Cryptography: Divide mount and boot times by 2 using a pre-computation of values used in PRF HMac calculation (thanks to Xavier de Carné de Carnavalet for finding this optimization).

author: Mounir IDRASSI <mounir.idrassi@idrix.fr> 2016-01-17 02:24:22 +0100
committer: Mounir IDRASSI <mounir.idrassi@idrix.fr> 2016-01-17 10:52:29 +0100
commit: 59afc2c4d9704476bdaf8c4c8b45684a80781a06 (patch)
tree: a6eea03b8651260f24feda750a9cdf218ba62d7d
parent: dd1e62ebcd62338b2cf16ebab6157c9e74416a0e (diff)
download: VeraCrypt-59afc2c4d9704476bdaf8c4c8b45684a80781a06.tar.gz
VeraCrypt-59afc2c4d9704476bdaf8c4c8b45684a80781a06.zip
1 files changed, 259 insertions, 106 deletions
diff --git a/src/Common/Pkcs5.c b/src/Common/Pkcs5.c
index 5e626a32..3fc75167 100644
--- a/src/Common/Pkcs5.c
+++ b/src/Common/Pkcs5.c
@@ -19,7 +19,16 @@
 #ifndef TC_WINDOWS_BOOT
 #include "Sha2.h"
 #include "Whirlpool.h"
+#include "misc.h"
 #else
+#pragma optimize ("t", on)
+#include <string.h>
+#if defined( _MSC_VER )
+#  ifndef DEBUG
+#    pragma intrinsic( memcpy )
+#    pragma intrinsic( memset )
+#  endif
+#endif
 #include "Sha2Small.h"
 #endif
 #include "Pkcs5.h"
@@ -42,7 +51,8 @@ void hmac_truncate
 typedef struct hmac_sha256_ctx_struct
 {
 	sha256_ctx ctx;
-	char buf[SHA256_BLOCKSIZE];
+	sha256_ctx inner_digest_ctx; /*pre-computed inner digest context */
+	sha256_ctx outer_digest_ctx; /*pre-computed outer digest context */
 	char k[PKCS5_SALT_SIZE + 4]; /* enough to hold (salt_len + 4) and also the SHA256 hash */
 	char u[SHA256_DIGESTSIZE];
 } hmac_sha256_ctx;
@@ -56,35 +66,20 @@ void hmac_sha256_internal
 	  hmac_sha256_ctx* hmac /* HMAC-SHA256 context which holds temporary variables */
 )
 {
-	int i;
 	sha256_ctx* ctx = &(hmac->ctx);
-	char* buf = hmac->buf;
 
-	/**** Inner Digest ****/
+	/**** Restore Precomputed Inner Digest Context ****/
 
-	sha256_begin (ctx);
-
-	/* Pad the key for inner digest */
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x36);
-	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
-		buf[i] = 0x36;
+	memcpy (ctx, &(hmac->inner_digest_ctx), sizeof (sha256_ctx));
 
-	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
 	sha256_hash ((unsigned char *) d, ld, ctx);
 
 	sha256_end ((unsigned char *) d, ctx); /* d = inner digest */
 
-	/**** Outer Digest ****/
-
-	sha256_begin (ctx);
+	/**** Restore Precomputed Outer Digest Context ****/
 
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x5C);
-	for (i = lk; i < SHA256_BLOCKSIZE; ++i)
-		buf[i] = 0x5C;
+	memcpy (ctx, &(hmac->outer_digest_ctx), sizeof (sha256_ctx));
 
-	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
 	sha256_hash ((unsigned char *) d, SHA256_DIGESTSIZE, ctx);
 
 	sha256_end ((unsigned char *) d, ctx); /* d = outer digest */
@@ -100,6 +95,9 @@ void hmac_sha256
 )
 {
 	hmac_sha256_ctx hmac;
+	sha256_ctx* ctx;
+	char* buf = hmac.k;
+	int b;
 	char key[SHA256_DIGESTSIZE];
     /* If the key is longer than the hash algorithm block size,
 	   let key = sha256(key), as per HMAC specifications. */
@@ -116,6 +114,30 @@ void hmac_sha256
 
 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
+
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	sha256_begin (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x36);
+	memset (&buf[lk], 0x36, SHA256_BLOCKSIZE - lk);
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	sha256_begin (ctx);
+
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x5C);
+	memset (&buf[lk], 0x5C, SHA256_BLOCKSIZE - lk);
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
+
 	hmac_sha256_internal(k, lk, d, ld, &hmac);
 	/* Prevent leaks */
 	burn(&hmac, sizeof(hmac));
@@ -171,6 +193,8 @@ static void derive_u_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, u
 void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen)
 {	
 	hmac_sha256_ctx hmac;
+	sha256_ctx* ctx;
+	char* buf = hmac.k;
 	int b, l, r;
 #ifndef TC_WINDOWS_BOOT
 	char key[SHA256_DIGESTSIZE];
@@ -202,6 +226,29 @@ void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 
 	r = dklen - (l - 1) * SHA256_DIGESTSIZE;
 
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	sha256_begin (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x36);
+	memset (&buf[pwd_len], 0x36, SHA256_BLOCKSIZE - pwd_len);
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	sha256_begin (ctx);
+
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x5C);
+	memset (&buf[pwd_len], 0x5C, SHA256_BLOCKSIZE - pwd_len);
+
+	sha256_hash ((unsigned char *) buf, SHA256_BLOCKSIZE, ctx);
+
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
@@ -229,7 +276,8 @@ void derive_key_sha256 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 typedef struct hmac_sha512_ctx_struct
 {
 	sha512_ctx ctx;
-	char buf[SHA512_BLOCKSIZE];
+	sha512_ctx inner_digest_ctx; /*pre-computed inner digest context */
+	sha512_ctx outer_digest_ctx; /*pre-computed outer digest context */
 	char k[PKCS5_SALT_SIZE + 4]; /* enough to hold (salt_len + 4) and also the SHA512 hash */
 	char u[SHA512_DIGESTSIZE];
 } hmac_sha512_ctx;
@@ -244,34 +292,19 @@ void hmac_sha512_internal
 )
 {
 	sha512_ctx* ctx = &(hmac->ctx);
-	char* buf = hmac->buf;
-	int i;
 
-	/**** Inner Digest ****/
+	/**** Restore Precomputed Inner Digest Context ****/
 
-	sha512_begin (ctx);
+	memcpy (ctx, &(hmac->inner_digest_ctx), sizeof (sha512_ctx));
 
-	/* Pad the key for inner digest */
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x36);
-	for (i = lk; i < SHA512_BLOCKSIZE; ++i)
-		buf[i] = 0x36;
-
-	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
 	sha512_hash ((unsigned char *) d, ld, ctx);
 
 	sha512_end ((unsigned char *) d, ctx);
 
-	/**** Outer Digest ****/
-
-	sha512_begin (ctx);
+	/**** Restore Precomputed Outer Digest Context ****/
 
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x5C);
-	for (i = lk; i < SHA512_BLOCKSIZE; ++i)
-		buf[i] = 0x5C;
+	memcpy (ctx, &(hmac->outer_digest_ctx), sizeof (sha512_ctx));
 
-	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
 	sha512_hash ((unsigned char *) d, SHA512_DIGESTSIZE, ctx);
 
 	sha512_end ((unsigned char *) d, ctx);
@@ -286,6 +319,11 @@ void hmac_sha512
 )
 {
 	hmac_sha512_ctx hmac;
+	sha512_ctx* ctx;
+	char* buf = hmac.k; /* there is enough space to hold SHA512_BLOCKSIZE (128) bytes
+							   * because k is followed by u in hmac_sha512_ctx
+								*/
+	int b;
 	char key[SHA512_DIGESTSIZE];
 
     /* If the key is longer than the hash algorithm block size,
@@ -304,6 +342,29 @@ void hmac_sha512
 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
 
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	sha512_begin (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x36);
+	memset (&buf[lk], 0x36, SHA512_BLOCKSIZE - lk);
+
+	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	sha512_begin (ctx);
+
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x5C);
+	memset (&buf[lk], 0x5C, SHA512_BLOCKSIZE - lk);
+
+	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
+
 	hmac_sha512_internal (k, lk, d, ld, &hmac);
 
 	/* Prevent leaks */
@@ -341,6 +402,10 @@ static void derive_u_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, u
 void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen)
 {
 	hmac_sha512_ctx hmac;
+	sha512_ctx* ctx;
+	char* buf = hmac.k; /* there is enough space to hold SHA512_BLOCKSIZE (128) bytes
+							   * because k is followed by u in hmac_sha512_ctx
+								*/
 	int b, l, r;
 	char key[SHA512_DIGESTSIZE];
 
@@ -371,6 +436,29 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 
 	r = dklen - (l - 1) * SHA512_DIGESTSIZE;
 
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	sha512_begin (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x36);
+	memset (&buf[pwd_len], 0x36, SHA512_BLOCKSIZE - pwd_len);
+
+	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	sha512_begin (ctx);
+
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x5C);
+	memset (&buf[pwd_len], 0x5C, SHA512_BLOCKSIZE - pwd_len);
+
+	sha512_hash ((unsigned char *) buf, SHA512_BLOCKSIZE, ctx);
+
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
@@ -396,7 +484,8 @@ void derive_key_sha512 (char *pwd, int pwd_len, char *salt, int salt_len, uint32
 typedef struct hmac_ripemd160_ctx_struct
 {
 	RMD160_CTX context;
-	char k_pad[65];
+	RMD160_CTX inner_digest_ctx; /*pre-computed inner digest context */
+	RMD160_CTX outer_digest_ctx; /*pre-computed outer digest context */
 	char k[PKCS5_SALT_SIZE + 4]; /* enough to hold (salt_len + 4) and also the RIPEMD-160 hash */
 	char u[RIPEMD160_DIGESTSIZE];
 } hmac_ripemd160_ctx;
@@ -404,70 +493,71 @@ typedef struct hmac_ripemd160_ctx_struct
 void hmac_ripemd160_internal (char *key, int keylen, char *input_digest, int len, hmac_ripemd160_ctx* hmac)
 {
 	RMD160_CTX* context = &(hmac->context);
-   unsigned char* k_pad = (unsigned char*) hmac->k_pad;  /* inner/outer padding - key XORd with ipad */
-   int i;
 
-	/*
+	/**** Restore Precomputed Inner Digest Context ****/
 
-	RMD160(K XOR opad, RMD160(K XOR ipad, text))
+	memcpy (context, &(hmac->inner_digest_ctx), sizeof (RMD160_CTX));
 
-	where K is an n byte key
-	ipad is the byte 0x36 repeated RIPEMD160_BLOCKSIZE times
-	opad is the byte 0x5c repeated RIPEMD160_BLOCKSIZE times
-	and text is the data being protected */
+	RMD160Update(context, (const unsigned char *) input_digest, len); /* then text of datagram */
+	RMD160Final((unsigned char *) input_digest, context);         /* finish up 1st pass */
 
+	/**** Restore Precomputed Outer Digest Context ****/
 
-	/* start out by storing key in pads */
-	memset(k_pad, 0x36, 65);
+	memcpy (context, &(hmac->outer_digest_ctx), sizeof (RMD160_CTX));
 
-    /* XOR key with ipad and opad values */
-    for (i=0; i<keylen; i++) 
-	{
-        k_pad[i] ^= key[i];
-    }
-
-    /* perform inner RIPEMD-160 */
-
-    RMD160Init(context);           /* init context for 1st pass */
-    RMD160Update(context, k_pad, RIPEMD160_BLOCKSIZE);  /* start with inner pad */
-    RMD160Update(context, (const unsigned char *) input_digest, len); /* then text of datagram */
-    RMD160Final((unsigned char *) input_digest, context);         /* finish up 1st pass */
-
-    /* perform outer RIPEMD-160 */
-    memset(k_pad, 0x5c, 65);
-    for (i=0; i<keylen; i++) 
-	 {
-        k_pad[i] ^= key[i];
-    }
-
-    RMD160Init(context);           /* init context for 2nd pass */
-    RMD160Update(context, k_pad, RIPEMD160_BLOCKSIZE);  /* start with outer pad */
-    /* results of 1st hash */
-    RMD160Update(context, (const unsigned char *) input_digest, RIPEMD160_DIGESTSIZE);
-    RMD160Final((unsigned char *) input_digest, context);         /* finish up 2nd pass */
+	/* results of 1st hash */
+	RMD160Update(context, (const unsigned char *) input_digest, RIPEMD160_DIGESTSIZE);
+	RMD160Final((unsigned char *) input_digest, context);         /* finish up 2nd pass */
 }
 
 #ifndef TC_WINDOWS_BOOT
 void hmac_ripemd160 (char *key, int keylen, char *input_digest, int len)
 {
 	hmac_ripemd160_ctx hmac;
+	RMD160_CTX* ctx;
+	unsigned char* k_pad = (unsigned char*) hmac.k;  /* inner/outer padding - key XORd with ipad */
 	unsigned char tk[RIPEMD160_DIGESTSIZE];
+	int i;
 
-    /* If the key is longer than the hash algorithm block size,
-	   let key = ripemd160(key), as per HMAC specifications. */
-    if (keylen > RIPEMD160_BLOCKSIZE) 
+	/* If the key is longer than the hash algorithm block size,
+	let key = ripemd160(key), as per HMAC specifications. */
+	if (keylen > RIPEMD160_BLOCKSIZE) 
 	{
-        RMD160_CTX      tctx;
+		RMD160_CTX      tctx;
 
-        RMD160Init(&tctx);
-        RMD160Update(&tctx, (const unsigned char *) key, keylen);
-        RMD160Final(tk, &tctx);
+		RMD160Init(&tctx);
+		RMD160Update(&tctx, (const unsigned char *) key, keylen);
+		RMD160Final(tk, &tctx);
 
-        key = (char *) tk;
-        keylen = RIPEMD160_DIGESTSIZE;
+		key = (char *) tk;
+		keylen = RIPEMD160_DIGESTSIZE;
 
 		burn (&tctx, sizeof(tctx));	// Prevent leaks
-    }
+	}   
+
+	/* perform inner RIPEMD-160 */
+	ctx = &(hmac.inner_digest_ctx);
+	/* start out by storing key in pads */
+	memset(k_pad, 0x36, 64);
+	/* XOR key with ipad and opad values */
+	for (i=0; i<keylen; i++) 
+	{
+		k_pad[i] ^= key[i];
+	}
+
+	RMD160Init(ctx);           /* init context for 1st pass */
+	RMD160Update(ctx, k_pad, RIPEMD160_BLOCKSIZE);  /* start with inner pad */
+
+	/* perform outer RIPEMD-160 */
+	ctx = &(hmac.outer_digest_ctx);
+	memset(k_pad, 0x5c, 64);
+	for (i=0; i<keylen; i++) 
+	{
+		k_pad[i] ^= key[i];
+	}
+
+	RMD160Init(ctx);           /* init context for 2nd pass */
+	RMD160Update(ctx, k_pad, RIPEMD160_BLOCKSIZE);  /* start with outer pad */
 
 	hmac_ripemd160_internal (key, keylen, input_digest, len, &hmac);
 
@@ -525,6 +615,8 @@ void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, uin
 {	
 	int b, l, r;
 	hmac_ripemd160_ctx hmac;
+	RMD160_CTX* ctx;
+	unsigned char* k_pad = (unsigned char*) hmac.k;
 #ifndef TC_WINDOWS_BOOT
 	unsigned char tk[RIPEMD160_DIGESTSIZE];
     /* If the password is longer than the hash algorithm block size,
@@ -555,6 +647,30 @@ void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, uin
 
 	r = dklen - (l - 1) * RIPEMD160_DIGESTSIZE;
 
+	/* perform inner RIPEMD-160 */
+	ctx = &(hmac.inner_digest_ctx);
+	/* start out by storing key in pads */
+	memset(k_pad, 0x36, 64);
+	/* XOR key with ipad and opad values */
+	for (b=0; b<pwd_len; b++) 
+	{
+		k_pad[b] ^= pwd[b];
+	}
+
+	RMD160Init(ctx);           /* init context for 1st pass */
+	RMD160Update(ctx, k_pad, RIPEMD160_BLOCKSIZE);  /* start with inner pad */
+
+	/* perform outer RIPEMD-160 */
+	ctx = &(hmac.outer_digest_ctx);
+	memset(k_pad, 0x5c, 64);
+	for (b=0; b<pwd_len; b++) 
+	{
+		k_pad[b] ^= pwd[b];
+	}
+
+	RMD160Init(ctx);           /* init context for 2nd pass */
+	RMD160Update(ctx, k_pad, RIPEMD160_BLOCKSIZE);  /* start with outer pad */
+
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
@@ -581,7 +697,8 @@ void derive_key_ripemd160 (char *pwd, int pwd_len, char *salt, int salt_len, uin
 typedef struct hmac_whirlpool_ctx_struct
 {
 	WHIRLPOOL_CTX ctx;
-	CRYPTOPP_ALIGN_DATA(16) char buf[WHIRLPOOL_BLOCKSIZE];
+	WHIRLPOOL_CTX inner_digest_ctx; /*pre-computed inner digest context */
+	WHIRLPOOL_CTX outer_digest_ctx; /*pre-computed outer digest context */
 	CRYPTOPP_ALIGN_DATA(16) char k[PKCS5_SALT_SIZE + 4]; /* enough to hold (salt_len + 4) and also the Whirlpool hash */
 	char u[WHIRLPOOL_DIGESTSIZE];
 } hmac_whirlpool_ctx;
@@ -596,34 +713,19 @@ void hmac_whirlpool_internal
 )
 {
 	WHIRLPOOL_CTX* ctx = &(hmac->ctx);
-	char* buf = hmac->buf;
-	int i;
 
-	/**** Inner Digest ****/
+	/**** Restore Precomputed Inner Digest Context ****/
 
-	WHIRLPOOL_init (ctx);
+	memcpy (ctx, &(hmac->inner_digest_ctx), sizeof (WHIRLPOOL_CTX));
 
-	/* Pad the key for inner digest */
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x36);
-	for (i = lk; i < WHIRLPOOL_BLOCKSIZE; ++i)
-		buf[i] = 0x36;
-
-	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
 	WHIRLPOOL_add ((unsigned char *) d, ld * 8, ctx);
 
 	WHIRLPOOL_finalize (ctx, (unsigned char *) d);
 
-	/**** Outer Digest ****/
+	/**** Restore Precomputed Outer Digest Context ****/
 
-	WHIRLPOOL_init (ctx);
-
-	for (i = 0; i < lk; ++i)
-		buf[i] = (char) (k[i] ^ 0x5C);
-	for (i = lk; i < WHIRLPOOL_BLOCKSIZE; ++i)
-		buf[i] = 0x5C;
+	memcpy (ctx, &(hmac->outer_digest_ctx), sizeof (WHIRLPOOL_CTX));
 
-	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
 	WHIRLPOOL_add ((unsigned char *) d, WHIRLPOOL_DIGESTSIZE * 8, ctx);
 
 	WHIRLPOOL_finalize (ctx, (unsigned char *) d);
@@ -638,6 +740,9 @@ void hmac_whirlpool
 )
 {
 	hmac_whirlpool_ctx hmac;
+	WHIRLPOOL_CTX* ctx;
+	char* buf = hmac.k;
+	int b;
 	char key[WHIRLPOOL_DIGESTSIZE];
     /* If the key is longer than the hash algorithm block size,
 	   let key = whirlpool(key), as per HMAC specifications. */
@@ -655,6 +760,29 @@ void hmac_whirlpool
 		burn (&tctx, sizeof(tctx));		// Prevent leaks
 	}
 
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	WHIRLPOOL_init (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x36);
+	memset (&buf[lk], 0x36, WHIRLPOOL_BLOCKSIZE - lk);
+
+	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	WHIRLPOOL_init (ctx);
+
+	for (b = 0; b < lk; ++b)
+		buf[b] = (char) (k[b] ^ 0x5C);
+	memset (&buf[lk], 0x5C, WHIRLPOOL_BLOCKSIZE - lk);
+
+	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
+
 	hmac_whirlpool_internal(k, lk, d, ld, &hmac);
 	/* Prevent leaks */
 	burn(&hmac, sizeof(hmac));
@@ -689,6 +817,8 @@ static void derive_u_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len
 void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, uint32 iterations, char *dk, int dklen)
 {
 	hmac_whirlpool_ctx hmac;
+	WHIRLPOOL_CTX* ctx;
+	char* buf = hmac.k;
 	char key[WHIRLPOOL_DIGESTSIZE];
 	int b, l, r;
     /* If the password is longer than the hash algorithm block size,
@@ -718,6 +848,29 @@ void derive_key_whirlpool (char *pwd, int pwd_len, char *salt, int salt_len, uin
 
 	r = dklen - (l - 1) * WHIRLPOOL_DIGESTSIZE;
 
+	/**** Precompute HMAC Inner Digest ****/
+
+	ctx = &(hmac.inner_digest_ctx);
+	WHIRLPOOL_init (ctx);
+
+	/* Pad the key for inner digest */
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x36);
+	memset (&buf[pwd_len], 0x36, WHIRLPOOL_BLOCKSIZE - pwd_len);
+
+	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
+
+	/**** Precompute HMAC Outer Digest ****/
+
+	ctx = &(hmac.outer_digest_ctx);
+	WHIRLPOOL_init (ctx);
+
+	for (b = 0; b < pwd_len; ++b)
+		buf[b] = (char) (pwd[b] ^ 0x5C);
+	memset (&buf[pwd_len], 0x5C, WHIRLPOOL_BLOCKSIZE - pwd_len);
+
+	WHIRLPOOL_add ((unsigned char *) buf, WHIRLPOOL_BLOCKSIZE * 8, ctx);
+
 	/* first l - 1 blocks */
 	for (b = 1; b < l; b++)
 	{
author	Mounir IDRASSI <mounir.idrassi@idrix.fr>	2016-01-17 02:24:22 +0100
committer	Mounir IDRASSI <mounir.idrassi@idrix.fr>	2016-01-17 10:52:29 +0100
commit	59afc2c4d9704476bdaf8c4c8b45684a80781a06 (patch)
tree	a6eea03b8651260f24feda750a9cdf218ba62d7d
parent	dd1e62ebcd62338b2cf16ebab6157c9e74416a0e (diff)
download	VeraCrypt-59afc2c4d9704476bdaf8c4c8b45684a80781a06.tar.gz VeraCrypt-59afc2c4d9704476bdaf8c4c8b45684a80781a06.zip