You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

334 lines
6.6 KiB

// Package keccak implements the Keccak (SHA-3) hash algorithm.
// http://keccak.noekeon.org / FIPS 202 draft.
package cryptonight
// import "fmt"
import "hash"
const (
domainNone = 1
domainSHA3 = 0x06
domainSHAKE = 0x1f
)
const rounds = 24
var roundConstants = []uint64{
0x0000000000000001, 0x0000000000008082,
0x800000000000808A, 0x8000000080008000,
0x000000000000808B, 0x0000000080000001,
0x8000000080008081, 0x8000000000008009,
0x000000000000008A, 0x0000000000000088,
0x0000000080008009, 0x000000008000000A,
0x000000008000808B, 0x800000000000008B,
0x8000000000008089, 0x8000000000008003,
0x8000000000008002, 0x8000000000000080,
0x000000000000800A, 0x800000008000000A,
0x8000000080008081, 0x8000000000008080,
0x0000000080000001, 0x8000000080008008,
}
type keccak struct {
S [25]uint64
size int
blockSize int
buf []byte
domain byte
}
func newKeccak(capacity, output int, domain byte) hash.Hash {
var h keccak
h.size = output / 8
h.blockSize = (200 - capacity/8)
h.domain = domain
return &h
}
func New224() hash.Hash {
return newKeccak(224*2, 224, domainNone)
}
func New256() hash.Hash {
return newKeccak(256*2, 256, domainNone)
}
func New384() hash.Hash {
return newKeccak(384*2, 384, domainNone)
}
func New512() hash.Hash {
return newKeccak(512*2, 512, domainNone)
}
func (k *keccak) Write(b []byte) (int, error) {
n := len(b)
if len(k.buf) > 0 {
x := k.blockSize - len(k.buf)
if x > len(b) {
x = len(b)
}
k.buf = append(k.buf, b[:x]...)
b = b[x:]
if len(k.buf) < k.blockSize {
return n, nil
}
k.absorb(k.buf)
k.buf = nil
}
for len(b) >= k.blockSize {
k.absorb(b[:k.blockSize])
b = b[k.blockSize:]
}
k.buf = b
return n, nil
}
func (k0 *keccak) Sum(b []byte) []byte {
k := *k0
k.final()
return k.squeeze(b)
}
func (k *keccak) Reset() {
for i := range k.S {
k.S[i] = 0
}
k.buf = nil
}
func (k *keccak) Size() int {
return k.size
}
func (k *keccak) BlockSize() int {
return k.blockSize
}
func (k *keccak) absorb(block []byte) {
if len(block) != k.blockSize {
panic("absorb() called with invalid block size")
}
for i := 0; i < k.blockSize/8; i++ {
k.S[i] ^= uint64le(block[i*8:])
}
keccakf(&k.S)
}
func (k *keccak) pad(block []byte) []byte {
padded := make([]byte, k.blockSize)
copy(padded, k.buf)
padded[len(k.buf)] = k.domain
padded[len(padded)-1] |= 0x80
return padded
}
func (k *keccak) final() {
last := k.pad(k.buf)
k.absorb(last)
}
func (k *keccak) squeeze(b []byte) []byte {
buf := make([]byte, 8*len(k.S))
n := k.size
for {
for i := range k.S {
putUint64le(buf[i*8:], k.S[i])
}
if n <= k.blockSize {
b = append(b, buf[:n]...)
break
}
b = append(b, buf[:k.blockSize]...)
n -= k.blockSize
keccakf(&k.S)
}
return b
}
func keccakf(S *[25]uint64) {
var bc0, bc1, bc2, bc3, bc4 uint64
var S0, S1, S2, S3, S4 uint64
var S5, S6, S7, S8, S9 uint64
var S10, S11, S12, S13, S14 uint64
var S15, S16, S17, S18, S19 uint64
var S20, S21, S22, S23, S24 uint64
var tmp uint64
//S[0]=0x2073692073696854;
//S[1]=0x1747365742061
// S[16]=0x8000000000000000;
/* for i :=0; i< 25;i++{
fmt.Printf("%2d %X\n", i, S[i])
}
*/
S0, S1, S2, S3, S4 = S[0], S[1], S[2], S[3], S[4]
S5, S6, S7, S8, S9 = S[5], S[6], S[7], S[8], S[9]
S10, S11, S12, S13, S14 = S[10], S[11], S[12], S[13], S[14]
S15, S16, S17, S18, S19 = S[15], S[16], S[17], S[18], S[19]
S20, S21, S22, S23, S24 = S[20], S[21], S[22], S[23], S[24]
for r := 0; r < rounds; r++ {
// theta
bc0 = S0 ^ S5 ^ S10 ^ S15 ^ S20
bc1 = S1 ^ S6 ^ S11 ^ S16 ^ S21
bc2 = S2 ^ S7 ^ S12 ^ S17 ^ S22
bc3 = S3 ^ S8 ^ S13 ^ S18 ^ S23
bc4 = S4 ^ S9 ^ S14 ^ S19 ^ S24
tmp = bc4 ^ (bc1<<1 | bc1>>(64-1))
S0 ^= tmp
S5 ^= tmp
S10 ^= tmp
S15 ^= tmp
S20 ^= tmp
tmp = bc0 ^ (bc2<<1 | bc2>>(64-1))
S1 ^= tmp
S6 ^= tmp
S11 ^= tmp
S16 ^= tmp
S21 ^= tmp
tmp = bc1 ^ (bc3<<1 | bc3>>(64-1))
S2 ^= tmp
S7 ^= tmp
S12 ^= tmp
S17 ^= tmp
S22 ^= tmp
tmp = bc2 ^ (bc4<<1 | bc4>>(64-1))
S3 ^= tmp
S8 ^= tmp
S13 ^= tmp
S18 ^= tmp
S23 ^= tmp
tmp = bc3 ^ (bc0<<1 | bc0>>(64-1))
S4 ^= tmp
S9 ^= tmp
S14 ^= tmp
S19 ^= tmp
S24 ^= tmp
// rho phi
tmp = S1
tmp, S10 = S10, tmp<<1|tmp>>(64-1)
tmp, S7 = S7, tmp<<3|tmp>>(64-3)
tmp, S11 = S11, tmp<<6|tmp>>(64-6)
tmp, S17 = S17, tmp<<10|tmp>>(64-10)
tmp, S18 = S18, tmp<<15|tmp>>(64-15)
tmp, S3 = S3, tmp<<21|tmp>>(64-21)
tmp, S5 = S5, tmp<<28|tmp>>(64-28)
tmp, S16 = S16, tmp<<36|tmp>>(64-36)
tmp, S8 = S8, tmp<<45|tmp>>(64-45)
tmp, S21 = S21, tmp<<55|tmp>>(64-55)
tmp, S24 = S24, tmp<<2|tmp>>(64-2)
tmp, S4 = S4, tmp<<14|tmp>>(64-14)
tmp, S15 = S15, tmp<<27|tmp>>(64-27)
tmp, S23 = S23, tmp<<41|tmp>>(64-41)
tmp, S19 = S19, tmp<<56|tmp>>(64-56)
tmp, S13 = S13, tmp<<8|tmp>>(64-8)
tmp, S12 = S12, tmp<<25|tmp>>(64-25)
tmp, S2 = S2, tmp<<43|tmp>>(64-43)
tmp, S20 = S20, tmp<<62|tmp>>(64-62)
tmp, S14 = S14, tmp<<18|tmp>>(64-18)
tmp, S22 = S22, tmp<<39|tmp>>(64-39)
tmp, S9 = S9, tmp<<61|tmp>>(64-61)
tmp, S6 = S6, tmp<<20|tmp>>(64-20)
S1 = tmp<<44 | tmp>>(64-44)
// chi
bc0 = S0
bc1 = S1
bc2 = S2
bc3 = S3
bc4 = S4
S0 ^= (^bc1) & bc2
S1 ^= (^bc2) & bc3
S2 ^= (^bc3) & bc4
S3 ^= (^bc4) & bc0
S4 ^= (^bc0) & bc1
bc0 = S5
bc1 = S6
bc2 = S7
bc3 = S8
bc4 = S9
S5 ^= (^bc1) & bc2
S6 ^= (^bc2) & bc3
S7 ^= (^bc3) & bc4
S8 ^= (^bc4) & bc0
S9 ^= (^bc0) & bc1
bc0 = S10
bc1 = S11
bc2 = S12
bc3 = S13
bc4 = S14
S10 ^= (^bc1) & bc2
S11 ^= (^bc2) & bc3
S12 ^= (^bc3) & bc4
S13 ^= (^bc4) & bc0
S14 ^= (^bc0) & bc1
bc0 = S15
bc1 = S16
bc2 = S17
bc3 = S18
bc4 = S19
S15 ^= (^bc1) & bc2
S16 ^= (^bc2) & bc3
S17 ^= (^bc3) & bc4
S18 ^= (^bc4) & bc0
S19 ^= (^bc0) & bc1
bc0 = S20
bc1 = S21
bc2 = S22
bc3 = S23
bc4 = S24
S20 ^= (^bc1) & bc2
S21 ^= (^bc2) & bc3
S22 ^= (^bc3) & bc4
S23 ^= (^bc4) & bc0
S24 ^= (^bc0) & bc1
// iota
S0 ^= roundConstants[r]
}
S[0], S[1], S[2], S[3], S[4] = S0, S1, S2, S3, S4
S[5], S[6], S[7], S[8], S[9] = S5, S6, S7, S8, S9
S[10], S[11], S[12], S[13], S[14] = S10, S11, S12, S13, S14
S[15], S[16], S[17], S[18], S[19] = S15, S16, S17, S18, S19
S[20], S[21], S[22], S[23], S[24] = S20, S21, S22, S23, S24
}
func uint64le(v []byte) uint64 {
return uint64(v[0]) |
uint64(v[1])<<8 |
uint64(v[2])<<16 |
uint64(v[3])<<24 |
uint64(v[4])<<32 |
uint64(v[5])<<40 |
uint64(v[6])<<48 |
uint64(v[7])<<56
}
func putUint64le(v []byte, x uint64) {
v[0] = byte(x)
v[1] = byte(x >> 8)
v[2] = byte(x >> 16)
v[3] = byte(x >> 24)
v[4] = byte(x >> 32)
v[5] = byte(x >> 40)
v[6] = byte(x >> 48)
v[7] = byte(x >> 56)
}