@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash( | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
unsigned int i; | |||
memcpy(buf, pub_seed, SPX_N); | |||
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash( | |||
PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES); | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
for (i = 0; i < inblocks * SPX_N; i++) { | |||
buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i]; | |||
} | |||
sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N, | |||
sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N, | |||
SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||
@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random( | |||
const unsigned char *sk_prf, const unsigned char *optrand, | |||
const unsigned char *m, size_t mlen) { | |||
unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
int i; | |||
/* This implements HMAC-SHA256 */ | |||
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random( | |||
} | |||
memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_init(state); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_init(&state); | |||
sha256_inc_blocks(&state, buf, 1); | |||
memcpy(buf, optrand, SPX_N); | |||
/* If optrand + message cannot fill up an entire block */ | |||
if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(buf + SPX_N, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, | |||
buf, mlen + SPX_N); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N); | |||
sha256_inc_blocks(state, buf, 1); | |||
sha256_inc_blocks(&state, buf, 1); | |||
m += SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N; | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen); | |||
sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen); | |||
} | |||
for (i = 0; i < SPX_N; i++) { | |||
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message( | |||
unsigned char buf[SPX_DGST_BYTES]; | |||
unsigned char *bufp = buf; | |||
uint8_t state[40]; | |||
sha256ctx state; | |||
sha256_inc_init(state); | |||
sha256_inc_init(&state); | |||
memcpy(inbuf, R, SPX_N); | |||
memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES); | |||
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message( | |||
/* If R + pk + message cannot fill up an entire block */ | |||
if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen); | |||
sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen); | |||
} | |||
/* Otherwise first fill a block, so that finalize only uses the message */ | |||
else { | |||
memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, | |||
SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES); | |||
sha256_inc_blocks(state, inbuf, SPX_INBLOCKS); | |||
sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS); | |||
m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES; | |||
sha256_inc_finalize(seed, state, m, mlen); | |||
sha256_inc_finalize(seed, &state, m, mlen); | |||
} | |||
/* By doing this in two steps, we prevent hashing the message twice; | |||
@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1( | |||
} | |||
} | |||
uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40]; | |||
sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded; | |||
/** | |||
* Absorb the constant pub_seed using one round of the compression function | |||
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s | |||
block[i] = 0; | |||
} | |||
sha256_inc_init(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1); | |||
sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded); | |||
sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1); | |||
} |
@@ -8,13 +8,15 @@ | |||
#include <stddef.h> | |||
#include <stdint.h> | |||
#include "sha2.h" | |||
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]); | |||
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1( | |||
unsigned char *out, unsigned long outlen, | |||
unsigned char *input_plus_four_bytes, unsigned long inlen); | |||
extern uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40]; | |||
extern sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded; | |||
void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed); | |||
@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_thash( | |||
const unsigned char *pub_seed, uint32_t addr[8]) { | |||
unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES]; | |||
uint8_t sha2_state[40]; | |||
sha256ctx sha2_state; | |||
(void)pub_seed; /* Suppress an 'unused parameter' warning. */ | |||
/* Retrieve precomputed state containing pub_seed */ | |||
memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t)); | |||
memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx)); | |||
PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(buf, addr); | |||
memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N); | |||
memcpy(out, outbuf, SPX_N); | |||
} | |||