/* * The MIT License (MIT) * * Copyright (c) 2015 Markku-Juhani O. Saarinen * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal * in the Software without restriction, including without limitation the rights * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, and to permit persons to whom the Software is * furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included in * all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE * SOFTWARE. */ // sha3.c // 19-Nov-11 Markku-Juhani O. Saarinen // Revised 07-Aug-15 to match with official release of FIPS PUB 202 "SHA3" // Revised 03-Sep-15 for portability + OpenSSL - style API #include "hash.h" #include #include #include #ifndef KECCAKF_ROUNDS #define KECCAKF_ROUNDS 24 #endif #ifndef ROTL64 #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y)))) #endif // update the state with given number of rounds void sha3_keccakf(uint64_t st[25]) { // constants const uint64_t keccakf_rndc[24] = {0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 0x8000000080008000, 0x000000000000808b, 0x0000000080000001, 0x8000000080008081, 0x8000000000008009, 0x000000000000008a, 0x0000000000000088, 0x0000000080008009, 0x000000008000000a, 0x000000008000808b, 0x800000000000008b, 0x8000000000008089, 0x8000000000008003, 0x8000000000008002, 0x8000000000000080, 0x000000000000800a, 0x800000008000000a, 0x8000000080008081, 0x8000000000008080, 0x0000000080000001, 0x8000000080008008}; const int keccakf_rotc[24] = {1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14, 27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44}; const int keccakf_piln[24] = {10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4, 15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1}; // variables int i, j, r; uint64_t t, bc[5]; #if !defined(LITTLE_ENDIAN) uint8_t *v; // endianess conversion. this is redundant on little-endian targets for (i = 0; i < 25; i++) { v = (uint8_t *)&st[i]; st[i] = ((uint64_t)v[0]) | (((uint64_t)v[1]) << 8) | (((uint64_t)v[2]) << 16) | (((uint64_t)v[3]) << 24) | (((uint64_t)v[4]) << 32) | (((uint64_t)v[5]) << 40) | (((uint64_t)v[6]) << 48) | (((uint64_t)v[7]) << 56); } #endif // actual iteration for (r = 0; r < KECCAKF_ROUNDS; r++) { // Theta for (i = 0; i < 5; i++) bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20]; for (i = 0; i < 5; i++) { t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1); for (j = 0; j < 25; j += 5) st[j + i] ^= t; } // Rho Pi t = st[1]; for (i = 0; i < 24; i++) { j = keccakf_piln[i]; bc[0] = st[j]; st[j] = ROTL64(t, keccakf_rotc[i]); t = bc[0]; } // Chi for (j = 0; j < 25; j += 5) { for (i = 0; i < 5; i++) bc[i] = st[j + i]; for (i = 0; i < 5; i++) st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5]; } // Iota st[0] ^= keccakf_rndc[r]; } #if !defined(LITTLE_ENDIAN) // endianess conversion. this is redundant on little-endian targets for (i = 0; i < 25; i++) { v = (uint8_t *)&st[i]; t = st[i]; v[0] = t & 0xFF; v[1] = (t >> 8) & 0xFF; v[2] = (t >> 16) & 0xFF; v[3] = (t >> 24) & 0xFF; v[4] = (t >> 32) & 0xFF; v[5] = (t >> 40) & 0xFF; v[6] = (t >> 48) & 0xFF; v[7] = (t >> 56) & 0xFF; } #endif } // Initialize the context for SHA3 int sha3_init(struct b_hash_ctx *c, int mdlen) { int i; for (i = 0; i < 25; i++) c->ctx_state.sha3.st.q[i] = 0; c->ctx_state.sha3.mdlen = mdlen; c->ctx_state.sha3.rsiz = 200 - 2 * mdlen; c->ctx_state.sha3.pt = 0; return 1; } // update state with more data void sha3_update(struct b_hash_ctx *c, const void *data, size_t len) { size_t i; int j; j = c->ctx_state.sha3.pt; for (i = 0; i < len; i++) { c->ctx_state.sha3.st.b[j++] ^= ((const uint8_t *)data)[i]; if (j >= c->ctx_state.sha3.rsiz) { sha3_keccakf(c->ctx_state.sha3.st.q); j = 0; } } c->ctx_state.sha3.pt = j; } // finalize and output a hash int sha3_final(void *md, struct b_hash_ctx *c) { int i; c->ctx_state.sha3.st.b[c->ctx_state.sha3.pt] ^= 0x06; c->ctx_state.sha3.st.b[c->ctx_state.sha3.rsiz - 1] ^= 0x80; sha3_keccakf(c->ctx_state.sha3.st.q); for (i = 0; i < c->ctx_state.sha3.mdlen; i++) { ((uint8_t *)md)[i] = c->ctx_state.sha3.st.b[i]; } return 1; } // compute a SHA-3 hash (md) of given byte length from "in" void *sha3(const void *in, size_t inlen, void *md, int mdlen) { struct b_hash_ctx sha3; sha3_init(&sha3, mdlen); sha3_update(&sha3, in, inlen); sha3_final(md, &sha3); return md; } // SHAKE128 and SHAKE256 extensible-output functionality void shake_xof(struct b_hash_ctx *c) { c->ctx_state.sha3.st.b[c->ctx_state.sha3.pt] ^= 0x1F; c->ctx_state.sha3.st.b[c->ctx_state.sha3.rsiz - 1] ^= 0x80; sha3_keccakf(c->ctx_state.sha3.st.q); c->ctx_state.sha3.pt = 0; } void shake_out(struct b_hash_ctx *c, void *out, size_t len) { size_t i; int j; j = c->ctx_state.sha3.pt; for (i = 0; i < len; i++) { if (j >= c->ctx_state.sha3.rsiz) { sha3_keccakf(c->ctx_state.sha3.st.q); j = 0; } ((uint8_t *)out)[i] = c->ctx_state.sha3.st.b[j++]; } c->ctx_state.sha3.pt = j; } static void sha3_224_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHA3_224); } static void sha3_224_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHA3_224]; sha3_final(md, ctx); memcpy(out, md, b_min(size_t, sizeof md, max)); } static void sha3_256_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHA3_256); } static void sha3_256_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHA3_256]; sha3_final(md, ctx); memcpy(out, md, b_min(size_t, sizeof md, max)); } static void sha3_384_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHA3_384); } static void sha3_384_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHA3_384]; sha3_final(md, ctx); memcpy(out, md, b_min(size_t, sizeof md, max)); } static void sha3_512_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHA3_512); } static void sha3_512_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHA3_512]; sha3_final(md, ctx); memcpy(out, md, b_min(size_t, sizeof md, max)); } static void shake128_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHAKE128); } static void shake128_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHAKE128]; shake_xof(ctx); shake_out(ctx, md, sizeof md); memcpy(out, md, b_min(size_t, sizeof md, max)); } static void shake256_init(struct b_hash_ctx *ctx) { sha3_init(ctx, B_DIGEST_LENGTH_SHAKE256); } static void shake256_finish(struct b_hash_ctx *ctx, void *out, size_t max) { unsigned char md[B_DIGEST_LENGTH_SHAKE256]; shake_xof(ctx); shake_out(ctx, md, sizeof md); memcpy(out, md, b_min(size_t, sizeof md, max)); } struct b_hash_function_ops z__b_sha3_224_ops = { .hash_init = sha3_224_init, .hash_update = sha3_update, .hash_finish = sha3_224_finish, }; struct b_hash_function_ops z__b_sha3_256_ops = { .hash_init = sha3_256_init, .hash_update = sha3_update, .hash_finish = sha3_256_finish, }; struct b_hash_function_ops z__b_sha3_384_ops = { .hash_init = sha3_384_init, .hash_update = sha3_update, .hash_finish = sha3_384_finish, }; struct b_hash_function_ops z__b_sha3_512_ops = { .hash_init = sha3_512_init, .hash_update = sha3_update, .hash_finish = sha3_512_finish, }; struct b_hash_function_ops z__b_shake128_ops = { .hash_init = shake128_init, .hash_update = sha3_update, .hash_finish = shake128_finish, }; struct b_hash_function_ops z__b_shake256_ops = { .hash_init = shake256_init, .hash_update = sha3_update, .hash_finish = shake256_finish, };