DH-Keccak/assets/KremKeccak/KeccakSponge.c

   1 /*
   2 The Keccak sponge function, designed by Guido Bertoni, Joan Daemen,
   3 Michaël Peeters and Gilles Van Assche. For more information, feedback or
   4 questions, please refer to our website: http://keccak.noekeon.org/
   5
   6 Implementation by the designers,
   7 hereby denoted as "the implementer".
   8
   9 To the extent possible under law, the implementer has waived all copyright
  10 and related or neighboring rights to the source code in this file.
  11 http://creativecommons.org/publicdomain/zero/1.0/
  12 */
  13
  14 #include <string.h>
  15 #include "KeccakSponge.h"
  16 #include "KeccakF-1600-interface.h"
  17 #ifdef KeccakReference
  18 #include "displayIntermediateValues.h"
  19 #endif
  20
  21 int InitSponge(spongeState *state, unsigned int rate, unsigned int capacity)
  22 {
  23     if (rate+capacity != 1600)
  24         return 1;
  25     if ((rate <= 0) || (rate >= 1600) || ((rate % 64) != 0))
  26         return 1;
  27     KeccakInitialize();
  28     state->rate = rate;
  29     state->capacity = capacity;
  30     state->fixedOutputLength = 0;
  31     KeccakInitializeState(state->state);
  32     memset(state->dataQueue, 0, KeccakMaximumRateInBytes);
  33     state->bitsInQueue = 0;
  34     state->squeezing = 0;
  35     state->bitsAvailableForSqueezing = 0;
  36
  37     return 0;
  38 }
  39
  40 void AbsorbQueue(spongeState *state)
  41 {
  42     // state->bitsInQueue is assumed to be equal to state->rate
  43     #ifdef KeccakReference
  44     displayBytes(1, "Block to be absorbed", state->dataQueue, state->rate/8);
  45     #endif
  46 #ifdef ProvideFast576
  47     if (state->rate == 576)
  48         KeccakAbsorb576bits(state->state, state->dataQueue);
  49     else
  50 #endif
  51 #ifdef ProvideFast832
  52     if (state->rate == 832)
  53         KeccakAbsorb832bits(state->state, state->dataQueue);
  54     else
  55 #endif
  56 #ifdef ProvideFast1024
  57     if (state->rate == 1024)
  58         KeccakAbsorb1024bits(state->state, state->dataQueue);
  59     else
  60 #endif
  61 #ifdef ProvideFast1088
  62     if (state->rate == 1088)
  63         KeccakAbsorb1088bits(state->state, state->dataQueue);
  64     else
  65 #endif
  66 #ifdef ProvideFast1152
  67     if (state->rate == 1152)
  68         KeccakAbsorb1152bits(state->state, state->dataQueue);
  69     else
  70 #endif
  71 #ifdef ProvideFast1344
  72     if (state->rate == 1344)
  73         KeccakAbsorb1344bits(state->state, state->dataQueue);
  74     else
  75 #endif
  76         KeccakAbsorb(state->state, state->dataQueue, state->rate/64);
  77     state->bitsInQueue = 0;
  78 }
  79
  80 int Absorb(spongeState *state, const unsigned char *data, unsigned long long databitlen)
  81 {
  82     unsigned long long i, j, wholeBlocks;
  83     unsigned int partialBlock, partialByte;
  84     const unsigned char *curData;
  85
  86     if ((state->bitsInQueue % 8) != 0)
  87         return 1; // Only the last call may contain a partial byte
  88     if (state->squeezing)
  89         return 1; // Too late for additional input
  90
  91     i = 0;
  92     while(i < databitlen) {
  93         if ((state->bitsInQueue == 0) && (databitlen >= state->rate) && (i <= (databitlen-state->rate))) {
  94             wholeBlocks = (databitlen-i)/state->rate;
  95             curData = data+i/8;
  96 #ifdef ProvideFast576
  97             if (state->rate == 576) {
  98                 for(j=0; j<wholeBlocks; j++, curData+=576/8) {
  99                     #ifdef KeccakReference
 100                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 101                     #endif
 102                     KeccakAbsorb576bits(state->state, curData);
 103                 }
 104             }
 105             else
 106 #endif
 107 #ifdef ProvideFast832
 108             if (state->rate == 832) {
 109                 for(j=0; j<wholeBlocks; j++, curData+=832/8) {
 110                     #ifdef KeccakReference
 111                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 112                     #endif
 113                     KeccakAbsorb832bits(state->state, curData);
 114                 }
 115             }
 116             else
 117 #endif
 118 #ifdef ProvideFast1024
 119             if (state->rate == 1024) {
 120                 for(j=0; j<wholeBlocks; j++, curData+=1024/8) {
 121                     #ifdef KeccakReference
 122                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 123                     #endif
 124                     KeccakAbsorb1024bits(state->state, curData);
 125                 }
 126             }
 127             else
 128 #endif
 129 #ifdef ProvideFast1088
 130             if (state->rate == 1088) {
 131                 for(j=0; j<wholeBlocks; j++, curData+=1088/8) {
 132                     #ifdef KeccakReference
 133                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 134                     #endif
 135                     KeccakAbsorb1088bits(state->state, curData);
 136                 }
 137             }
 138             else
 139 #endif
 140 #ifdef ProvideFast1152
 141             if (state->rate == 1152) {
 142                 for(j=0; j<wholeBlocks; j++, curData+=1152/8) {
 143                     #ifdef KeccakReference
 144                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 145                     #endif
 146                     KeccakAbsorb1152bits(state->state, curData);
 147                 }
 148             }
 149             else
 150 #endif
 151 #ifdef ProvideFast1344
 152             if (state->rate == 1344) {
 153                 for(j=0; j<wholeBlocks; j++, curData+=1344/8) {
 154                     #ifdef KeccakReference
 155                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 156                     #endif
 157                     KeccakAbsorb1344bits(state->state, curData);
 158                 }
 159             }
 160             else
 161 #endif
 162             {
 163                 for(j=0; j<wholeBlocks; j++, curData+=state->rate/8) {
 164                     #ifdef KeccakReference
 165                     displayBytes(1, "Block to be absorbed", curData, state->rate/8);
 166                     #endif
 167                     KeccakAbsorb(state->state, curData, state->rate/64);
 168                 }
 169             }
 170             i += wholeBlocks*state->rate;
 171         }
 172         else {
 173             partialBlock = (unsigned int)(databitlen - i);
 174             if (partialBlock+state->bitsInQueue > state->rate)
 175                 partialBlock = state->rate-state->bitsInQueue;
 176             partialByte = partialBlock % 8;
 177             partialBlock -= partialByte;
 178             memcpy(state->dataQueue+state->bitsInQueue/8, data+i/8, partialBlock/8);
 179             state->bitsInQueue += partialBlock;
 180             i += partialBlock;
 181             if (state->bitsInQueue == state->rate)
 182                 AbsorbQueue(state);
 183             if (partialByte > 0) {
 184                 unsigned char mask = (1 << partialByte)-1;
 185                 state->dataQueue[state->bitsInQueue/8] = data[i/8] & mask;
 186                 state->bitsInQueue += partialByte;
 187                 i += partialByte;
 188             }
 189         }
 190     }
 191     return 0;
 192 }
 193
 194 void PadAndSwitchToSqueezingPhase(spongeState *state)
 195 {
 196     // Note: the bits are numbered from 0=LSB to 7=MSB
 197     if (state->bitsInQueue + 1 == state->rate) {
 198         state->dataQueue[state->bitsInQueue/8 ] |= 1 << (state->bitsInQueue % 8);
 199         AbsorbQueue(state);
 200         memset(state->dataQueue, 0, state->rate/8);
 201     }
 202     else {
 203         memset(state->dataQueue + (state->bitsInQueue+7)/8, 0, state->rate/8 - (state->bitsInQueue+7)/8);
 204         state->dataQueue[state->bitsInQueue/8 ] |= 1 << (state->bitsInQueue % 8);
 205     }
 206     state->dataQueue[(state->rate-1)/8] |= 1 << ((state->rate-1) % 8);
 207     AbsorbQueue(state);
 208
 209     #ifdef KeccakReference
 210     displayText(1, "--- Switching to squeezing phase ---");
 211     #endif
 212 #ifdef ProvideFast1024
 213     if (state->rate == 1024) {
 214         KeccakExtract1024bits(state->state, state->dataQueue);
 215         state->bitsAvailableForSqueezing = 1024;
 216     }
 217     else
 218 #endif
 219     {
 220         KeccakExtract(state->state, state->dataQueue, state->rate/64);
 221         state->bitsAvailableForSqueezing = state->rate;
 222     }
 223     #ifdef KeccakReference
 224     displayBytes(1, "Block available for squeezing", state->dataQueue, state->bitsAvailableForSqueezing/8);
 225     #endif
 226     state->squeezing = 1;
 227 }
 228
 229 int Squeeze(spongeState *state, unsigned char *output, unsigned long long outputLength)
 230 {
 231     unsigned long long i;
 232     unsigned int partialBlock;
 233
 234     if (!state->squeezing)
 235         PadAndSwitchToSqueezingPhase(state);
 236     if ((outputLength % 8) != 0)
 237         return 1; // Only multiple of 8 bits are allowed, truncation can be done at user level
 238
 239     i = 0;
 240     while(i < outputLength) {
 241         if (state->bitsAvailableForSqueezing == 0) {
 242             KeccakPermutation(state->state);
 243 #ifdef ProvideFast1024
 244             if (state->rate == 1024) {
 245                 KeccakExtract1024bits(state->state, state->dataQueue);
 246                 state->bitsAvailableForSqueezing = 1024;
 247             }
 248             else
 249 #endif
 250             {
 251                 KeccakExtract(state->state, state->dataQueue, state->rate/64);
 252                 state->bitsAvailableForSqueezing = state->rate;
 253             }
 254             #ifdef KeccakReference
 255             displayBytes(1, "Block available for squeezing", state->dataQueue, state->bitsAvailableForSqueezing/8);
 256             #endif
 257         }
 258         partialBlock = state->bitsAvailableForSqueezing;
 259         if ((unsigned long long)partialBlock > outputLength - i)
 260             partialBlock = (unsigned int)(outputLength - i);
 261         memcpy(output+i/8, state->dataQueue+(state->rate-state->bitsAvailableForSqueezing)/8, partialBlock/8);
 262         state->bitsAvailableForSqueezing -= partialBlock;
 263         i += partialBlock;
 264     }
 265     return 0;
 266 }