kris
/
xmss-KAT-generator
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
45 Commits
1 Branch
488 KiB
 
 
Tree: 0986ceb2b7
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '0986ceb2b7'
${ noResults }
xmss-KAT-generator/fips202.c

419 lines
12 KiB
Raw Blame History 

  1. /* Based on the public domain implementation in

  2.  * crypto_hash/keccakc512/simple/ from http://bench.cr.yp.to/supercop.html

  3.  * by Ronny Van Keer 

  4.  * and the public domain "TweetFips202" implementation

  5.  * from https://twitter.com/tweetfips202

  6.  * by Gilles Van Assche, Daniel J. Bernstein, and Peter Schwabe */

  7. 

  8. #include <stdint.h>

  9. #include <assert.h>

  10. #include "fips202.h"

  11. 

  12. #define NROUNDS 24

  13. #define ROL(a, offset) ((a << offset) ^ (a >> (64-offset)))

  14. 

  15. static uint64_t load64(const unsigned char *x)

  16. {

  17.   unsigned long long r = 0, i;

  18. 

  19.   for (i = 0; i < 8; ++i) {

  20.     r |= (unsigned long long)x[i] << 8 * i;

  21.   }

  22.   return r;

  23. }

  24. 

  25. static void store64(uint8_t *x, uint64_t u)

  26. {

  27.   unsigned int i;

  28. 

  29.   for(i=0; i<8; ++i) {

  30.     x[i] = u;

  31.     u >>= 8;

  32.   }

  33. }

  34. 

  35. static const uint64_t KeccakF_RoundConstants[NROUNDS] = 

  36. {

  37.     (uint64_t)0x0000000000000001ULL,

  38.     (uint64_t)0x0000000000008082ULL,

  39.     (uint64_t)0x800000000000808aULL,

  40.     (uint64_t)0x8000000080008000ULL,

  41.     (uint64_t)0x000000000000808bULL,

  42.     (uint64_t)0x0000000080000001ULL,

  43.     (uint64_t)0x8000000080008081ULL,

  44.     (uint64_t)0x8000000000008009ULL,

  45.     (uint64_t)0x000000000000008aULL,

  46.     (uint64_t)0x0000000000000088ULL,

  47.     (uint64_t)0x0000000080008009ULL,

  48.     (uint64_t)0x000000008000000aULL,

  49.     (uint64_t)0x000000008000808bULL,

  50.     (uint64_t)0x800000000000008bULL,

  51.     (uint64_t)0x8000000000008089ULL,

  52.     (uint64_t)0x8000000000008003ULL,

  53.     (uint64_t)0x8000000000008002ULL,

  54.     (uint64_t)0x8000000000000080ULL,

  55.     (uint64_t)0x000000000000800aULL,

  56.     (uint64_t)0x800000008000000aULL,

  57.     (uint64_t)0x8000000080008081ULL,

  58.     (uint64_t)0x8000000000008080ULL,

  59.     (uint64_t)0x0000000080000001ULL,

  60.     (uint64_t)0x8000000080008008ULL

  61. };

  62. 

  63. void KeccakF1600_StatePermute(uint64_t * state)

  64. {

  65.   int round;

  66. 

  67.         uint64_t Aba, Abe, Abi, Abo, Abu;

  68.         uint64_t Aga, Age, Agi, Ago, Agu;

  69.         uint64_t Aka, Ake, Aki, Ako, Aku;

  70.         uint64_t Ama, Ame, Ami, Amo, Amu;

  71.         uint64_t Asa, Ase, Asi, Aso, Asu;

  72.         uint64_t BCa, BCe, BCi, BCo, BCu;

  73.         uint64_t Da, De, Di, Do, Du;

  74.         uint64_t Eba, Ebe, Ebi, Ebo, Ebu;

  75.         uint64_t Ega, Ege, Egi, Ego, Egu;

  76.         uint64_t Eka, Eke, Eki, Eko, Eku;

  77.         uint64_t Ema, Eme, Emi, Emo, Emu;

  78.         uint64_t Esa, Ese, Esi, Eso, Esu;

  79. 

  80.         //copyFromState(A, state)

  81.         Aba = state[ 0];

  82.         Abe = state[ 1];

  83.         Abi = state[ 2];

  84.         Abo = state[ 3];

  85.         Abu = state[ 4];

  86.         Aga = state[ 5];

  87.         Age = state[ 6];

  88.         Agi = state[ 7];

  89.         Ago = state[ 8];

  90.         Agu = state[ 9];

  91.         Aka = state[10];

  92.         Ake = state[11];

  93.         Aki = state[12];

  94.         Ako = state[13];

  95.         Aku = state[14];

  96.         Ama = state[15];

  97.         Ame = state[16];

  98.         Ami = state[17];

  99.         Amo = state[18];

  100.         Amu = state[19];

  101.         Asa = state[20];

  102.         Ase = state[21];

  103.         Asi = state[22];

  104.         Aso = state[23];

  105.         Asu = state[24];

  106. 

  107.         for( round = 0; round < NROUNDS; round += 2 )

  108.         {

  109.             //    prepareTheta

  110.             BCa = Aba^Aga^Aka^Ama^Asa;

  111.             BCe = Abe^Age^Ake^Ame^Ase;

  112.             BCi = Abi^Agi^Aki^Ami^Asi;

  113.             BCo = Abo^Ago^Ako^Amo^Aso;

  114.             BCu = Abu^Agu^Aku^Amu^Asu;

  115. 

  116.             //thetaRhoPiChiIotaPrepareTheta(round  , A, E)

  117.             Da = BCu^ROL(BCe, 1);

  118.             De = BCa^ROL(BCi, 1);

  119.             Di = BCe^ROL(BCo, 1);

  120.             Do = BCi^ROL(BCu, 1);

  121.             Du = BCo^ROL(BCa, 1);

  122. 

  123.             Aba ^= Da;

  124.             BCa = Aba;

  125.             Age ^= De;

  126.             BCe = ROL(Age, 44);

  127.             Aki ^= Di;

  128.             BCi = ROL(Aki, 43);

  129.             Amo ^= Do;

  130.             BCo = ROL(Amo, 21);

  131.             Asu ^= Du;

  132.             BCu = ROL(Asu, 14);

  133.             Eba =   BCa ^((~BCe)&  BCi );

  134.             Eba ^= (uint64_t)KeccakF_RoundConstants[round];

  135.             Ebe =   BCe ^((~BCi)&  BCo );

  136.             Ebi =   BCi ^((~BCo)&  BCu );

  137.             Ebo =   BCo ^((~BCu)&  BCa );

  138.             Ebu =   BCu ^((~BCa)&  BCe );

  139. 

  140.             Abo ^= Do;

  141.             BCa = ROL(Abo, 28);

  142.             Agu ^= Du;

  143.             BCe = ROL(Agu, 20);

  144.             Aka ^= Da;

  145.             BCi = ROL(Aka,  3);

  146.             Ame ^= De;

  147.             BCo = ROL(Ame, 45);

  148.             Asi ^= Di;

  149.             BCu = ROL(Asi, 61);

  150.             Ega =   BCa ^((~BCe)&  BCi );

  151.             Ege =   BCe ^((~BCi)&  BCo );

  152.             Egi =   BCi ^((~BCo)&  BCu );

  153.             Ego =   BCo ^((~BCu)&  BCa );

  154.             Egu =   BCu ^((~BCa)&  BCe );

  155. 

  156.             Abe ^= De;

  157.             BCa = ROL(Abe,  1);

  158.             Agi ^= Di;

  159.             BCe = ROL(Agi,  6);

  160.             Ako ^= Do;

  161.             BCi = ROL(Ako, 25);

  162.             Amu ^= Du;

  163.             BCo = ROL(Amu,  8);

  164.             Asa ^= Da;

  165.             BCu = ROL(Asa, 18);

  166.             Eka =   BCa ^((~BCe)&  BCi );

  167.             Eke =   BCe ^((~BCi)&  BCo );

  168.             Eki =   BCi ^((~BCo)&  BCu );

  169.             Eko =   BCo ^((~BCu)&  BCa );

  170.             Eku =   BCu ^((~BCa)&  BCe );

  171. 

  172.             Abu ^= Du;

  173.             BCa = ROL(Abu, 27);

  174.             Aga ^= Da;

  175.             BCe = ROL(Aga, 36);

  176.             Ake ^= De;

  177.             BCi = ROL(Ake, 10);

  178.             Ami ^= Di;

  179.             BCo = ROL(Ami, 15);

  180.             Aso ^= Do;

  181.             BCu = ROL(Aso, 56);

  182.             Ema =   BCa ^((~BCe)&  BCi );

  183.             Eme =   BCe ^((~BCi)&  BCo );

  184.             Emi =   BCi ^((~BCo)&  BCu );

  185.             Emo =   BCo ^((~BCu)&  BCa );

  186.             Emu =   BCu ^((~BCa)&  BCe );

  187. 

  188.             Abi ^= Di;

  189.             BCa = ROL(Abi, 62);

  190.             Ago ^= Do;

  191.             BCe = ROL(Ago, 55);

  192.             Aku ^= Du;

  193.             BCi = ROL(Aku, 39);

  194.             Ama ^= Da;

  195.             BCo = ROL(Ama, 41);

  196.             Ase ^= De;

  197.             BCu = ROL(Ase,  2);

  198.             Esa =   BCa ^((~BCe)&  BCi );

  199.             Ese =   BCe ^((~BCi)&  BCo );

  200.             Esi =   BCi ^((~BCo)&  BCu );

  201.             Eso =   BCo ^((~BCu)&  BCa );

  202.             Esu =   BCu ^((~BCa)&  BCe );

  203. 

  204.             //    prepareTheta

  205.             BCa = Eba^Ega^Eka^Ema^Esa;

  206.             BCe = Ebe^Ege^Eke^Eme^Ese;

  207.             BCi = Ebi^Egi^Eki^Emi^Esi;

  208.             BCo = Ebo^Ego^Eko^Emo^Eso;

  209.             BCu = Ebu^Egu^Eku^Emu^Esu;

  210. 

  211.             //thetaRhoPiChiIotaPrepareTheta(round+1, E, A)

  212.             Da = BCu^ROL(BCe, 1);

  213.             De = BCa^ROL(BCi, 1);

  214.             Di = BCe^ROL(BCo, 1);

  215.             Do = BCi^ROL(BCu, 1);

  216.             Du = BCo^ROL(BCa, 1);

  217. 

  218.             Eba ^= Da;

  219.             BCa = Eba;

  220.             Ege ^= De;

  221.             BCe = ROL(Ege, 44);

  222.             Eki ^= Di;

  223.             BCi = ROL(Eki, 43);

  224.             Emo ^= Do;

  225.             BCo = ROL(Emo, 21);

  226.             Esu ^= Du;

  227.             BCu = ROL(Esu, 14);

  228.             Aba =   BCa ^((~BCe)&  BCi );

  229.             Aba ^= (uint64_t)KeccakF_RoundConstants[round+1];

  230.             Abe =   BCe ^((~BCi)&  BCo );

  231.             Abi =   BCi ^((~BCo)&  BCu );

  232.             Abo =   BCo ^((~BCu)&  BCa );

  233.             Abu =   BCu ^((~BCa)&  BCe );

  234. 

  235.             Ebo ^= Do;

  236.             BCa = ROL(Ebo, 28);

  237.             Egu ^= Du;

  238.             BCe = ROL(Egu, 20);

  239.             Eka ^= Da;

  240.             BCi = ROL(Eka, 3);

  241.             Eme ^= De;

  242.             BCo = ROL(Eme, 45);

  243.             Esi ^= Di;

  244.             BCu = ROL(Esi, 61);

  245.             Aga =   BCa ^((~BCe)&  BCi );

  246.             Age =   BCe ^((~BCi)&  BCo );

  247.             Agi =   BCi ^((~BCo)&  BCu );

  248.             Ago =   BCo ^((~BCu)&  BCa );

  249.             Agu =   BCu ^((~BCa)&  BCe );

  250. 

  251.             Ebe ^= De;

  252.             BCa = ROL(Ebe, 1);

  253.             Egi ^= Di;

  254.             BCe = ROL(Egi, 6);

  255.             Eko ^= Do;

  256.             BCi = ROL(Eko, 25);

  257.             Emu ^= Du;

  258.             BCo = ROL(Emu, 8);

  259.             Esa ^= Da;

  260.             BCu = ROL(Esa, 18);

  261.             Aka =   BCa ^((~BCe)&  BCi );

  262.             Ake =   BCe ^((~BCi)&  BCo );

  263.             Aki =   BCi ^((~BCo)&  BCu );

  264.             Ako =   BCo ^((~BCu)&  BCa );

  265.             Aku =   BCu ^((~BCa)&  BCe );

  266. 

  267.             Ebu ^= Du;

  268.             BCa = ROL(Ebu, 27);

  269.             Ega ^= Da;

  270.             BCe = ROL(Ega, 36);

  271.             Eke ^= De;

  272.             BCi = ROL(Eke, 10);

  273.             Emi ^= Di;

  274.             BCo = ROL(Emi, 15);

  275.             Eso ^= Do;

  276.             BCu = ROL(Eso, 56);

  277.             Ama =   BCa ^((~BCe)&  BCi );

  278.             Ame =   BCe ^((~BCi)&  BCo );

  279.             Ami =   BCi ^((~BCo)&  BCu );

  280.             Amo =   BCo ^((~BCu)&  BCa );

  281.             Amu =   BCu ^((~BCa)&  BCe );

  282. 

  283.             Ebi ^= Di;

  284.             BCa = ROL(Ebi, 62);

  285.             Ego ^= Do;

  286.             BCe = ROL(Ego, 55);

  287.             Eku ^= Du;

  288.             BCi = ROL(Eku, 39);

  289.             Ema ^= Da;

  290.             BCo = ROL(Ema, 41);

  291.             Ese ^= De;

  292.             BCu = ROL(Ese, 2);

  293.             Asa =   BCa ^((~BCe)&  BCi );

  294.             Ase =   BCe ^((~BCi)&  BCo );

  295.             Asi =   BCi ^((~BCo)&  BCu );

  296.             Aso =   BCo ^((~BCu)&  BCa );

  297.             Asu =   BCu ^((~BCa)&  BCe );

  298.         }

  299. 

  300.         //copyToState(state, A)

  301.         state[ 0] = Aba;

  302.         state[ 1] = Abe;

  303.         state[ 2] = Abi;

  304.         state[ 3] = Abo;

  305.         state[ 4] = Abu;

  306.         state[ 5] = Aga;

  307.         state[ 6] = Age;

  308.         state[ 7] = Agi;

  309.         state[ 8] = Ago;

  310.         state[ 9] = Agu;

  311.         state[10] = Aka;

  312.         state[11] = Ake;

  313.         state[12] = Aki;

  314.         state[13] = Ako;

  315.         state[14] = Aku;

  316.         state[15] = Ama;

  317.         state[16] = Ame;

  318.         state[17] = Ami;

  319.         state[18] = Amo;

  320.         state[19] = Amu;

  321.         state[20] = Asa;

  322.         state[21] = Ase;

  323.         state[22] = Asi;

  324.         state[23] = Aso;

  325.         state[24] = Asu;

  326. 

  327.         #undef    round

  328. }

  329. 

  330. #include <string.h>

  331. #define MIN(a, b) ((a) < (b) ? (a) : (b))

  332. 

  333. 

  334. static void keccak_absorb(uint64_t *s,

  335.                           unsigned int r,

  336.                           const unsigned char *m, unsigned long long int mlen,

  337.                           unsigned char p)

  338. {

  339.   unsigned long long i;

  340.   unsigned char t[200];

  341. 

  342.   while (mlen >= r)

  343.   {

  344.     for (i = 0; i < r / 8; ++i)

  345.       s[i] ^= load64(m + 8 * i);

  346.     KeccakF1600_StatePermute(s);

  347.     mlen -= r;

  348.     m += r;

  349.   }

  350. 

  351.   for (i = 0; i < r; ++i)

  352.     t[i] = 0;

  353.   for (i = 0; i < mlen; ++i)

  354.     t[i] = m[i];

  355.   t[i] = p;

  356.   t[r - 1] |= 128;

  357.   for (i = 0; i < r / 8; ++i)

  358.     s[i] ^= load64(t + 8 * i);

  359. }

  360. 

  361. static void keccak_squeezeblocks(unsigned char *h, unsigned long long int nblocks,

  362.                                  uint64_t *s, 

  363.                                  unsigned int r)

  364. {

  365.   unsigned int i;

  366.   while(nblocks > 0) 

  367.   {

  368.     KeccakF1600_StatePermute(s);

  369.     for(i=0;i<(r>>3);i++)

  370.     {

  371.       store64(h+8*i, s[i]);

  372.     }

  373.     h += r;

  374.     nblocks--;

  375.   }

  376. }

  377. 

  378. void shake128(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen)

  379. {

  380.   unsigned int i;

  381.   uint64_t s[25];

  382.   unsigned char d[SHAKE128_RATE];

  383. 

  384.   for(i = 0; i < 25; i++)

  385.     s[i] = 0;

  386.   keccak_absorb(s, SHAKE128_RATE, input, inputByteLen, 0x1F);

  387. 

  388.   keccak_squeezeblocks(output, outputByteLen/SHAKE128_RATE, s, SHAKE128_RATE);

  389.   output += (outputByteLen/SHAKE128_RATE)*SHAKE128_RATE;

  390. 

  391.   if (outputByteLen % SHAKE128_RATE) {

  392.     keccak_squeezeblocks(d, 1, s, SHAKE128_RATE);

  393.     for(i = 0; i < outputByteLen % SHAKE128_RATE; i++) {

  394.       output[i] = d[i];

  395.     }

  396.   }

  397. }

  398. 

  399. void shake256(unsigned char *output, unsigned int outputByteLen, const unsigned char *input, unsigned int inputByteLen)

  400. {

  401.   unsigned int i;

  402.   uint64_t s[25];

  403.   unsigned char d[SHAKE256_RATE];

  404. 

  405.   for(i = 0; i < 25; i++)

  406.     s[i] = 0;

  407.   keccak_absorb(s, SHAKE256_RATE, input, inputByteLen, 0x1F);

  408. 

  409.   keccak_squeezeblocks(output, outputByteLen/SHAKE256_RATE, s, SHAKE256_RATE);

  410.   output += (outputByteLen/SHAKE256_RATE)*SHAKE256_RATE;

  411. 

  412.   if (outputByteLen % SHAKE256_RATE) {

  413.     keccak_squeezeblocks(d, 1, s, SHAKE256_RATE);

  414.     for(i = 0; i < outputByteLen % SHAKE256_RATE; i++) {

  415.       output[i] = d[i];

  416.     }

  417.   }

  418. }