Botan 1.10.17

keccak.cpp
Go to the documentation of this file.
1 /*
2 * Keccak
3 * (C) 2010 Jack Lloyd
4 *
5 * Distributed under the terms of the Botan license
6 */
7
8 #include <botan/keccak.h>
9 #include <botan/loadstor.h>
10 #include <botan/parsing.h>
11 #include <botan/exceptn.h>
12 #include <botan/rotate.h>
13 #include <botan/internal/xor_buf.h>
14
15 namespace Botan {
16
17 namespace {
18
19 void keccak_f_1600(u64bit A[25])
20 {
21 static const u64bit RC[24] = {
22 0x0000000000000001, 0x0000000000008082, 0x800000000000808A,
23 0x8000000080008000, 0x000000000000808B, 0x0000000080000001,
24 0x8000000080008081, 0x8000000000008009, 0x000000000000008A,
25 0x0000000000000088, 0x0000000080008009, 0x000000008000000A,
26 0x000000008000808B, 0x800000000000008B, 0x8000000000008089,
27 0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
28 0x000000000000800A, 0x800000008000000A, 0x8000000080008081,
29 0x8000000000008080, 0x0000000080000001, 0x8000000080008008
30 };
31
32 for(size_t i = 0; i != 24; ++i)
33 {
34 const u64bit C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
35 const u64bit C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
36 const u64bit C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
37 const u64bit C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
38 const u64bit C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
39
40 const u64bit D0 = rotate_left(C0, 1) ^ C3;
41 const u64bit D1 = rotate_left(C1, 1) ^ C4;
42 const u64bit D2 = rotate_left(C2, 1) ^ C0;
43 const u64bit D3 = rotate_left(C3, 1) ^ C1;
44 const u64bit D4 = rotate_left(C4, 1) ^ C2;
45
46 const u64bit B00 = A[ 0] ^ D1;
47 const u64bit B01 = rotate_left(A[ 6] ^ D2, 44);
48 const u64bit B02 = rotate_left(A[12] ^ D3, 43);
49 const u64bit B03 = rotate_left(A[18] ^ D4, 21);
50 const u64bit B04 = rotate_left(A[24] ^ D0, 14);
51 const u64bit B05 = rotate_left(A[ 3] ^ D4, 28);
52 const u64bit B06 = rotate_left(A[ 9] ^ D0, 20);
53 const u64bit B07 = rotate_left(A[10] ^ D1, 3);
54 const u64bit B08 = rotate_left(A[16] ^ D2, 45);
55 const u64bit B09 = rotate_left(A[22] ^ D3, 61);
56 const u64bit B10 = rotate_left(A[ 1] ^ D2, 1);
57 const u64bit B11 = rotate_left(A[ 7] ^ D3, 6);
58 const u64bit B12 = rotate_left(A[13] ^ D4, 25);
59 const u64bit B13 = rotate_left(A[19] ^ D0, 8);
60 const u64bit B14 = rotate_left(A[20] ^ D1, 18);
61 const u64bit B15 = rotate_left(A[ 4] ^ D0, 27);
62 const u64bit B16 = rotate_left(A[ 5] ^ D1, 36);
63 const u64bit B17 = rotate_left(A[11] ^ D2, 10);
64 const u64bit B18 = rotate_left(A[17] ^ D3, 15);
65 const u64bit B19 = rotate_left(A[23] ^ D4, 56);
66 const u64bit B20 = rotate_left(A[ 2] ^ D3, 62);
67 const u64bit B21 = rotate_left(A[ 8] ^ D4, 55);
68 const u64bit B22 = rotate_left(A[14] ^ D0, 39);
69 const u64bit B23 = rotate_left(A[15] ^ D1, 41);
70 const u64bit B24 = rotate_left(A[21] ^ D2, 2);
71
72 A[ 0] = B00 ^ (~B01 & B02);
73 A[ 1] = B01 ^ (~B02 & B03);
74 A[ 2] = B02 ^ (~B03 & B04);
75 A[ 3] = B03 ^ (~B04 & B00);
76 A[ 4] = B04 ^ (~B00 & B01);
77 A[ 5] = B05 ^ (~B06 & B07);
78 A[ 6] = B06 ^ (~B07 & B08);
79 A[ 7] = B07 ^ (~B08 & B09);
80 A[ 8] = B08 ^ (~B09 & B05);
81 A[ 9] = B09 ^ (~B05 & B06);
82 A[10] = B10 ^ (~B11 & B12);
83 A[11] = B11 ^ (~B12 & B13);
84 A[12] = B12 ^ (~B13 & B14);
85 A[13] = B13 ^ (~B14 & B10);
86 A[14] = B14 ^ (~B10 & B11);
87 A[15] = B15 ^ (~B16 & B17);
88 A[16] = B16 ^ (~B17 & B18);
89 A[17] = B17 ^ (~B18 & B19);
90 A[18] = B18 ^ (~B19 & B15);
91 A[19] = B19 ^ (~B15 & B16);
92 A[20] = B20 ^ (~B21 & B22);
93 A[21] = B21 ^ (~B22 & B23);
94 A[22] = B22 ^ (~B23 & B24);
95 A[23] = B23 ^ (~B24 & B20);
96 A[24] = B24 ^ (~B20 & B21);
97
98 A[0] ^= RC[i];
99 }
100 }
101
102 }
103
104 Keccak_1600::Keccak_1600(size_t output_bits) :
105 output_bits(output_bits),
106 bitrate(1600 - 2*output_bits),
107 S(25),
108 S_pos(0)
109 {
110 // We only support the parameters for the SHA-3 proposal
111
112 if(output_bits != 224 && output_bits != 256 &&
113 output_bits != 384 && output_bits != 512)
114 throw Invalid_Argument("Keccak_1600: Invalid output length " +
115 to_string(output_bits));
116 }
117
118 std::string Keccak_1600::name() const
119 {
120 return "Keccak-1600(" + to_string(output_bits) + ")";
121 }
122
123 HashFunction* Keccak_1600::clone() const
124 {
125 return new Keccak_1600(output_bits);
126 }
127
128 void Keccak_1600::clear()
129 {
130 zeroise(S);
131 S_pos = 0;
132 }
133
134 void Keccak_1600::add_data(const byte input[], size_t length)
135 {
136 if(length == 0)
137 return;
138
139 while(length)
140 {
141 size_t to_take = std::min(length, bitrate / 8 - S_pos);
142
143 length -= to_take;
144
145 while(to_take && S_pos % 8)
146 {
147 S[S_pos / 8] ^= static_cast<u64bit>(input[0]) << (8 * (S_pos % 8));
148
149 ++S_pos;
150 ++input;
151 --to_take;
152 }
153
154 while(to_take && to_take % 8 == 0)
155 {
156 S[S_pos / 8] ^= load_le<u64bit>(input, 0);
157 S_pos += 8;
158 input += 8;
159 to_take -= 8;
160 }
161
162 while(to_take)
163 {
164 S[S_pos / 8] ^= static_cast<u64bit>(input[0]) << (8 * (S_pos % 8));
165
166 ++S_pos;
167 ++input;
168 --to_take;
169 }
170
171 if(S_pos == bitrate / 8)
172 {
173 keccak_f_1600(&S[0]);
174 S_pos = 0;
175 }
176 }
177 }
178
179 void Keccak_1600::final_result(byte output[])
180 {
181 MemoryVector<byte> padding(bitrate / 8 - S_pos);
182
183 padding[0] = 0x01;
184 padding[padding.size()-1] |= 0x80;
185
186 add_data(padding, padding.size());
187
188 /*
189 * We never have to run the permutation again because we only support
190 * limited output lengths
191 */
192 for(size_t i = 0; i != output_bits/8; ++i)
193 output[i] = get_byte(7 - (i % 8), S[i/8]);
194
195 clear();
196 }
197
198 }
Botan::Keccak_1600::name
std::string name() const
Definition: keccak.cpp:118
Botan::Keccak_1600::clone
HashFunction * clone() const
Definition: keccak.cpp:123
Botan::rotate_left
T rotate_left(T input, size_t rot)
Definition: rotate.h:21
Botan::Invalid_Argument
std::invalid_argument Invalid_Argument
Definition: exceptn.h:20
Botan::get_byte
byte get_byte(size_t byte_num, T input)
Definition: get_byte.h:21
Botan::byte
unsigned char byte
Definition: types.h:22
Botan::u64bit
unsigned long long u64bit
Definition: types.h:49
Botan::Keccak_1600::clear
void clear()
Definition: keccak.cpp:128
Botan
Definition: algo_base.h:14
Botan::HashFunction
Definition: hash.h:20
Botan::CT::min
T min(T a, T b)
Definition: ct_utils.h:127
Botan::to_string
std::string to_string(u64bit n, size_t min_len)
Definition: parsing.cpp:42
Botan::zeroise
void zeroise(MemoryRegion< T > &vec)
Definition: secmem.h:428
Botan::Keccak_1600::Keccak_1600
Keccak_1600(size_t output_bits=512)
Definition: keccak.cpp:104
Botan::load_le< u64bit >
u64bit load_le< u64bit >(const byte in[], size_t off)
Definition: loadstor.h:218