poly — Poly1305 one-time authenticator
Feeds a message in 16-byte blocks and produces a 16-byte tag. It testifies that “someone who knows this key sent this byte string” (RFC 8439 §2.5).
The key must be fresh for every message
aead makes a one-time key from the nonce for every message (key_gen). If you use this module directly, you carry that discipline yourself. It does not promise constant time (there are bounds checks and stops) and has not been audited. Comparing tags is the caller’s job — compare without early return (as aead.unseal does).It does 130-bit arithmetic on u64 split into five 26-bit limbs. The largest product is around 252, safe inside u64 — the limb layout is the safety argument, which is why that number is written at the top of the source.
| op | What it does |
|---|---|
setup | Sets up state (five h · five r) from the key |
block | Feeds one 16-byte block. addhi is 1 for a full block |
emit | Produces the 16-byte tag from state and key |
Table 50.1 — Ops of poly
addhi is an argument because a short last block must place the top 1 bit differently. aead fills every block with pad16, so it always passes 1 — the saying that padding exists to reduce cases to one becomes concrete here.
block stays as this module’s definition of the meaning. The loop over blocks, though, is what aead now calls as the word poly1305 — the state has the same layout (five h, five r), so setup and emit remain in the language and only the middle went down (measured 331 → 1840 MB/s). A regression test holds the word and the loop over block against the same state.
What is checked — the RFC 8439 §2.5.2 tag vector and VM/native agreement. Not built — constant-time guarantees, tag comparison, detection of key reuse, serialising streaming state.