1 // sha3.c
2 // 19-Nov-11 Markku-Juhani O. Saarinen <mjos@iki.fi>
3
4 // Revised 07-Aug-15 to match with official release of FIPS PUB 202 "SHA3"
5 // Revised 03-Sep-15 for portability + OpenSSL - style API
6
7 #include "sha3.h"
8
9 // update the state with given number of rounds
10
11 static void sha3_keccakf(uint64_t st[25])
12 {
13 // constants
14 const uint64_t keccakf_rndc[24] = {
15 0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
16 0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
17 0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
18 0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
19 0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
20 0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
21 0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
22 0x8000000000008080, 0x0000000080000001, 0x8000000080008008
23 };
24 const int keccakf_rotc[24] = {
25 1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
26 27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
27 };
28 const int keccakf_piln[24] = {
29 10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
30 15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
31 };
32
33 // variables
34 int i, j, r;
35 uint64_t t, bc[5];
36
37 #if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
38 uint8_t *v;
39
40 // endianess conversion. this is redundant on little-endian targets
41 for (i = 0; i < 25; i++) {
42 v = (uint8_t *) &st[i];
43 st[i] = ((uint64_t) v[0]) | (((uint64_t) v[1]) << 8) |
44 (((uint64_t) v[2]) << 16) | (((uint64_t) v[3]) << 24) |
45 (((uint64_t) v[4]) << 32) | (((uint64_t) v[5]) << 40) |
46 (((uint64_t) v[6]) << 48) | (((uint64_t) v[7]) << 56);
47 }
48 #endif
49
50 // actual iteration
51 for (r = 0; r < KECCAKF_ROUNDS; r++) {
52
53 // Theta
54 for (i = 0; i < 5; i++)
55 bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
56
57 for (i = 0; i < 5; i++) {
58 t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
59 for (j = 0; j < 25; j += 5)
60 st[j + i] ^= t;
61 }
62
63 // Rho Pi
64 t = st[1];
65 for (i = 0; i < 24; i++) {
66 j = keccakf_piln[i];
67 bc[0] = st[j];
68 st[j] = ROTL64(t, keccakf_rotc[i]);
69 t = bc[0];
70 }
71
72 // Chi
73 for (j = 0; j < 25; j += 5) {
74 for (i = 0; i < 5; i++)
75 bc[i] = st[j + i];
76 for (i = 0; i < 5; i++)
77 st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
78 }
79
80 // Iota
81 st[0] ^= keccakf_rndc[r];
82 }
83
84 #if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
85 // endianess conversion. this is redundant on little-endian targets
86 for (i = 0; i < 25; i++) {
87 v = (uint8_t *) &st[i];
88 t = st[i];
89 v[0] = t & 0xFF;
90 v[1] = (t >> 8) & 0xFF;
91 v[2] = (t >> 16) & 0xFF;
92 v[3] = (t >> 24) & 0xFF;
93 v[4] = (t >> 32) & 0xFF;
94 v[5] = (t >> 40) & 0xFF;
95 v[6] = (t >> 48) & 0xFF;
96 v[7] = (t >> 56) & 0xFF;
97 }
98 #endif
99 }
100
101 // Initialize the context for SHA3
102
103 static int sha3_init(sha3_ctx_t *c, int mdlen)
104 {
105 int i;
106
107 for (i = 0; i < 25; i++)
108 c->st.q[i] = 0;
109 c->mdlen = mdlen;
110 c->rsiz = 200 - 2 * mdlen;
111 c->pt = 0;
112
113 return 1;
114 }
115
116 // update state with more data
117
118 static int sha3_update(sha3_ctx_t *c, const void *data, size_t len)
119 {
120 size_t i;
121 int j;
122
123 j = c->pt;
124 for (i = 0; i < len; i++) {
125 c->st.b[j++] ^= ((const uint8_t *) data)[i];
126 if (j >= c->rsiz) {
127 sha3_keccakf(c->st.q);
128 j = 0;
129 }
130 }
131 c->pt = j;
132
133 return 1;
134 }
135
136 // finalize and output a hash
137
138 static int sha3_final(void *md, sha3_ctx_t *c)
139 {
140 int i;
141
142 c->st.b[c->pt] ^= 0x06;
143 c->st.b[c->rsiz - 1] ^= 0x80;
144 sha3_keccakf(c->st.q);
145
146 for (i = 0; i < c->mdlen; i++) {
147 ((uint8_t *) md)[i] = c->st.b[i];
148 }
149
150 return 1;
151 }
152
153 #if 0
154 // compute a SHA-3 hash (md) of given byte length from "in"
155
156 void *sha3(const void *in, size_t inlen, void *md, int mdlen)
157 {
158 sha3_ctx_t sha3;
159
160 sha3_init(&sha3, mdlen);
161 sha3_update(&sha3, in, inlen);
162 sha3_final(md, &sha3);
163
164 return md;
165 }
166 #endif
167
168 // SHAKE128 and SHAKE256 extensible-output functionality
169
170 static void shake_xof(sha3_ctx_t *c)
171 {
172 c->st.b[c->pt] ^= 0x1F;
173 c->st.b[c->rsiz - 1] ^= 0x80;
174 sha3_keccakf(c->st.q);
175 c->pt = 0;
176 }
177
178 static void shake_out(sha3_ctx_t *c, void *out, size_t len)
179 {
180 size_t i;
181 int j;
182
183 j = c->pt;
184 for (i = 0; i < len; i++) {
185 if (j >= c->rsiz) {
186 sha3_keccakf(c->st.q);
187 j = 0;
188 }
189 ((uint8_t *) out)[i] = c->st.b[j++];
190 }
191 c->pt = j;
192 }
193