blake256: Initial commit

CMakeLists.txt

@@ -12,6 +12,7 @@ set(SOURCES
     ed25519-donna/curve25519-donna-32bit.c ed25519-donna/curve25519-donna-helpers.c ed25519-donna/modm-donna-32bit.c
     ed25519-donna/ed25519-donna-basepoint-table.c ed25519-donna/ed25519-donna-32bit-tables.c ed25519-donna/ed25519-donna-impl-base.c
     ed25519-donna/ed25519.c ed25519-donna/curve25519-donna-scalarmult-base.c ed25519-donna/ed25519-sha3.c ed25519-donna/ed25519-keccak.c
+    blake256.c
     blake2b.c blake2s.c
     chacha20poly1305/chacha20poly1305.c chacha20poly1305/chacha_merged.c chacha20poly1305/poly1305-donna.c chacha20poly1305/rfc7539.c
     rc4.c

Makefile

@@ -47,6 +47,7 @@ SRCS  += aes/aescrypt.c aes/aeskey.c aes/aestab.c aes/aes_modes.c
 SRCS  += ed25519-donna/curve25519-donna-32bit.c ed25519-donna/curve25519-donna-helpers.c ed25519-donna/modm-donna-32bit.c
 SRCS  += ed25519-donna/ed25519-donna-basepoint-table.c ed25519-donna/ed25519-donna-32bit-tables.c ed25519-donna/ed25519-donna-impl-base.c
 SRCS  += ed25519-donna/ed25519.c ed25519-donna/curve25519-donna-scalarmult-base.c ed25519-donna/ed25519-sha3.c ed25519-donna/ed25519-keccak.c
+SRCS  += blake256.c
 SRCS  += blake2b.c blake2s.c
 SRCS  += chacha20poly1305/chacha20poly1305.c chacha20poly1305/chacha_merged.c chacha20poly1305/poly1305-donna.c chacha20poly1305/rfc7539.c
 SRCS  += rc4.c

blake256.c

@@ -0,0 +1,374 @@
+// Copyright (c) 2014-2017, The Monero Project
+// 
+// All rights reserved.
+// 
+// Redistribution and use in source and binary forms, with or without modification, are
+// permitted provided that the following conditions are met:
+// 
+// 1. Redistributions of source code must retain the above copyright notice, this list of
+//    conditions and the following disclaimer.
+// 
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list
+//    of conditions and the following disclaimer in the documentation and/or other
+//    materials provided with the distribution.
+// 
+// 3. Neither the name of the copyright holder nor the names of its contributors may be
+//    used to endorse or promote products derived from this software without specific
+//    prior written permission.
+// 
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// 
+
+/*
+ * The blake256_* and blake224_* functions are largely copied from
+ * blake256_light.c and blake224_light.c from the BLAKE website:
+ *
+ *     http://131002.net/blake/
+ *
+ * The hmac_* functions implement HMAC-BLAKE-256 and HMAC-BLAKE-224.
+ * HMAC is specified by RFC 2104.
+ */
+
+#include <string.h>
+#include <stdint.h>
+#include "blake256.h"
+
+#define U8TO32(p) \
+    (((uint32_t)((p)[0]) << 24) | ((uint32_t)((p)[1]) << 16) |    \
+     ((uint32_t)((p)[2]) <<  8) | ((uint32_t)((p)[3])      ))
+#define U32TO8(p, v) \
+    (p)[0] = (uint8_t)((v) >> 24); (p)[1] = (uint8_t)((v) >> 16); \
+    (p)[2] = (uint8_t)((v) >>  8); (p)[3] = (uint8_t)((v)      );
+
+static const uint8_t sigma[][16] = {
+    { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10,11,12,13,14,15},
+    {14,10, 4, 8, 9,15,13, 6, 1,12, 0, 2,11, 7, 5, 3},
+    {11, 8,12, 0, 5, 2,15,13,10,14, 3, 6, 7, 1, 9, 4},
+    { 7, 9, 3, 1,13,12,11,14, 2, 6, 5,10, 4, 0,15, 8},
+    { 9, 0, 5, 7, 2, 4,10,15,14, 1,11,12, 6, 8, 3,13},
+    { 2,12, 6,10, 0,11, 8, 3, 4,13, 7, 5,15,14, 1, 9},
+    {12, 5, 1,15,14,13, 4,10, 0, 7, 6, 3, 9, 2, 8,11},
+    {13,11, 7,14,12, 1, 3, 9, 5, 0,15, 4, 8, 6, 2,10},
+    { 6,15,14, 9,11, 3, 0, 8,12, 2,13, 7, 1, 4,10, 5},
+    {10, 2, 8, 4, 7, 6, 1, 5,15,11, 9,14, 3,12,13, 0},
+    { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10,11,12,13,14,15},
+    {14,10, 4, 8, 9,15,13, 6, 1,12, 0, 2,11, 7, 5, 3},
+    {11, 8,12, 0, 5, 2,15,13,10,14, 3, 6, 7, 1, 9, 4},
+    { 7, 9, 3, 1,13,12,11,14, 2, 6, 5,10, 4, 0,15, 8}
+};
+
+static const uint32_t cst[16] = {
+    0x243F6A88, 0x85A308D3, 0x13198A2E, 0x03707344,
+    0xA4093822, 0x299F31D0, 0x082EFA98, 0xEC4E6C89,
+    0x452821E6, 0x38D01377, 0xBE5466CF, 0x34E90C6C,
+    0xC0AC29B7, 0xC97C50DD, 0x3F84D5B5, 0xB5470917
+};
+
+static const uint8_t padding[] = {
+    0x80,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+    0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
+};
+
+
+static void blake256_compress(BLAKE256_CTX *S, const uint8_t *block) {
+    uint32_t v[16], m[16], i;
+
+#define ROT(x,n) (((x)<<(32-n))|((x)>>(n)))
+#define G(a,b,c,d,e)                                      \
+    v[a] += (m[sigma[i][e]] ^ cst[sigma[i][e+1]]) + v[b]; \
+    v[d] = ROT(v[d] ^ v[a],16);                           \
+    v[c] += v[d];                                         \
+    v[b] = ROT(v[b] ^ v[c],12);                           \
+    v[a] += (m[sigma[i][e+1]] ^ cst[sigma[i][e]])+v[b];   \
+    v[d] = ROT(v[d] ^ v[a], 8);                           \
+    v[c] += v[d];                                         \
+    v[b] = ROT(v[b] ^ v[c], 7);
+
+    for (i = 0; i < 16; ++i) m[i] = U8TO32(block + i * 4);
+    for (i = 0; i < 8;  ++i) v[i] = S->h[i];
+    v[ 8] = S->s[0] ^ 0x243F6A88;
+    v[ 9] = S->s[1] ^ 0x85A308D3;
+    v[10] = S->s[2] ^ 0x13198A2E;
+    v[11] = S->s[3] ^ 0x03707344;
+    v[12] = 0xA4093822;
+    v[13] = 0x299F31D0;
+    v[14] = 0x082EFA98;
+    v[15] = 0xEC4E6C89;
+
+    if (S->nullt == 0) {
+        v[12] ^= S->t[0];
+        v[13] ^= S->t[0];
+        v[14] ^= S->t[1];
+        v[15] ^= S->t[1];
+    }
+
+    for (i = 0; i < 14; ++i) {
+        G(0, 4,  8, 12,  0);
+        G(1, 5,  9, 13,  2);
+        G(2, 6, 10, 14,  4);
+        G(3, 7, 11, 15,  6);
+        G(3, 4,  9, 14, 14);
+        G(2, 7,  8, 13, 12);
+        G(0, 5, 10, 15,  8);
+        G(1, 6, 11, 12, 10);
+    }
+
+    for (i = 0; i < 16; ++i) S->h[i % 8] ^= v[i];
+    for (i = 0; i < 8;  ++i) S->h[i] ^= S->s[i % 4];
+}
+
+void blake256_Init(BLAKE256_CTX *S) {
+    S->h[0] = 0x6A09E667;
+    S->h[1] = 0xBB67AE85;
+    S->h[2] = 0x3C6EF372;
+    S->h[3] = 0xA54FF53A;
+    S->h[4] = 0x510E527F;
+    S->h[5] = 0x9B05688C;
+    S->h[6] = 0x1F83D9AB;
+    S->h[7] = 0x5BE0CD19;
+    S->t[0] = S->t[1] = S->buflen = S->nullt = 0;
+    S->s[0] = S->s[1] = S->s[2] = S->s[3] = 0;
+}
+
+void blake224_Init(BLAKE256_CTX *S) {
+    S->h[0] = 0xC1059ED8;
+    S->h[1] = 0x367CD507;
+    S->h[2] = 0x3070DD17;
+    S->h[3] = 0xF70E5939;
+    S->h[4] = 0xFFC00B31;
+    S->h[5] = 0x68581511;
+    S->h[6] = 0x64F98FA7;
+    S->h[7] = 0xBEFA4FA4;
+    S->t[0] = S->t[1] = S->buflen = S->nullt = 0;
+    S->s[0] = S->s[1] = S->s[2] = S->s[3] = 0;
+}
+
+// datalen = number of bits
+static void blake256_update(BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+    int left = S->buflen >> 3;
+    int fill = 64 - left;
+
+    if (left && (((datalen >> 3) & 0x3F) >= (unsigned) fill)) {
+        memcpy((void *) (S->buf + left), (void *) data, fill);
+        S->t[0] += 512;
+        if (S->t[0] == 0) S->t[1]++;
+        blake256_compress(S, S->buf);
+        data += fill;
+        datalen -= (fill << 3);
+        left = 0;
+    }
+
+    while (datalen >= 512) {
+        S->t[0] += 512;
+        if (S->t[0] == 0) S->t[1]++;
+        blake256_compress(S, data);
+        data += 64;
+        datalen -= 512;
+    }
+
+    if (datalen > 0) {
+        memcpy((void *) (S->buf + left), (void *) data, datalen >> 3);
+        S->buflen = (left << 3) + datalen;
+    } else {
+        S->buflen = 0;
+    }
+}
+
+// datalen = number of bytes
+void blake256_Update(BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+    blake256_update(S, data, datalen * 8);
+}
+
+// datalen = number of bits
+static void blake224_update(BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+    blake256_update(S, data, datalen);
+}
+
+// datalen = number of bytes
+void blake224_Update(BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+    blake224_update(S, data, datalen * 8);
+}
+
+static void blake256_final_h(BLAKE256_CTX *S, uint8_t *digest, uint8_t pa, uint8_t pb) {
+    uint8_t msglen[8];
+    uint32_t lo = S->t[0] + S->buflen, hi = S->t[1];
+    if (lo < (unsigned) S->buflen) hi++;
+    U32TO8(msglen + 0, hi);
+    U32TO8(msglen + 4, lo);
+
+    if (S->buflen == 440) { /* one padding byte */
+        S->t[0] -= 8;
+        blake256_update(S, &pa, 8);
+    } else {
+        if (S->buflen < 440) { /* enough space to fill the block  */
+            if (S->buflen == 0) S->nullt = 1;
+            S->t[0] -= 440 - S->buflen;
+            blake256_update(S, padding, 440 - S->buflen);
+        } else { /* need 2 compressions */
+            S->t[0] -= 512 - S->buflen;
+            blake256_update(S, padding, 512 - S->buflen);
+            S->t[0] -= 440;
+            blake256_update(S, padding + 1, 440);
+            S->nullt = 1;
+        }
+        blake256_update(S, &pb, 8);
+        S->t[0] -= 8;
+    }
+    S->t[0] -= 64;
+    blake256_update(S, msglen, 64);
+
+    U32TO8(digest +  0, S->h[0]);
+    U32TO8(digest +  4, S->h[1]);
+    U32TO8(digest +  8, S->h[2]);
+    U32TO8(digest + 12, S->h[3]);
+    U32TO8(digest + 16, S->h[4]);
+    U32TO8(digest + 20, S->h[5]);
+    U32TO8(digest + 24, S->h[6]);
+    U32TO8(digest + 28, S->h[7]);
+}
+
+void blake256_Final(BLAKE256_CTX *S, uint8_t *digest) {
+    blake256_final_h(S, digest, 0x81, 0x01);
+}
+
+void blake224_Final(BLAKE256_CTX *S, uint8_t *digest) {
+    blake256_final_h(S, digest, 0x80, 0x00);
+}
+
+// inlen = number of bytes
+void blake256(const uint8_t *in, size_t inlen, uint8_t *out) {
+    BLAKE256_CTX S;
+    blake256_Init(&S);
+    blake256_Update(&S, in, inlen);
+    blake256_Final(&S, out);
+}
+
+// inlen = number of bytes
+void blake224(const uint8_t *in, size_t inlen, uint8_t *out) {
+    BLAKE256_CTX S;
+    blake224_Init(&S);
+    blake224_Update(&S, in, inlen);
+    blake224_Final(&S, out);
+}
+
+// keylen = number of bytes
+void hmac_blake256_Init(HMAC_BLAKE256_CTX *S, const uint8_t *_key, size_t keylen) {
+    const uint8_t *key = _key;
+    uint8_t keyhash[32];
+    uint8_t pad[64];
+    size_t i;
+
+    if (keylen > 64) {
+        blake256(key, keylen, keyhash);
+        key = keyhash;
+        keylen = 32;
+    }
+
+    blake256_Init(&S->inner);
+    memset(pad, 0x36, 64);
+    for (i = 0; i < keylen; ++i) {
+        pad[i] ^= key[i];
+    }
+    blake256_update(&S->inner, pad, 512);
+
+    blake256_Init(&S->outer);
+    memset(pad, 0x5c, 64);
+    for (i = 0; i < keylen; ++i) {
+        pad[i] ^= key[i];
+    }
+    blake256_update(&S->outer, pad, 512);
+
+    memset(keyhash, 0, 32);
+}
+
+// keylen = number of bytes
+void hmac_blake224_Init(HMAC_BLAKE256_CTX *S, const uint8_t *_key, size_t keylen) {
+    const uint8_t *key = _key;
+    uint8_t keyhash[32];
+    uint8_t pad[64];
+    size_t i;
+
+    if (keylen > 64) {
+        blake256(key, keylen, keyhash);
+        key = keyhash;
+        keylen = 28;
+    }
+
+    blake224_Init(&S->inner);
+    memset(pad, 0x36, 64);
+    for (i = 0; i < keylen; ++i) {
+        pad[i] ^= key[i];
+    }
+    blake224_update(&S->inner, pad, 512);
+
+    blake224_Init(&S->outer);
+    memset(pad, 0x5c, 64);
+    for (i = 0; i < keylen; ++i) {
+        pad[i] ^= key[i];
+    }
+    blake224_update(&S->outer, pad, 512);
+
+    memset(keyhash, 0, 32);
+}
+
+// datalen = number of bits
+static void hmac_blake256_update(HMAC_BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+  // update the inner BLAKE256_CTX
+  blake256_update(&S->inner, data, datalen);
+}
+
+// datalen = number of bytes
+void hmac_blake256_Update(HMAC_BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+  hmac_blake256_update(S, data, datalen * 8);
+}
+
+// datalen = number of bits
+static void hmac_blake224_update(HMAC_BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+  // update the inner BLAKE256_CTX
+  blake224_update(&S->inner, data, datalen);
+}
+
+// datalen = number of bytes
+void hmac_blake224_Update(HMAC_BLAKE256_CTX *S, const uint8_t *data, size_t datalen) {
+  hmac_blake224_update(S, data, datalen * 8);
+}
+
+void hmac_blake256_Final(HMAC_BLAKE256_CTX *S, uint8_t *digest) {
+    uint8_t ihash[32];
+    blake256_Final(&S->inner, ihash);
+    blake256_update(&S->outer, ihash, 256);
+    blake256_Final(&S->outer, digest);
+    memset(ihash, 0, 32);
+}
+
+void hmac_blake224_Final(HMAC_BLAKE256_CTX *S, uint8_t *digest) {
+    uint8_t ihash[32];
+    blake224_Final(&S->inner, ihash);
+    blake224_update(&S->outer, ihash, 224);
+    blake224_Final(&S->outer, digest);
+    memset(ihash, 0, 32);
+}
+
+// keylen = number of bytes; inlen = number of bytes
+void hmac_blake256(const uint8_t *key, size_t keylen, const uint8_t *in, size_t inlen, uint8_t *out) {
+    HMAC_BLAKE256_CTX S;
+    hmac_blake256_Init(&S, key, keylen);
+    hmac_blake256_Update(&S, in, inlen);
+    hmac_blake256_Final(&S, out);
+}
+
+// keylen = number of bytes; inlen = number of bytes
+void hmac_blake224(const uint8_t *key, size_t keylen, const uint8_t *in, size_t inlen, uint8_t *out) {
+    HMAC_BLAKE256_CTX S;
+    hmac_blake224_Init(&S, key, keylen);
+    hmac_blake224_Update(&S, in, inlen);
+    hmac_blake224_Final(&S, out);
+}

blake256.h

@@ -0,0 +1,76 @@
+// Copyright (c) 2014-2017, The Monero Project
+// 
+// All rights reserved.
+// 
+// Redistribution and use in source and binary forms, with or without modification, are
+// permitted provided that the following conditions are met:
+// 
+// 1. Redistributions of source code must retain the above copyright notice, this list of
+//    conditions and the following disclaimer.
+// 
+// 2. Redistributions in binary form must reproduce the above copyright notice, this list
+//    of conditions and the following disclaimer in the documentation and/or other
+//    materials provided with the distribution.
+// 
+// 3. Neither the name of the copyright holder nor the names of its contributors may be
+//    used to endorse or promote products derived from this software without specific
+//    prior written permission.
+// 
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+// THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+// STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+// THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// 
+// Parts of this file are originally copyright (c) 2012-2013 The Cryptonote developers
+
+#ifndef __BLAKE256_H__
+#define __BLAKE256_H__
+
+#include <stdint.h>
+
+#define BLAKE224_DIGEST_LENGTH 28
+#define BLAKE256_DIGEST_LENGTH 32
+
+typedef struct {
+  uint32_t h[8], s[4], t[2];
+  int buflen, nullt;
+  uint8_t buf[64];
+} BLAKE256_CTX;
+
+typedef struct {
+  BLAKE256_CTX inner;
+  BLAKE256_CTX outer;
+} HMAC_BLAKE256_CTX;
+
+void blake256_Init(BLAKE256_CTX *);
+void blake224_Init(BLAKE256_CTX *);
+
+void blake256_Update(BLAKE256_CTX *, const uint8_t *, size_t);
+void blake224_Update(BLAKE256_CTX *, const uint8_t *, size_t);
+
+void blake256_Final(BLAKE256_CTX *, uint8_t *);
+void blake224_Final(BLAKE256_CTX *, uint8_t *);
+
+void blake256(const uint8_t *, size_t, uint8_t *);
+void blake224(const uint8_t *, size_t, uint8_t *);
+
+/* HMAC functions: */
+
+void hmac_blake256_Init(HMAC_BLAKE256_CTX *, const uint8_t *, size_t);
+void hmac_blake224_Init(HMAC_BLAKE256_CTX *, const uint8_t *, size_t);
+
+void hmac_blake256_Update(HMAC_BLAKE256_CTX *, const uint8_t *, size_t);
+void hmac_blake224_Update(HMAC_BLAKE256_CTX *, const uint8_t *, size_t);
+
+void hmac_blake256_Final(HMAC_BLAKE256_CTX *, uint8_t *);
+void hmac_blake224_Final(HMAC_BLAKE256_CTX *, uint8_t *);
+
+void hmac_blake256(const uint8_t *, size_t, const uint8_t *, size_t, uint8_t *);
+void hmac_blake224(const uint8_t *, size_t, const uint8_t *, size_t, uint8_t *);
+
+#endif /* __BLAKE256_H__ */

test_check.c

@@ -47,6 +47,7 @@
 #include "rand.h"
 #include "sha2.h"
 #include "sha3.h"
+#include "blake256.h"
 #include "blake2b.h"
 #include "blake2s.h"
 #include "curves.h"
@@ -2138,6 +2139,43 @@ START_TEST(test_keccak_256)
 }
 END_TEST
 
+START_TEST(test_blake256)
+{
+	struct {
+		const char *hash;
+		const char *data;
+	} tests[] = {
+		{ "716f6e863f744b9ac22c97ec7b76ea5f5908bc5b2f67c61510bfc4751384ea7a", "", },
+		{ "e104256a2bc501f459d03fac96b9014f593e22d30f4de525fa680c3aa189eb4f", "cc", },
+		{ "8f341148be7e354fdf38b693d8c6b4e0bd57301a734f6fd35cd85b8491c3ddcd", "41fb", },
+		{ "bc334d1069099f10c601883ac6f3e7e9787c6aa53171f76a21923cc5ad3ab937", "1f877c", },
+		{ "b672a16f53982bab1e77685b71c0a5f6703ffd46a1c834be69f614bd128d658e", "c1ecfdfc", },
+		{ "d9134b2899057a7d8d320cc99e3e116982bc99d3c69d260a7f1ed3da8be68d99", "21f134ac57", },
+		{ "637923bd29a35aa3ecbbd2a50549fc32c14cf0fdcaf41c3194dd7414fd224815", "c6f50bb74e29", },
+		{ "70c092fd5c8c21e9ef4bbc82a5c7819e262a530a748caf285ff0cba891954f1e", "119713cc83eeef", },
+		{ "fdf092993edbb7a0dc7ca67f04051bbd14481639da0808947aff8bfab5abed4b", "4a4f202484512526", },
+		{ "6f6fc234bf35beae1a366c44c520c59ad5aa70351b5f5085e21e1fe2bfcee709", "1f66ab4185ed9b6375", },
+		{ "4fdaf89e2a0e78c000061b59455e0ea93a4445b440e7562c8f0cfa165c93de2e", "eed7422227613b6f53c9", },
+		{ "d6b780eee9c811f664393dc2c58b5a68c92b3c9fe9ceb70371d33ece63b5787e", "eaeed5cdffd89dece455f1", },
+		{ "d0015071d3e7ed048c764850d76406eceae52b8e2e6e5a2c3aa92ae880485b34", "5be43c90f22902e4fe8ed2d3", },
+		{ "9b0207902f9932f7a85c24722e93e31f6ed2c75c406509aa0f2f6d1cab046ce4", "a746273228122f381c3b46e4f1", },
+		{ "258020d5b04a814f2b72c1c661e1f5a5c395d9799e5eee8b8519cf7300e90cb1", "3c5871cd619c69a63b540eb5a625", },
+		{ "4adae3b55baa907fefc253365fdd99d8398befd0551ed6bf9a2a2784d3c304d1", "fa22874bcc068879e8ef11a69f0722", },
+		{ "6dd10d772f8d5b4a96c3c5d30878cd9a1073fa835bfe6d2b924fa64a1fab1711", "52a608ab21ccdd8a4457a57ede782176", },
+		{ "0b8741ddf2259d3af2901eb1ae354f22836442c965556f5c1eb89501191cb46a", "82e192e4043ddcd12ecf52969d0f807eed", },
+		{ "f48a754ca8193a82643150ab94038b5dd170b4ebd1e0751b78cfb0a98fa5076a", "75683dcb556140c522543bb6e9098b21a21e", },
+		{ "5698409ab856b74d9fa5e9b259dfa46001f89041752da424e56e491577b88c86", "06e4efe45035e61faaf4287b4d8d1f12ca97e5", },
+	};
+
+	uint8_t hash[BLAKE256_DIGEST_LENGTH];
+
+	for (size_t i = 0; i < (sizeof(tests) / sizeof(*tests)); i++) {
+		blake256(fromhex(tests[i].data), i, hash);
+		ck_assert_mem_eq(hash, fromhex(tests[i].hash), BLAKE256_DIGEST_LENGTH);
+	}
+}
+END_TEST
+
 // test vectors from https://raw.githubusercontent.com/BLAKE2/BLAKE2/master/testvectors/blake2b-kat.txt
 START_TEST(test_blake2b)
 {
@@ -4174,6 +4212,10 @@ Suite *test_suite(void)
 	tcase_add_test(tc, test_keccak_256);
 	suite_add_tcase(s, tc);
 
+	tc = tcase_create("blake");
+	tcase_add_test(tc, test_blake256);
+	suite_add_tcase(s, tc);
+
 	tc = tcase_create("blake2");
 	tcase_add_test(tc, test_blake2b);
 	tcase_add_test(tc, test_blake2s);