bluelib/core/hash/sha3.c

/*
 * The MIT License (MIT)
 *
 * Copyright (c) 2015 Markku-Juhani O. Saarinen
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

// sha3.c
// 19-Nov-11  Markku-Juhani O. Saarinen <mjos@iki.fi>

// Revised 07-Aug-15 to match with official release of FIPS PUB 202 "SHA3"
// Revised 03-Sep-15 for portability + OpenSSL - style API

#include "hash.h"

#include <blue/core/hash.h>
#include <blue/core/misc.h>
#include <string.h>

#ifndef KECCAKF_ROUNDS
#define KECCAKF_ROUNDS 24
#endif

#ifndef ROTL64
#define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
#endif

// update the state with given number of rounds

void sha3_keccakf(uint64_t st[25])
{
	// constants
	const uint64_t keccakf_rndc[24]
		= {0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
	           0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
	           0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
	           0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
	           0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
	           0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
	           0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
	           0x8000000000008080, 0x0000000080000001, 0x8000000080008008};
	const int keccakf_rotc[24]
		= {1,  3,  6,  10, 15, 21, 28, 36, 45, 55, 2,  14,
	           27, 41, 56, 8,  25, 43, 62, 18, 39, 61, 20, 44};
	const int keccakf_piln[24]
		= {10, 7,  11, 17, 18, 3, 5,  16, 8,  21, 24, 4,
	           15, 23, 19, 13, 12, 2, 20, 14, 22, 9,  6,  1};

	// variables
	int i, j, r;
	uint64_t t, bc[5];

#if !defined(LITTLE_ENDIAN)
	uint8_t *v;

	// endianess conversion. this is redundant on little-endian targets
	for (i = 0; i < 25; i++) {
		v = (uint8_t *)&st[i];
		st[i] = ((uint64_t)v[0]) | (((uint64_t)v[1]) << 8)
		      | (((uint64_t)v[2]) << 16) | (((uint64_t)v[3]) << 24)
		      | (((uint64_t)v[4]) << 32) | (((uint64_t)v[5]) << 40)
		      | (((uint64_t)v[6]) << 48) | (((uint64_t)v[7]) << 56);
	}
#endif

	// actual iteration
	for (r = 0; r < KECCAKF_ROUNDS; r++) {

		// Theta
		for (i = 0; i < 5; i++)
			bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15]
			      ^ st[i + 20];

		for (i = 0; i < 5; i++) {
			t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
			for (j = 0; j < 25; j += 5)
				st[j + i] ^= t;
		}

		// Rho Pi
		t = st[1];
		for (i = 0; i < 24; i++) {
			j = keccakf_piln[i];
			bc[0] = st[j];
			st[j] = ROTL64(t, keccakf_rotc[i]);
			t = bc[0];
		}

		//  Chi
		for (j = 0; j < 25; j += 5) {
			for (i = 0; i < 5; i++)
				bc[i] = st[j + i];
			for (i = 0; i < 5; i++)
				st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
		}

		//  Iota
		st[0] ^= keccakf_rndc[r];
	}

#if !defined(LITTLE_ENDIAN)
	// endianess conversion. this is redundant on little-endian targets
	for (i = 0; i < 25; i++) {
		v = (uint8_t *)&st[i];
		t = st[i];
		v[0] = t & 0xFF;
		v[1] = (t >> 8) & 0xFF;
		v[2] = (t >> 16) & 0xFF;
		v[3] = (t >> 24) & 0xFF;
		v[4] = (t >> 32) & 0xFF;
		v[5] = (t >> 40) & 0xFF;
		v[6] = (t >> 48) & 0xFF;
		v[7] = (t >> 56) & 0xFF;
	}
#endif
}

// Initialize the context for SHA3

int sha3_init(struct b_hash_ctx *c, int mdlen)
{
	int i;

	for (i = 0; i < 25; i++)
		c->ctx_state.sha3.st.q[i] = 0;
	c->ctx_state.sha3.mdlen = mdlen;
	c->ctx_state.sha3.rsiz = 200 - 2 * mdlen;
	c->ctx_state.sha3.pt = 0;

	return 1;
}

// update state with more data

void sha3_update(struct b_hash_ctx *c, const void *data, size_t len)
{
	size_t i;
	int j;

	j = c->ctx_state.sha3.pt;
	for (i = 0; i < len; i++) {
		c->ctx_state.sha3.st.b[j++] ^= ((const uint8_t *)data)[i];
		if (j >= c->ctx_state.sha3.rsiz) {
			sha3_keccakf(c->ctx_state.sha3.st.q);
			j = 0;
		}
	}

	c->ctx_state.sha3.pt = j;
}

// finalize and output a hash

int sha3_final(void *md, struct b_hash_ctx *c)
{
	int i;

	c->ctx_state.sha3.st.b[c->ctx_state.sha3.pt] ^= 0x06;
	c->ctx_state.sha3.st.b[c->ctx_state.sha3.rsiz - 1] ^= 0x80;
	sha3_keccakf(c->ctx_state.sha3.st.q);

	for (i = 0; i < c->ctx_state.sha3.mdlen; i++) {
		((uint8_t *)md)[i] = c->ctx_state.sha3.st.b[i];
	}

	return 1;
}

// compute a SHA-3 hash (md) of given byte length from "in"

void *sha3(const void *in, size_t inlen, void *md, int mdlen)
{
	struct b_hash_ctx sha3;

	sha3_init(&sha3, mdlen);
	sha3_update(&sha3, in, inlen);
	sha3_final(md, &sha3);

	return md;
}

// SHAKE128 and SHAKE256 extensible-output functionality

void shake_xof(struct b_hash_ctx *c)
{
	c->ctx_state.sha3.st.b[c->ctx_state.sha3.pt] ^= 0x1F;
	c->ctx_state.sha3.st.b[c->ctx_state.sha3.rsiz - 1] ^= 0x80;
	sha3_keccakf(c->ctx_state.sha3.st.q);
	c->ctx_state.sha3.pt = 0;
}

void shake_out(struct b_hash_ctx *c, void *out, size_t len)
{
	size_t i;
	int j;

	j = c->ctx_state.sha3.pt;
	for (i = 0; i < len; i++) {
		if (j >= c->ctx_state.sha3.rsiz) {
			sha3_keccakf(c->ctx_state.sha3.st.q);
			j = 0;
		}
		((uint8_t *)out)[i] = c->ctx_state.sha3.st.b[j++];
	}
	c->ctx_state.sha3.pt = j;
}

static void sha3_224_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHA3_224);
}

static void sha3_224_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHA3_224];
	sha3_final(md, ctx);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

static void sha3_256_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHA3_256);
}

static void sha3_256_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHA3_256];
	sha3_final(md, ctx);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

static void sha3_384_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHA3_384);
}

static void sha3_384_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHA3_384];
	sha3_final(md, ctx);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

static void sha3_512_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHA3_512);
}

static void sha3_512_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHA3_512];
	sha3_final(md, ctx);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

static void shake128_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHAKE128);
}

static void shake128_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHAKE128];
	shake_xof(ctx);
	shake_out(ctx, md, sizeof md);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

static void shake256_init(struct b_hash_ctx *ctx)
{
	sha3_init(ctx, B_DIGEST_LENGTH_SHAKE256);
}

static void shake256_finish(struct b_hash_ctx *ctx, void *out, size_t max)
{
	unsigned char md[B_DIGEST_LENGTH_SHAKE256];
	shake_xof(ctx);
	shake_out(ctx, md, sizeof md);
	memcpy(out, md, b_min(size_t, sizeof md, max));
}

struct b_hash_function_ops z__b_sha3_224_ops = {
	.hash_init = sha3_224_init,
	.hash_update = sha3_update,
	.hash_finish = sha3_224_finish,
};

struct b_hash_function_ops z__b_sha3_256_ops = {
	.hash_init = sha3_256_init,
	.hash_update = sha3_update,
	.hash_finish = sha3_256_finish,
};

struct b_hash_function_ops z__b_sha3_384_ops = {
	.hash_init = sha3_384_init,
	.hash_update = sha3_update,
	.hash_finish = sha3_384_finish,
};

struct b_hash_function_ops z__b_sha3_512_ops = {
	.hash_init = sha3_512_init,
	.hash_update = sha3_update,
	.hash_finish = sha3_512_finish,
};

struct b_hash_function_ops z__b_shake128_ops = {
	.hash_init = shake128_init,
	.hash_update = sha3_update,
	.hash_finish = shake128_finish,
};

struct b_hash_function_ops z__b_shake256_ops = {
	.hash_init = shake256_init,
	.hash_update = sha3_update,
	.hash_finish = shake256_finish,
};