WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Add BLAKE2b/BLAKE2s examples 

Incremental hashing checked against the RFC 7693 known-answer vectors,
plus BLAKE2b's native keyed mode used as a MAC.
pull/610/head
Anthony 2026-07-24 15:18:39 -04:00 committed by Anthony Hu
parent eba0390017
commit 73dde4a277
5 changed files with 395 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
hash/blake2/Makefile 100644
View File

@ -0,0 +1,26 @@
CC=gcc
WOLFSSL_INSTALL_DIR=/usr/local
CFLAGS=-Wall -I$(WOLFSSL_INSTALL_DIR)/include
LIBS=-L$(WOLFSSL_INSTALL_DIR)/lib -lwolfssl -lm
all: blake2b-hash blake2s-hash blake2-keyed-mac
blake2b-hash: blake2b-hash.o
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
blake2s-hash: blake2s-hash.o
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
blake2-keyed-mac: blake2-keyed-mac.o
$(CC) -o $@ $^ $(CFLAGS) $(LIBS)
.PHONY: clean all check
clean:
rm -f *.o blake2b-hash blake2s-hash blake2-keyed-mac
check: all
out=$$(./blake2b-hash) && printf '%s' "$$out" | grep -q 'matches RFC 7693 test vector'
out=$$(./blake2s-hash) && printf '%s' "$$out" | grep -q 'matches RFC 7693 test vector'
out=$$(./blake2-keyed-mac) && printf '%s' "$$out" | grep -q 'Wrong key rejected'
@echo "PASS: hash-blake2 checks"

34
hash/blake2/README.md 100644
View File

@ -0,0 +1,34 @@
# wolfSSL BLAKE2 Examples
Demonstrates the dedicated BLAKE2b/BLAKE2s wolfCrypt APIs (`wc_Blake2b*` /
`wc_Blake2s*`), including BLAKE2's native keyed mode.
* `blake2b-hash.c` - incremental BLAKE2b-512 hashing, verified against the
RFC 7693 Appendix A test vector.
* `blake2s-hash.c` - incremental BLAKE2s-256 hashing, verified against the
RFC 7693 Appendix B test vector.
* `blake2-keyed-mac.c` - keyed BLAKE2b as a MAC via
`wc_InitBlake2b_WithKey()`. Unlike SHA-2, BLAKE2 does not need the HMAC
construction to be used as a MAC.
## Building wolfSSL
```
./configure --enable-blake2 --enable-blake2s
make
sudo make install
```
`--enable-blake2` enables BLAKE2b, `--enable-blake2s` enables BLAKE2s.
## Building and running the examples
```
make
./blake2b-hash [message]
./blake2s-hash [message]
./blake2-keyed-mac
```
With no argument the hash examples digest `"abc"` and compare against the
RFC 7693 known-answer vectors.

132
hash/blake2/blake2-keyed-mac.c 100644
View File

@ -0,0 +1,132 @@
/* blake2-keyed-mac.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
/* Example of BLAKE2b in keyed mode, used as a MAC.
*
* BLAKE2's native keyed mode replaces the HMAC construction: the key is mixed
* into the initial state, so a single hash pass produces the tag. */
#include <stdio.h>
#include <string.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/blake2.h>
#include <wolfssl/wolfcrypt/random.h>
#ifdef HAVE_BLAKE2B
/* 32-byte tag is plenty for a MAC; BLAKE2b allows 1-64. */
#define TAG_SZ 32
#define KEY_SZ 32
static void print_hex(const char* label, const byte* data, word32 len)
{
word32 i;
printf("%s: ", label);
for (i = 0; i < len; i++)
printf("%02x", data[i]);
printf("\n");
}
static int mac_message(const byte* key, word32 keySz, const char* msg,
byte* tag, word32 tagSz)
{
int ret;
Blake2b b2b;
ret = wc_InitBlake2b_WithKey(&b2b, tagSz, key, keySz);
if (ret == 0)
ret = wc_Blake2bUpdate(&b2b, (const byte*)msg, (word32)strlen(msg));
if (ret == 0)
ret = wc_Blake2bFinal(&b2b, tag, tagSz);
return ret;
}
int main(void)
{
int ret;
WC_RNG rng;
byte key[KEY_SZ];
byte tag[TAG_SZ];
byte check[TAG_SZ];
const char* msg = "authenticate this message";
ret = wc_InitRng(&rng);
if (ret != 0) {
printf("wc_InitRng failed %d\n", ret);
return 1;
}
ret = wc_RNG_GenerateBlock(&rng, key, KEY_SZ);
wc_FreeRng(&rng);
if (ret != 0) {
printf("wc_RNG_GenerateBlock failed %d\n", ret);
return 1;
}
ret = mac_message(key, KEY_SZ, msg, tag, TAG_SZ);
if (ret != 0) {
printf("MAC generation failed %d\n", ret);
return 1;
}
print_hex("key", key, KEY_SZ);
print_hex("tag", tag, TAG_SZ);
/* Verifier recomputes the tag with the shared key and compares. */
ret = mac_message(key, KEY_SZ, msg, check, TAG_SZ);
if (ret != 0) {
printf("MAC verification failed %d\n", ret);
return 1;
}
if (memcmp(tag, check, TAG_SZ) != 0) {
printf("MAC mismatch!\n");
return 1;
}
printf("MAC verified\n");
/* A different key must produce a different tag. */
key[0] ^= 0x01;
ret = mac_message(key, KEY_SZ, msg, check, TAG_SZ);
if (ret != 0) {
printf("MAC computation failed %d\n", ret);
return 1;
}
if (memcmp(tag, check, TAG_SZ) == 0) {
printf("Tag did not change with key!\n");
return 1;
}
printf("Wrong key rejected\n");
return 0;
}
#else
int main(void)
{
printf("Please build wolfSSL with ./configure --enable-blake2\n");
return 0;
}
#endif /* HAVE_BLAKE2B */

104
hash/blake2/blake2b-hash.c 100644
View File

@ -0,0 +1,104 @@
/* blake2b-hash.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
/* Example of incremental BLAKE2b hashing with the wc_Blake2b API. */
#include <stdio.h>
#include <string.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/blake2.h>
#ifdef HAVE_BLAKE2B
#define DIGEST_SZ 64
/* BLAKE2b-512("abc") from RFC 7693 Appendix A. */
static const byte kat_abc[DIGEST_SZ] = {
0xba, 0x80, 0xa5, 0x3f, 0x98, 0x1c, 0x4d, 0x0d,
0x6a, 0x27, 0x97, 0xb6, 0x9f, 0x12, 0xf6, 0xe9,
0x4c, 0x21, 0x2f, 0x14, 0x68, 0x5a, 0xc4, 0xb7,
0x4b, 0x12, 0xbb, 0x6f, 0xdb, 0xff, 0xa2, 0xd1,
0x7d, 0x87, 0xc5, 0x39, 0x2a, 0xab, 0x79, 0x2d,
0xc2, 0x52, 0xd5, 0xde, 0x45, 0x33, 0xcc, 0x95,
0x18, 0xd3, 0x8a, 0xa8, 0xdb, 0xf1, 0x92, 0x5a,
0xb9, 0x23, 0x86, 0xed, 0xd4, 0x00, 0x99, 0x23
};
static void print_hex(const char* label, const byte* data, word32 len)
{
word32 i;
printf("%s: ", label);
for (i = 0; i < len; i++)
printf("%02x", data[i]);
printf("\n");
}
int main(int argc, char* argv[])
{
int ret;
Blake2b b2b;
byte digest[DIGEST_SZ];
const char* msg = (argc > 1) ? argv[1] : "abc";
ret = wc_InitBlake2b(&b2b, DIGEST_SZ);
if (ret != 0) {
printf("wc_InitBlake2b failed %d\n", ret);
return 1;
}
/* Data may be added in as many update calls as needed. */
ret = wc_Blake2bUpdate(&b2b, (const byte*)msg, (word32)strlen(msg));
if (ret != 0) {
printf("wc_Blake2bUpdate failed %d\n", ret);
return 1;
}
ret = wc_Blake2bFinal(&b2b, digest, DIGEST_SZ);
if (ret != 0) {
printf("wc_Blake2bFinal failed %d\n", ret);
return 1;
}
print_hex("BLAKE2b-512", digest, DIGEST_SZ);
if (argc <= 1) {
if (memcmp(digest, kat_abc, DIGEST_SZ) != 0) {
printf("Digest does not match RFC 7693 test vector!\n");
return 1;
}
printf("Digest matches RFC 7693 test vector\n");
}
return 0;
}
#else
int main(void)
{
printf("Please build wolfSSL with ./configure --enable-blake2\n");
return 0;
}
#endif /* HAVE_BLAKE2B */

99
hash/blake2/blake2s-hash.c 100644
View File

@ -0,0 +1,99 @@
/* blake2s-hash.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL. (formerly known as CyaSSL)
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
*/
/* Example of incremental BLAKE2s hashing with the wc_Blake2s API. */
#include <stdio.h>
#include <string.h>
#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/blake2.h>
#ifdef HAVE_BLAKE2S
#define DIGEST_SZ 32
/* BLAKE2s-256("abc") from RFC 7693 Appendix B. */
static const byte kat_abc[DIGEST_SZ] = {
0x50, 0x8c, 0x5e, 0x8c, 0x32, 0x7c, 0x14, 0xe2,
0xe1, 0xa7, 0x2b, 0xa3, 0x4e, 0xeb, 0x45, 0x2f,
0x37, 0x45, 0x8b, 0x20, 0x9e, 0xd6, 0x3a, 0x29,
0x4d, 0x99, 0x9b, 0x4c, 0x86, 0x67, 0x59, 0x82
};
static void print_hex(const char* label, const byte* data, word32 len)
{
word32 i;
printf("%s: ", label);
for (i = 0; i < len; i++)
printf("%02x", data[i]);
printf("\n");
}
int main(int argc, char* argv[])
{
int ret;
Blake2s b2s;
byte digest[DIGEST_SZ];
const char* msg = (argc > 1) ? argv[1] : "abc";
ret = wc_InitBlake2s(&b2s, DIGEST_SZ);
if (ret != 0) {
printf("wc_InitBlake2s failed %d\n", ret);
return 1;
}
ret = wc_Blake2sUpdate(&b2s, (const byte*)msg, (word32)strlen(msg));
if (ret != 0) {
printf("wc_Blake2sUpdate failed %d\n", ret);
return 1;
}
ret = wc_Blake2sFinal(&b2s, digest, DIGEST_SZ);
if (ret != 0) {
printf("wc_Blake2sFinal failed %d\n", ret);
return 1;
}
print_hex("BLAKE2s-256", digest, DIGEST_SZ);
if (argc <= 1) {
if (memcmp(digest, kat_abc, DIGEST_SZ) != 0) {
printf("Digest does not match RFC 7693 test vector!\n");
return 1;
}
printf("Digest matches RFC 7693 test vector\n");
}
return 0;
}
#else
int main(void)
{
printf("Please build wolfSSL with ./configure --enable-blake2s\n");
return 0;
}
#endif /* HAVE_BLAKE2S */