Bug in poly1305-donna-16.h

[Gammatester]

The code in poly1305-donna-16.h failed to pass the selftest and most of the test vectors from
http://tools.ietf.org/html/rfc7539. See my post and the answer at http://stackoverflow.com/questions/31806863/verification-of-poly1305-donna-16-h-code.

[dchest]

Test that fails is:

    /* generates a final value of (2^130 - 2) == 3 */
    static const unsigned char wrap_key[32] = {
        0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    };

    static const unsigned char wrap_msg[16] = {
        0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
        0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff
    };

    static const unsigned char wrap_mac[16] = {
        0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
        0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    };

[floodyberry]

Sorry about not updating for so long! This should be fixed now. The issue was not properly detecting if st->h was >= 2^130 - 5, coupled with believing my own README and defining POLY1305_16BITS instead of POLY1305_16BIT and not catching the failure. The chance of the bug affecting anything in the real world is essentially zero luckily, but it's good to have it fixed.

[dchest]

Thanks a lot!

[Gammatester]

Thank you! I just compiled and ran it under with GCC 4.7.3 and MS VC 6 and got

poly1305 self test: successful
sample mac is ddb9da7ddd5e52792730ed5cda5f90a4 (correct)

I will add a comment to the stackoverflow question.