1 /* $OpenBSD: sha3.c,v 1.16 2024/11/23 15:38:12 jsing Exp $ */
2 /*
3 * The MIT License (MIT)
4 *
5 * Copyright (c) 2015 Markku-Juhani O. Saarinen
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in all
15 * copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 * SOFTWARE.
24 */
25
26 #include <endian.h>
27 #include <string.h>
28
29 #include "sha3_internal.h"
30
31 #define KECCAKF_ROUNDS 24
32
33 #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
34
35 static const uint64_t sha3_keccakf_rndc[24] = {
36 0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
37 0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
38 0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
39 0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
40 0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
41 0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
42 0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
43 0x8000000000008080, 0x0000000080000001, 0x8000000080008008
44 };
45 static const int sha3_keccakf_rotc[24] = {
46 1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
47 27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
48 };
49 static const int sha3_keccakf_piln[24] = {
50 10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
51 15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
52 };
53
54 static void
sha3_keccakf(uint64_t st[25])55 sha3_keccakf(uint64_t st[25])
56 {
57 uint64_t t, bc[5];
58 int i, j, r;
59
60 for (i = 0; i < 25; i++)
61 st[i] = le64toh(st[i]);
62
63 for (r = 0; r < KECCAKF_ROUNDS; r++) {
64
65 /* Theta */
66 for (i = 0; i < 5; i++)
67 bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
68
69 for (i = 0; i < 5; i++) {
70 t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
71 for (j = 0; j < 25; j += 5)
72 st[j + i] ^= t;
73 }
74
75 /* Rho Pi */
76 t = st[1];
77 for (i = 0; i < 24; i++) {
78 j = sha3_keccakf_piln[i];
79 bc[0] = st[j];
80 st[j] = ROTL64(t, sha3_keccakf_rotc[i]);
81 t = bc[0];
82 }
83
84 /* Chi */
85 for (j = 0; j < 25; j += 5) {
86 for (i = 0; i < 5; i++)
87 bc[i] = st[j + i];
88 for (i = 0; i < 5; i++)
89 st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
90 }
91
92 /* Iota */
93 st[0] ^= sha3_keccakf_rndc[r];
94 }
95
96 for (i = 0; i < 25; i++)
97 st[i] = htole64(st[i]);
98 }
99
100 int
sha3_init(sha3_ctx * c,int mdlen)101 sha3_init(sha3_ctx *c, int mdlen)
102 {
103 if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2)
104 return 0;
105
106 memset(c, 0, sizeof(*c));
107
108 c->mdlen = mdlen;
109 c->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen;
110
111 return 1;
112 }
113
114 int
sha3_update(sha3_ctx * c,const void * data,size_t len)115 sha3_update(sha3_ctx *c, const void *data, size_t len)
116 {
117 size_t i, j;
118
119 j = c->pt;
120 for (i = 0; i < len; i++) {
121 c->state.b[j++] ^= ((const uint8_t *) data)[i];
122 if (j >= c->rsize) {
123 sha3_keccakf(c->state.q);
124 j = 0;
125 }
126 }
127 c->pt = j;
128
129 return 1;
130 }
131
132 int
sha3_final(void * md,sha3_ctx * c)133 sha3_final(void *md, sha3_ctx *c)
134 {
135 int i;
136
137 c->state.b[c->pt] ^= 0x06;
138 c->state.b[c->rsize - 1] ^= 0x80;
139 sha3_keccakf(c->state.q);
140
141 for (i = 0; i < c->mdlen; i++) {
142 ((uint8_t *) md)[i] = c->state.b[i];
143 }
144
145 return 1;
146 }
147
148 /* SHAKE128 and SHAKE256 extensible-output functionality. */
149 void
shake_xof(sha3_ctx * c)150 shake_xof(sha3_ctx *c)
151 {
152 c->state.b[c->pt] ^= 0x1F;
153 c->state.b[c->rsize - 1] ^= 0x80;
154 sha3_keccakf(c->state.q);
155 c->pt = 0;
156 }
157
158 void
shake_out(sha3_ctx * c,void * out,size_t len)159 shake_out(sha3_ctx *c, void *out, size_t len)
160 {
161 size_t i, j;
162
163 j = c->pt;
164 for (i = 0; i < len; i++) {
165 if (j >= c->rsize) {
166 sha3_keccakf(c->state.q);
167 j = 0;
168 }
169 ((uint8_t *) out)[i] = c->state.b[j++];
170 }
171 c->pt = j;
172 }
173