Independent Submission M-J. Saarinen, Ed.
Request for Comments: 7693 Queen's University Belfast
Category: Informational J-P. Aumasson
ISSN: 2070-1721 Kudelski Security
November 2015
Independent Submission M-J. Saarinen, Ed.
Request for Comments: 7693 Queen's University Belfast
Category: Informational J-P. Aumasson
ISSN: 2070-1721 Kudelski Security
November 2015
The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)
BLAKE2加密哈希和消息身份验证码（MAC）
Abstract
摘要
This document describes the cryptographic hash function BLAKE2 and makes the algorithm specification and C source code conveniently available to the Internet community. BLAKE2 comes in two main flavors: BLAKE2b is optimized for 64-bit platforms and BLAKE2s for smaller architectures. BLAKE2 can be directly keyed, making it functionally equivalent to a Message Authentication Code (MAC).
本文档描述了加密哈希函数BLAKE2，并使算法规范和C源代码方便地提供给互联网社区。BLAKE2有两种主要风格：BLAKE2b针对64位平台进行了优化，BLAKE2s针对较小的体系结构进行了优化。BLAKE2可以直接设置密钥，使其功能等同于消息身份验证码（MAC）。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
这是对RFC系列的贡献，独立于任何其他RFC流。RFC编辑器已选择自行发布此文档，并且未声明其对实现或部署的价值。RFC编辑批准发布的文件不适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7693.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc7693.
Copyright Notice
版权公告
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2015 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。
Table of Contents
目录
1. Introduction and Terminology . . . . . . . . . . . . . . . . 3
2. Conventions, Variables, and Constants . . . . . . . . . . . . 4
2.1. Parameters . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Other Constants and Variables . . . . . . . . . . . . . . 4
2.3. Arithmetic Notation . . . . . . . . . . . . . . . . . . . 4
2.4. Little-Endian Interpretation of Words as Bytes . . . . . 5
2.5. Parameter Block . . . . . . . . . . . . . . . . . . . . . 5
2.6. Initialization Vector . . . . . . . . . . . . . . . . . . 6
2.7. Message Schedule SIGMA . . . . . . . . . . . . . . . . . 6
3. BLAKE2 Processing . . . . . . . . . . . . . . . . . . . . . . 7
3.1. Mixing Function G . . . . . . . . . . . . . . . . . . . . 7
3.2. Compression Function F . . . . . . . . . . . . . . . . . 8
3.3. Padding Data and Computing a BLAKE2 Digest . . . . . . . 9
4. Standard Parameter Sets and Algorithm Identifiers . . . . . . 10
5. Security Considerations . . . . . . . . . . . . . . . . . . . 11
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 11
6.1. Normative References . . . . . . . . . . . . . . . . . . 11
6.2. Informative References . . . . . . . . . . . . . . . . . 11
Appendix A. Example of BLAKE2b Computation . . . . . . . . . . . 13
Appendix B. Example of BLAKE2s Computation . . . . . . . . . . . 15
Appendix C. BLAKE2b Implementation C Source . . . . . . . . . . 16
C.1. blake2b.h . . . . . . . . . . . . . . . . . . . . . . . . 16
C.2. blake2b.c . . . . . . . . . . . . . . . . . . . . . . . . 17
Appendix D. BLAKE2s Implementation C Source . . . . . . . . . . 21
D.1. blake2s.h . . . . . . . . . . . . . . . . . . . . . . . . 21
D.2. blake2s.c . . . . . . . . . . . . . . . . . . . . . . . . 22
Appendix E. BLAKE2b and BLAKE2s Self-Test Module C Source . . . 26
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 29
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 30
1. Introduction and Terminology . . . . . . . . . . . . . . . . 3
2. Conventions, Variables, and Constants . . . . . . . . . . . . 4
2.1. Parameters . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Other Constants and Variables . . . . . . . . . . . . . . 4
2.3. Arithmetic Notation . . . . . . . . . . . . . . . . . . . 4
2.4. Little-Endian Interpretation of Words as Bytes . . . . . 5
2.5. Parameter Block . . . . . . . . . . . . . . . . . . . . . 5
2.6. Initialization Vector . . . . . . . . . . . . . . . . . . 6
2.7. Message Schedule SIGMA . . . . . . . . . . . . . . . . . 6
3. BLAKE2 Processing . . . . . . . . . . . . . . . . . . . . . . 7
3.1. Mixing Function G . . . . . . . . . . . . . . . . . . . . 7
3.2. Compression Function F . . . . . . . . . . . . . . . . . 8
3.3. Padding Data and Computing a BLAKE2 Digest . . . . . . . 9
4. Standard Parameter Sets and Algorithm Identifiers . . . . . . 10
5. Security Considerations . . . . . . . . . . . . . . . . . . . 11
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 11
6.1. Normative References . . . . . . . . . . . . . . . . . . 11
6.2. Informative References . . . . . . . . . . . . . . . . . 11
Appendix A. Example of BLAKE2b Computation . . . . . . . . . . . 13
Appendix B. Example of BLAKE2s Computation . . . . . . . . . . . 15
Appendix C. BLAKE2b Implementation C Source . . . . . . . . . . 16
C.1. blake2b.h . . . . . . . . . . . . . . . . . . . . . . . . 16
C.2. blake2b.c . . . . . . . . . . . . . . . . . . . . . . . . 17
Appendix D. BLAKE2s Implementation C Source . . . . . . . . . . 21
D.1. blake2s.h . . . . . . . . . . . . . . . . . . . . . . . . 21
D.2. blake2s.c . . . . . . . . . . . . . . . . . . . . . . . . 22
Appendix E. BLAKE2b and BLAKE2s Self-Test Module C Source . . . 26
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 29
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 30
The BLAKE2 cryptographic hash function [BLAKE2] was designed by Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein.
BLAKE2加密哈希函数[BLAKE2]由Jean-Philippe Aumasson、Samuel Neves、Zooko Wilcox-O'Hearn和Christian Winnerlein设计。
BLAKE2 comes in two basic flavors:
BLAKE2有两种基本风格：
o BLAKE2b (or just BLAKE2) is optimized for 64-bit platforms and produces digests of any size between 1 and 64 bytes.
o BLAKE2b（或仅BLAKE2）针对64位平台进行了优化，可生成1到64字节之间任意大小的摘要。
o BLAKE2s is optimized for 8- to 32-bit platforms and produces digests of any size between 1 and 32 bytes.
o BLAKE2s针对8到32位平台进行了优化，可生成1到32字节之间任意大小的摘要。
Both BLAKE2b and BLAKE2s are believed to be highly secure and perform well on any platform, software, or hardware. BLAKE2 does not require a special "HMAC" (Hashed Message Authentication Code) construction for keyed message authentication as it has a built-in keying mechanism.
BLAKE2b和BLAKE2s都被认为是高度安全的，在任何平台、软件或硬件上都表现良好。BLAKE2不需要特殊的“HMAC”（哈希消息身份验证代码）构造来进行密钥消息身份验证，因为它具有内置的密钥机制。
The BLAKE2 hash function may be used by digital signature algorithms and message authentication and integrity protection mechanisms in applications such as Public Key Infrastructure (PKI), secure communication protocols, cloud storage, intrusion detection, forensic suites, and version control systems.
BLAKE2哈希函数可用于公钥基础设施（PKI）、安全通信协议、云存储、入侵检测、取证套件和版本控制系统等应用程序中的数字签名算法、消息认证和完整性保护机制。
The BLAKE2 suite provides a more efficient alternative to US Secure Hash Algorithms SHA and HMAC-SHA [RFC6234]. BLAKE2s-128 is especially suited as a fast and more secure drop-in replacement to MD5 and HMAC-MD5 in legacy applications [RFC6151].
BLAKE2套件为我们的安全哈希算法SHA和HMAC-SHA[RFC6234]提供了一个更有效的替代方案。BLAKE2s-128特别适合作为传统应用程序中MD5和HMAC-MD5的快速、更安全的嵌入式替代品[RFC6151]。
To aid implementation, we provide a trace of BLAKE2b-512 hash computation in Appendix A and a trace of BLAKE2s-256 hash computation in Appendix B. Due to space constraints, this document does not contain a full set of test vectors for BLAKE2.
为了帮助实现，我们在附录a中提供了BLAKE2b-512哈希计算的跟踪，在附录B中提供了BLAKE2s-256哈希计算的跟踪。由于空间限制，本文档不包含BLAKE2的完整测试向量集。
A reference implementation in C programming language for BLAKE2b can be found in Appendix C and for BLAKE2s in Appendix D of this document. These implementations MAY be validated with the more exhaustive Test Module contained in Appendix E.
BLAKE2b和BLAKE2s的C编程语言参考实现见本文档附录C和附录D。这些实现可以通过附录E中包含的更详尽的测试模块进行验证。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
The following table summarizes various parameters and their ranges:
下表总结了各种参数及其范围：
| BLAKE2b | BLAKE2s |
--------------+------------------+------------------+
Bits in word | w = 64 | w = 32 |
Rounds in F | r = 12 | r = 10 |
Block bytes | bb = 128 | bb = 64 |
Hash bytes | 1 <= nn <= 64 | 1 <= nn <= 32 |
Key bytes | 0 <= kk <= 64 | 0 <= kk <= 32 |
Input bytes | 0 <= ll < 2**128 | 0 <= ll < 2**64 |
--------------+------------------+------------------+
G Rotation | (R1, R2, R3, R4) | (R1, R2, R3, R4) |
constants = | (32, 24, 16, 63) | (16, 12, 8, 7) |
--------------+------------------+------------------+
| BLAKE2b | BLAKE2s |
--------------+------------------+------------------+
Bits in word | w = 64 | w = 32 |
Rounds in F | r = 12 | r = 10 |
Block bytes | bb = 128 | bb = 64 |
Hash bytes | 1 <= nn <= 64 | 1 <= nn <= 32 |
Key bytes | 0 <= kk <= 64 | 0 <= kk <= 32 |
Input bytes | 0 <= ll < 2**128 | 0 <= ll < 2**64 |
--------------+------------------+------------------+
G Rotation | (R1, R2, R3, R4) | (R1, R2, R3, R4) |
constants = | (32, 24, 16, 63) | (16, 12, 8, 7) |
--------------+------------------+------------------+
These variables are used in the algorithm description:
这些变量用于算法描述中：
IV[0..7] Initialization Vector (constant).
IV[0..7]初始化向量（常数）。
SIGMA[0..9] Message word permutations (constant).
西格玛[0..9]消息字排列（常数）。
p[0..7] Parameter block (defines hash and key sizes).
p[0..7]参数块（定义哈希和密钥大小）。
m[0..15] Sixteen words of a single message block.
m[0..15]单个消息块的十六个字。
h[0..7] Internal state of the hash.
h[0..7]散列的内部状态。
d[0..dd-1] Padded input blocks. Each has "bb" bytes.
d[0..dd-1]填充输入块。每个都有“bb”字节。
t Message byte offset at the end of the current block.
t当前块末尾的消息字节偏移量。
f Flag indicating the last block.
f标志，指示最后一个块。
For real-valued x, we define the following functions:
对于实值x，我们定义以下函数：
floor(x) Floor, the largest integer <= x.
楼层（x）楼层，最大整数<=x。
ceil(x) Ceiling, the smallest integer >= x.
天花板（x）天花板，最小整数>=x。
frac(x) Positive fractional part of x, frac(x) = x - floor(x).
分形（x）x的正分数部分，分形（x）=x-楼层（x）。
Operator notation in pseudocode:
伪代码中的运算符表示法：
2**n = 2 to the power "n". 2**0=1, 2**1=2, 2**2=4, 2**3=8, etc.
2**n=2至功率“n”。2**0=1、2**1=2、2**2=4、2**3=8等。
a ^ b = Bitwise exclusive-or operation between "a" and "b".
a^b=在“a”和“b”之间进行位异或运算。
a mod b = Remainder "a" modulo "b", always in range [0, b-1].
a模b=余数a模b，始终在[0，b-1]范围内。
x >> n = floor(x / 2**n). Logical shift "x" right by "n" bits.
x>>n=地板（x/2**n）。将“x”逻辑右移“n”位。
x << n = (x * 2**n) mod (2**w). Logical shift "x" left by "n".
x << n = (x * 2**n) mod (2**w). Logical shift "x" left by "n".
x >>> n = (x >> n) ^ (x << (w - n)). Rotate "x" right by "n".
x >>> n = (x >> n) ^ (x << (w - n)). Rotate "x" right by "n".
All mathematical operations are on 64-bit words in BLAKE2b and on 32-bit words in BLAKE2s.
所有的数学运算都在BLAKE2b中的64位字和BLAKE2s中的32位字上进行。
We may also perform operations on vectors of words. Vector indexing is zero based; the first element of an n-element vector "v" is v[0] and the last one is v[n - 1]. All elements are denoted by v[0..n-1].
我们还可以对单词的向量执行操作。向量索引是基于零的；n元素向量“v”的第一个元素是v[0]，最后一个元素是v[n-1]。所有元素都用v[0..n-1]表示。
Byte (octet) streams are interpreted as words in little-endian order, with the least-significant byte first. Consider this sequence of eight hexadecimal bytes:
字节（八位字节）流被解释为以小尾端顺序排列的字，其中最低有效字节排在第一位。考虑这个八个十六进制字节的序列：
x[0..7] = 0x01 0x23 0x45 0x67 0x89 0xAB 0xCD 0xEF
x[0..7]=0x01 0x23 0x45 0x67 0x89 0xAB 0xCD 0xEF
When interpreted as a 32-bit word from the beginning memory address, x[0..3] has a numerical value of 0x67452301 or 1732584193.
当解释为起始存储器地址的32位字时，x[0..3]的数值为0x67452301或1732584193。
When interpreted as a 64-bit word, bytes x[0..7] have a numerical value of 0xEFCDAB8967452301 or 17279655951921914625.
当解释为64位字时，字节x[0..7]的数值为0xEFCDAB8967452301或17279655951921914625。
We specify the parameter block words p[0..7] as follows:
我们将参数块字p[0..7]指定如下：
byte offset: 3 2 1 0 (otherwise zero) p[0] = 0x0101kknn p[1..7] = 0
字节偏移量：3 2 1 0（否则为零）p[0]=0x0101KNN p[1..7]=0
Here the "nn" byte specifies the hash size in bytes. The second (little-endian) byte of the parameter block, "kk", specifies the key size in bytes. Set kk = 00 for unkeyed hashing. Bytes 2 and 3 are set as 01. All other bytes in the parameter block are set as zero.
这里的“nn”字节以字节为单位指定哈希大小。参数块的第二个（小端）字节“kk”以字节为单位指定密钥大小。为无眼散列设置kk=00。字节2和3设置为01。参数块中的所有其他字节都设置为零。
Note: [BLAKE2] defines additional variants of BLAKE2 with features such as salting, personalized hashes, and tree hashing. These OPTIONAL features use fields in the parameter block that are not defined in this document.
注：[BLAKE2]定义了BLAKE2的其他变体，具有盐析、个性化哈希和树哈希等特性。这些可选功能使用本文档中未定义的参数块中的字段。
We define the Initialization Vector constant IV mathematically as:
我们在数学上将初始向量常数IV定义为：
IV[i] = floor(2**w * frac(sqrt(prime(i+1)))), where prime(i) is the i:th prime number ( 2, 3, 5, 7, 11, 13, 17, 19 ) and sqrt(x) is the square root of x.
IV[i]=楼层（2**w*frac（质数（i+1））），其中质数（i）是第i个质数（2,3,5,7,11,13,17,19），而质数（x）是x的平方根。
The numerical values of IV can also be found in implementations in Appendices C and D for BLAKE2b and BLAKE2s, respectively.
对于BLAKE2b和BLAKE2s，IV的数值也可以在附录C和D中分别找到。
Note: BLAKE2b IV is the same as SHA-512 IV, and BLAKE2s IV is the same as SHA-256 IV; see [RFC6234].
注：BLAKE2b IV与SHA-512 IV相同，BLAKE2s IV与SHA-256 IV相同；见[RFC6234]。
Message word schedule permutations for each round of both BLAKE2b and BLAKE2s are defined by SIGMA. For BLAKE2b, the two extra permutations for rounds 10 and 11 are SIGMA[10..11] = SIGMA[0..1].
BLAKE2b和BLAKE2s每轮的消息字调度排列由SIGMA定义。对于BLAKE2b，第10轮和第11轮的两个额外排列为SIGMA[10..11]=SIGMA[0..1]。
Round | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
----------+-------------------------------------------------+
SIGMA[0] | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
SIGMA[1] | 14 10 4 8 9 15 13 6 1 12 0 2 11 7 5 3 |
SIGMA[2] | 11 8 12 0 5 2 15 13 10 14 3 6 7 1 9 4 |
SIGMA[3] | 7 9 3 1 13 12 11 14 2 6 5 10 4 0 15 8 |
SIGMA[4] | 9 0 5 7 2 4 10 15 14 1 11 12 6 8 3 13 |
SIGMA[5] | 2 12 6 10 0 11 8 3 4 13 7 5 15 14 1 9 |
SIGMA[6] | 12 5 1 15 14 13 4 10 0 7 6 3 9 2 8 11 |
SIGMA[7] | 13 11 7 14 12 1 3 9 5 0 15 4 8 6 2 10 |
SIGMA[8] | 6 15 14 9 11 3 0 8 12 2 13 7 1 4 10 5 |
SIGMA[9] | 10 2 8 4 7 6 1 5 15 11 9 14 3 12 13 0 |
----------+-------------------------------------------------+
Round | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
----------+-------------------------------------------------+
SIGMA[0] | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
SIGMA[1] | 14 10 4 8 9 15 13 6 1 12 0 2 11 7 5 3 |
SIGMA[2] | 11 8 12 0 5 2 15 13 10 14 3 6 7 1 9 4 |
SIGMA[3] | 7 9 3 1 13 12 11 14 2 6 5 10 4 0 15 8 |
SIGMA[4] | 9 0 5 7 2 4 10 15 14 1 11 12 6 8 3 13 |
SIGMA[5] | 2 12 6 10 0 11 8 3 4 13 7 5 15 14 1 9 |
SIGMA[6] | 12 5 1 15 14 13 4 10 0 7 6 3 9 2 8 11 |
SIGMA[7] | 13 11 7 14 12 1 3 9 5 0 15 4 8 6 2 10 |
SIGMA[8] | 6 15 14 9 11 3 0 8 12 2 13 7 1 4 10 5 |
SIGMA[9] | 10 2 8 4 7 6 1 5 15 11 9 14 3 12 13 0 |
----------+-------------------------------------------------+
The G primitive function mixes two input words, "x" and "y", into four words indexed by "a", "b", "c", and "d" in the working vector v[0..15]. The full modified vector is returned. The rotation constants (R1, R2, R3, R4) are given in Section 2.1.
G基元函数将两个输入字“x”和“y”混合成四个字，在工作向量v[0..15]中由“a”、“b”、“c”和“d”索引。返回完整的修改向量。第2.1节给出了旋转常数（R1、R2、R3、R4）。
FUNCTION G( v[0..15], a, b, c, d, x, y )
|
| v[a] := (v[a] + v[b] + x) mod 2**w
| v[d] := (v[d] ^ v[a]) >>> R1
| v[c] := (v[c] + v[d]) mod 2**w
| v[b] := (v[b] ^ v[c]) >>> R2
| v[a] := (v[a] + v[b] + y) mod 2**w
| v[d] := (v[d] ^ v[a]) >>> R3
| v[c] := (v[c] + v[d]) mod 2**w
| v[b] := (v[b] ^ v[c]) >>> R4
|
| RETURN v[0..15]
|
END FUNCTION.
FUNCTION G( v[0..15], a, b, c, d, x, y )
|
| v[a] := (v[a] + v[b] + x) mod 2**w
| v[d] := (v[d] ^ v[a]) >>> R1
| v[c] := (v[c] + v[d]) mod 2**w
| v[b] := (v[b] ^ v[c]) >>> R2
| v[a] := (v[a] + v[b] + y) mod 2**w
| v[d] := (v[d] ^ v[a]) >>> R3
| v[c] := (v[c] + v[d]) mod 2**w
| v[b] := (v[b] ^ v[c]) >>> R4
|
| RETURN v[0..15]
|
END FUNCTION.
Compression function F takes as an argument the state vector "h", message block vector "m" (last block is padded with zeros to full block size, if required), 2w-bit offset counter "t", and final block indicator flag "f". Local vector v[0..15] is used in processing. F returns a new state vector. The number of rounds, "r", is 12 for BLAKE2b and 10 for BLAKE2s. Rounds are numbered from 0 to r - 1.
压缩函数F将状态向量“h”、消息块向量“m”（最后一个块用零填充到完整块大小，如果需要）、2w位偏移计数器“t”和最终块指示符标志“F”作为参数。局部向量v[0..15]用于处理。F返回一个新的状态向量。对于BLAKE2b，发数“r”为12发，BLAKE2s为10发。轮数从0到r-1。
FUNCTION F( h[0..7], m[0..15], t, f )
|
| // Initialize local work vector v[0..15]
| v[0..7] := h[0..7] // First half from state.
| v[8..15] := IV[0..7] // Second half from IV.
|
| v[12] := v[12] ^ (t mod 2**w) // Low word of the offset.
| v[13] := v[13] ^ (t >> w) // High word.
|
| IF f = TRUE THEN // last block flag?
| | v[14] := v[14] ^ 0xFF..FF // Invert all bits.
| END IF.
|
| // Cryptographic mixing
| FOR i = 0 TO r - 1 DO // Ten or twelve rounds.
| |
| | // Message word selection permutation for this round.
| | s[0..15] := SIGMA[i mod 10][0..15]
| |
| | v := G( v, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]] )
| | v := G( v, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]] )
| | v := G( v, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]] )
| | v := G( v, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]] )
| |
| | v := G( v, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]] )
| | v := G( v, 1, 6, 11, 12, m[s[10]], m[s[11]] )
| | v := G( v, 2, 7, 8, 13, m[s[12]], m[s[13]] )
| | v := G( v, 3, 4, 9, 14, m[s[14]], m[s[15]] )
| |
| END FOR
|
| FOR i = 0 TO 7 DO // XOR the two halves.
| | h[i] := h[i] ^ v[i] ^ v[i + 8]
| END FOR.
|
| RETURN h[0..7] // New state.
|
END FUNCTION.
FUNCTION F( h[0..7], m[0..15], t, f )
|
| // Initialize local work vector v[0..15]
| v[0..7] := h[0..7] // First half from state.
| v[8..15] := IV[0..7] // Second half from IV.
|
| v[12] := v[12] ^ (t mod 2**w) // Low word of the offset.
| v[13] := v[13] ^ (t >> w) // High word.
|
| IF f = TRUE THEN // last block flag?
| | v[14] := v[14] ^ 0xFF..FF // Invert all bits.
| END IF.
|
| // Cryptographic mixing
| FOR i = 0 TO r - 1 DO // Ten or twelve rounds.
| |
| | // Message word selection permutation for this round.
| | s[0..15] := SIGMA[i mod 10][0..15]
| |
| | v := G( v, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]] )
| | v := G( v, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]] )
| | v := G( v, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]] )
| | v := G( v, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]] )
| |
| | v := G( v, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]] )
| | v := G( v, 1, 6, 11, 12, m[s[10]], m[s[11]] )
| | v := G( v, 2, 7, 8, 13, m[s[12]], m[s[13]] )
| | v := G( v, 3, 4, 9, 14, m[s[14]], m[s[15]] )
| |
| END FOR
|
| FOR i = 0 TO 7 DO // XOR the two halves.
| | h[i] := h[i] ^ v[i] ^ v[i + 8]
| END FOR.
|
| RETURN h[0..7] // New state.
|
END FUNCTION.
We refer the reader to Appendices C and D for reference C language implementations of BLAKE2b and BLAKE2s, respectively.
我们让读者参考附录C和D，分别了解BLAKE2b和BLAKE2s的参考C语言实现。
Key and data input are split and padded into "dd" message blocks d[0..dd-1], each consisting of 16 words (or "bb" bytes).
键和数据输入被拆分并填充到“dd”消息块d[0..dd-1]，每个消息块由16个字（或“bb”字节）组成。
If a secret key is used (kk > 0), it is padded with zero bytes and set as d[0]. Otherwise, d[0] is the first data block. The final data block d[dd-1] is also padded with zero to "bb" bytes (16 words).
如果使用了密钥（kk>0），则会用零字节填充密钥并将其设置为d[0]。否则，d[0]是第一个数据块。最后的数据块d[dd-1]也用0到“bb”字节（16个字）填充。
The number of blocks is therefore dd = ceil(kk / bb) + ceil(ll / bb). However, in the special case of an unkeyed empty message (kk = 0 and ll = 0), we still set dd = 1 and d[0] consists of all zeros.
因此，块的数量为dd=ceil（kk/bb）+ceil（ll/bb）。但是，在一个未检查的空消息（kk=0和ll=0）的特殊情况下，我们仍然将dd=1和d[0]设置为全零。
The following procedure processes the padded data blocks into an "nn"-byte final hash value. See Section 2 for a description of various variables and constants used.
以下过程将填充的数据块处理为“nn”字节的最终哈希值。有关使用的各种变量和常数的说明，请参见第2节。
FUNCTION BLAKE2( d[0..dd-1], ll, kk, nn )
|
| h[0..7] := IV[0..7] // Initialization Vector.
|
| // Parameter block p[0]
| h[0] := h[0] ^ 0x01010000 ^ (kk << 8) ^ nn
|
| // Process padded key and data blocks
| IF dd > 1 THEN
| | FOR i = 0 TO dd - 2 DO
| | | h := F( h, d[i], (i + 1) * bb, FALSE )
| | END FOR.
| END IF.
|
| // Final block.
| IF kk = 0 THEN
| | h := F( h, d[dd - 1], ll, TRUE )
| ELSE
| | h := F( h, d[dd - 1], ll + bb, TRUE )
| END IF.
|
| RETURN first "nn" bytes from little-endian word array h[].
|
END FUNCTION.
FUNCTION BLAKE2( d[0..dd-1], ll, kk, nn )
|
| h[0..7] := IV[0..7] // Initialization Vector.
|
| // Parameter block p[0]
| h[0] := h[0] ^ 0x01010000 ^ (kk << 8) ^ nn
|
| // Process padded key and data blocks
| IF dd > 1 THEN
| | FOR i = 0 TO dd - 2 DO
| | | h := F( h, d[i], (i + 1) * bb, FALSE )
| | END FOR.
| END IF.
|
| // Final block.
| IF kk = 0 THEN
| | h := F( h, d[dd - 1], ll, TRUE )
| ELSE
| | h := F( h, d[dd - 1], ll + bb, TRUE )
| END IF.
|
| RETURN first "nn" bytes from little-endian word array h[].
|
END FUNCTION.
An implementation of BLAKE2b and/or BLAKE2s MAY support the following digest size parameters for interoperability (e.g., digital signatures), as long as a sufficient level of security is attained by the parameter selections. These parameters and identifiers are intended to be suitable as drop-in replacements to MD5 and corresponding SHA algorithms.
BLAKE2b和/或BLAKE2s的实现可以支持以下摘要大小参数以实现互操作性（例如，数字签名），只要通过参数选择达到足够的安全级别。这些参数和标识符适合作为MD5和相应SHA算法的替代品。
Developers adapting BLAKE2 to ASN.1-based message formats SHOULD use the OID tree at x = 1.3.6.1.4.1.1722.12.2. The same OID can be used for both keyed and unkeyed hashing since in the latter case the key simply has zero length.
使BLAKE2适应基于ASN.1的消息格式的开发人员应使用x=1.3.6.1.4.1.1722.12.2处的OID树。同一OID可用于键控和非键控哈希，因为在后一种情况下，键的长度为零。
Algorithm | Target | Collision | Hash | Hash ASN.1 |
Identifier | Arch | Security | nn | OID Suffix |
---------------+--------+-----------+------+------------+
id-blake2b160 | 64-bit | 2**80 | 20 | x.1.5 |
id-blake2b256 | 64-bit | 2**128 | 32 | x.1.8 |
id-blake2b384 | 64-bit | 2**192 | 48 | x.1.12 |
id-blake2b512 | 64-bit | 2**256 | 64 | x.1.16 |
---------------+--------+-----------+------+------------+
id-blake2s128 | 32-bit | 2**64 | 16 | x.2.4 |
id-blake2s160 | 32-bit | 2**80 | 20 | x.2.5 |
id-blake2s224 | 32-bit | 2**112 | 28 | x.2.7 |
id-blake2s256 | 32-bit | 2**128 | 32 | x.2.8 |
---------------+--------+-----------+------+------------+
Algorithm | Target | Collision | Hash | Hash ASN.1 |
Identifier | Arch | Security | nn | OID Suffix |
---------------+--------+-----------+------+------------+
id-blake2b160 | 64-bit | 2**80 | 20 | x.1.5 |
id-blake2b256 | 64-bit | 2**128 | 32 | x.1.8 |
id-blake2b384 | 64-bit | 2**192 | 48 | x.1.12 |
id-blake2b512 | 64-bit | 2**256 | 64 | x.1.16 |
---------------+--------+-----------+------+------------+
id-blake2s128 | 32-bit | 2**64 | 16 | x.2.4 |
id-blake2s160 | 32-bit | 2**80 | 20 | x.2.5 |
id-blake2s224 | 32-bit | 2**112 | 28 | x.2.7 |
id-blake2s256 | 32-bit | 2**128 | 32 | x.2.8 |
---------------+--------+-----------+------+------------+
hashAlgs OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) kudelski(1722) cryptography(12) 2
}
macAlgs OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) kudelski(1722) cryptography(12) 3
}
hashAlgs OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) kudelski(1722) cryptography(12) 2
}
macAlgs OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) kudelski(1722) cryptography(12) 3
}
-- the two BLAKE2 variants --
blake2b OBJECT IDENTIFIER ::= { hashAlgs 1 }
blake2s OBJECT IDENTIFIER ::= { hashAlgs 2 }
-- the two BLAKE2 variants --
blake2b OBJECT IDENTIFIER ::= { hashAlgs 1 }
blake2s OBJECT IDENTIFIER ::= { hashAlgs 2 }
-- BLAKE2b Identifiers --
id-blake2b160 OBJECT IDENTIFIER ::= { blake2b 5 }
id-blake2b256 OBJECT IDENTIFIER ::= { blake2b 8 }
id-blake2b384 OBJECT IDENTIFIER ::= { blake2b 12 }
id-blake2b512 OBJECT IDENTIFIER ::= { blake2b 16 }
-- BLAKE2b Identifiers --
id-blake2b160 OBJECT IDENTIFIER ::= { blake2b 5 }
id-blake2b256 OBJECT IDENTIFIER ::= { blake2b 8 }
id-blake2b384 OBJECT IDENTIFIER ::= { blake2b 12 }
id-blake2b512 OBJECT IDENTIFIER ::= { blake2b 16 }
-- BLAKE2s Identifiers --
id-blake2s128 OBJECT IDENTIFIER ::= { blake2s 4 }
id-blake2s160 OBJECT IDENTIFIER ::= { blake2s 5 }
id-blake2s224 OBJECT IDENTIFIER ::= { blake2s 7 }
id-blake2s256 OBJECT IDENTIFIER ::= { blake2s 8 }
-- BLAKE2s Identifiers --
id-blake2s128 OBJECT IDENTIFIER ::= { blake2s 4 }
id-blake2s160 OBJECT IDENTIFIER ::= { blake2s 5 }
id-blake2s224 OBJECT IDENTIFIER ::= { blake2s 7 }
id-blake2s256 OBJECT IDENTIFIER ::= { blake2s 8 }
This document is intended to provide convenient open-source access by the Internet community to the BLAKE2 cryptographic hash algorithm. We wish to make no independent assertion to its security in this document. We refer the reader to [BLAKE] and [BLAKE2] for detailed cryptanalytic rationale behind its design.
本文档旨在为互联网社区提供对BLAKE2加密哈希算法的方便的开源访问。我们不希望在本文件中对其安全性作出独立的断言。我们请读者参考[BLAKE]和[BLAKE2]，了解其设计背后的详细密码分析原理。
In order to avoid bloat, the reference implementations in Appendices C and D may not erase all sensitive data (such as secret keys) immediately from process memory after use. Such cleanup can be added if needed.
为了避免膨胀，附录C和D中的参考实现可能不会在使用后立即从进程内存中删除所有敏感数据（如密钥）。如果需要，可以添加此类清理。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，DOI 10.17487/RFC2119，1997年3月<http://www.rfc-editor.org/info/rfc2119>.
[BLAKE] Aumasson, J-P., Meier, W., Phan, R., and L. Henzen, "The Hash Function BLAKE", January 2015, <https://131002.net/blake/book>.
[BLAKE]Aumasson，J-P.，Meier，W.，Phan，R.，和L.Henzen，“哈希函数BLAKE”，2015年1月<https://131002.net/blake/book>.
[BLAKE2] Aumasson, J-P., Neves, S., Wilcox-O'Hearn, Z., and C. Winnerlein, "BLAKE2: simpler, smaller, fast as MD5", January 2013, <https://blake2.net/blake2.pdf>.
[BLAKE2]Aumasson，J-P.，Neves，S.，Wilcox-O'Hearn，Z.，和C.Winnerlein，“BLAKE2:更简单，更小，快如MD5”，2013年1月<https://blake2.net/blake2.pdf>.
[FIPS140-2IG] NIST, "Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program", September 2015, <http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/ FIPS1402IG.pdf/>.
[FIPS140-2IG]NIST，“FIPS PUB 140-2和加密模块验证计划的实施指南”，2015年9月<http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/ FIPS1402IG.pdf/>。
[RFC6151] Turner, S. and L. Chen, "Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms", RFC 6151, DOI 10.17487/RFC6151, March 2011, <http://www.rfc-editor.org/info/rfc6151>.
[RFC6151]Turner，S.和L.Chen，“MD5消息摘要和HMAC-MD5算法的更新安全注意事项”，RFC 6151，DOI 10.17487/RFC6151，2011年3月<http://www.rfc-editor.org/info/rfc6151>.
[RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, DOI 10.17487/RFC6234, May 2011, <http://www.rfc-editor.org/info/rfc6234>.
[RFC6234]Eastlake 3rd，D.和T.Hansen，“美国安全哈希算法（基于SHA和SHA的HMAC和HKDF）”，RFC 6234，DOI 10.17487/RFC6234，2011年5月<http://www.rfc-editor.org/info/rfc6234>.
We compute the unkeyed hash of three ASCII bytes "abc" with BLAKE2b-512 and show internal values during computation.
我们使用BLAKE2b-512计算三个ASCII字节“abc”的无眼散列，并在计算过程中显示内部值。
m[16] = 0000000000636261 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
m[16]=0000000000 636261 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(i= 0) v[16] = 6A09E667F2BDC948 BB67AE8584CAA73B 3C6EF372FE94F82B A54FF53A5F1D36F1 510E527FADE682D1 9B05688C2B3E6C1F 1F83D9ABFB41BD6B 5BE0CD19137E2179 6A09E667F3BCC908 BB67AE8584CAA73B 3C6EF372FE94F82B A54FF53A5F1D36F1 510E527FADE682D2 9B05688C2B3E6C1F E07C265404BE4294 5BE0CD19137E2179
（i=0）v[16]=6A09E667F2BDC948 BB67AE8584CAA73B 3C6EF372FE94F82B A54FF53A5F1D36F1 510E527FADE682D1 9B05688C2B3E6C1F 1F883D9ABFB41BD6B 5BE0CD19137E2179 6A09E667F3BCC908 BB67AE8584CAA73B 3C6EF372FE94F82B A54FF53A5F1D36F1 510E527FADE682D2 9B05688C2B3E6F E07C265404BE425BE01919E2179
(i= 1) v[16] = 86B7C1568029BB79 C12CBCC809FF59F3 C6A5214CC0EACA8E 0C87CD524C14CC5D 44EE6039BD86A9F7 A447C850AA694A7E DE080F1BB1C0F84B 595CB8A9A1ACA66C BEC3AE837EAC4887 6267FC79DF9D6AD1 FA87B01273FA6DBE 521A715C63E08D8A E02D0975B8D37A83 1C7B754F08B7D193 8F885A76B6E578FE 2318A24E2140FC64
（i=1）v[16]=86B7C1568029BB79 C12CBCC809FF59F3 C6A5214CC0EACA8E 0C87CD524C14CC5D 44EE6039BD86A9F7 A447C850AA694A7E DE080F1BB1C0F84B595CB8A9AA1ACA66C成为3个EAC4887 6267FC79DF9D6AD1 FA87B01273FA6DBE 521A715C638D8D8D8E08A8A00975B8D37A83 1C7B7B8E754B8E588E22316FE
(i= 2) v[16] = 53281E83806010F2 3594B403F81B4393 8CD63C7462DE0DFF 85F693F3DA53F974 BAABDBB2F386D9AE CA5425AEC65A10A8 C6A22E2FF0F7AA48 C6A56A51CB89C595 224E6A3369224F96 500E125E58A92923 E9E4AD0D0E1A0D48 85DF9DC143C59A74 92A3AAAA6D952B7F C5FDF71090FAE853 2A8A40F15A462DD0 572D17EFFDD37358
（i=2）v[16]=53281E83806010F2 3594B403F81B4393 8CD63C7462DEF 85F693F3DA53F974 BAABDB2F386D9AE CA5425AEC65A10A8 C6A22E2F0F7AA48 C6A56A51CB89C595 224E6A3369224F96 500E125E58A923 E4AD0D0E1A0D48 85DF9DC143C59A74 92AA6D957F C5FD71090FA853 2A58A462D0357
(i= 3) v[16] = 60ED96AA7AD41725 E46A743C71800B9D 1A04B543A01F156B A2F8716E775C4877 DA0A61BCDE4267EA B1DD230754D7BDEE 25A1422779E06D14 E6823AE4C3FF58A5 A1677E19F37FD5DA 22BDCE6976B08C51 F1DE8696BEC11BF1 A0EBD586A4A1D2C8 C804EBAB11C99FA9 8E0CEC959C715793 7C45557FAE0D4D89 716343F52FDD265E
（i=3）v[16]=60ED96AA7AD41725 E46A743C71800B9D 1A04B543A01F156B A2F8716E775C4877 DA0A61BCDE422779E06D14 E6823E4FF58A5 A1677E19F37FD5DA 22BDCE6976B08C51 DE8696BEF1 A0EBD586A4A1D2C8 C804EBABB11C99FA9 8E0CEC959C71577C4657D289
(i= 4) v[16] = BB2A77D3A8382351 45EB47971F23B103 98BE297F6E45C684 A36077DEE3370B89 8A03C4CB7E97590A 24192E49EBF54EA0 4F82C9401CB32D7A 8CCD013726420DC4 A9C9A8F17B1FC614 55908187977514A0 5B44273E66B19D27 B6D5C9FCA2579327 086092CFB858437E 5C4BE2156DBEECF9 2EFEDE99ED4EFF16 3E7B5F234CD1F804
（i=4）v[16]=BB2A77D3A8382351 45EB47971F23B103 98BE297F6E45C684 A36077B89 8A03C4CB7E97590A 24192E49EBF54EA0 4F82C9401CB32D7A 8CCD013726420DC4 A9C9A8F17BF614 55908187977514A0 5B4427E66B19D27 B6D5D9FCA2579327 086092CFB8537E 5B2156DBEECF9 2EFE998CFD7B8CFD8CFD8CFD8CFD8CFD8CFD8CFD8CFD1372647B804
(i= 5) v[16] = C79C15B3D423B099 2DA2224E8DA97556 77D2B26DF1C45C55 8934EB09A3456052 0F6D9EEED157DA2A 6FE66467AF88C0A9 4EB0B76284C7AAFB 299C8E725D954697 B2240B59E6D567D3 2643C2370E49EBFD 79E02EEF20CDB1AE 64B3EED7BB602F39 B97D2D439E4DF63D C718E755294C9111 1F0893F2772BB373 1205EA4A7859807D
（i=5）v[16]=C79C15B3D423B0992DA224E8DA97556 77D2B26DF1C45C55 8934EB09A3456052 0F6D9EEED157DA6FE66467AF88C0A9 4EB0B76284C7AAFB 299C8E725D954697 B2240B59E6D567D32643C2370E49EBFD 79E02EF20CDB1AE 64B3EEDB602F39 B97D239E4DF63D C718E755294C9111 1F8937B9E757B37EA7D
(i= 6) v[16] = E58F97D6385BAEE4 7640AA9764DA137A DEB4C7C23EFE287E 70F6F41C8783C9F6 7127CD48C76A7708 9E472AF0BE3DB3F6 0F244C62DDF71788 219828AA83880842 41CCA9073C8C4D0D 5C7912BC10DF3B4B A2C3ABBD37510EE2 CB5668CC2A9F7859 8733794F07AC1500 C67A6BE42335AA6F ACB22B28681E4C82 DB2161604CBC9828
（i=6）v[16]=E58F97D6385BAEE4 7640AA9764DA137A DEB4C7C23EFE287E 70F6F41C87C9F6 7127CD48C76A7708 9E472AF0BE3DB3F6 0F244C62DDF71788 219828AA83880842 41CCA9073C8C4D0D 5C7912BC10DF3B2B A2C37510EE2 CB5668CC2A9F7859 8733794F07AC1500 C67A6BE42335AA6F ACB228682B1608B828
(i= 7) v[16] = 6E2D286EEADEDC81 BCF02C0787E86358 57D56A56DD015EDF 55D899D40A5D0D0A 819415B56220C459 B63C479A6A769F02 258E55E0EC1F362A 3A3B4EC60E19DFDC 04D769B3FCB048DB B78A9A33E9BFF4DD 5777272AE1E930C0 5A387849E578DBF6 92AAC307CF2C0AFC 30AACCC4F06DAFAA 483893CC094F8863 E03C6CC89C26BF92
（i=7）v[16]=6E2D286EEADDC81 BCF02C0787E86358 57D56A56DD015EDF 55D899D40A5D0A 819415B56220C459 B63C479A6A769F02 258E55E0EC1F362A 3A3B4EC60E19DFDC 04D769B3FCB048DB B78A9E33E9BFF4DD 5777272AE930C0 5A387849E578DBF6 92AAC307CF2C0AFC 30AACCC479F06DAFA483893CC094F0892
(i= 8) v[16] = FFC83ECE76024D01 1BE7BFFB8C5CC5F9 A35A18CBAC4C65B7 B7C2C7E6D88C285F 81937DA314A50838 E1179523A2541963 3A1FAD7106232B8F 1C7EDE92AB8B9C46 A3C2D35E4F685C10 A53D3F73AA619624 30BBCC0285A22F65 BCEFBB6A81539E5D 3841DEF6F4C9848A 98662C85FBA726D4 7762439BD5A851BD B0B9F0D443D1A889
（i=8）v[16]=FFC83ECE76024D01 1BE7FFB8C5CC5F9 A35A18CBAC4C65B7 B7C2C7E6D88C285F 81937DA314A50838 E1179523A2541963 31A1FAD7106232B8F 1C7EDE92AB8B9C46 A3C2D35E4F685C10 A53D3F373AA619624 BBCC0285A2F65 BCEFBBB6C81539E5D 3841DEF6F4C98662C85D4 77629BD41B8D4B9D4B9D9D9D9D41B9D9D9D9
(i= 9) v[16] = 753A70A1E8FAEADD 6B0D43CA2C25D629 F8343BA8B94F8C0B BC7D062B0DB5CF35 58540EE1B1AEBC47 63C5B9B80D294CB9 490870ECAD27DEBD B2A90DDF667287FE 316CC9EBEEFAD8FC 4A466BCD021526A4 5DA7F7638CEC5669 D9C8826727D306FC 88ED6C4F3BD7A537 19AE688DDF67F026 4D8707AAB40F7E6D FD3F572687FEA4F1
（i=9）v[16]=753A70A1E8FAEADD 6B0D43CA2C25D629 F8343 BA8B94F8C0B BC7D062B0DB5CF35 58540EE1B1EBC47 63C5B9B80D294CB9 49080ECAD27 DEBD B2A90DDF667287FE 316CC9EBEEFAD8FC 4A466BCD01526A4 DA7F7638CEC569 D9C8826727D3067ED6C4C4807A537 19AE688DD67F026 4DB677F677F677F677F677F677A4
(i=10) v[16] = E630C747CCD59C4F BC713D41127571CA 46DB183025025078 6727E81260610140 2D04185EAC2A8CBA 5F311B88904056EC 40BD313009201AAB 0099D4F82A2A1EAB 6DD4FBC1DE60165D B3B0B51DE3C86270 900AEE2F233B08E5 A07199D87AD058D8 2C6B25593D717852 37E8CA471BEAA5F8 2CFC1BAC10EF4457 01369EC18746E775
（i=10）v[16]=E630C747CCD59C4F BC713D41127571CA 46DB18302025078 6727E81260610140 2D041185EAC2A8CBA 5F311B88904056EC 40BD313009201AAB 0099D4F82A2A1EAB 6DD4BC1DE60165D B3B01DE3C86270 900AEE233B08E5 A07199D87AD058D8 2C6B255593D717852 37E8CA471BEAA5 2CFC1BAC10EF4457 01369EC18746E775
(i=11) v[16] = E801F73B9768C760 35C6D22320BE511D 306F27584F65495E B51776ADF569A77B F4F1BE86690B3C34 3CC88735D1475E4B 5DAC67921FF76949 1CDB9D31AD70CC4E 35BA354A9C7DF448 4929CBE45679D73E 733D1A17248F39DB 92D57B736F5F170A 61B5C0A41D491399 B5C333457E12844A BD696BE010D0D889 02231E1A917FE0BD
（i=11）v[16]=E801F73B9768C760 35C6D22320BE51AD 306F27584F65495E B51776ADF569A77B F4F1BE86690B3C34 3CC88735D1475E4B 5DAC67921FF76949 1CDB9D31AD70CC4E 35BA354A9C7DF448 49CBE45679D73E 731A17248F39DB 92D57B736F570A 61C0A41D4991399 B53457E128A BD69D8810D07BD
(i=12) v[16] = 12EF8A641EC4F6D6 BCED5DE977C9FAF5 733CA476C5148639 97DF596B0610F6FC F42C16519AD5AFA7 AA5AC1888E10467E 217D930AA51787F3 906A6FF19E573942 75AB709BD3DCBF24 EE7CE1F345947AA4 F8960D6C2FAF5F5E E332538A36B6D246 885BEF040EF6AA0B A4939A417BFB78A3 646CBB7AF6DCE980 E813A23C60AF3B82
（i=12）v[16]=12EF8A641EC4F6D6 BCED5DE977C9FAF5 733CA476C5148639 97DF596B0610F6FC F42C16519AD5AFA7 AA5AC1888E10467E 217D930AA51787F3906A6FF19E573942 75AB709BD3DCBF24 EE7CE1F345947AAF8960D6C2FAF5325A36B6D246 885EF04066A0B A4939A417FB78A3 646CB7CF816AF8B82
h[8] = 0D4D1C983FA580BA E9F6129FB697276A B7C45A68142F214C D1A2FFDB6FBB124B 2D79AB2A39C5877D 95CC3345DED552C2 5A92F1DBA88AD318 239900D4ED8623B9
h[8]=0D4D1C983FA580BA E9F6129FB697276A B7C45A68142F214C D1A2FFDB6FBB124B 2D79AB2A39C5877D 95CC3345DED552C2 5A92F1DBA88AD318 23990D4ED8623B9
BLAKE2b-512("abc") = BA 80 A5 3F 98 1C 4D 0D 6A 27 97 B6 9F 12 F6 E9 4C 21 2F 14 68 5A C4 B7 4B 12 BB 6F DB FF A2 D1 7D 87 C5 39 2A AB 79 2D C2 52 D5 DE 45 33 CC 95 18 D3 8A A8 DB F1 92 5A B9 23 86 ED D4 00 99 23
BLAKE2b-512（“abc”）=BA 80 A5 3F 98 1C 4D 0D 6A 27 97 B6 9F 12 F6 E9 4C 21 2F 14 68 5A C4 B7 4B 12 BB 6F DB FF A2 D1 7D 87 C5 39 2A AB 79 2D C2 52 D5 DE 45 33 CC 95 18 D3 8A A8 DB F1 92 5A B9 23 86 ED D4 00 99 23
We compute the unkeyed hash of three ASCII bytes "abc" with BLAKE2s-256 and show internal values during computation.
我们使用BLAKE2s-256计算三个ASCII字节“abc”的无眼散列，并在计算过程中显示内部值。
m[16] = 00636261 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
m[16]=0063626100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(i=0) v[16] = 6B08E647 BB67AE85 3C6EF372 A54FF53A 510E527F 9B05688C 1F83D9AB 5BE0CD19 6A09E667 BB67AE85 3C6EF372 A54FF53A 510E527C 9B05688C E07C2654 5BE0CD19
（i=0）v[16]=6B08E647 BB67AE85 3C6EF372 A54FF53A 510E527F 9B05688C 1F83D9AB 5BE0CD19 6A09E667 BB67AE85 3C6EF372 A54FF53A 510E527C 9B05688C E07C2654 5BE0CD19
(i=1) v[16] = 16A3242E D7B5E238 CE8CE24B 927AEDE1 A7B430D9 93A4A14E A44E7C31 41D4759B 95BF33D3 9A99C181 608A3A6B B666383E 7A8DD50F BE378ED7 353D1EE6 3BB44C6B
（i=1）v[16]=16A3242E D7B5E238 CE8CE24B 927AEDE1 A7B430D9 93A4A14E A44E7C31 41D4759B 95BF33D3 9A99C181 608A3A6B B666383E 7A8DD50F BE378ED7 353D1EE6 3BB44C6B
(i=2) v[16] = 3AE30FE3 0982A96B E88185B4 3E339B16 F24338CD 0E66D326 E005ED0C D591A277 180B1F3A FCF43914 30DB62D6 4847831C 7F00C58E FB847886 C544E836 524AB0E2
（i=2）v[16]=3AE30FE3 0982A96B E88185B4 3E339B16 F24338CD 0E66D326 E005ED0C D591A277 180B1F3A FCF43914 30DB62D6 4847831C 7F00C58E FB847886 C544E836 524AB0E2
(i=3) v[16] = 7A3BE783 997546C1 D45246DF EDB5F821 7F98A742 10E864E2 D4AB70D0 C63CB1AB 6038DA9E 414594B0 F2C218B5 8DA0DCB7 D7CD7AF5 AB4909DF 85031A52 C4EDFC98
（i=3）v[16]=7A3BE783 997546C1 D45246DF EDB5F821 7F98A742 10E864E2 D4AB70D0 C63CB1AB 6038DA9E 414594B0 F2C218B5 8DA0DCB7 D7CD7AF5 AB4909DF 85031A52 C4EDFC98
(i=4) v[16] = 2A8B8CB7 1ACA82B2 14045D7F CC7258ED 383CF67C E090E7F9 3025D276 57D04DE4 994BACF0 F0982759 F17EE300 D48FC2D5 DC854C10 523898A9 C03A0F89 47D6CD88
（i=4）v[16]=2A8B8CB7 1ACA82B2 14045D7F CC7258ED 383CF67C E090E7F9 3025D276 57D04DE4 994BACF0 F0982759 F17EE300 D48FC2D5 DC854C10 523898A9 C03A0F89 47D6CD88
(i=5) v[16] = C4AA2DDB 111343A3 D54A700A 574A00A9 857D5A48 B1E11989 6F5C52DF DD2C53A3 678E5F8E 9718D4E9 622CB684 92976076 0E41A517 359DC2BE 87A87DDD 643F9CEC
（i=5）v[16]=C4AA2DDB 111343A3 D54A700A 574A00A9 857D5A48 B1E11989 6F5C52DF DD2C53A3 678E5F8E 9718D4E9 622CB684 92976076 0E41A517 359DC2BE 87A87DDD 643F9CEC
(i=6) v[16] = 3453921C D7595EE1 592E776D 3ED6A974 4D997CB3 DE9212C3 35ADF5C9 9916FD65 96562E89 4EAD0792 EBFC2712 2385F5B2 F34600FB D7BC20FB EB452A7B ECE1AA40
（i=6）v[16]=3453921C D7595EE1 592E776D 3ED6A974 4D997CB3 DE9212C3 35ADF5C9 9916FD65 96562E89 4EAD0792 EBFC2712 2385F5B2 F34600FB D7BC20FB EB452A7B ECEAA40
(i=7) v[16] = BE851B2D A85F6358 81E6FC3B 0BB28000 FA55A33A 87BE1FAD 4119370F 1E2261AA A1318FD3 F4329816 071783C2 6E536A8D 9A81A601 E7EC80F1 ACC09948 F849A584
（i=7）v[16]=BE851B2D A85F6358 81E6FC3B 0BB28000 FA55A33A 87BE1FAD 4119370F 1E2261AA A1318FD3 F4329816 071783C2 6E536A8D 9A81A601 E7EC80F1 ACC09948 F849A584
(i=8) v[16] = 07E5B85A 069CC164 F9DE3141 A56F4680 9E440AD2 9AB659EA 3C84B971 21DBD9CF 46699F8C 765257EC AF1D998C 75E4C3B6 523878DC 30715015 397FEE81 4F1FA799
（i=8）v[16]=07E5B85A 069CC164 F9DE3141 A56F4680 9E440AD2 9AB659EA 3C84B971 21DBD9CF 46699F8C 765257EC AF1D998C 75E4C3B6 523878 DC 3071505 397费用
(i=9) v[16] = 435148C4 A5AA2D11 4B354173 D543BC9E BDA2591C BF1D2569 4FCB3120 707ADA48 565B3FDE 32C9C916 EAF4A1AB B1018F28 8078D978 68ADE4B5 9778FDA3 2863B92E
（i=9）v[16]=435148C4 A5AA2D11 4B354173 D543BC9E BDA2591C BF1D2569 4B3120 707ADA48 565B3FDE 32C9C916 EAF4A1AB B1018F28 8078D978 68ADE4B5 9778FDA3 2863B92E
(i=10) v[16] = D9C994AA CFEC3AA6 700D0AB2 2C38670E AF6A1F66 1D023EF3 1D9EC27D 945357A5 3E9FFEBD 969FE811 EF485E21 A632797A DEEF082E AF3D80E1 4E86829B 4DEAFD3A
（i=10）v[16]=D9C994AA CFEC3AA6 700D0AB2 2C38670E AF6A1F66 1D023EF3 1D9EC27D 945357A5 3E9FFEBD 969FE811 EF485E21 A632797A DEEF082E AF3D80E1 4E86829B 4DEAFD3A
h[8] = 8C5E8C50 E2147C32 A32BA7E1 2F45EB4E 208B4537 293AD69E 4C9B994D 82596786
h[8]=8C5E8C50 E2147C32 A32BA7E1 2F45EB4E 208B4537 293AD69E 4C9B994D 82596786
BLAKE2s-256("abc") = 50 8C 5E 8C 32 7C 14 E2 E1 A7 2B A3 4E EB 45 2F 37 45 8B 20 9E D6 3A 29 4D 99 9B 4C 86 67 59 82
BLAKE2s-256（“abc”）=50 8C 5E 8C 32 7C 14 E2 E1 A7 2B A3 4E EB 45 2F 37 45 8B 20 9E D6 3A 29 4D 99 9B 4C 86 67 59 82
<CODE BEGINS>
// blake2b.h
// BLAKE2b Hashing Context and API Prototypes
<CODE BEGINS>
// blake2b.h
// BLAKE2b Hashing Context and API Prototypes
#ifndef BLAKE2B_H #define BLAKE2B_H
#如果定义BLAKE2B#u H#定义BLAKE2B#u H
#include <stdint.h>
#include <stddef.h>
#include <stdint.h>
#include <stddef.h>
// state context
typedef struct {
uint8_t b[128]; // input buffer
uint64_t h[8]; // chained state
uint64_t t[2]; // total number of bytes
size_t c; // pointer for b[]
size_t outlen; // digest size
} blake2b_ctx;
// state context
typedef struct {
uint8_t b[128]; // input buffer
uint64_t h[8]; // chained state
uint64_t t[2]; // total number of bytes
size_t c; // pointer for b[]
size_t outlen; // digest size
} blake2b_ctx;
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 64 gives the digest size in bytes.
// Secret key (also <= 64 bytes) is optional (keylen = 0).
int blake2b_init(blake2b_ctx *ctx, size_t outlen,
const void *key, size_t keylen); // secret key
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 64 gives the digest size in bytes.
// Secret key (also <= 64 bytes) is optional (keylen = 0).
int blake2b_init(blake2b_ctx *ctx, size_t outlen,
const void *key, size_t keylen); // secret key
// Add "inlen" bytes from "in" into the hash.
void blake2b_update(blake2b_ctx *ctx, // context
const void *in, size_t inlen); // data to be hashed
// Add "inlen" bytes from "in" into the hash.
void blake2b_update(blake2b_ctx *ctx, // context
const void *in, size_t inlen); // data to be hashed
// Generate the message digest (size given in init).
// Result placed in "out".
void blake2b_final(blake2b_ctx *ctx, void *out);
// Generate the message digest (size given in init).
// Result placed in "out".
void blake2b_final(blake2b_ctx *ctx, void *out);
// All-in-one convenience function.
int blake2b(void *out, size_t outlen, // return buffer for digest
const void *key, size_t keylen, // optional secret key
const void *in, size_t inlen); // data to be hashed
// All-in-one convenience function.
int blake2b(void *out, size_t outlen, // return buffer for digest
const void *key, size_t keylen, // optional secret key
const void *in, size_t inlen); // data to be hashed
#endif <CODE ENDS>
#endif<代码结束>
<CODE BEGINS> // blake2b.c // A simple BLAKE2b Reference Implementation.
<CODE BEGINS>//blake2b.c//一个简单的blake2b参考实现。
#include "blake2b.h"
#包括“blake2b.h”
// Cyclic right rotation.
//循环右旋转。
#ifndef ROTR64
#define ROTR64(x, y) (((x) >> (y)) ^ ((x) << (64 - (y))))
#endif
#ifndef ROTR64
#define ROTR64(x, y) (((x) >> (y)) ^ ((x) << (64 - (y))))
#endif
// Little-endian byte access.
//小端字节访问。
#define B2B_GET64(p) \
(((uint64_t) ((uint8_t *) (p))[0]) ^ \
(((uint64_t) ((uint8_t *) (p))[1]) << 8) ^ \
(((uint64_t) ((uint8_t *) (p))[2]) << 16) ^ \
(((uint64_t) ((uint8_t *) (p))[3]) << 24) ^ \
(((uint64_t) ((uint8_t *) (p))[4]) << 32) ^ \
(((uint64_t) ((uint8_t *) (p))[5]) << 40) ^ \
(((uint64_t) ((uint8_t *) (p))[6]) << 48) ^ \
(((uint64_t) ((uint8_t *) (p))[7]) << 56))
#define B2B_GET64(p) \
(((uint64_t) ((uint8_t *) (p))[0]) ^ \
(((uint64_t) ((uint8_t *) (p))[1]) << 8) ^ \
(((uint64_t) ((uint8_t *) (p))[2]) << 16) ^ \
(((uint64_t) ((uint8_t *) (p))[3]) << 24) ^ \
(((uint64_t) ((uint8_t *) (p))[4]) << 32) ^ \
(((uint64_t) ((uint8_t *) (p))[5]) << 40) ^ \
(((uint64_t) ((uint8_t *) (p))[6]) << 48) ^ \
(((uint64_t) ((uint8_t *) (p))[7]) << 56))
// G Mixing function.
//G混合函数。
#define B2B_G(a, b, c, d, x, y) { \
v[a] = v[a] + v[b] + x; \
v[d] = ROTR64(v[d] ^ v[a], 32); \
v[c] = v[c] + v[d]; \
v[b] = ROTR64(v[b] ^ v[c], 24); \
v[a] = v[a] + v[b] + y; \
v[d] = ROTR64(v[d] ^ v[a], 16); \
v[c] = v[c] + v[d]; \
v[b] = ROTR64(v[b] ^ v[c], 63); }
#define B2B_G(a, b, c, d, x, y) { \
v[a] = v[a] + v[b] + x; \
v[d] = ROTR64(v[d] ^ v[a], 32); \
v[c] = v[c] + v[d]; \
v[b] = ROTR64(v[b] ^ v[c], 24); \
v[a] = v[a] + v[b] + y; \
v[d] = ROTR64(v[d] ^ v[a], 16); \
v[c] = v[c] + v[d]; \
v[b] = ROTR64(v[b] ^ v[c], 63); }
// Initialization Vector.
//初始化向量。
static const uint64_t blake2b_iv[8] = {
0x6A09E667F3BCC908, 0xBB67AE8584CAA73B,
0x3C6EF372FE94F82B, 0xA54FF53A5F1D36F1,
0x510E527FADE682D1, 0x9B05688C2B3E6C1F,
0x1F83D9ABFB41BD6B, 0x5BE0CD19137E2179
};
static const uint64_t blake2b_iv[8] = {
0x6A09E667F3BCC908, 0xBB67AE8584CAA73B,
0x3C6EF372FE94F82B, 0xA54FF53A5F1D36F1,
0x510E527FADE682D1, 0x9B05688C2B3E6C1F,
0x1F83D9ABFB41BD6B, 0x5BE0CD19137E2179
};
// Compression function. "last" flag indicates last block.
//压缩功能。“last”标志表示最后一个块。
static void blake2b_compress(blake2b_ctx *ctx, int last)
{
const uint8_t sigma[12][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
};
int i;
uint64_t v[16], m[16];
static void blake2b_compress(blake2b_ctx *ctx, int last)
{
const uint8_t sigma[12][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
};
int i;
uint64_t v[16], m[16];
for (i = 0; i < 8; i++) { // init work variables
v[i] = ctx->h[i];
v[i + 8] = blake2b_iv[i];
}
for (i = 0; i < 8; i++) { // init work variables
v[i] = ctx->h[i];
v[i + 8] = blake2b_iv[i];
}
v[12] ^= ctx->t[0]; // low 64 bits of offset
v[13] ^= ctx->t[1]; // high 64 bits
if (last) // last block flag set ?
v[14] = ~v[14];
v[12] ^= ctx->t[0]; // low 64 bits of offset
v[13] ^= ctx->t[1]; // high 64 bits
if (last) // last block flag set ?
v[14] = ~v[14];
for (i = 0; i < 16; i++) // get little-endian words
m[i] = B2B_GET64(&ctx->b[8 * i]);
for (i = 0; i < 16; i++) // get little-endian words
m[i] = B2B_GET64(&ctx->b[8 * i]);
for (i = 0; i < 12; i++) { // twelve rounds
B2B_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]);
B2B_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]);
B2B_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]);
B2B_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]);
B2B_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]);
B2B_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]);
B2B_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]);
B2B_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]);
}
for (i = 0; i < 12; i++) { // twelve rounds
B2B_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]);
B2B_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]);
B2B_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]);
B2B_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]);
B2B_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]);
B2B_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]);
B2B_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]);
B2B_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]);
}
for( i = 0; i < 8; ++i )
ctx->h[i] ^= v[i] ^ v[i + 8];
}
for( i = 0; i < 8; ++i )
ctx->h[i] ^= v[i] ^ v[i + 8];
}
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 64 gives the digest size in bytes.
// Secret key (also <= 64 bytes) is optional (keylen = 0).
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 64 gives the digest size in bytes.
// Secret key (also <= 64 bytes) is optional (keylen = 0).
int blake2b_init(blake2b_ctx *ctx, size_t outlen,
const void *key, size_t keylen) // (keylen=0: no key)
{
size_t i;
int blake2b_init(blake2b_ctx *ctx, size_t outlen,
const void *key, size_t keylen) // (keylen=0: no key)
{
size_t i;
if (outlen == 0 || outlen > 64 || keylen > 64)
return -1; // illegal parameters
if (outlen == 0 || outlen > 64 || keylen > 64)
return -1; // illegal parameters
for (i = 0; i < 8; i++) // state, "param block"
ctx->h[i] = blake2b_iv[i];
ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen;
for (i = 0; i < 8; i++) // state, "param block"
ctx->h[i] = blake2b_iv[i];
ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen;
ctx->t[0] = 0; // input count low word
ctx->t[1] = 0; // input count high word
ctx->c = 0; // pointer within buffer
ctx->outlen = outlen;
ctx->t[0] = 0; // input count low word
ctx->t[1] = 0; // input count high word
ctx->c = 0; // pointer within buffer
ctx->outlen = outlen;
for (i = keylen; i < 128; i++) // zero input block
ctx->b[i] = 0;
if (keylen > 0) {
blake2b_update(ctx, key, keylen);
ctx->c = 128; // at the end
}
for (i = keylen; i < 128; i++) // zero input block
ctx->b[i] = 0;
if (keylen > 0) {
blake2b_update(ctx, key, keylen);
ctx->c = 128; // at the end
}
return 0;
}
return 0;
}
// Add "inlen" bytes from "in" into the hash.
//将“in”中的“inlen”字节添加到哈希中。
void blake2b_update(blake2b_ctx *ctx,
const void *in, size_t inlen) // data bytes
{
size_t i;
void blake2b_update(blake2b_ctx *ctx,
const void *in, size_t inlen) // data bytes
{
size_t i;
for (i = 0; i < inlen; i++) {
if (ctx->c == 128) { // buffer full ?
ctx->t[0] += ctx->c; // add counters
if (ctx->t[0] < ctx->c) // carry overflow ?
ctx->t[1]++; // high word
blake2b_compress(ctx, 0); // compress (not last)
ctx->c = 0; // counter to zero
}
ctx->b[ctx->c++] = ((const uint8_t *) in)[i];
}
}
for (i = 0; i < inlen; i++) {
if (ctx->c == 128) { // buffer full ?
ctx->t[0] += ctx->c; // add counters
if (ctx->t[0] < ctx->c) // carry overflow ?
ctx->t[1]++; // high word
blake2b_compress(ctx, 0); // compress (not last)
ctx->c = 0; // counter to zero
}
ctx->b[ctx->c++] = ((const uint8_t *) in)[i];
}
}
// Generate the message digest (size given in init). // Result placed in "out".
//生成消息摘要（init中给出的大小）。//结果放在“输出”中。
void blake2b_final(blake2b_ctx *ctx, void *out)
{
size_t i;
void blake2b_final(blake2b_ctx *ctx, void *out)
{
size_t i;
ctx->t[0] += ctx->c; // mark last block offset
if (ctx->t[0] < ctx->c) // carry overflow
ctx->t[1]++; // high word
ctx->t[0] += ctx->c; // mark last block offset
if (ctx->t[0] < ctx->c) // carry overflow
ctx->t[1]++; // high word
while (ctx->c < 128) // fill up with zeros
ctx->b[ctx->c++] = 0;
blake2b_compress(ctx, 1); // final block flag = 1
while (ctx->c < 128) // fill up with zeros
ctx->b[ctx->c++] = 0;
blake2b_compress(ctx, 1); // final block flag = 1
// little endian convert and store
for (i = 0; i < ctx->outlen; i++) {
((uint8_t *) out)[i] =
(ctx->h[i >> 3] >> (8 * (i & 7))) & 0xFF;
}
}
// little endian convert and store
for (i = 0; i < ctx->outlen; i++) {
((uint8_t *) out)[i] =
(ctx->h[i >> 3] >> (8 * (i & 7))) & 0xFF;
}
}
// Convenience function for all-in-one computation.
//方便功能，可进行一体化计算。
int blake2b(void *out, size_t outlen,
const void *key, size_t keylen,
const void *in, size_t inlen)
{
blake2b_ctx ctx;
int blake2b(void *out, size_t outlen,
const void *key, size_t keylen,
const void *in, size_t inlen)
{
blake2b_ctx ctx;
if (blake2b_init(&ctx, outlen, key, keylen))
return -1;
blake2b_update(&ctx, in, inlen);
blake2b_final(&ctx, out);
if (blake2b_init(&ctx, outlen, key, keylen))
return -1;
blake2b_update(&ctx, in, inlen);
blake2b_final(&ctx, out);
return 0;
}
<CODE ENDS>
return 0;
}
<CODE ENDS>
<CODE BEGINS>
// blake2s.h
// BLAKE2s Hashing Context and API Prototypes
<CODE BEGINS>
// blake2s.h
// BLAKE2s Hashing Context and API Prototypes
#ifndef BLAKE2S_H #define BLAKE2S_H
#如果未定义BLAKE2S#u H#定义BLAKE2S#u H
#include <stdint.h>
#include <stddef.h>
#include <stdint.h>
#include <stddef.h>
// state context
typedef struct {
uint8_t b[64]; // input buffer
uint32_t h[8]; // chained state
uint32_t t[2]; // total number of bytes
size_t c; // pointer for b[]
size_t outlen; // digest size
} blake2s_ctx;
// state context
typedef struct {
uint8_t b[64]; // input buffer
uint32_t h[8]; // chained state
uint32_t t[2]; // total number of bytes
size_t c; // pointer for b[]
size_t outlen; // digest size
} blake2s_ctx;
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 32 gives the digest size in bytes.
// Secret key (also <= 32 bytes) is optional (keylen = 0).
int blake2s_init(blake2s_ctx *ctx, size_t outlen,
const void *key, size_t keylen); // secret key
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 32 gives the digest size in bytes.
// Secret key (also <= 32 bytes) is optional (keylen = 0).
int blake2s_init(blake2s_ctx *ctx, size_t outlen,
const void *key, size_t keylen); // secret key
// Add "inlen" bytes from "in" into the hash.
void blake2s_update(blake2s_ctx *ctx, // context
const void *in, size_t inlen); // data to be hashed
// Add "inlen" bytes from "in" into the hash.
void blake2s_update(blake2s_ctx *ctx, // context
const void *in, size_t inlen); // data to be hashed
// Generate the message digest (size given in init).
// Result placed in "out".
void blake2s_final(blake2s_ctx *ctx, void *out);
// Generate the message digest (size given in init).
// Result placed in "out".
void blake2s_final(blake2s_ctx *ctx, void *out);
// All-in-one convenience function.
int blake2s(void *out, size_t outlen, // return buffer for digest
const void *key, size_t keylen, // optional secret key
const void *in, size_t inlen); // data to be hashed
// All-in-one convenience function.
int blake2s(void *out, size_t outlen, // return buffer for digest
const void *key, size_t keylen, // optional secret key
const void *in, size_t inlen); // data to be hashed
#endif <CODE ENDS>
#endif<代码结束>
<CODE BEGINS> // blake2s.c // A simple blake2s Reference Implementation.
<CODE BEGINS>//blake2s.c//一个简单的blake2s参考实现。
#include "blake2s.h"
#包括“blake2s.h”
// Cyclic right rotation.
//循环右旋转。
#ifndef ROTR32
#define ROTR32(x, y) (((x) >> (y)) ^ ((x) << (32 - (y))))
#endif
#ifndef ROTR32
#define ROTR32(x, y) (((x) >> (y)) ^ ((x) << (32 - (y))))
#endif
// Little-endian byte access.
//小端字节访问。
#define B2S_GET32(p) \
(((uint32_t) ((uint8_t *) (p))[0]) ^ \
(((uint32_t) ((uint8_t *) (p))[1]) << 8) ^ \
(((uint32_t) ((uint8_t *) (p))[2]) << 16) ^ \
(((uint32_t) ((uint8_t *) (p))[3]) << 24))
#define B2S_GET32(p) \
(((uint32_t) ((uint8_t *) (p))[0]) ^ \
(((uint32_t) ((uint8_t *) (p))[1]) << 8) ^ \
(((uint32_t) ((uint8_t *) (p))[2]) << 16) ^ \
(((uint32_t) ((uint8_t *) (p))[3]) << 24))
// Mixing function G.
//混合函数G。
#define B2S_G(a, b, c, d, x, y) { \
v[a] = v[a] + v[b] + x; \
v[d] = ROTR32(v[d] ^ v[a], 16); \
v[c] = v[c] + v[d]; \
v[b] = ROTR32(v[b] ^ v[c], 12); \
v[a] = v[a] + v[b] + y; \
v[d] = ROTR32(v[d] ^ v[a], 8); \
v[c] = v[c] + v[d]; \
v[b] = ROTR32(v[b] ^ v[c], 7); }
#define B2S_G(a, b, c, d, x, y) { \
v[a] = v[a] + v[b] + x; \
v[d] = ROTR32(v[d] ^ v[a], 16); \
v[c] = v[c] + v[d]; \
v[b] = ROTR32(v[b] ^ v[c], 12); \
v[a] = v[a] + v[b] + y; \
v[d] = ROTR32(v[d] ^ v[a], 8); \
v[c] = v[c] + v[d]; \
v[b] = ROTR32(v[b] ^ v[c], 7); }
// Initialization Vector.
//初始化向量。
static const uint32_t blake2s_iv[8] =
{
0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
};
static const uint32_t blake2s_iv[8] =
{
0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
};
// Compression function. "last" flag indicates last block.
//压缩功能。“last”标志表示最后一个块。
static void blake2s_compress(blake2s_ctx *ctx, int last)
{
const uint8_t sigma[10][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }
};
int i;
uint32_t v[16], m[16];
static void blake2s_compress(blake2s_ctx *ctx, int last)
{
const uint8_t sigma[10][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
{ 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
{ 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
{ 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
{ 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
{ 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
{ 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
{ 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
{ 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 }
};
int i;
uint32_t v[16], m[16];
for (i = 0; i < 8; i++) { // init work variables
v[i] = ctx->h[i];
v[i + 8] = blake2s_iv[i];
}
for (i = 0; i < 8; i++) { // init work variables
v[i] = ctx->h[i];
v[i + 8] = blake2s_iv[i];
}
v[12] ^= ctx->t[0]; // low 32 bits of offset
v[13] ^= ctx->t[1]; // high 32 bits
if (last) // last block flag set ?
v[14] = ~v[14];
v[12] ^= ctx->t[0]; // low 32 bits of offset
v[13] ^= ctx->t[1]; // high 32 bits
if (last) // last block flag set ?
v[14] = ~v[14];
for (i = 0; i < 16; i++) // get little-endian words
m[i] = B2S_GET32(&ctx->b[4 * i]);
for (i = 0; i < 16; i++) // get little-endian words
m[i] = B2S_GET32(&ctx->b[4 * i]);
for (i = 0; i < 10; i++) { // ten rounds
B2S_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]);
B2S_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]);
B2S_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]);
B2S_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]);
B2S_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]);
B2S_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]);
B2S_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]);
B2S_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]);
}
for (i = 0; i < 10; i++) { // ten rounds
B2S_G( 0, 4, 8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]);
B2S_G( 1, 5, 9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]);
B2S_G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]);
B2S_G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]);
B2S_G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]);
B2S_G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]);
B2S_G( 2, 7, 8, 13, m[sigma[i][12]], m[sigma[i][13]]);
B2S_G( 3, 4, 9, 14, m[sigma[i][14]], m[sigma[i][15]]);
}
for( i = 0; i < 8; ++i )
ctx->h[i] ^= v[i] ^ v[i + 8];
}
for( i = 0; i < 8; ++i )
ctx->h[i] ^= v[i] ^ v[i + 8];
}
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 32 gives the digest size in bytes.
// Secret key (also <= 32 bytes) is optional (keylen = 0).
// Initialize the hashing context "ctx" with optional key "key".
// 1 <= outlen <= 32 gives the digest size in bytes.
// Secret key (also <= 32 bytes) is optional (keylen = 0).
int blake2s_init(blake2s_ctx *ctx, size_t outlen,
const void *key, size_t keylen) // (keylen=0: no key)
{
size_t i;
int blake2s_init(blake2s_ctx *ctx, size_t outlen,
const void *key, size_t keylen) // (keylen=0: no key)
{
size_t i;
if (outlen == 0 || outlen > 32 || keylen > 32)
return -1; // illegal parameters
if (outlen == 0 || outlen > 32 || keylen > 32)
return -1; // illegal parameters
for (i = 0; i < 8; i++) // state, "param block"
ctx->h[i] = blake2s_iv[i];
ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen;
for (i = 0; i < 8; i++) // state, "param block"
ctx->h[i] = blake2s_iv[i];
ctx->h[0] ^= 0x01010000 ^ (keylen << 8) ^ outlen;
ctx->t[0] = 0; // input count low word
ctx->t[1] = 0; // input count high word
ctx->c = 0; // pointer within buffer
ctx->outlen = outlen;
ctx->t[0] = 0; // input count low word
ctx->t[1] = 0; // input count high word
ctx->c = 0; // pointer within buffer
ctx->outlen = outlen;
for (i = keylen; i < 64; i++) // zero input block
ctx->b[i] = 0;
if (keylen > 0) {
blake2s_update(ctx, key, keylen);
ctx->c = 64; // at the end
}
for (i = keylen; i < 64; i++) // zero input block
ctx->b[i] = 0;
if (keylen > 0) {
blake2s_update(ctx, key, keylen);
ctx->c = 64; // at the end
}
return 0;
}
return 0;
}
// Add "inlen" bytes from "in" into the hash.
//将“in”中的“inlen”字节添加到哈希中。
void blake2s_update(blake2s_ctx *ctx,
const void *in, size_t inlen) // data bytes
{
size_t i;
void blake2s_update(blake2s_ctx *ctx,
const void *in, size_t inlen) // data bytes
{
size_t i;
for (i = 0; i < inlen; i++) {
if (ctx->c == 64) { // buffer full ?
ctx->t[0] += ctx->c; // add counters
if (ctx->t[0] < ctx->c) // carry overflow ?
ctx->t[1]++; // high word
blake2s_compress(ctx, 0); // compress (not last)
ctx->c = 0; // counter to zero
}
ctx->b[ctx->c++] = ((const uint8_t *) in)[i];
}
}
for (i = 0; i < inlen; i++) {
if (ctx->c == 64) { // buffer full ?
ctx->t[0] += ctx->c; // add counters
if (ctx->t[0] < ctx->c) // carry overflow ?
ctx->t[1]++; // high word
blake2s_compress(ctx, 0); // compress (not last)
ctx->c = 0; // counter to zero
}
ctx->b[ctx->c++] = ((const uint8_t *) in)[i];
}
}
// Generate the message digest (size given in init). // Result placed in "out".
//生成消息摘要（init中给出的大小）。//结果放在“输出”中。
void blake2s_final(blake2s_ctx *ctx, void *out)
{
size_t i;
void blake2s_final(blake2s_ctx *ctx, void *out)
{
size_t i;
ctx->t[0] += ctx->c; // mark last block offset
if (ctx->t[0] < ctx->c) // carry overflow
ctx->t[1]++; // high word
ctx->t[0] += ctx->c; // mark last block offset
if (ctx->t[0] < ctx->c) // carry overflow
ctx->t[1]++; // high word
while (ctx->c < 64) // fill up with zeros
ctx->b[ctx->c++] = 0;
blake2s_compress(ctx, 1); // final block flag = 1
while (ctx->c < 64) // fill up with zeros
ctx->b[ctx->c++] = 0;
blake2s_compress(ctx, 1); // final block flag = 1
// little endian convert and store
for (i = 0; i < ctx->outlen; i++) {
((uint8_t *) out)[i] =
(ctx->h[i >> 2] >> (8 * (i & 3))) & 0xFF;
}
}
// little endian convert and store
for (i = 0; i < ctx->outlen; i++) {
((uint8_t *) out)[i] =
(ctx->h[i >> 2] >> (8 * (i & 3))) & 0xFF;
}
}
// Convenience function for all-in-one computation.
//方便功能，可进行一体化计算。
int blake2s(void *out, size_t outlen,
const void *key, size_t keylen,
const void *in, size_t inlen)
{
blake2s_ctx ctx;
int blake2s(void *out, size_t outlen,
const void *key, size_t keylen,
const void *in, size_t inlen)
{
blake2s_ctx ctx;
if (blake2s_init(&ctx, outlen, key, keylen))
return -1;
blake2s_update(&ctx, in, inlen);
blake2s_final(&ctx, out);
if (blake2s_init(&ctx, outlen, key, keylen))
return -1;
blake2s_update(&ctx, in, inlen);
blake2s_final(&ctx, out);
return 0;
}
<CODE ENDS>
return 0;
}
<CODE ENDS>
This module computes a series of keyed and unkeyed hashes from deterministically generated pseudorandom data and computes a hash over those results. This is a fairly exhaustive, yet compact and fast method for verifying that the hashing module is functioning correctly.
此模块从确定生成的伪随机数据计算一系列键控和非键控哈希，并对这些结果计算哈希。这是一种相当详尽、紧凑且快速的方法，用于验证哈希模块是否正常工作。
Such testing is RECOMMENDED, especially when compiling the implementation for a new a target platform configuration. Furthermore, some security standards, such as FIPS-140, may require a Power-On Self Test (POST) to be performed every time the cryptographic module is loaded [FIPS140-2IG].
建议进行此类测试，尤其是在为新的目标平台配置编译实现时。此外，一些安全标准，如FIPS-140，可能要求每次加载加密模块时都要执行开机自检（POST）[FIPS140-2IG]。
<CODE BEGINS> // test_main.c // Self test Modules for BLAKE2b and BLAKE2s -- and a stub main().
<CODE BEGINS>//test_main.c//BLAKE2b和BLAKE2s的自检模块——以及存根main（）。
#include <stdio.h>
#include <stdio.h>
#include "blake2b.h" #include "blake2s.h"
#包括“blake2b.h”#包括“blake2s.h”
// Deterministic sequences (Fibonacci generator).
//确定性序列（斐波那契发生器）。
static void selftest_seq(uint8_t *out, size_t len, uint32_t seed)
{
size_t i;
uint32_t t, a , b;
static void selftest_seq(uint8_t *out, size_t len, uint32_t seed)
{
size_t i;
uint32_t t, a , b;
a = 0xDEAD4BAD * seed; // prime
b = 1;
a = 0xDEAD4BAD * seed; // prime
b = 1;
for (i = 0; i < len; i++) { // fill the buf
t = a + b;
a = b;
b = t;
out[i] = (t >> 24) & 0xFF;
}
for (i = 0; i < len; i++) { // fill the buf
t = a + b;
a = b;
b = t;
out[i] = (t >> 24) & 0xFF;
}
}
}
// BLAKE2b self-test validation. Return 0 when OK.
//BLAKE2b自检验证。确定时返回0。
int blake2b_selftest()
{
// grand hash of hash results
const uint8_t blake2b_res[32] = {
0xC2, 0x3A, 0x78, 0x00, 0xD9, 0x81, 0x23, 0xBD,
0x10, 0xF5, 0x06, 0xC6, 0x1E, 0x29, 0xDA, 0x56,
0x03, 0xD7, 0x63, 0xB8, 0xBB, 0xAD, 0x2E, 0x73,
0x7F, 0x5E, 0x76, 0x5A, 0x7B, 0xCC, 0xD4, 0x75
};
// parameter sets
const size_t b2b_md_len[4] = { 20, 32, 48, 64 };
const size_t b2b_in_len[6] = { 0, 3, 128, 129, 255, 1024 };
int blake2b_selftest()
{
// grand hash of hash results
const uint8_t blake2b_res[32] = {
0xC2, 0x3A, 0x78, 0x00, 0xD9, 0x81, 0x23, 0xBD,
0x10, 0xF5, 0x06, 0xC6, 0x1E, 0x29, 0xDA, 0x56,
0x03, 0xD7, 0x63, 0xB8, 0xBB, 0xAD, 0x2E, 0x73,
0x7F, 0x5E, 0x76, 0x5A, 0x7B, 0xCC, 0xD4, 0x75
};
// parameter sets
const size_t b2b_md_len[4] = { 20, 32, 48, 64 };
const size_t b2b_in_len[6] = { 0, 3, 128, 129, 255, 1024 };
size_t i, j, outlen, inlen;
uint8_t in[1024], md[64], key[64];
blake2b_ctx ctx;
size_t i, j, outlen, inlen;
uint8_t in[1024], md[64], key[64];
blake2b_ctx ctx;
// 256-bit hash for testing
if (blake2b_init(&ctx, 32, NULL, 0))
return -1;
// 256-bit hash for testing
if (blake2b_init(&ctx, 32, NULL, 0))
return -1;
for (i = 0; i < 4; i++) {
outlen = b2b_md_len[i];
for (j = 0; j < 6; j++) {
inlen = b2b_in_len[j];
for (i = 0; i < 4; i++) {
outlen = b2b_md_len[i];
for (j = 0; j < 6; j++) {
inlen = b2b_in_len[j];
selftest_seq(in, inlen, inlen); // unkeyed hash
blake2b(md, outlen, NULL, 0, in, inlen);
blake2b_update(&ctx, md, outlen); // hash the hash
selftest_seq(in, inlen, inlen); // unkeyed hash
blake2b(md, outlen, NULL, 0, in, inlen);
blake2b_update(&ctx, md, outlen); // hash the hash
selftest_seq(key, outlen, outlen); // keyed hash
blake2b(md, outlen, key, outlen, in, inlen);
blake2b_update(&ctx, md, outlen); // hash the hash
}
}
selftest_seq(key, outlen, outlen); // keyed hash
blake2b(md, outlen, key, outlen, in, inlen);
blake2b_update(&ctx, md, outlen); // hash the hash
}
}
// compute and compare the hash of hashes
blake2b_final(&ctx, md);
for (i = 0; i < 32; i++) {
if (md[i] != blake2b_res[i])
return -1;
}
// compute and compare the hash of hashes
blake2b_final(&ctx, md);
for (i = 0; i < 32; i++) {
if (md[i] != blake2b_res[i])
return -1;
}
return 0;
返回0；
}
}
// BLAKE2s self-test validation. Return 0 when OK.
//BLAKE2s自检验证。确定时返回0。
int blake2s_selftest()
{
// Grand hash of hash results.
const uint8_t blake2s_res[32] = {
0x6A, 0x41, 0x1F, 0x08, 0xCE, 0x25, 0xAD, 0xCD,
0xFB, 0x02, 0xAB, 0xA6, 0x41, 0x45, 0x1C, 0xEC,
0x53, 0xC5, 0x98, 0xB2, 0x4F, 0x4F, 0xC7, 0x87,
0xFB, 0xDC, 0x88, 0x79, 0x7F, 0x4C, 0x1D, 0xFE
};
// Parameter sets.
const size_t b2s_md_len[4] = { 16, 20, 28, 32 };
const size_t b2s_in_len[6] = { 0, 3, 64, 65, 255, 1024 };
int blake2s_selftest()
{
// Grand hash of hash results.
const uint8_t blake2s_res[32] = {
0x6A, 0x41, 0x1F, 0x08, 0xCE, 0x25, 0xAD, 0xCD,
0xFB, 0x02, 0xAB, 0xA6, 0x41, 0x45, 0x1C, 0xEC,
0x53, 0xC5, 0x98, 0xB2, 0x4F, 0x4F, 0xC7, 0x87,
0xFB, 0xDC, 0x88, 0x79, 0x7F, 0x4C, 0x1D, 0xFE
};
// Parameter sets.
const size_t b2s_md_len[4] = { 16, 20, 28, 32 };
const size_t b2s_in_len[6] = { 0, 3, 64, 65, 255, 1024 };
size_t i, j, outlen, inlen;
uint8_t in[1024], md[32], key[32];
blake2s_ctx ctx;
size_t i, j, outlen, inlen;
uint8_t in[1024], md[32], key[32];
blake2s_ctx ctx;
// 256-bit hash for testing.
if (blake2s_init(&ctx, 32, NULL, 0))
return -1;
// 256-bit hash for testing.
if (blake2s_init(&ctx, 32, NULL, 0))
return -1;
for (i = 0; i < 4; i++) {
outlen = b2s_md_len[i];
for (j = 0; j < 6; j++) {
inlen = b2s_in_len[j];
for (i = 0; i < 4; i++) {
outlen = b2s_md_len[i];
for (j = 0; j < 6; j++) {
inlen = b2s_in_len[j];
selftest_seq(in, inlen, inlen); // unkeyed hash
blake2s(md, outlen, NULL, 0, in, inlen);
blake2s_update(&ctx, md, outlen); // hash the hash
selftest_seq(in, inlen, inlen); // unkeyed hash
blake2s(md, outlen, NULL, 0, in, inlen);
blake2s_update(&ctx, md, outlen); // hash the hash
selftest_seq(key, outlen, outlen); // keyed hash
blake2s(md, outlen, key, outlen, in, inlen);
blake2s_update(&ctx, md, outlen); // hash the hash
}
}
selftest_seq(key, outlen, outlen); // keyed hash
blake2s(md, outlen, key, outlen, in, inlen);
blake2s_update(&ctx, md, outlen); // hash the hash
}
}
// Compute and compare the hash of hashes.
blake2s_final(&ctx, md);
for (i = 0; i < 32; i++) {
if (md[i] != blake2s_res[i])
return -1;
}
// Compute and compare the hash of hashes.
blake2s_final(&ctx, md);
for (i = 0; i < 32; i++) {
if (md[i] != blake2s_res[i])
return -1;
}
return 0;
返回0；
}
}
// Test driver.
//试驾。
int main(int argc, char **argv)
{
printf("blake2b_selftest() = %s\n",
blake2b_selftest() ? "FAIL" : "OK");
printf("blake2s_selftest() = %s\n",
blake2s_selftest() ? "FAIL" : "OK");
int main(int argc, char **argv)
{
printf("blake2b_selftest() = %s\n",
blake2b_selftest() ? "FAIL" : "OK");
printf("blake2s_selftest() = %s\n",
blake2s_selftest() ? "FAIL" : "OK");
return 0;
}
<CODE ENDS>
return 0;
}
<CODE ENDS>
Acknowledgements
致谢
The editor wishes to thank the [BLAKE2] team for their encouragement: Jean-Philippe Aumasson, Samuel Neves, Zooko Wilcox-O'Hearn, and Christian Winnerlein. We have borrowed passages from [BLAKE] and [BLAKE2] with permission.
编辑希望感谢[BLAKE2]团队的鼓励：Jean-Philippe Aumasson、Samuel Neves、Zooko Wilcox-O'Hearn和Christian Winnerlein。经允许，我们借用了[BLAKE]和[BLAKE2]的文章。
[BLAKE2] is based on the SHA-3 proposal [BLAKE], designed by Jean-Philippe Aumasson, Luca Henzen, Willi Meier, and Raphael C.-W. Phan. BLAKE2, like BLAKE, relies on a core algorithm borrowed from the ChaCha stream cipher, designed by Daniel J. Bernstein.
[BLAKE2]基于SHA-3计划[BLAKE]，由Jean-Philippe Aumasson、Luca Henzen、Willi Meier和Raphael C.-W.Phan设计。BLAKE2和BLAKE一样，依赖于从Daniel J.Bernstein设计的ChaCha流密码中借用的核心算法。
Authors' Addresses
作者地址
Markku-Juhani O. Saarinen (editor) Queen's University Belfast Centre for Secure Information Technologies, ECIT Northern Ireland Science Park Queen's Road, Queen's Island Belfast BT3 9DT United Kingdom
Markku Juhani O.Saarinen（编辑）皇后大学贝尔法斯特安全信息技术中心，ECIT北爱尔兰科技园，皇后岛贝尔法斯特BT3 9DT英国
Email: m.saarinen@qub.ac.uk
URI: http://www.csit.qub.ac.uk
Email: m.saarinen@qub.ac.uk
URI: http://www.csit.qub.ac.uk
Jean-Philippe Aumasson Kudelski Security 22-24, Route de Geneve Case Postale 134 Cheseaux 1033 Switzerland
Jean-Philippe Aumasson-Kudelski安全22-24，Geneve路案件邮政134瑞士Cheseaux 1033
Email: jean-philippe.aumasson@nagra.com
URI: https://www.kudelskisecurity.com
Email: jean-philippe.aumasson@nagra.com
URI: https://www.kudelskisecurity.com