Reference implementations of PQC
選択できるのは25トピックまでです。 トピックは、先頭が英数字で、英数字とダッシュ('-')を使用した35文字以内のものにしてください。
 
 
 
 

139 行
5.0 KiB

  1. #include <stddef.h>
  2. #include <stdint.h>
  3. #include "sp800-185.h"
  4. static size_t left_encode(uint8_t *encbuf, size_t value) {
  5. size_t n, i, v;
  6. for (v = value, n = 0; v && (n < sizeof(size_t)); n++, v >>= 8) {
  7. ; /* empty */
  8. }
  9. if (n == 0) {
  10. n = 1;
  11. }
  12. for (i = 1; i <= n; i++) {
  13. encbuf[i] = (uint8_t)(value >> (8 * (n-i)));
  14. }
  15. encbuf[0] = (uint8_t)n;
  16. return n + 1;
  17. }
  18. void cshake128_inc_init(shake128incctx *state, const uint8_t *name, size_t namelen, const uint8_t *cstm, size_t cstmlen) {
  19. uint8_t encbuf[sizeof(size_t)+1];
  20. shake128_inc_init(state);
  21. shake128_inc_absorb(state, encbuf, left_encode(encbuf, SHAKE128_RATE));
  22. shake128_inc_absorb(state, encbuf, left_encode(encbuf, namelen * 8));
  23. shake128_inc_absorb(state, name, namelen);
  24. shake128_inc_absorb(state, encbuf, left_encode(encbuf, cstmlen * 8));
  25. shake128_inc_absorb(state, cstm, cstmlen);
  26. if (state->ctx[25] != 0) {
  27. state->ctx[25] = SHAKE128_RATE - 1;
  28. encbuf[0] = 0;
  29. shake128_inc_absorb(state, encbuf, 1);
  30. }
  31. }
  32. void cshake128_inc_absorb(shake128incctx *state, const uint8_t *input, size_t inlen) {
  33. shake128_inc_absorb(state, input, inlen);
  34. }
  35. void cshake128_inc_finalize(shake128incctx *state) {
  36. state->ctx[state->ctx[25] >> 3] ^= (uint64_t)0x04 << (8 * (state->ctx[25] & 0x07));
  37. state->ctx[(SHAKE128_RATE - 1) >> 3] ^= (uint64_t)128 << (8 * ((SHAKE128_RATE - 1) & 0x07));
  38. state->ctx[25] = 0;
  39. }
  40. void cshake128_inc_squeeze(uint8_t *output, size_t outlen, shake128incctx *state) {
  41. shake128_inc_squeeze(output, outlen, state);
  42. }
  43. void cshake256_inc_init(shake256incctx *state, const uint8_t *name, size_t namelen, const uint8_t *cstm, size_t cstmlen) {
  44. uint8_t encbuf[sizeof(size_t)+1];
  45. shake256_inc_init(state);
  46. shake256_inc_absorb(state, encbuf, left_encode(encbuf, SHAKE256_RATE));
  47. shake256_inc_absorb(state, encbuf, left_encode(encbuf, namelen * 8));
  48. shake256_inc_absorb(state, name, namelen);
  49. shake256_inc_absorb(state, encbuf, left_encode(encbuf, cstmlen * 8));
  50. shake256_inc_absorb(state, cstm, cstmlen);
  51. if (state->ctx[25] != 0) {
  52. state->ctx[25] = SHAKE256_RATE - 1;
  53. encbuf[0] = 0;
  54. shake256_inc_absorb(state, encbuf, 1);
  55. }
  56. }
  57. void cshake256_inc_absorb(shake256incctx *state, const uint8_t *input, size_t inlen) {
  58. shake256_inc_absorb(state, input, inlen);
  59. }
  60. void cshake256_inc_finalize(shake256incctx *state) {
  61. state->ctx[state->ctx[25] >> 3] ^= (uint64_t)0x04 << (8 * (state->ctx[25] & 0x07));
  62. state->ctx[(SHAKE256_RATE - 1) >> 3] ^= (uint64_t)128 << (8 * ((SHAKE256_RATE - 1) & 0x07));
  63. state->ctx[25] = 0;
  64. }
  65. void cshake256_inc_squeeze(uint8_t *output, size_t outlen, shake256incctx *state) {
  66. shake256_inc_squeeze(output, outlen, state);
  67. }
  68. /*************************************************
  69. * Name: cshake128
  70. *
  71. * Description: cSHAKE128 XOF with non-incremental API
  72. *
  73. * Arguments: - uint8_t *output: pointer to output
  74. * - size_t outlen: requested output length in bytes
  75. * - const uint8_t *name: pointer to function-name string
  76. * - size_t namelen: length of function-name string in bytes
  77. * - const uint8_t *cstm: pointer to non-empty customization string
  78. * - size_t cstmlen: length of customization string in bytes
  79. * - const uint8_t *input: pointer to input
  80. * - size_t inlen: length of input in bytes
  81. **************************************************/
  82. void cshake128(uint8_t *output, size_t outlen,
  83. const uint8_t *name, size_t namelen,
  84. const uint8_t *cstm, size_t cstmlen,
  85. const uint8_t *input, size_t inlen) {
  86. shake128incctx state;
  87. cshake128_inc_init(&state, name, namelen, cstm, cstmlen);
  88. cshake128_inc_absorb(&state, input, inlen);
  89. cshake128_inc_finalize(&state);
  90. cshake128_inc_squeeze(output, outlen, &state);
  91. }
  92. /*************************************************
  93. * Name: cshake256
  94. *
  95. * Description: cSHAKE256 XOF with non-incremental API
  96. *
  97. * Arguments: - uint8_t *output: pointer to output
  98. * - size_t outlen: requested output length in bytes
  99. * - const uint8_t *name: pointer to function-name string
  100. * - size_t namelen: length of function-name string in bytes
  101. * - const uint8_t *cstm: pointer to non-empty customization string
  102. * - size_t cstmlen: length of customization string in bytes
  103. * - const uint8_t *input: pointer to input
  104. * - size_t inlen: length of input in bytes
  105. **************************************************/
  106. void cshake256(uint8_t *output, size_t outlen,
  107. const uint8_t *name, size_t namelen,
  108. const uint8_t *cstm, size_t cstmlen,
  109. const uint8_t *input, size_t inlen) {
  110. shake256incctx state;
  111. cshake256_inc_init(&state, name, namelen, cstm, cstmlen);
  112. cshake256_inc_absorb(&state, input, inlen);
  113. cshake256_inc_finalize(&state);
  114. cshake256_inc_squeeze(output, outlen, &state);
  115. }