POLYVAL is a GHASH-like universal hash function defined over GF(2^128). It's a sort of "mirror image" of GHASH optimized for little endian architectures. As such, it can be used as the core of GHASH.

This is an implementation I wrote awhile ago based on (at the time) draft-irtf-cfrg-gcmsiv (now RFC 8452 Section 3). It is definitely unfinished and ~~has never been run against test vectors~~ ~~is presently failing the test vectors, so for now ASSUME IT IS BROKEN AND SHOULD NOT BE USED~~ passes the test vectors!

The implementation uses Shay Gueron's techniques for efficient finite field multiplication with PCLMULQDQ, including a Montgomery fast reduction method. For background on how these work, see this excellent blog post by QuarksLab:

https://blog.quarkslab.com/reversing-a-finite-field-multiplication-optimization.html

When using these techniques, it's still not as fast as I'd like, but certainly acceptable performance (edit: updated):

test bench1_10    ... bench:          18 ns/iter (+/- 1) = 555 MB/s
test bench2_100   ... bench:          85 ns/iter (+/- 7) = 1176 MB/s
test bench3_1000  ... bench:         797 ns/iter (+/- 126) = 1254 MB/s
test bench3_10000 ... bench:       7,558 ns/iter (+/- 733) = 1323 MB/s

It contains a fallback implementation used when PCLMULQDQ isn't available (gated under the off-by-default insecure-soft cargo feature) which is both non-constant-time (😱) and abysmally slow:

test bench1_10    ... bench:         206 ns/iter (+/- 20) = 48 MB/s
test bench2_100   ... bench:       1,981 ns/iter (+/- 187) = 50 MB/s
test bench3_1000  ... bench:      19,648 ns/iter (+/- 1,907) = 50 MB/s
test bench3_10000 ... bench:     194,441 ns/iter (+/- 21,198) = 51 MB/s

I seem to be getting incorrect results when using the hmac crate with blake2s. I have verified that the implementation of the hash functions themselves behave identically.

HMAC-Blake2s : mismatching output

MACing the empty message with the empty key, using Go /x/crypto for reference:

package main

import (
	"crypto/hmac"
	"encoding/hex"
	"fmt"
	"golang.org/x/crypto/blake2s"
	"hash"
)

func main() {
	var sum [blake2s.Size]byte
	mac := hmac.New(func() hash.Hash {
		h, _ := blake2s.New256(nil)
		return h
	}, []byte{})
	mac.Sum(sum[:0])
	fmt.Println(hex.EncodeToString(sum[:]))
}

Go Playground

Outputs eaf4bb25938f4d20e72656bbbc7a9bf63c0c18537333c35bdb67db1402661acd

use blake2::Blake2s;
use hex;
use hmac::Hmac;
use hmac::Mac;

fn main() {
    let mac = Hmac::<Blake2s>::new_varkey(&[]).unwrap();
    println!("{}", hex::encode(mac.result().code()));
}

Outputs 972c8a67004c0a295f6aa879b2130cada52849501e36bd1791b588a356ea852f

HMAC-SHA256 : identical output

The same behaviour does not occur when instantiating HMAC with SHA256:

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
)

func main() {
	var sum [sha256.Size]byte
	mac := hmac.New(sha256.New, []byte{})
	mac.Sum(sum[:0])
	fmt.Println(hex.EncodeToString(sum[:]))
}

Go Playgound

Outputs b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad

use hex;
use hmac::Hmac;
use hmac::Mac;
use sha2::Sha256;

fn main() {
    let mac = Hmac::<Sha256>::new_varkey(&[]).unwrap();
    println!("{}", hex::encode(mac.result().code()));
}

Outputs b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad

I have reason to believe the Rust implementation is at fault: the Go code is used in wireguard-go and successfully performs cryptographic handshakes with other compatible clients.

This PR adds an initial poly1305 crate based on the rust-crypto implementation of Poly1305 (which in turn is a translation of poly1305-donna):

https://github.com/DaGenix/rust-crypto/blob/9a4d8f279b643b8ae006e442141571fc7a85a3cf/src/poly1305.rs

I've done the minimal work to adapt it to crypto_mac::Mac and generally fact it more like the rest of RustCrypto/MACs.

Performance is good enough for my purposes, but could be better w\ SIMD acceleration. Benchmark using the crypto-mac crate's bench! macro on a 3.1 GHz Intel Core i7:

running 4 tests
test bench1_10    ... bench:          21 ns/iter (+/- 1) = 476 MB/s
test bench2_100   ... bench:         100 ns/iter (+/- 21) = 1000 MB/s
test bench3_1000  ... bench:         900 ns/iter (+/- 250) = 1111 MB/s
test bench3_10000 ... bench:       8,937 ns/iter (+/- 1,075) = 1118 MB/s

I will throw the code into Godbolt so we can do some inspection of whether or not the implementation appears to be constant-time on select platforms.

Currently the MACs that use block ciphers (CMAC, PMAC) require the BlockCipher in use to be Clone.

It seems to me that it should be possible to not require Clone. Instead, conditionally implement Clone for the Mac if the BlockCipher is Clone?

This would be a breaking change though. Generic code that needs cloning is now requiring just Mac, and it'll now have to require Mac + Clone

My use case is using a custom block cipher that contains &mut's inside, so it can't be cloned. (I know it's weird, it's a cipher that does very expensive calculations that sometimes can be cached so it has a mutable ref to a cache).

I want to get String result to make request header. so I used std::str::from_utf8 but it failed and get Utf8Error, like below.

let mut mac = HmacSha256::new_varkey(b"my secret and secure key")
    .expect("HMAC can take key of any size");
mac.input(b"input message");
let result = mac.result();
let code_bytes = result.code();

// Err(Utf8Error { valid_up_to: 0, error_len: Some(1) })
println!("{:?}", std::str::from_utf8(code_bytes.as_slice()));

Looks like updating from 11.0 -> 12.1 moved the Implementation of Reset behind a feature flag.

hmac = {version="0.12.1", features=["reset"]} in your Cargo.toml will fix issues like

56 |         let sign = mac.finalize_reset().into_bytes();
   |                        ^^^^^^^^^^^^^^ the trait `Reset` is not implemented for `HmacCore<CoreWrapper<CtVariableCoreWrapper<Sha256VarCore, sha2::digest::typenum::UInt<sha2::digest::typenum::UInt<sha2::digest::typenum::UInt<sha2::digest::typenum::UInt<sha2::digest::typenum::UInt<sha2::digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, OidSha256>>>`

For types like hmac::Hmac<sha2::Sha256>, hmac::Hmac<sha2::Sha384>, hmac::Hmac<sha2::Sha512>

Putting this here purely so I help someone else arrive at the same conclusion faster.

I wrote this function with hmac 0.11, digest 0.9:

fn hmac<D>(secret: AnyLuaValue, msg: AnyLuaValue) -> Result<AnyLuaValue>
    where
        D: Update + BlockInput + FixedOutput + Reset + Default + Clone,
        D::BlockSize: ArrayLength<u8> + Clone,
        D::OutputSize: ArrayLength<u8>,
{
    let secret = byte_array(secret)?;
    let msg = byte_array(msg)?;

    let mut mac = match Hmac::<D>::new_from_slice(&secret) {
        Ok(mac) => mac,
        Err(_) => bail!("Invalid key length"),
    };
    mac.update(&msg);
    let result = mac.finalize();
    Ok(lua_bytes(&result.into_bytes()))
}

I'm having trouble porting this to the latest version of those crates, I'm getting errors like this:

error[E0599]: the function or associated item `new_from_slice` exists for struct `CoreWrapper<HmacCore<D>>`, but its trait bounds were not satisfied
   --> src/runtime.rs:161:36
    |
161 |       let mut mac = match Hmac::<D>::new_from_slice(&secret) {
    |                                      ^^^^^^^^^^^^^^ function or associated item cannot be called on `CoreWrapper<HmacCore<D>>` due to unsatisfied trait bounds
    |
   ::: /home/user/.cargo/registry/src/github.com-1ecc6299db9ec823/digest-0.10.3/src/core_api/wrapper.rs:22:1
    |
22  | / pub struct CoreWrapper<T>
23  | | where
24  | |     T: BufferKindUser,
25  | |     T::BlockSize: IsLess<U256>,
...   |
29  | |     buffer: BlockBuffer<T::BlockSize, T::BufferKind>,
30  | | }
    | | -
    | | |
    | | doesn't satisfy `CoreWrapper<HmacCore<D>>: FixedOutput`
    | | doesn't satisfy `CoreWrapper<HmacCore<D>>: MacMarker`
    | |_doesn't satisfy `CoreWrapper<HmacCore<D>>: Mac`
    |   doesn't satisfy `CoreWrapper<HmacCore<D>>: Update`
    |
    = note: the following trait bounds were not satisfied:
            `CoreWrapper<HmacCore<D>>: Update`
            which is required by `CoreWrapper<HmacCore<D>>: Mac`
            `CoreWrapper<HmacCore<D>>: FixedOutput`
            which is required by `CoreWrapper<HmacCore<D>>: Mac`
            `CoreWrapper<HmacCore<D>>: MacMarker`
            which is required by `CoreWrapper<HmacCore<D>>: Mac`
            `&CoreWrapper<HmacCore<D>>: Update`
            which is required by `&CoreWrapper<HmacCore<D>>: Mac`
            `&CoreWrapper<HmacCore<D>>: FixedOutput`
            which is required by `&CoreWrapper<HmacCore<D>>: Mac`
            `&CoreWrapper<HmacCore<D>>: MacMarker`
            which is required by `&CoreWrapper<HmacCore<D>>: Mac`
            `&CoreWrapper<HmacCore<D>>: InnerInit`
            which is required by `&CoreWrapper<HmacCore<D>>: digest::KeyInit`
            `&CoreWrapper<HmacCore<D>>: InnerUser`
            which is required by `&CoreWrapper<HmacCore<D>>: digest::KeyInit`
            `&mut CoreWrapper<HmacCore<D>>: Update`
            which is required by `&mut CoreWrapper<HmacCore<D>>: Mac`
            `&mut CoreWrapper<HmacCore<D>>: FixedOutput`
            which is required by `&mut CoreWrapper<HmacCore<D>>: Mac`
            `&mut CoreWrapper<HmacCore<D>>: MacMarker`
            which is required by `&mut CoreWrapper<HmacCore<D>>: Mac`
            `&mut CoreWrapper<HmacCore<D>>: InnerInit`
            which is required by `&mut CoreWrapper<HmacCore<D>>: digest::KeyInit`
            `&mut CoreWrapper<HmacCore<D>>: InnerUser`
            which is required by `&mut CoreWrapper<HmacCore<D>>: digest::KeyInit`

error[E0277]: the trait bound `<D as digest::core_api::CoreProxy>::Core: FixedOutputCore` is not satisfied
   --> src/runtime.rs:161:25
    |
161 |     let mut mac = match Hmac::<D>::new_from_slice(&secret) {
    |                         ^^^^^^^^^ the trait `FixedOutputCore` is not implemented for `<D as digest::core_api::CoreProxy>::Core`
    |
    = note: required because of the requirements on the impl of `BlockSizeUser` for `HmacCore<D>`
help: consider further restricting the associated type
    |
142 |         <D as digest::core_api::CoreProxy>::Core: HashMarker, <D as digest::core_api::CoreProxy>::Core: FixedOutputCore
    |                                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

warning: unused import: `Update`
 --> src/runtime.rs:9:22
  |
9 | use digest::{Digest, Update, FixedOutput, Reset};
  |                      ^^^^^^

warning: unused import: `Mac`
  --> src/runtime.rs:11:18
   |
11 | use hmac::{Hmac, Mac};
   |                  ^^^

warning: unused import: `typenum`
   --> src/runtime.rs:130:5
    |
130 | use typenum::*;
    |     ^^^^^^^

Some errors have detailed explanations: E0277, E0599.
For more information about an error, try `rustc --explain E0277`.
warning: `authoscope` (lib) generated 6 warnings
error: could not compile `authoscope` due to 2 previous errors; 6 warnings emitted

but the suggested code errors like this:

error[E0277]: the trait bound `<<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize: Cmp<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>>` is not satisfied
   --> src/runtime.rs:142:64
    |
142 |         <D as digest::core_api::CoreProxy>::Core: HashMarker + FixedOutputCore,
    |                                                                ^^^^^^^^^^^^^^^ the trait `Cmp<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>>` is not implemented for `<<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize`
    |
    = note: required because of the requirements on the impl of `IsLess<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>>` for `<<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize`
help: consider further restricting the associated type
    |
142 |         <D as digest::core_api::CoreProxy>::Core: HashMarker + FixedOutputCore, <<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize: Cmp<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>>
    |                                                                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

error[E0283]: type annotations needed
   --> src/runtime.rs:142:64
    |
142 |         <D as digest::core_api::CoreProxy>::Core: HashMarker + FixedOutputCore,
    |                                                                ^^^^^^^^^^^^^^^ cannot infer type
    |
    = note: multiple `impl`s satisfying `<<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLessPrivate<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, _>` found in the `typenum` crate:
            - impl<A, B> IsLessPrivate<B, digest::typenum::Equal> for A;
            - impl<A, B> IsLessPrivate<B, digest::typenum::Greater> for A;
            - impl<A, B> IsLessPrivate<B, digest::typenum::Less> for A;
    = note: required because of the requirements on the impl of `IsLess<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<digest::typenum::UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>, B0>, B0>>` for `<<D as digest::core_api::CoreProxy>::Core as BlockSizeUser>::BlockSize`

Some errors have detailed explanations: E0277, E0283.
For more information about an error, try `rustc --explain E0277`.
warning: `authoscope` (lib) generated 3 warnings
error: could not compile `authoscope` due to 2 previous errors; 3 warnings emitted

any pointers?

The default example doesn't seem to work for me and running cargo check in the terminal confirms it.

[dependencies] sha2 = "0.10.2" hmac = "0.12.1"

I'm using coinbase-rs which has a dependency on hmac, causing builds to fail like this:

$ cargo run
    Updating crates.io index
error: failed to select a version for the requirement `crypto-mac = "^0.7"`
candidate versions found which didn't match: 0.11.1, 0.11.0, 0.10.1, ...
location searched: crates.io index
required by package `hmac v0.7.0`
    ... which is depended on by `coinbase-rs v0.3.0`
    ... which is depended on by `cb-candles v0.1.0 (/home/blake/workspace/cb-candles)`

hmac already has a bumped version of crypto-mac, but should yank 0.7.0 so that coinbase-rs builds fail

Changed

• Bump aes crate dependency to v0.4 (#40)
• Bump dbl crate dependency to v0.3 (#39)
• Bump crypto-mac dependency to v0.8; MSRV 1.41+ (#34)
• Rename result methods to finalize (#38)
• Upgrade to Rust 2018 edition (#34)

CI is broken (ostensibly also for master) because typenum switched to using nested import braces, which are unsupported on 1.21:

https://travis-ci.org/RustCrypto/MACs/jobs/576563817

So it seems 1.21 is below typenum's MSRV. Since we plan on bumping MSRV anyway, this removes the tests for 1.21 so master CI passes again.

Right now public bounds are quite scary:

pub struct HmacCore<D>
where
    D: CoreProxy,
    D::Core: HashMarker
        + UpdateCore
        + FixedOutputCore
        + BufferKindUser<BufferKind = Eager>
        + Default
        + Clone,
    <D::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
    Le<<D::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
{ .. }

Ideally we would use trait aliases, but they are currently not available in stable Rust. As a workaround we can introduce a sealed trait with blanket impl for types which satisfy the current bound and use it in our public bounds.

List of "would be nice to have" algorithms:

• [ ] CBC-MAC (#103)
• [ ] GMAC
• [x] CMAC (OMAC1)
• [ ] KMAC
• [ ] OMAC2
• [x] PMAC (#2)
• [ ] UMAC
• [ ] VMAC
• [x] Poly1305 (#14)

It can be changed based on discussion.