx6
592
sr1highx6 = sr1high * x6
593
sr2high = sr2high_stack
599
h0 = r0lowx0 + sr1lowx6
600
sr2lowx6 = sr2low * x6
601
r2high = r2high_stack
604
r1highx0 = r1high * x0
605
sr3low = sr3low_stack
607
h1 = r0highx0 + sr1highx6
608
sr2highx6 = sr2high * x6
609
sr3high = sr3high_stack
613
z2 = math.Float64frombits(uint64(d2))
615
h2 = r1lowx0 + sr2lowx6
616
sr3lowx6 = sr3low * x6
619
r2highx0 = r2high * x0
620
z3 = math.Float64frombits(uint64(d3))
622
h3 = r1highx0 + sr2highx6
623
sr3highx6 = sr3high * x6
625
r1highx4 = r1high * x4
628
h4 = r2lowx0 + sr3lowx6
631
r0highx4 = r0high * x4
634
h5 = r2highx0 + sr3highx6
638
sr3highx4 = sr3high * x4
641
sr3lowx4 = sr3low * x4
644
sr2highx4 = sr2high * x4
647
sr2lowx4 = sr2low * x4
653
r0highx2 = r0high * x2
659
r1highx2 = r1high * x2
665
r2highx2 = r2high * x2
668
sr3lowx2 = sr3low * x2
671
sr3highx2 = sr3high * x2
679
z1 = math.Float64frombits(uint64(d1))
682
z0 = math.Float64frombits(uint64(d0))
698
goto multiplyaddatleast16bytes
701
multiplyaddatmost15bytes:
761
r3high = r3high_stack
765
r0high = r0high_stack
768
r3highx0 = r3high * x0
769
sr1low = sr1low_stack
772
r0highx6 = r0high * x6
773
sr1high = sr1high_stack
779
h6 = r3lowx0 + r0lowx6
780
sr1lowx6 = sr1low * x6
781
r1high = r1high_stack
784
r0highx0 = r0high * x0
785
sr2low = sr2low_stack
787
h7 = r3highx0 + r0highx6
788
sr1highx6 = sr1high * x6
789
sr2high = sr2high_stack
795
h0 = r0lowx0 + sr1lowx6
796
sr2lowx6 = sr2low * x6
797
r2high = r2high_stack
800
r1highx0 = r1high * x0
801
sr3low = sr3low_stack
803
h1 = r0highx0 + sr1highx6
804
sr2highx6 = sr2high * x6
805
sr3high = sr3high_stack
810
h2 = r1lowx0 + sr2lowx6
811
sr3lowx6 = sr3low * x6
814
r2highx0 = r2high * x0
816
h3 = r1highx0 + sr2highx6
817
sr3highx6 = sr3high * x6
819
r1highx4 = r1high * x4
821
h4 = r2lowx0 + sr3lowx6
824
r0highx4 = r0high * x4
826
h5 = r2highx0 + sr3highx6
830
sr3highx4 = sr3high * x4
833
sr3lowx4 = sr3low * x4
836
sr2highx4 = sr2high * x4
839
sr2lowx4 = sr2low * x4
845
r0highx2 = r0high * x2
851
r1highx2 = r1high * x2
857
r2highx2 = r2high * x2
860
sr3lowx2 = sr3low * x2
863
sr3highx2 = sr3high * x2
903
m01 &^= uint32(lbelow2)
905
m02 &^= uint32(lbelow3)
906
m01 -= uint32(lbelow2)
909
m03 &^= uint32(lbelow4)
914
m02 += uint32(lbelow2)
918
m03 += uint32(lbelow3)
948
m10 &^= uint32(lbelow5)
951
m10 += uint32(lbelow4)
954
m11 &^= uint32(lbelow6)
955
m11 += uint32(lbelow5)
961
m12 &^= uint32(lbelow7)
964
m13 &^= uint32(lbelow8)
966
m12 += uint32(lbelow6)
970
m13 += uint32(lbelow7)
998
m22 = uint32(m[p+10])
1002
m23 = uint32(m[p+11])
1003
m20 &^= uint32(lbelow9)
1006
m20 += uint32(lbelow8)
1009
m21 &^= uint32(lbelow10)
1010
m21 += uint32(lbelow9)
1016
m22 &^= uint32(lbelow11)
1018
lbelow10 -= lbelow11
1019
m23 &^= uint32(lbelow12)
1021
m22 += uint32(lbelow10)
1022
lbelow11 -= lbelow12
1025
m23 += uint32(lbelow11)
1040
m30 = uint32(m[p+12])
1044
m31 = uint32(m[p+13])
1048
m32 = uint32(m[p+14])
1049
m30 &^= uint32(lbelow13)
1050
lbelow12 -= lbelow13
1052
m30 += uint32(lbelow12)
1053
lbelow13 -= lbelow14
1056
m31 &^= uint32(lbelow14)
1058
m31 += uint32(lbelow13)
1059
m32 &^= uint32(lbelow15)
1062
lbelow14 -= lbelow15
1065
m32 += uint32(lbelow14)
1069
m33 = uint64(lbelow15 + 1)
1079
z3 = math.Float64frombits(uint64(d3))
1081
z2 = math.Float64frombits(uint64(d2))
1083
z1 = math.Float64frombits(uint64(d1))
1085
z0 = math.Float64frombits(uint64(d0))
1160
r3lowx0 = r3low * x0
1161
r3high = r3high_stack
1164
r0lowx6 = r0low * x6
1165
r0high = r0high_stack
1168
r3highx0 = r3high * x0
1169
sr1low = sr1low_stack
1172
r0highx6 = r0high * x6
1173
sr1high = sr1high_stack
1176
r0lowx0 = r0low * x0
1179
h6 = r3lowx0 + r0lowx6
1180
sr1lowx6 = sr1low * x6
1181
r1high = r1high_stack
1184
r0highx0 = r0high * x0
1185
sr2low = sr2low_stack
1187
h7 = r3highx0 + r0highx6
1188
sr1highx6 = sr1high * x6
1189
sr2high = sr2high_stack
1192
r1lowx0 = r1low * x0
1195
h0 = r0lowx0 + sr1lowx6
1196
sr2lowx6 = sr2low * x6
1197
r2high = r2high_stack
1200
r1highx0 = r1high * x0
1201
sr3low = sr3low_stack
1203
h1 = r0highx0 + sr1highx6
1204
sr2highx6 = sr2high * x6
1205
sr3high = sr3high_stack
1208
r2lowx0 = r2low * x0
1210
h2 = r1lowx0 + sr2lowx6
1211
sr3lowx6 = sr3low * x6
1214
r2highx0 = r2high * x0
1216
h3 = r1highx0 + sr2highx6
1217
sr3highx6 = sr3high * x6
1219
r1highx4 = r1high * x4
1221
h4 = r2lowx0 + sr3lowx6
1222
r1lowx4 = r1low * x4
1224
r0highx4 = r0high * x4
1226
h5 = r2highx0 + sr3highx6
1227
r0lowx4 = r0low * x4
1230
sr3highx4 = sr3high * x4
1233
sr3lowx4 = sr3low * x4
1236
sr2highx4 = sr2high * x4
1239
sr2lowx4 = sr2low * x4
1242
r0lowx2 = r0low * x2
1245
r0highx2 = r0high * x2
1248
r1lowx2 = r1low * x2
1251
r1highx2 = r1high * x2
1254
r2lowx2 = r2low * x2
1257
r2highx2 = r2high * x2
1260
sr3lowx2 = sr3low * x2
1263
sr3highx2 = sr3high * x2
1351
d1 = int64(math.Float64bits(x2))
1354
d0 = int64(math.Float64bits(x0))
1357
d2 = int64(math.Float64bits(x4))
1360
d3 = int64(math.Float64bits(x6))
1365
bits32 = math.MaxUint64
1417
f = uint64(int64(g4) >> 63)