1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
|
/*
* SHA-3
* (C) 2010,2016 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#include <botan/sha3.h>
#include <botan/exceptn.h>
namespace Botan {
//static
void SHA_3::permute(uint64_t A[25])
{
static const uint64_t RC[24] = {
0x0000000000000001, 0x0000000000008082, 0x800000000000808A,
0x8000000080008000, 0x000000000000808B, 0x0000000080000001,
0x8000000080008081, 0x8000000000008009, 0x000000000000008A,
0x0000000000000088, 0x0000000080008009, 0x000000008000000A,
0x000000008000808B, 0x800000000000008B, 0x8000000000008089,
0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
0x000000000000800A, 0x800000008000000A, 0x8000000080008081,
0x8000000000008080, 0x0000000080000001, 0x8000000080008008
};
for(size_t i = 0; i != 24; ++i)
{
const uint64_t C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
const uint64_t C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
const uint64_t C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
const uint64_t C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
const uint64_t C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
const uint64_t D0 = rotl<1>(C0) ^ C3;
const uint64_t D1 = rotl<1>(C1) ^ C4;
const uint64_t D2 = rotl<1>(C2) ^ C0;
const uint64_t D3 = rotl<1>(C3) ^ C1;
const uint64_t D4 = rotl<1>(C4) ^ C2;
const uint64_t B00 = A[ 0] ^ D1;
const uint64_t B10 = rotl< 1>(A[ 1] ^ D2);
const uint64_t B20 = rotl<62>(A[ 2] ^ D3);
const uint64_t B05 = rotl<28>(A[ 3] ^ D4);
const uint64_t B15 = rotl<27>(A[ 4] ^ D0);
const uint64_t B16 = rotl<36>(A[ 5] ^ D1);
const uint64_t B01 = rotl<44>(A[ 6] ^ D2);
const uint64_t B11 = rotl< 6>(A[ 7] ^ D3);
const uint64_t B21 = rotl<55>(A[ 8] ^ D4);
const uint64_t B06 = rotl<20>(A[ 9] ^ D0);
const uint64_t B07 = rotl< 3>(A[10] ^ D1);
const uint64_t B17 = rotl<10>(A[11] ^ D2);
const uint64_t B02 = rotl<43>(A[12] ^ D3);
const uint64_t B12 = rotl<25>(A[13] ^ D4);
const uint64_t B22 = rotl<39>(A[14] ^ D0);
const uint64_t B23 = rotl<41>(A[15] ^ D1);
const uint64_t B08 = rotl<45>(A[16] ^ D2);
const uint64_t B18 = rotl<15>(A[17] ^ D3);
const uint64_t B03 = rotl<21>(A[18] ^ D4);
const uint64_t B13 = rotl< 8>(A[19] ^ D0);
const uint64_t B14 = rotl<18>(A[20] ^ D1);
const uint64_t B24 = rotl< 2>(A[21] ^ D2);
const uint64_t B09 = rotl<61>(A[22] ^ D3);
const uint64_t B19 = rotl<56>(A[23] ^ D4);
const uint64_t B04 = rotl<14>(A[24] ^ D0);
A[ 0] = B00 ^ (~B01 & B02);
A[ 1] = B01 ^ (~B02 & B03);
A[ 2] = B02 ^ (~B03 & B04);
A[ 3] = B03 ^ (~B04 & B00);
A[ 4] = B04 ^ (~B00 & B01);
A[ 5] = B05 ^ (~B06 & B07);
A[ 6] = B06 ^ (~B07 & B08);
A[ 7] = B07 ^ (~B08 & B09);
A[ 8] = B08 ^ (~B09 & B05);
A[ 9] = B09 ^ (~B05 & B06);
A[10] = B10 ^ (~B11 & B12);
A[11] = B11 ^ (~B12 & B13);
A[12] = B12 ^ (~B13 & B14);
A[13] = B13 ^ (~B14 & B10);
A[14] = B14 ^ (~B10 & B11);
A[15] = B15 ^ (~B16 & B17);
A[16] = B16 ^ (~B17 & B18);
A[17] = B17 ^ (~B18 & B19);
A[18] = B18 ^ (~B19 & B15);
A[19] = B19 ^ (~B15 & B16);
A[20] = B20 ^ (~B21 & B22);
A[21] = B21 ^ (~B22 & B23);
A[22] = B22 ^ (~B23 & B24);
A[23] = B23 ^ (~B24 & B20);
A[24] = B24 ^ (~B20 & B21);
A[0] ^= RC[i];
}
}
//static
size_t SHA_3::absorb(size_t bitrate,
secure_vector<uint64_t>& S, size_t S_pos,
const uint8_t input[], size_t length)
{
while(length > 0)
{
size_t to_take = std::min(length, bitrate / 8 - S_pos);
length -= to_take;
while(to_take && S_pos % 8)
{
S[S_pos / 8] ^= static_cast<uint64_t>(input[0]) << (8 * (S_pos % 8));
++S_pos;
++input;
--to_take;
}
while(to_take && to_take % 8 == 0)
{
S[S_pos / 8] ^= load_le<uint64_t>(input, 0);
S_pos += 8;
input += 8;
to_take -= 8;
}
while(to_take)
{
S[S_pos / 8] ^= static_cast<uint64_t>(input[0]) << (8 * (S_pos % 8));
++S_pos;
++input;
--to_take;
}
if(S_pos == bitrate / 8)
{
SHA_3::permute(S.data());
S_pos = 0;
}
}
return S_pos;
}
//static
void SHA_3::finish(size_t bitrate,
secure_vector<uint64_t>& S, size_t S_pos,
uint8_t init_pad, uint8_t fini_pad)
{
S[S_pos / 8] ^= static_cast<uint64_t>(init_pad) << (8 * (S_pos % 8));
S[(bitrate / 64) - 1] ^= static_cast<uint64_t>(fini_pad) << 56;
SHA_3::permute(S.data());
}
//static
void SHA_3::expand(size_t bitrate,
secure_vector<uint64_t>& S,
uint8_t output[], size_t output_length)
{
BOTAN_ARG_CHECK(bitrate % 8 == 0);
size_t Si = 0;
for(size_t i = 0; i != output_length; ++i)
{
if(i > 0)
{
if(i % (bitrate / 8) == 0)
{
SHA_3::permute(S.data());
Si = 0;
}
else if(i % 8 == 0)
{
Si += 1;
}
}
output[i] = get_byte(7 - (i % 8), S[Si]);
}
}
SHA_3::SHA_3(size_t output_bits) :
m_output_bits(output_bits),
m_bitrate(1600 - 2*output_bits),
m_S(25),
m_S_pos(0)
{
// We only support the parameters for SHA-3 in this constructor
if(output_bits != 224 && output_bits != 256 &&
output_bits != 384 && output_bits != 512)
throw Invalid_Argument("SHA_3: Invalid output length " +
std::to_string(output_bits));
}
std::string SHA_3::name() const
{
return "SHA-3(" + std::to_string(m_output_bits) + ")";
}
std::unique_ptr<HashFunction> SHA_3::copy_state() const
{
return std::unique_ptr<HashFunction>(new SHA_3(*this));
}
HashFunction* SHA_3::clone() const
{
return new SHA_3(m_output_bits);
}
void SHA_3::clear()
{
zeroise(m_S);
m_S_pos = 0;
}
void SHA_3::add_data(const uint8_t input[], size_t length)
{
m_S_pos = SHA_3::absorb(m_bitrate, m_S, m_S_pos, input, length);
}
void SHA_3::final_result(uint8_t output[])
{
SHA_3::finish(m_bitrate, m_S, m_S_pos, 0x06, 0x80);
/*
* We never have to run the permutation again because we only support
* limited output lengths
*/
copy_out_vec_le(output, m_output_bits/8, m_S);
clear();
}
}
|
