1// sha3.c
  2// 19-Nov-11  Markku-Juhani O. Saarinen <mjos@iki.fi>
  3// https://github.com/mjosaarinen/tiny_sha3
  4// LICENSE: MIT
  5
  6// Revised 07-Aug-15 to match with official release of FIPS PUB 202 "SHA3"
  7// Revised 03-Sep-15 for portability + OpenSSL - style API
  8
  9#include "sha3.h"
 10
 11// update the state with given number of rounds
 12
 13void sha3_keccakf(uint64_t st[25]) {
 14  // constants
 15  const uint64_t keccakf_rndc[24] = {0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 0x8000000080008000,
 16                                     0x000000000000808b, 0x0000000080000001, 0x8000000080008081, 0x8000000000008009,
 17                                     0x000000000000008a, 0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
 18                                     0x000000008000808b, 0x800000000000008b, 0x8000000000008089, 0x8000000000008003,
 19                                     0x8000000000008002, 0x8000000000000080, 0x000000000000800a, 0x800000008000000a,
 20                                     0x8000000080008081, 0x8000000000008080, 0x0000000080000001, 0x8000000080008008};
 21  const int keccakf_rotc[24] = {1,  3,  6,  10, 15, 21, 28, 36, 45, 55, 2,  14,
 22                                27, 41, 56, 8,  25, 43, 62, 18, 39, 61, 20, 44};
 23  const int keccakf_piln[24] = {10, 7, 11, 17, 18, 3, 5, 16, 8, 21, 24, 4, 15, 23, 19, 13, 12, 2, 20, 14, 22, 9, 6, 1};
 24
 25  // variables
 26  int i, j, r;
 27  uint64_t t, bc[5];
 28
 29#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
 30  uint8_t* v;
 31
 32  // endianess conversion. this is redundant on little-endian targets
 33  for (i = 0; i < 25; i++) {
 34    v = (uint8_t*)&st[i];
 35    st[i] = ((uint64_t)v[0]) | (((uint64_t)v[1]) << 8) | (((uint64_t)v[2]) << 16) | (((uint64_t)v[3]) << 24) |
 36            (((uint64_t)v[4]) << 32) | (((uint64_t)v[5]) << 40) | (((uint64_t)v[6]) << 48) | (((uint64_t)v[7]) << 56);
 37  }
 38#endif
 39
 40  // actual iteration
 41  for (r = 0; r < KECCAKF_ROUNDS; r++) {
 42    // Theta
 43    for (i = 0; i < 5; i++) bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
 44
 45    for (i = 0; i < 5; i++) {
 46      t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
 47      for (j = 0; j < 25; j += 5) st[j + i] ^= t;
 48    }
 49
 50    // Rho Pi
 51    t = st[1];
 52    for (i = 0; i < 24; i++) {
 53      j = keccakf_piln[i];
 54      bc[0] = st[j];
 55      st[j] = ROTL64(t, keccakf_rotc[i]);
 56      t = bc[0];
 57    }
 58
 59    //  Chi
 60    for (j = 0; j < 25; j += 5) {
 61      for (i = 0; i < 5; i++) bc[i] = st[j + i];
 62      for (i = 0; i < 5; i++) st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
 63    }
 64
 65    //  Iota
 66    st[0] ^= keccakf_rndc[r];
 67  }
 68
 69#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
 70  // endianess conversion. this is redundant on little-endian targets
 71  for (i = 0; i < 25; i++) {
 72    v = (uint8_t*)&st[i];
 73    t = st[i];
 74    v[0] = t & 0xFF;
 75    v[1] = (t >> 8) & 0xFF;
 76    v[2] = (t >> 16) & 0xFF;
 77    v[3] = (t >> 24) & 0xFF;
 78    v[4] = (t >> 32) & 0xFF;
 79    v[5] = (t >> 40) & 0xFF;
 80    v[6] = (t >> 48) & 0xFF;
 81    v[7] = (t >> 56) & 0xFF;
 82  }
 83#endif
 84}
 85
 86// Initialize the context for SHA3
 87
 88int sha3_init(sha3_ctx_t* c, int mdlen) {
 89  int i;
 90
 91  for (i = 0; i < 25; i++) c->st.q[i] = 0;
 92  c->mdlen = mdlen;
 93  c->rsiz = 200 - 2 * mdlen;
 94  c->pt = 0;
 95
 96  return 1;
 97}
 98
 99// update state with more data
100
101int sha3_update(sha3_ctx_t* c, const void* data, size_t len) {
102  size_t i;
103  int j;
104
105  j = c->pt;
106  for (i = 0; i < len; i++) {
107    c->st.b[j++] ^= ((const uint8_t*)data)[i];
108    if (j >= c->rsiz) {
109      sha3_keccakf(c->st.q);
110      j = 0;
111    }
112  }
113  c->pt = j;
114
115  return 1;
116}
117
118// finalize and output a hash
119
120int sha3_final(void* md, sha3_ctx_t* c) {
121  int i;
122
123  c->st.b[c->pt] ^= 0x06;
124  c->st.b[c->rsiz - 1] ^= 0x80;
125  sha3_keccakf(c->st.q);
126
127  for (i = 0; i < c->mdlen; i++) {
128    ((uint8_t*)md)[i] = c->st.b[i];
129  }
130
131  return 1;
132}
133
134// compute a SHA-3 hash (md) of given byte length from "in"
135
136void* sha3(const void* in, size_t inlen, void* md, int mdlen) {
137  sha3_ctx_t sha3;
138
139  sha3_init(&sha3, mdlen);
140  sha3_update(&sha3, in, inlen);
141  sha3_final(md, &sha3);
142
143  return md;
144}
145
146// SHAKE128 and SHAKE256 extensible-output functionality
147
148void shake_xof(sha3_ctx_t* c) {
149  c->st.b[c->pt] ^= 0x1F;
150  c->st.b[c->rsiz - 1] ^= 0x80;
151  sha3_keccakf(c->st.q);
152  c->pt = 0;
153}
154
155void shake_out(sha3_ctx_t* c, void* out, size_t len) {
156  size_t i;
157  int j;
158
159  j = c->pt;
160  for (i = 0; i < len; i++) {
161    if (j >= c->rsiz) {
162      sha3_keccakf(c->st.q);
163      j = 0;
164    }
165    ((uint8_t*)out)[i] = c->st.b[j++];
166  }
167  c->pt = j;
168}