kris/pqc
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Port SPHINCS+-SHA256 to sha256ctx struct

Browse Source
This commit is contained in:
Thom Wiggers 2019-05-20 09:39:06 +02:00
parent 7c30aa73c9
commit 6953a0b32e
No known key found for this signature in database
GPG Key ID: 001BB0A7CE26E363
48 changed files with 240 additions and 216 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
crypto_sign/sphincs-sha256-128f-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-128f-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-128f-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-128f-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-128f-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-128f-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-128f-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-128f-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-128s-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-128s-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-128s-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-128s-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-128s-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-128s-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-128s-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-128s-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-192f-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-192f-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-192f-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-192f-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-192f-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-192f-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-192f-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-192f-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-192s-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-192s-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-192s-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-192s-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-192s-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-192s-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-192s-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-192s-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-256f-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-256f-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-256f-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-256f-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-256f-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-256f-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-256f-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-256f-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-256s-robust/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-256s-robust/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-256s-robust/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-256s-robust/clean/thash_sha256_robust.c
View File

@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash(
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
uint8_t sha2_state[40];
sha256ctx sha2_state;
unsigned int i;
memcpy(buf, pub_seed, SPX_N);
@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash(
PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
for (i = 0; i < inblocks * SPX_N; i++) {
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
}
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}

22
crypto_sign/sphincs-sha256-256s-simple/clean/hash_sha256.c
View File

@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random(
const unsigned char *sk_prf, const unsigned char *optrand,
const unsigned char *m, size_t mlen) {
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
uint8_t state[40];
sha256ctx state;
int i;
/* This implements HMAC-SHA256 */
@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random(
}
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_init(state);
sha256_inc_blocks(state, buf, 1);
sha256_inc_init(&state);
sha256_inc_blocks(&state, buf, 1);
memcpy(buf, optrand, SPX_N);
/* If optrand + message cannot fill up an entire block */
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
memcpy(buf + SPX_N, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
buf, mlen + SPX_N);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
sha256_inc_blocks(state, buf, 1);
sha256_inc_blocks(&state, buf, 1);
m += SPX_SHA256_BLOCK_BYTES - SPX_N;
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
}
for (i = 0; i < SPX_N; i++) {
@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message(
unsigned char buf[SPX_DGST_BYTES];
unsigned char *bufp = buf;
uint8_t state[40];
sha256ctx state;
sha256_inc_init(state);
sha256_inc_init(&state);
memcpy(inbuf, R, SPX_N);
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message(
/* If R + pk + message cannot fill up an entire block */
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
}
/* Otherwise first fill a block, so that finalize only uses the message */
else {
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
sha256_inc_finalize(seed, state, m, mlen);
sha256_inc_finalize(seed, &state, m, mlen);
}
/* By doing this in two steps, we prevent hashing the message twice;

6
crypto_sign/sphincs-sha256-256s-simple/clean/sha256.c
View File

@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1(
}
}
uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40];
sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded;
/**
* Absorb the constant pub_seed using one round of the compression function
@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
block[i] = 0;
}
sha256_inc_init(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1);
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded);
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1);
}

4
crypto_sign/sphincs-sha256-256s-simple/clean/sha256.h
View File

@ -8,13 +8,15 @@
#include <stddef.h>
#include <stdint.h>
#include "sha2.h"
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1(
unsigned char *out, unsigned long outlen,
unsigned char *input_plus_four_bytes, unsigned long inlen);
extern uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40];
extern sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded;
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);

6
crypto_sign/sphincs-sha256-256s-simple/clean/thash_sha256_simple.c
View File

@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_thash(
const unsigned char *pub_seed, uint32_t addr[8]) {
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
uint8_t sha2_state[40];
sha256ctx sha2_state;
(void)pub_seed; /* Suppress an 'unused parameter' warning. */
/* Retrieve precomputed state containing pub_seed */
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(buf, addr);
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
memcpy(out, outbuf, SPX_N);
}