156 lines
4 KiB
C
156 lines
4 KiB
C
/* Copyright (c) 2015 Markku-Juhani O. Saarinen */
|
|
|
|
#include "sha3.h"
|
|
|
|
#ifndef KECCAKF_ROUNDS
|
|
#define KECCAKF_ROUNDS 24
|
|
#endif
|
|
|
|
#ifndef ROTL64
|
|
#define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
|
|
#endif
|
|
|
|
// update the state with given number of rounds
|
|
|
|
static void sha3_keccakf(uint64_t st[25])
|
|
{
|
|
// constants
|
|
const uint64_t keccakf_rndc[24] = {
|
|
0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
|
|
0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
|
|
0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
|
|
0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
|
|
0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
|
|
0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
|
|
0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
|
|
0x8000000000008080, 0x0000000080000001, 0x8000000080008008
|
|
};
|
|
const int keccakf_rotc[24] = {
|
|
1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
|
|
27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
|
|
};
|
|
const int keccakf_piln[24] = {
|
|
10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
|
|
15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
|
|
};
|
|
|
|
// variables
|
|
int i, j, r;
|
|
uint64_t t, bc[5];
|
|
|
|
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
|
|
uint8_t *v;
|
|
|
|
// endianess conversion. this is redundant on little-endian targets
|
|
for (i = 0; i < 25; i++) {
|
|
v = (uint8_t *) &st[i];
|
|
st[i] = ((uint64_t) v[0]) | (((uint64_t) v[1]) << 8) |
|
|
(((uint64_t) v[2]) << 16) | (((uint64_t) v[3]) << 24) |
|
|
(((uint64_t) v[4]) << 32) | (((uint64_t) v[5]) << 40) |
|
|
(((uint64_t) v[6]) << 48) | (((uint64_t) v[7]) << 56);
|
|
}
|
|
#endif
|
|
|
|
// actual iteration
|
|
for (r = 0; r < KECCAKF_ROUNDS; r++) {
|
|
|
|
// Theta
|
|
for (i = 0; i < 5; i++)
|
|
bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
|
|
|
|
for (i = 0; i < 5; i++) {
|
|
t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
|
|
for (j = 0; j < 25; j += 5)
|
|
st[j + i] ^= t;
|
|
}
|
|
|
|
// Rho Pi
|
|
t = st[1];
|
|
for (i = 0; i < 24; i++) {
|
|
j = keccakf_piln[i];
|
|
bc[0] = st[j];
|
|
st[j] = ROTL64(t, keccakf_rotc[i]);
|
|
t = bc[0];
|
|
}
|
|
|
|
// Chi
|
|
for (j = 0; j < 25; j += 5) {
|
|
for (i = 0; i < 5; i++)
|
|
bc[i] = st[j + i];
|
|
for (i = 0; i < 5; i++)
|
|
st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
|
|
}
|
|
|
|
// Iota
|
|
st[0] ^= keccakf_rndc[r];
|
|
}
|
|
|
|
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
|
|
// endianess conversion. this is redundant on little-endian targets
|
|
for (i = 0; i < 25; i++) {
|
|
v = (uint8_t *) &st[i];
|
|
t = st[i];
|
|
v[0] = t & 0xFF;
|
|
v[1] = (t >> 8) & 0xFF;
|
|
v[2] = (t >> 16) & 0xFF;
|
|
v[3] = (t >> 24) & 0xFF;
|
|
v[4] = (t >> 32) & 0xFF;
|
|
v[5] = (t >> 40) & 0xFF;
|
|
v[6] = (t >> 48) & 0xFF;
|
|
v[7] = (t >> 56) & 0xFF;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
// Initialize the context for SHA3
|
|
|
|
void digestif_sha3_init(struct sha3_ctx *ctx, int mdlen)
|
|
{
|
|
int i;
|
|
for (i = 0; i < 25; i++)
|
|
ctx->st.q[i] = 0;
|
|
ctx->mdlen = mdlen/8;
|
|
ctx->rsiz = 200 - 2 * ctx->mdlen;
|
|
ctx->pt = 0;
|
|
|
|
return;
|
|
}
|
|
|
|
// update state with more data
|
|
|
|
void digestif_sha3_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len)
|
|
{
|
|
uint32_t i;
|
|
int j;
|
|
|
|
j = ctx->pt;
|
|
for (i = 0; i < len; i++) {
|
|
ctx->st.b[j++] ^= data[i];
|
|
if (j >= ctx->rsiz) {
|
|
sha3_keccakf(ctx->st.q);
|
|
j = 0;
|
|
}
|
|
}
|
|
ctx->pt = j;
|
|
|
|
return;
|
|
}
|
|
|
|
// finalize and output a hash
|
|
|
|
void digestif_sha3_finalize(struct sha3_ctx *ctx, uint8_t *md, uint8_t padding)
|
|
{
|
|
int i;
|
|
|
|
//padding
|
|
ctx->st.b[ctx->pt] ^= padding;
|
|
ctx->st.b[ctx->rsiz - 1] ^= 0x80;
|
|
|
|
//call f on the last block
|
|
sha3_keccakf(ctx->st.q);
|
|
for (i = 0; i < ctx->mdlen; i++) {
|
|
md[i] = ctx->st.b[i];
|
|
}
|
|
|
|
return;
|
|
}
|