experimental/tiny_sha3_bit_interleaved
1
0
Fork 0
Code Pull Requests Activity
Files
master
tiny_sha3_bit_interleaved/sha3.c

357 lines
10 KiB
C
Raw Permalink Blame History

// sha3.c
// 19-Nov-11 Markku-Juhani O. Saarinen <mjos@iki.fi>
// 22-May-25 Kris Kwiatkowski <kris@amongbytes.com>
// Revised 07-Aug-15 to match with official release of FIPS PUB 202 "SHA3"
// Revised 03-Sep-15 for portability + OpenSSL - style API
// Revised 22-May-25 Added bit-interleaved implementation optimized for 32-bit architectures.
#include "sha3.h"
// Interleave even and odd bits into one 64-bit line
uint64_t unshuffle(uint32_t even, uint32_t odd) {
uint64_t result = 0;
for (int i = 0; i < 32; i++) {
result |= ((uint64_t)(even >> i) & 1) << (2 * i);
result |= ((uint64_t)(odd >> i) & 1) << (2 * i + 1);
}
return result;
}
/* Get 32 bits from 'x' located on even possitions.
* Example: Assuming x={1,0,1,0,1,0} and index of first
* bit start from 0. This function returns x={0,0,0}. */
uint32_t shuffle_even(uint64_t x) {
x &= 0x5555555555555555ULL;
x = (x | (x >> 1)) & 0x3333333333333333ULL;
x = (x | (x >> 2)) & 0x0F0F0F0F0F0F0F0FULL;
x = (x | (x >> 4)) & 0x00FF00FF00FF00FFULL;
x = (x | (x >> 8)) & 0x0000FFFF0000FFFFULL;
x = (x | (x >> 16)) & 0x00000000FFFFFFFFULL;
return (uint32_t)x;
}
/* Get 32 bits from 'x' located on even possitions.
* Example: Assuming x={1,0,1,0,1,0} and index of first
* bit start from 0. This function returns x={1,1,1}. */
uint32_t shuffle_odd(uint64_t x) {
return shuffle_even(x >> 1);
}
void sha3_keccakf(uint64_t st[25])
{
// constants
const uint64_t keccakf_rndc[24] = {
0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
0x8000000000008080, 0x0000000080000001, 0x8000000080008008
};
const int keccakf_rotc[24] = {
1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
};
const int keccakf_piln[24] = {
10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
};
// variables
int i, j, r;
uint64_t t, bc[5];
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
uint8_t *v;
// endianess conversion. this is redundant on little-endian targets
for (i = 0; i < 25; i++) {
v = (uint8_t *) &st[i];
st[i] = ((uint64_t) v[0]) | (((uint64_t) v[1]) << 8) |
(((uint64_t) v[2]) << 16) | (((uint64_t) v[3]) << 24) |
(((uint64_t) v[4]) << 32) | (((uint64_t) v[5]) << 40) |
(((uint64_t) v[6]) << 48) | (((uint64_t) v[7]) << 56);
}
#endif
// actual iteration
for (r = 0; r < KECCAKF_ROUNDS; r++) {
// Theta
for (i = 0; i < 5; i++)
bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
for (i = 0; i < 5; i++) {
t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
for (j = 0; j < 25; j += 5)
st[j + i] ^= t;
}
// Rho Pi
t = st[1];
for (i = 0; i < 24; i++) {
j = keccakf_piln[i];
bc[0] = st[j];
st[j] = ROTL64(t, keccakf_rotc[i]);
t = bc[0];
}
// Chi
for (j = 0; j < 25; j += 5) {
for (i = 0; i < 5; i++)
bc[i] = st[j + i];
for (i = 0; i < 5; i++)
st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
}
// Iota
st[0] ^= keccakf_rndc[r];
}
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
// endianess conversion. this is redundant on little-endian targets
for (i = 0; i < 25; i++) {
v = (uint8_t *) &st[i];
t = st[i];
v[0] = t & 0xFF;
v[1] = (t >> 8) & 0xFF;
v[2] = (t >> 16) & 0xFF;
v[3] = (t >> 24) & 0xFF;
v[4] = (t >> 32) & 0xFF;
v[5] = (t >> 40) & 0xFF;
v[6] = (t >> 48) & 0xFF;
v[7] = (t >> 56) & 0xFF;
}
#endif
}
void sha3_keccakf_bi(uint64_t st[25])
{
// constants
const uint64_t keccakf_rndc[24] = {
0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
0x8000000000008080, 0x0000000080000001, 0x8000000080008008
};
const int keccakf_rotc[24] = {
1, 3, 6, 10, 15, 21, 28, 36, 45, 55, 2, 14,
27, 41, 56, 8, 25, 43, 62, 18, 39, 61, 20, 44
};
const int keccakf_piln[24] = {
10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4,
15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1
};
// variables
int i, j, r;
uint32_t t1, t2;
uint32_t even[25], odd[25];
uint32_t bc_even[5], bc_odd[5];
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
uint8_t *v;
// endianess conversion. this is redundant on little-endian targets
for (i = 0; i < 25; i++) {
v = (uint8_t *) &st[i];
st[i] = ((uint64_t) v[0]) | (((uint64_t) v[1]) << 8) |
(((uint64_t) v[2]) << 16) | (((uint64_t) v[3]) << 24) |
(((uint64_t) v[4]) << 32) | (((uint64_t) v[5]) << 40) |
(((uint64_t) v[6]) << 48) | (((uint64_t) v[7]) << 56);
}
#endif
for (i = 0; i < 25; i++) {
even[i] = shuffle_even(st[i]);
odd[i] = shuffle_odd(st[i]);;
}
// actual iteration
for (r = 0; r < KECCAKF_ROUNDS; r++) {
// Theta
for (i = 0; i < 5; i++) {
bc_even[i] = even[i] ^ even[i + 5] ^ even[i + 10] ^ even[i + 15] ^ even[i + 20];
bc_odd[i] = odd[i] ^ odd[i + 5] ^ odd[i + 10] ^ odd[i + 15] ^ odd[i + 20];
}
// Chi
for (i = 0; i < 5; i++) {
/* Note that we are rotating by 1. In this case we only care about
* "odd" bits. */
uint32_t rot32 = ROTL32(bc_odd[(i + 1) % 5], 1);
t1 = bc_even[(i + 4) % 5] ^ rot32;
t2 = bc_odd[(i + 4) % 5] ^ bc_even[(i + 1) % 5];
for (j = 0; j < 25; j += 5) {
even[j + i] ^= t1;
odd[j + i] ^= t2;
}
}
// Rho Pi
t1 = even[1]; t2 = odd[1];
for (i = 0; i < 24; i++) {
j = keccakf_piln[i];
bc_even[0] = even[j]; bc_odd[0] = odd[j];
int half = keccakf_rotc[i] >> 1;
if (keccakf_rotc[i]&1) {
// U0 = ROT32(U1, tau)
odd[j] = ROTL32(t1, half);
// U1 = ROT32(U0, tau + 1)
even[j] = ROTL32(t2, half + 1);
} else {
// U0 = ROT32(U0, tau)
odd[j] = ROTL32(t2, half);
// U1 = ROT32(U1, tau)
even[j] = ROTL32(t1, half);
}
t1 = bc_even[0]; t2 = bc_odd[0];
}
// Chi
for (j = 0; j < 25; j += 5) {
for (i = 0; i < 5; i++) {
bc_even[i] = even[j + i];
bc_odd[i] = odd[j + i];
}
for (i = 0; i < 5; i++) {
even[j + i] ^= (~bc_even[(i + 1) % 5]) & bc_even[(i + 2) % 5];
odd[j + i] ^= (~bc_odd[(i + 1) % 5]) & bc_odd[(i + 2) % 5];
}
}
// Iota (can be precomputed)
even[0] ^= shuffle_even(keccakf_rndc[r]);
odd[0] ^= shuffle_odd(keccakf_rndc[r]);
}
for (i = 0; i < 25; i++) {
st[i] = unshuffle(even[i], odd[i]);
}
#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
// endianess conversion. this is redundant on little-endian targets
for (i = 0; i < 25; i++) {
v = (uint8_t *) &st[i];
t = st[i];
v[0] = t & 0xFF;
v[1] = (t >> 8) & 0xFF;
v[2] = (t >> 16) & 0xFF;
v[3] = (t >> 24) & 0xFF;
v[4] = (t >> 32) & 0xFF;
v[5] = (t >> 40) & 0xFF;
v[6] = (t >> 48) & 0xFF;
v[7] = (t >> 56) & 0xFF;
}
#endif
}
#ifdef BIT_INTERLEAVING
#define KECCAK_F sha3_keccakf_bi
#else
#define KECCAK_F sha3_keccakf
#endif
// Initialize the context for SHA3
int sha3_init(sha3_ctx_t *c, int mdlen)
{
int i;
for (i = 0; i < 25; i++)
c->st.q[i] = 0;
c->mdlen = mdlen;
c->rsiz = 200 - 2 * mdlen;
c->pt = 0;
return 1;
}
// update state with more data
int sha3_update(sha3_ctx_t *c, const void *data, size_t len)
{
size_t i;
int j;
j = c->pt;
for (i = 0; i < len; i++) {
c->st.b[j++] ^= ((const uint8_t *) data)[i];
if (j >= c->rsiz) {
sha3_keccakf(c->st.q);
j = 0;
}
}
c->pt = j;
return 1;
}
// finalize and output a hash
int sha3_final(void *md, sha3_ctx_t *c)
{
int i;
c->st.b[c->pt] ^= 0x06;
c->st.b[c->rsiz - 1] ^= 0x80;
sha3_keccakf(c->st.q);
for (i = 0; i < c->mdlen; i++) {
((uint8_t *) md)[i] = c->st.b[i];
}
return 1;
}
// compute a SHA-3 hash (md) of given byte length from "in"
void *sha3(const void *in, size_t inlen, void *md, int mdlen)
{
sha3_ctx_t sha3;
sha3_init(&sha3, mdlen);
sha3_update(&sha3, in, inlen);
sha3_final(md, &sha3);
return md;
}
// SHAKE128 and SHAKE256 extensible-output functionality
void shake_xof(sha3_ctx_t *c)
{
c->st.b[c->pt] ^= 0x1F;
c->st.b[c->rsiz - 1] ^= 0x80;
sha3_keccakf(c->st.q);
c->pt = 0;
}
void shake_out(sha3_ctx_t *c, void *out, size_t len)
{
size_t i;
int j;
j = c->pt;
for (i = 0; i < len; i++) {
if (j >= c->rsiz) {
sha3_keccakf(c->st.q);
j = 0;
}
((uint8_t *) out)[i] = c->st.b[j++];
}
c->pt = j;
}
View Git Blame Copy Permalink