keccak.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421
  1. /*
  2. * An implementation of the SHA3 (Keccak) hash function family.
  3. *
  4. * Algorithm specifications: http://keccak.noekeon.org/
  5. * NIST Announcement:
  6. * http://csrc.nist.gov/groups/ST/hash/sha-3/winner_sha-3.html
  7. *
  8. * Written in 2013 by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>
  9. *
  10. * ===================================================================
  11. * The contents of this file are dedicated to the public domain. To
  12. * the extent that dedication to the public domain is not available,
  13. * everyone is granted a worldwide, perpetual, royalty-free,
  14. * non-exclusive license to exercise all rights associated with the
  15. * contents of this file for any purpose whatsoever.
  16. * No rights are reserved.
  17. *
  18. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  19. * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  20. * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  21. * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  22. * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  23. * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  24. * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  25. * SOFTWARE.
  26. * ===================================================================
  27. */
  28. #include <string.h>
  29. #include <assert.h>
  30. #include "common.h"
  31. #include "endianess.h"
  32. FAKE_INIT(keccak)
  33. typedef struct
  34. {
  35. uint64_t state[25];
  36. /* The buffer is as long as the state,
  37. * but only 'rate' bytes will be used.
  38. */
  39. uint8_t buf[200];
  40. /* When absorbing, this is the number of bytes in buf that
  41. * are coming from the message and outstanding.
  42. * When squeezing, this is the remaining number of bytes
  43. * that can be used as digest.
  44. */
  45. unsigned valid_bytes;
  46. /* All values in bytes */
  47. unsigned capacity;
  48. unsigned rate;
  49. uint8_t squeezing;
  50. uint8_t padding;
  51. } keccak_state;
  52. #undef ROL64
  53. #define ROL64(x,y) ((((x) << (y)) | (x) >> (64-(y))) & 0xFFFFFFFFFFFFFFFFULL)
  54. static void keccak_function (uint64_t *state);
  55. static void keccak_absorb_internal (keccak_state *self)
  56. {
  57. unsigned i,j;
  58. uint64_t d;
  59. for (i=j=0; j < self->rate; ++i, j += 8) {
  60. d = LOAD_U64_LITTLE(self->buf + j);
  61. self->state[i] ^= d;
  62. }
  63. }
  64. static void
  65. keccak_squeeze_internal (keccak_state *self)
  66. {
  67. unsigned i, j;
  68. for (i=j=0; j < self->rate; ++i, j += 8) {
  69. STORE_U64_LITTLE(self->buf+j, self->state[i]);
  70. }
  71. }
  72. EXPORT_SYM int keccak_init (keccak_state **state,
  73. size_t capacity_bytes,
  74. uint8_t padding)
  75. {
  76. keccak_state *ks;
  77. if (NULL == state) {
  78. return ERR_NULL;
  79. }
  80. *state = ks = (keccak_state*) calloc(1, sizeof(keccak_state));
  81. if (NULL == ks)
  82. return ERR_MEMORY;
  83. if (capacity_bytes >= 200)
  84. return ERR_DIGEST_SIZE;
  85. ks->capacity = (unsigned)capacity_bytes;
  86. ks->rate = 200 - ks->capacity;
  87. ks->squeezing = 0;
  88. ks->padding = padding;
  89. return 0;
  90. }
  91. EXPORT_SYM int keccak_destroy(keccak_state *state)
  92. {
  93. free(state);
  94. return 0;
  95. }
  96. EXPORT_SYM int keccak_absorb (keccak_state *self,
  97. const uint8_t *in,
  98. size_t length)
  99. {
  100. if (NULL==self || NULL==in)
  101. return ERR_NULL;
  102. if (self->squeezing != 0)
  103. return ERR_UNKNOWN;
  104. while (length > 0) {
  105. unsigned tc;
  106. unsigned left;
  107. left = self->rate - self->valid_bytes;
  108. tc = (unsigned) MIN(length, left);
  109. memcpy(self->buf + self->valid_bytes, in, tc);
  110. self->valid_bytes += tc;
  111. in += tc;
  112. length -= tc;
  113. if (self->valid_bytes == self->rate) {
  114. keccak_absorb_internal (self);
  115. keccak_function (self->state);
  116. self->valid_bytes = 0;
  117. }
  118. }
  119. return 0;
  120. }
  121. static void keccak_finish (keccak_state *self)
  122. {
  123. assert(self->squeezing == 0);
  124. assert(self->valid_bytes < self->rate);
  125. /* Padding */
  126. memset(self->buf + self->valid_bytes, 0, self->rate - self->valid_bytes);
  127. self->buf[self->valid_bytes] = self->padding;
  128. self->buf[self->rate-1] |= 0x80;
  129. /* Final absorb */
  130. keccak_absorb_internal (self);
  131. keccak_function (self->state);
  132. /* First squeeze */
  133. self->squeezing = 1;
  134. keccak_squeeze_internal (self);
  135. self->valid_bytes = self->rate;
  136. }
  137. EXPORT_SYM int keccak_squeeze (keccak_state *self, uint8_t *out, size_t length)
  138. {
  139. if ((NULL == self) || (NULL == out))
  140. return ERR_NULL;
  141. if (self->squeezing == 0) {
  142. keccak_finish (self);
  143. }
  144. assert(self->squeezing == 1);
  145. assert(self->valid_bytes > 0);
  146. assert(self->valid_bytes <= self->rate);
  147. while (length > 0) {
  148. unsigned tc;
  149. tc = (unsigned)MIN(self->valid_bytes, length);
  150. memcpy(out, self->buf + (self->rate - self->valid_bytes), tc);
  151. self->valid_bytes -= tc;
  152. out += tc;
  153. length -= tc;
  154. if (self->valid_bytes == 0) {
  155. keccak_function (self->state);
  156. keccak_squeeze_internal (self);
  157. self->valid_bytes = self->rate;
  158. }
  159. }
  160. return 0;
  161. }
  162. EXPORT_SYM int keccak_digest(keccak_state *state, uint8_t *digest, size_t len)
  163. {
  164. keccak_state tmp;
  165. if ((NULL==state) || (NULL==digest))
  166. return ERR_NULL;
  167. if (2*len != state->capacity)
  168. return ERR_UNKNOWN;
  169. tmp = *state;
  170. return keccak_squeeze(&tmp, digest, len);
  171. }
  172. /* Keccak core function */
  173. #define KECCAK_ROUNDS 24
  174. #define ROT_01 36
  175. #define ROT_02 3
  176. #define ROT_03 41
  177. #define ROT_04 18
  178. #define ROT_05 1
  179. #define ROT_06 44
  180. #define ROT_07 10
  181. #define ROT_08 45
  182. #define ROT_09 2
  183. #define ROT_10 62
  184. #define ROT_11 6
  185. #define ROT_12 43
  186. #define ROT_13 15
  187. #define ROT_14 61
  188. #define ROT_15 28
  189. #define ROT_16 55
  190. #define ROT_17 25
  191. #define ROT_18 21
  192. #define ROT_19 56
  193. #define ROT_20 27
  194. #define ROT_21 20
  195. #define ROT_22 39
  196. #define ROT_23 8
  197. #define ROT_24 14
  198. static const uint64_t roundconstants[KECCAK_ROUNDS] = {
  199. 0x0000000000000001ULL,
  200. 0x0000000000008082ULL,
  201. 0x800000000000808aULL,
  202. 0x8000000080008000ULL,
  203. 0x000000000000808bULL,
  204. 0x0000000080000001ULL,
  205. 0x8000000080008081ULL,
  206. 0x8000000000008009ULL,
  207. 0x000000000000008aULL,
  208. 0x0000000000000088ULL,
  209. 0x0000000080008009ULL,
  210. 0x000000008000000aULL,
  211. 0x000000008000808bULL,
  212. 0x800000000000008bULL,
  213. 0x8000000000008089ULL,
  214. 0x8000000000008003ULL,
  215. 0x8000000000008002ULL,
  216. 0x8000000000000080ULL,
  217. 0x000000000000800aULL,
  218. 0x800000008000000aULL,
  219. 0x8000000080008081ULL,
  220. 0x8000000000008080ULL,
  221. 0x0000000080000001ULL,
  222. 0x8000000080008008ULL
  223. };
  224. void keccak_function (uint64_t *state)
  225. {
  226. short i;
  227. /* Temporary variables to avoid indexing overhead */
  228. uint64_t a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12;
  229. uint64_t a13, a14, a15, a16, a17, a18, a19, a20, a21, a22, a23, a24;
  230. uint64_t b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12;
  231. uint64_t b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24;
  232. uint64_t c0, c1, c2, c3, c4, d;
  233. a0 = state[0];
  234. a1 = state[1];
  235. a2 = state[2];
  236. a3 = state[3];
  237. a4 = state[4];
  238. a5 = state[5];
  239. a6 = state[6];
  240. a7 = state[7];
  241. a8 = state[8];
  242. a9 = state[9];
  243. a10 = state[10];
  244. a11 = state[11];
  245. a12 = state[12];
  246. a13 = state[13];
  247. a14 = state[14];
  248. a15 = state[15];
  249. a16 = state[16];
  250. a17 = state[17];
  251. a18 = state[18];
  252. a19 = state[19];
  253. a20 = state[20];
  254. a21 = state[21];
  255. a22 = state[22];
  256. a23 = state[23];
  257. a24 = state[24];
  258. for (i = 0; i < KECCAK_ROUNDS; ++i) {
  259. /*
  260. Uses temporary variables and loop unrolling to
  261. avoid array indexing and inner loops overhead
  262. */
  263. /* Prepare column parity for Theta step */
  264. c0 = a0 ^ a5 ^ a10 ^ a15 ^ a20;
  265. c1 = a1 ^ a6 ^ a11 ^ a16 ^ a21;
  266. c2 = a2 ^ a7 ^ a12 ^ a17 ^ a22;
  267. c3 = a3 ^ a8 ^ a13 ^ a18 ^ a23;
  268. c4 = a4 ^ a9 ^ a14 ^ a19 ^ a24;
  269. /* Theta + Rho + Pi steps */
  270. d = c4 ^ ROL64(c1, 1);
  271. b0 = d ^ a0;
  272. b16 = ROL64(d ^ a5, ROT_01);
  273. b7 = ROL64(d ^ a10, ROT_02);
  274. b23 = ROL64(d ^ a15, ROT_03);
  275. b14 = ROL64(d ^ a20, ROT_04);
  276. d = c0 ^ ROL64(c2, 1);
  277. b10 = ROL64(d ^ a1, ROT_05);
  278. b1 = ROL64(d ^ a6, ROT_06);
  279. b17 = ROL64(d ^ a11, ROT_07);
  280. b8 = ROL64(d ^ a16, ROT_08);
  281. b24 = ROL64(d ^ a21, ROT_09);
  282. d = c1 ^ ROL64(c3, 1);
  283. b20 = ROL64(d ^ a2, ROT_10);
  284. b11 = ROL64(d ^ a7, ROT_11);
  285. b2 = ROL64(d ^ a12, ROT_12);
  286. b18 = ROL64(d ^ a17, ROT_13);
  287. b9 = ROL64(d ^ a22, ROT_14);
  288. d = c2 ^ ROL64(c4, 1);
  289. b5 = ROL64(d ^ a3, ROT_15);
  290. b21 = ROL64(d ^ a8, ROT_16);
  291. b12 = ROL64(d ^ a13, ROT_17);
  292. b3 = ROL64(d ^ a18, ROT_18);
  293. b19 = ROL64(d ^ a23, ROT_19);
  294. d = c3 ^ ROL64(c0, 1);
  295. b15 = ROL64(d ^ a4, ROT_20);
  296. b6 = ROL64(d ^ a9, ROT_21);
  297. b22 = ROL64(d ^ a14, ROT_22);
  298. b13 = ROL64(d ^ a19, ROT_23);
  299. b4 = ROL64(d ^ a24, ROT_24);
  300. /* Chi + Iota steps */
  301. a0 = b0 ^ (~b1 & b2) ^ roundconstants[i];
  302. a1 = b1 ^ (~b2 & b3);
  303. a2 = b2 ^ (~b3 & b4);
  304. a3 = b3 ^ (~b4 & b0);
  305. a4 = b4 ^ (~b0 & b1);
  306. a5 = b5 ^ (~b6 & b7);
  307. a6 = b6 ^ (~b7 & b8);
  308. a7 = b7 ^ (~b8 & b9);
  309. a8 = b8 ^ (~b9 & b5);
  310. a9 = b9 ^ (~b5 & b6);
  311. a10 = b10 ^ (~b11 & b12);
  312. a11 = b11 ^ (~b12 & b13);
  313. a12 = b12 ^ (~b13 & b14);
  314. a13 = b13 ^ (~b14 & b10);
  315. a14 = b14 ^ (~b10 & b11);
  316. a15 = b15 ^ (~b16 & b17);
  317. a16 = b16 ^ (~b17 & b18);
  318. a17 = b17 ^ (~b18 & b19);
  319. a18 = b18 ^ (~b19 & b15);
  320. a19 = b19 ^ (~b15 & b16);
  321. a20 = b20 ^ (~b21 & b22);
  322. a21 = b21 ^ (~b22 & b23);
  323. a22 = b22 ^ (~b23 & b24);
  324. a23 = b23 ^ (~b24 & b20);
  325. a24 = b24 ^ (~b20 & b21);
  326. }
  327. state[0] = a0;
  328. state[1] = a1;
  329. state[2] = a2;
  330. state[3] = a3;
  331. state[4] = a4;
  332. state[5] = a5;
  333. state[6] = a6;
  334. state[7] = a7;
  335. state[8] = a8;
  336. state[9] = a9;
  337. state[10] = a10;
  338. state[11] = a11;
  339. state[12] = a12;
  340. state[13] = a13;
  341. state[14] = a14;
  342. state[15] = a15;
  343. state[16] = a16;
  344. state[17] = a17;
  345. state[18] = a18;
  346. state[19] = a19;
  347. state[20] = a20;
  348. state[21] = a21;
  349. state[22] = a22;
  350. state[23] = a23;
  351. state[24] = a24;
  352. }