1 /* $OpenBSD: sha3.c,v 1.15 2023/04/16 15:32:16 jsing Exp $ */ 2 /* 3 * The MIT License (MIT) 4 * 5 * Copyright (c) 2015 Markku-Juhani O. Saarinen 6 * 7 * Permission is hereby granted, free of charge, to any person obtaining a copy 8 * of this software and associated documentation files (the "Software"), to deal 9 * in the Software without restriction, including without limitation the rights 10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 11 * copies of the Software, and to permit persons to whom the Software is 12 * furnished to do so, subject to the following conditions: 13 * 14 * The above copyright notice and this permission notice shall be included in all 15 * copies or substantial portions of the Software. 16 * 17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 23 * SOFTWARE. 24 */ 25 26 #include <endian.h> 27 #include <string.h> 28 29 #include "sha3_internal.h" 30 31 #define KECCAKF_ROUNDS 24 32 33 #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y)))) 34 35 static const uint64_t sha3_keccakf_rndc[24] = { 36 0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 37 0x8000000080008000, 0x000000000000808b, 0x0000000080000001, 38 0x8000000080008081, 0x8000000000008009, 0x000000000000008a, 39 0x0000000000000088, 0x0000000080008009, 0x000000008000000a, 40 0x000000008000808b, 0x800000000000008b, 0x8000000000008089, 41 0x8000000000008003, 0x8000000000008002, 0x8000000000000080, 42 0x000000000000800a, 0x800000008000000a, 0x8000000080008081, 43 0x8000000000008080, 0x0000000080000001, 0x8000000080008008 44 }; 45 static const int sha3_keccakf_rotc[24] = { 46 1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14, 47 27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44 48 }; 49 static const int sha3_keccakf_piln[24] = { 50 10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4, 51 15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1 52 }; 53 54 static void 55 sha3_keccakf(uint64_t st[25]) 56 { 57 uint64_t t, bc[5]; 58 int i, j, r; 59 60 #if BYTE_ORDER != LITTLE_ENDIAN 61 uint8_t *v; 62 63 for (i = 0; i < 25; i++) { 64 v = (uint8_t *) &st[i]; 65 st[i] = ((uint64_t) v[0]) | (((uint64_t) v[1]) << 8) | 66 (((uint64_t) v[2]) << 16) | (((uint64_t) v[3]) << 24) | 67 (((uint64_t) v[4]) << 32) | (((uint64_t) v[5]) << 40) | 68 (((uint64_t) v[6]) << 48) | (((uint64_t) v[7]) << 56); 69 } 70 #endif 71 72 for (r = 0; r < KECCAKF_ROUNDS; r++) { 73 74 /* Theta */ 75 for (i = 0; i < 5; i++) 76 bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20]; 77 78 for (i = 0; i < 5; i++) { 79 t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1); 80 for (j = 0; j < 25; j += 5) 81 st[j + i] ^= t; 82 } 83 84 /* Rho Pi */ 85 t = st[1]; 86 for (i = 0; i < 24; i++) { 87 j = sha3_keccakf_piln[i]; 88 bc[0] = st[j]; 89 st[j] = ROTL64(t, sha3_keccakf_rotc[i]); 90 t = bc[0]; 91 } 92 93 /* Chi */ 94 for (j = 0; j < 25; j += 5) { 95 for (i = 0; i < 5; i++) 96 bc[i] = st[j + i]; 97 for (i = 0; i < 5; i++) 98 st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5]; 99 } 100 101 /* Iota */ 102 st[0] ^= sha3_keccakf_rndc[r]; 103 } 104 105 #if BYTE_ORDER != LITTLE_ENDIAN 106 for (i = 0; i < 25; i++) { 107 v = (uint8_t *) &st[i]; 108 t = st[i]; 109 v[0] = t & 0xFF; 110 v[1] = (t >> 8) & 0xFF; 111 v[2] = (t >> 16) & 0xFF; 112 v[3] = (t >> 24) & 0xFF; 113 v[4] = (t >> 32) & 0xFF; 114 v[5] = (t >> 40) & 0xFF; 115 v[6] = (t >> 48) & 0xFF; 116 v[7] = (t >> 56) & 0xFF; 117 } 118 #endif 119 } 120 121 int 122 sha3_init(sha3_ctx *c, int mdlen) 123 { 124 if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2) 125 return 0; 126 127 memset(c, 0, sizeof(*c)); 128 129 c->mdlen = mdlen; 130 c->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen; 131 132 return 1; 133 } 134 135 int 136 sha3_update(sha3_ctx *c, const void *data, size_t len) 137 { 138 size_t i, j; 139 140 j = c->pt; 141 for (i = 0; i < len; i++) { 142 c->state.b[j++] ^= ((const uint8_t *) data)[i]; 143 if (j >= c->rsize) { 144 sha3_keccakf(c->state.q); 145 j = 0; 146 } 147 } 148 c->pt = j; 149 150 return 1; 151 } 152 153 int 154 sha3_final(void *md, sha3_ctx *c) 155 { 156 int i; 157 158 c->state.b[c->pt] ^= 0x06; 159 c->state.b[c->rsize - 1] ^= 0x80; 160 sha3_keccakf(c->state.q); 161 162 for (i = 0; i < c->mdlen; i++) { 163 ((uint8_t *) md)[i] = c->state.b[i]; 164 } 165 166 return 1; 167 } 168 169 /* SHAKE128 and SHAKE256 extensible-output functionality. */ 170 void 171 shake_xof(sha3_ctx *c) 172 { 173 c->state.b[c->pt] ^= 0x1F; 174 c->state.b[c->rsize - 1] ^= 0x80; 175 sha3_keccakf(c->state.q); 176 c->pt = 0; 177 } 178 179 void 180 shake_out(sha3_ctx *c, void *out, size_t len) 181 { 182 size_t i, j; 183 184 j = c->pt; 185 for (i = 0; i < len; i++) { 186 if (j >= c->rsize) { 187 sha3_keccakf(c->state.q); 188 j = 0; 189 } 190 ((uint8_t *) out)[i] = c->state.b[j++]; 191 } 192 c->pt = j; 193 } 194