Merge GH #669 Add SHA-3, SHAKE-128, and BoringSSL-mode NewHope

7 files changed, 315 insertions, 91 deletions

diff --git a/src/lib/hash/hash.cpp b/src/lib/hash/hash.cpp
index 5a31763d1..016f60df1 100644
--- a/src/lib/hash/hash.cpp
+++ b/src/lib/hash/hash.cpp
@@ -53,6 +53,10 @@
   #include <botan/sha2_64.h>
 #endif
 
+#if defined(BOTAN_HAS_SHA3)
+  #include <botan/sha3.h>
+#endif
+
 #if defined(BOTAN_HAS_SKEIN_512)
   #include <botan/skein_512.h>
 #endif
@@ -135,6 +139,10 @@ BOTAN_REGISTER_HASH_NAMED_NOARGS(GOST_34_11, "GOST-R-34.11-94");
 BOTAN_REGISTER_HASH_NAMED_1LEN(Keccak_1600, "Keccak-1600", 512);
 #endif
 
+#if defined(BOTAN_HAS_SHA3)
+BOTAN_REGISTER_HASH_NAMED_1LEN(SHA_3, "SHA-3", 512);
+#endif
+
 #if defined(BOTAN_HAS_MD4)
 BOTAN_REGISTER_HASH_NOARGS(MD4);
 #endif
diff --git a/src/lib/hash/keccak/info.txt b/src/lib/hash/keccak/info.txt
index 6fcd286a3..712a99c76 100644
--- a/src/lib/hash/keccak/info.txt
+++ b/src/lib/hash/keccak/info.txt
@@ -1 +1,5 @@
 define KECCAK 20131128
+
+<requires>
+sha3
+</requires>
diff --git a/src/lib/hash/keccak/keccak.cpp b/src/lib/hash/keccak/keccak.cpp
index e8bda068d..60cb20696 100644
--- a/src/lib/hash/keccak/keccak.cpp
+++ b/src/lib/hash/keccak/keccak.cpp
@@ -1,100 +1,17 @@
 /*
 * Keccak
-* (C) 2010 Jack Lloyd
+* (C) 2010,2016 Jack Lloyd
 *
 * Botan is released under the Simplified BSD License (see license.txt)
 */
 
 #include <botan/keccak.h>
+#include <botan/sha3.h>
 #include <botan/parsing.h>
 #include <botan/exceptn.h>
 
 namespace Botan {
 
-//static
-void Keccak_1600::permute(u64bit A[25])
-   {
-   static const u64bit RC[24] = {
-      0x0000000000000001, 0x0000000000008082, 0x800000000000808A,
-      0x8000000080008000, 0x000000000000808B, 0x0000000080000001,
-      0x8000000080008081, 0x8000000000008009, 0x000000000000008A,
-      0x0000000000000088, 0x0000000080008009, 0x000000008000000A,
-      0x000000008000808B, 0x800000000000008B, 0x8000000000008089,
-      0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
-      0x000000000000800A, 0x800000008000000A, 0x8000000080008081,
-      0x8000000000008080, 0x0000000080000001, 0x8000000080008008
-   };
-
-   for(size_t i = 0; i != 24; ++i)
-      {
-      const u64bit C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
-      const u64bit C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
-      const u64bit C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
-      const u64bit C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
-      const u64bit C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
-
-      const u64bit D0 = rotate_left(C0, 1) ^ C3;
-      const u64bit D1 = rotate_left(C1, 1) ^ C4;
-      const u64bit D2 = rotate_left(C2, 1) ^ C0;
-      const u64bit D3 = rotate_left(C3, 1) ^ C1;
-      const u64bit D4 = rotate_left(C4, 1) ^ C2;
-
-      const u64bit B00 = A[ 0] ^ D1;
-      const u64bit B10 = rotate_left(A[ 1] ^ D2, 1);
-      const u64bit B20 = rotate_left(A[ 2] ^ D3, 62);
-      const u64bit B05 = rotate_left(A[ 3] ^ D4, 28);
-      const u64bit B15 = rotate_left(A[ 4] ^ D0, 27);
-      const u64bit B16 = rotate_left(A[ 5] ^ D1, 36);
-      const u64bit B01 = rotate_left(A[ 6] ^ D2, 44);
-      const u64bit B11 = rotate_left(A[ 7] ^ D3, 6);
-      const u64bit B21 = rotate_left(A[ 8] ^ D4, 55);
-      const u64bit B06 = rotate_left(A[ 9] ^ D0, 20);
-      const u64bit B07 = rotate_left(A[10] ^ D1, 3);
-      const u64bit B17 = rotate_left(A[11] ^ D2, 10);
-      const u64bit B02 = rotate_left(A[12] ^ D3, 43);
-      const u64bit B12 = rotate_left(A[13] ^ D4, 25);
-      const u64bit B22 = rotate_left(A[14] ^ D0, 39);
-      const u64bit B23 = rotate_left(A[15] ^ D1, 41);
-      const u64bit B08 = rotate_left(A[16] ^ D2, 45);
-      const u64bit B18 = rotate_left(A[17] ^ D3, 15);
-      const u64bit B03 = rotate_left(A[18] ^ D4, 21);
-      const u64bit B13 = rotate_left(A[19] ^ D0, 8);
-      const u64bit B14 = rotate_left(A[20] ^ D1, 18);
-      const u64bit B24 = rotate_left(A[21] ^ D2, 2);
-      const u64bit B09 = rotate_left(A[22] ^ D3, 61);
-      const u64bit B19 = rotate_left(A[23] ^ D4, 56);
-      const u64bit B04 = rotate_left(A[24] ^ D0, 14);
-
-      A[ 0] = B00 ^ (~B01 & B02);
-      A[ 1] = B01 ^ (~B02 & B03);
-      A[ 2] = B02 ^ (~B03 & B04);
-      A[ 3] = B03 ^ (~B04 & B00);
-      A[ 4] = B04 ^ (~B00 & B01);
-      A[ 5] = B05 ^ (~B06 & B07);
-      A[ 6] = B06 ^ (~B07 & B08);
-      A[ 7] = B07 ^ (~B08 & B09);
-      A[ 8] = B08 ^ (~B09 & B05);
-      A[ 9] = B09 ^ (~B05 & B06);
-      A[10] = B10 ^ (~B11 & B12);
-      A[11] = B11 ^ (~B12 & B13);
-      A[12] = B12 ^ (~B13 & B14);
-      A[13] = B13 ^ (~B14 & B10);
-      A[14] = B14 ^ (~B10 & B11);
-      A[15] = B15 ^ (~B16 & B17);
-      A[16] = B16 ^ (~B17 & B18);
-      A[17] = B17 ^ (~B18 & B19);
-      A[18] = B18 ^ (~B19 & B15);
-      A[19] = B19 ^ (~B15 & B16);
-      A[20] = B20 ^ (~B21 & B22);
-      A[21] = B21 ^ (~B22 & B23);
-      A[22] = B22 ^ (~B23 & B24);
-      A[23] = B23 ^ (~B24 & B20);
-      A[24] = B24 ^ (~B20 & B21);
-
-      A[0] ^= RC[i];
-      }
-   }
-
 Keccak_1600::Keccak_1600(size_t output_bits) :
    m_output_bits(output_bits),
    m_bitrate(1600 - 2*output_bits),
@@ -164,7 +81,7 @@ void Keccak_1600::add_data(const byte input[], size_t length)
 
       if(m_S_pos == m_bitrate / 8)
          {
-         Keccak_1600::permute(m_S.data());
+         SHA_3::permute(m_S.data());
          m_S_pos = 0;
          }
       }
diff --git a/src/lib/hash/keccak/keccak.h b/src/lib/hash/keccak/keccak.h
index a66142d8c..ac50d4c52 100644
--- a/src/lib/hash/keccak/keccak.h
+++ b/src/lib/hash/keccak/keccak.h
@@ -34,11 +34,6 @@ class BOTAN_DLL Keccak_1600 final : public HashFunction
       std::string name() const override;
       void clear() override;
 
-      /**
-      * The bare Keccak-1600 permutation
-      */
-      static void permute(u64bit A[25]);
-
    private:
       void add_data(const byte input[], size_t length) override;
       void final_result(byte out[]) override;
diff --git a/src/lib/hash/sha3/info.txt b/src/lib/hash/sha3/info.txt
new file mode 100644
index 000000000..f755e9ea5
--- /dev/null
+++ b/src/lib/hash/sha3/info.txt
@@ -0,0 +1 @@
+define SHA3 20161018
diff --git a/src/lib/hash/sha3/sha3.cpp b/src/lib/hash/sha3/sha3.cpp
new file mode 100644
index 000000000..3897f0588
--- /dev/null
+++ b/src/lib/hash/sha3/sha3.cpp
@@ -0,0 +1,202 @@
+/*
+* SHA-3
+* (C) 2010,2016 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/sha3.h>
+#include <botan/parsing.h>
+#include <botan/exceptn.h>
+
+namespace Botan {
+
+//static
+void SHA_3::permute(u64bit A[25])
+   {
+   static const u64bit RC[24] = {
+      0x0000000000000001, 0x0000000000008082, 0x800000000000808A,
+      0x8000000080008000, 0x000000000000808B, 0x0000000080000001,
+      0x8000000080008081, 0x8000000000008009, 0x000000000000008A,
+      0x0000000000000088, 0x0000000080008009, 0x000000008000000A,
+      0x000000008000808B, 0x800000000000008B, 0x8000000000008089,
+      0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
+      0x000000000000800A, 0x800000008000000A, 0x8000000080008081,
+      0x8000000000008080, 0x0000000080000001, 0x8000000080008008
+   };
+
+   for(size_t i = 0; i != 24; ++i)
+      {
+      const u64bit C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
+      const u64bit C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
+      const u64bit C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
+      const u64bit C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
+      const u64bit C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
+
+      const u64bit D0 = rotate_left(C0, 1) ^ C3;
+      const u64bit D1 = rotate_left(C1, 1) ^ C4;
+      const u64bit D2 = rotate_left(C2, 1) ^ C0;
+      const u64bit D3 = rotate_left(C3, 1) ^ C1;
+      const u64bit D4 = rotate_left(C4, 1) ^ C2;
+
+      const u64bit B00 = A[ 0] ^ D1;
+      const u64bit B10 = rotate_left(A[ 1] ^ D2, 1);
+      const u64bit B20 = rotate_left(A[ 2] ^ D3, 62);
+      const u64bit B05 = rotate_left(A[ 3] ^ D4, 28);
+      const u64bit B15 = rotate_left(A[ 4] ^ D0, 27);
+      const u64bit B16 = rotate_left(A[ 5] ^ D1, 36);
+      const u64bit B01 = rotate_left(A[ 6] ^ D2, 44);
+      const u64bit B11 = rotate_left(A[ 7] ^ D3, 6);
+      const u64bit B21 = rotate_left(A[ 8] ^ D4, 55);
+      const u64bit B06 = rotate_left(A[ 9] ^ D0, 20);
+      const u64bit B07 = rotate_left(A[10] ^ D1, 3);
+      const u64bit B17 = rotate_left(A[11] ^ D2, 10);
+      const u64bit B02 = rotate_left(A[12] ^ D3, 43);
+      const u64bit B12 = rotate_left(A[13] ^ D4, 25);
+      const u64bit B22 = rotate_left(A[14] ^ D0, 39);
+      const u64bit B23 = rotate_left(A[15] ^ D1, 41);
+      const u64bit B08 = rotate_left(A[16] ^ D2, 45);
+      const u64bit B18 = rotate_left(A[17] ^ D3, 15);
+      const u64bit B03 = rotate_left(A[18] ^ D4, 21);
+      const u64bit B13 = rotate_left(A[19] ^ D0, 8);
+      const u64bit B14 = rotate_left(A[20] ^ D1, 18);
+      const u64bit B24 = rotate_left(A[21] ^ D2, 2);
+      const u64bit B09 = rotate_left(A[22] ^ D3, 61);
+      const u64bit B19 = rotate_left(A[23] ^ D4, 56);
+      const u64bit B04 = rotate_left(A[24] ^ D0, 14);
+
+      A[ 0] = B00 ^ (~B01 & B02);
+      A[ 1] = B01 ^ (~B02 & B03);
+      A[ 2] = B02 ^ (~B03 & B04);
+      A[ 3] = B03 ^ (~B04 & B00);
+      A[ 4] = B04 ^ (~B00 & B01);
+      A[ 5] = B05 ^ (~B06 & B07);
+      A[ 6] = B06 ^ (~B07 & B08);
+      A[ 7] = B07 ^ (~B08 & B09);
+      A[ 8] = B08 ^ (~B09 & B05);
+      A[ 9] = B09 ^ (~B05 & B06);
+      A[10] = B10 ^ (~B11 & B12);
+      A[11] = B11 ^ (~B12 & B13);
+      A[12] = B12 ^ (~B13 & B14);
+      A[13] = B13 ^ (~B14 & B10);
+      A[14] = B14 ^ (~B10 & B11);
+      A[15] = B15 ^ (~B16 & B17);
+      A[16] = B16 ^ (~B17 & B18);
+      A[17] = B17 ^ (~B18 & B19);
+      A[18] = B18 ^ (~B19 & B15);
+      A[19] = B19 ^ (~B15 & B16);
+      A[20] = B20 ^ (~B21 & B22);
+      A[21] = B21 ^ (~B22 & B23);
+      A[22] = B22 ^ (~B23 & B24);
+      A[23] = B23 ^ (~B24 & B20);
+      A[24] = B24 ^ (~B20 & B21);
+
+      A[0] ^= RC[i];
+      }
+   }
+
+SHA_3::SHA_3(size_t output_bits) :
+   m_output_bits(output_bits),
+   m_bitrate(1600 - 2*output_bits),
+   m_S(25),
+   m_S_pos(0)
+   {
+   // We only support the parameters for SHA-3 in this constructor
+
+   if(output_bits != 224 && output_bits != 256 &&
+      output_bits != 384 && output_bits != 512)
+      throw Invalid_Argument("SHA_3: Invalid output length " +
+                             std::to_string(output_bits));
+   }
+
+SHA_3::SHA_3(size_t output_bits, size_t capacity) :
+   m_output_bits(output_bits),
+   m_bitrate(1600 - capacity),
+   m_S(25),
+   m_S_pos(0)
+   {
+   if(capacity == 0 || capacity >= 1600)
+      throw Invalid_Argument("Impossible SHA-3 capacity specified");
+   }
+
+std::string SHA_3::name() const
+   {
+   return "SHA-3(" + std::to_string(m_output_bits) + ")";
+   }
+
+HashFunction* SHA_3::clone() const
+   {
+   return new SHA_3(m_output_bits);
+   }
+
+void SHA_3::clear()
+   {
+   zeroise(m_S);
+   m_S_pos = 0;
+   }
+
+void SHA_3::add_data(const byte input[], size_t length)
+   {
+   if(length == 0)
+      return;
+
+   while(length)
+      {
+      size_t to_take = std::min(length, m_bitrate / 8 - m_S_pos);
+
+      length -= to_take;
+
+      while(to_take && m_S_pos % 8)
+         {
+         m_S[m_S_pos / 8] ^= static_cast<u64bit>(input[0]) << (8 * (m_S_pos % 8));
+
+         ++m_S_pos;
+         ++input;
+         --to_take;
+         }
+
+      while(to_take && to_take % 8 == 0)
+         {
+         m_S[m_S_pos / 8] ^= load_le<u64bit>(input, 0);
+         m_S_pos += 8;
+         input += 8;
+         to_take -= 8;
+         }
+
+      while(to_take)
+         {
+         m_S[m_S_pos / 8] ^= static_cast<u64bit>(input[0]) << (8 * (m_S_pos % 8));
+
+         ++m_S_pos;
+         ++input;
+         --to_take;
+         }
+
+      if(m_S_pos == m_bitrate / 8)
+         {
+         SHA_3::permute(m_S.data());
+         m_S_pos = 0;
+         }
+      }
+   }
+
+void SHA_3::final_result(byte output[])
+   {
+   std::vector<byte> padding(m_bitrate / 8 - m_S_pos);
+
+   padding[0] = 0x06;
+   padding[padding.size()-1] |= 0x80;
+
+   add_data(padding.data(), padding.size());
+
+   /*
+   * We never have to run the permutation again because we only support
+   * limited output lengths
+   */
+   for(size_t i = 0; i != m_output_bits/8; ++i)
+      output[i] = get_byte(7 - (i % 8), m_S[i/8]);
+
+   clear();
+   }
+
+}
diff --git a/src/lib/hash/sha3/sha3.h b/src/lib/hash/sha3/sha3.h
new file mode 100644
index 000000000..c877bd938
--- /dev/null
+++ b/src/lib/hash/sha3/sha3.h
@@ -0,0 +1,97 @@
+/*
+* SHA-3
+* (C) 2010,2016 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_SHA3_H__
+#define BOTAN_SHA3_H__
+
+#include <botan/hash.h>
+#include <botan/secmem.h>
+#include <string>
+
+namespace Botan {
+
+/**
+* SHA-3
+*/
+class BOTAN_DLL SHA_3 : public HashFunction
+   {
+   public:
+
+      /**
+      * @param output_bits the size of the hash output; must be one of
+      *                    224, 256, 384, or 512
+      */
+      SHA_3(size_t output_bits);
+
+      /**
+      * @param output_bits the size of the hash output; must be a
+      * multiple of 8 (ie, byte-wide outputs)
+      * @param capacity the capacity of the spong, normally always
+      * 2*output_bits with SHA-3.
+      */
+      SHA_3(size_t output_bits, size_t capacity);
+
+      size_t hash_block_size() const override { return m_bitrate / 8; }
+      size_t output_length() const override { return m_output_bits / 8; }
+
+      HashFunction* clone() const override;
+      std::string name() const override;
+      void clear() override;
+
+      /**
+      * The bare Keccak-1600 permutation
+      */
+      static void permute(u64bit A[25]);
+
+   private:
+      void add_data(const byte input[], size_t length) override;
+      void final_result(byte out[]) override;
+
+      size_t m_output_bits, m_bitrate;
+      secure_vector<u64bit> m_S;
+      size_t m_S_pos;
+   };
+
+/**
+* SHA-3-224
+*/
+class BOTAN_DLL SHA_3_224 final : public SHA_3
+   {
+   public:
+      SHA_3_224() : SHA_3(224) {}
+   };
+
+/**
+* SHA-3-256
+*/
+class BOTAN_DLL SHA_3_256 final : public SHA_3
+   {
+   public:
+      SHA_3_256() : SHA_3(256) {}
+   };
+
+/**
+* SHA-3-384
+*/
+class BOTAN_DLL SHA_3_384 final : public SHA_3
+   {
+   public:
+      SHA_3_384() : SHA_3(384) {}
+   };
+
+/**
+* SHA-3-512
+*/
+class BOTAN_DLL SHA_3_512 final : public SHA_3
+   {
+   public:
+      SHA_3_512() : SHA_3(512) {}
+   };
+
+}
+
+#endif