m_sha3.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436
  1. /*
  2. * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <string.h>
  11. #include <openssl/evp.h>
  12. #include <openssl/objects.h>
  13. #include "internal/evp_int.h"
  14. #include "evp_locl.h"
  15. size_t SHA3_absorb(uint64_t A[5][5], const unsigned char *inp, size_t len,
  16. size_t r);
  17. void SHA3_squeeze(uint64_t A[5][5], unsigned char *out, size_t len, size_t r);
  18. #define KECCAK1600_WIDTH 1600
  19. typedef struct {
  20. uint64_t A[5][5];
  21. size_t block_size; /* cached ctx->digest->block_size */
  22. size_t md_size; /* output length, variable in XOF */
  23. size_t num; /* used bytes in below buffer */
  24. unsigned char buf[KECCAK1600_WIDTH / 8 - 32];
  25. unsigned char pad;
  26. } KECCAK1600_CTX;
  27. static int init(EVP_MD_CTX *evp_ctx, unsigned char pad)
  28. {
  29. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  30. size_t bsz = evp_ctx->digest->block_size;
  31. if (bsz <= sizeof(ctx->buf)) {
  32. memset(ctx->A, 0, sizeof(ctx->A));
  33. ctx->num = 0;
  34. ctx->block_size = bsz;
  35. ctx->md_size = evp_ctx->digest->md_size;
  36. ctx->pad = pad;
  37. return 1;
  38. }
  39. return 0;
  40. }
  41. static int sha3_init(EVP_MD_CTX *evp_ctx)
  42. {
  43. return init(evp_ctx, '\x06');
  44. }
  45. static int shake_init(EVP_MD_CTX *evp_ctx)
  46. {
  47. return init(evp_ctx, '\x1f');
  48. }
  49. static int kmac_init(EVP_MD_CTX *evp_ctx)
  50. {
  51. return init(evp_ctx, '\x04');
  52. }
  53. static int sha3_update(EVP_MD_CTX *evp_ctx, const void *_inp, size_t len)
  54. {
  55. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  56. const unsigned char *inp = _inp;
  57. size_t bsz = ctx->block_size;
  58. size_t num, rem;
  59. if (len == 0)
  60. return 1;
  61. if ((num = ctx->num) != 0) { /* process intermediate buffer? */
  62. rem = bsz - num;
  63. if (len < rem) {
  64. memcpy(ctx->buf + num, inp, len);
  65. ctx->num += len;
  66. return 1;
  67. }
  68. /*
  69. * We have enough data to fill or overflow the intermediate
  70. * buffer. So we append |rem| bytes and process the block,
  71. * leaving the rest for later processing...
  72. */
  73. memcpy(ctx->buf + num, inp, rem);
  74. inp += rem, len -= rem;
  75. (void)SHA3_absorb(ctx->A, ctx->buf, bsz, bsz);
  76. ctx->num = 0;
  77. /* ctx->buf is processed, ctx->num is guaranteed to be zero */
  78. }
  79. if (len >= bsz)
  80. rem = SHA3_absorb(ctx->A, inp, len, bsz);
  81. else
  82. rem = len;
  83. if (rem) {
  84. memcpy(ctx->buf, inp + len - rem, rem);
  85. ctx->num = rem;
  86. }
  87. return 1;
  88. }
  89. static int sha3_final(EVP_MD_CTX *evp_ctx, unsigned char *md)
  90. {
  91. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  92. size_t bsz = ctx->block_size;
  93. size_t num = ctx->num;
  94. /*
  95. * Pad the data with 10*1. Note that |num| can be |bsz - 1|
  96. * in which case both byte operations below are performed on
  97. * same byte...
  98. */
  99. memset(ctx->buf + num, 0, bsz - num);
  100. ctx->buf[num] = ctx->pad;
  101. ctx->buf[bsz - 1] |= 0x80;
  102. (void)SHA3_absorb(ctx->A, ctx->buf, bsz, bsz);
  103. SHA3_squeeze(ctx->A, md, ctx->md_size, bsz);
  104. return 1;
  105. }
  106. static int shake_ctrl(EVP_MD_CTX *evp_ctx, int cmd, int p1, void *p2)
  107. {
  108. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  109. switch (cmd) {
  110. case EVP_MD_CTRL_XOF_LEN:
  111. ctx->md_size = p1;
  112. return 1;
  113. default:
  114. return 0;
  115. }
  116. }
  117. #if defined(OPENSSL_CPUID_OBJ) && defined(__s390__) && defined(KECCAK1600_ASM)
  118. /*
  119. * IBM S390X support
  120. */
  121. # include "s390x_arch.h"
  122. # define S390X_SHA3_FC(ctx) ((ctx)->pad)
  123. # define S390X_sha3_224_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  124. S390X_CAPBIT(S390X_SHA3_224)) && \
  125. (OPENSSL_s390xcap_P.klmd[0] & \
  126. S390X_CAPBIT(S390X_SHA3_224)))
  127. # define S390X_sha3_256_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  128. S390X_CAPBIT(S390X_SHA3_256)) && \
  129. (OPENSSL_s390xcap_P.klmd[0] & \
  130. S390X_CAPBIT(S390X_SHA3_256)))
  131. # define S390X_sha3_384_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  132. S390X_CAPBIT(S390X_SHA3_384)) && \
  133. (OPENSSL_s390xcap_P.klmd[0] & \
  134. S390X_CAPBIT(S390X_SHA3_384)))
  135. # define S390X_sha3_512_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  136. S390X_CAPBIT(S390X_SHA3_512)) && \
  137. (OPENSSL_s390xcap_P.klmd[0] & \
  138. S390X_CAPBIT(S390X_SHA3_512)))
  139. # define S390X_shake128_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  140. S390X_CAPBIT(S390X_SHAKE_128)) && \
  141. (OPENSSL_s390xcap_P.klmd[0] & \
  142. S390X_CAPBIT(S390X_SHAKE_128)))
  143. # define S390X_shake256_CAPABLE ((OPENSSL_s390xcap_P.kimd[0] & \
  144. S390X_CAPBIT(S390X_SHAKE_256)) && \
  145. (OPENSSL_s390xcap_P.klmd[0] & \
  146. S390X_CAPBIT(S390X_SHAKE_256)))
  147. /* Convert md-size to block-size. */
  148. # define S390X_KECCAK1600_BSZ(n) ((KECCAK1600_WIDTH - ((n) << 1)) >> 3)
  149. static int s390x_sha3_init(EVP_MD_CTX *evp_ctx)
  150. {
  151. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  152. const size_t bsz = evp_ctx->digest->block_size;
  153. /*-
  154. * KECCAK1600_CTX structure's pad field is used to store the KIMD/KLMD
  155. * function code.
  156. */
  157. switch (bsz) {
  158. case S390X_KECCAK1600_BSZ(224):
  159. ctx->pad = S390X_SHA3_224;
  160. break;
  161. case S390X_KECCAK1600_BSZ(256):
  162. ctx->pad = S390X_SHA3_256;
  163. break;
  164. case S390X_KECCAK1600_BSZ(384):
  165. ctx->pad = S390X_SHA3_384;
  166. break;
  167. case S390X_KECCAK1600_BSZ(512):
  168. ctx->pad = S390X_SHA3_512;
  169. break;
  170. default:
  171. return 0;
  172. }
  173. memset(ctx->A, 0, sizeof(ctx->A));
  174. ctx->num = 0;
  175. ctx->block_size = bsz;
  176. ctx->md_size = evp_ctx->digest->md_size;
  177. return 1;
  178. }
  179. static int s390x_shake_init(EVP_MD_CTX *evp_ctx)
  180. {
  181. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  182. const size_t bsz = evp_ctx->digest->block_size;
  183. /*-
  184. * KECCAK1600_CTX structure's pad field is used to store the KIMD/KLMD
  185. * function code.
  186. */
  187. switch (bsz) {
  188. case S390X_KECCAK1600_BSZ(128):
  189. ctx->pad = S390X_SHAKE_128;
  190. break;
  191. case S390X_KECCAK1600_BSZ(256):
  192. ctx->pad = S390X_SHAKE_256;
  193. break;
  194. default:
  195. return 0;
  196. }
  197. memset(ctx->A, 0, sizeof(ctx->A));
  198. ctx->num = 0;
  199. ctx->block_size = bsz;
  200. ctx->md_size = evp_ctx->digest->md_size;
  201. return 1;
  202. }
  203. static int s390x_sha3_update(EVP_MD_CTX *evp_ctx, const void *_inp, size_t len)
  204. {
  205. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  206. const unsigned char *inp = _inp;
  207. const size_t bsz = ctx->block_size;
  208. size_t num, rem;
  209. if (len == 0)
  210. return 1;
  211. if ((num = ctx->num) != 0) {
  212. rem = bsz - num;
  213. if (len < rem) {
  214. memcpy(ctx->buf + num, inp, len);
  215. ctx->num += len;
  216. return 1;
  217. }
  218. memcpy(ctx->buf + num, inp, rem);
  219. inp += rem;
  220. len -= rem;
  221. s390x_kimd(ctx->buf, bsz, ctx->pad, ctx->A);
  222. ctx->num = 0;
  223. }
  224. rem = len % bsz;
  225. s390x_kimd(inp, len - rem, ctx->pad, ctx->A);
  226. if (rem) {
  227. memcpy(ctx->buf, inp + len - rem, rem);
  228. ctx->num = rem;
  229. }
  230. return 1;
  231. }
  232. static int s390x_sha3_final(EVP_MD_CTX *evp_ctx, unsigned char *md)
  233. {
  234. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  235. s390x_klmd(ctx->buf, ctx->num, NULL, 0, ctx->pad, ctx->A);
  236. memcpy(md, ctx->A, ctx->md_size);
  237. return 1;
  238. }
  239. static int s390x_shake_final(EVP_MD_CTX *evp_ctx, unsigned char *md)
  240. {
  241. KECCAK1600_CTX *ctx = evp_ctx->md_data;
  242. s390x_klmd(ctx->buf, ctx->num, md, ctx->md_size, ctx->pad, ctx->A);
  243. return 1;
  244. }
  245. # define EVP_MD_SHA3(bitlen) \
  246. const EVP_MD *EVP_sha3_##bitlen(void) \
  247. { \
  248. static const EVP_MD s390x_sha3_##bitlen##_md = { \
  249. NID_sha3_##bitlen, \
  250. NID_RSA_SHA3_##bitlen, \
  251. bitlen / 8, \
  252. EVP_MD_FLAG_DIGALGID_ABSENT, \
  253. s390x_sha3_init, \
  254. s390x_sha3_update, \
  255. s390x_sha3_final, \
  256. NULL, \
  257. NULL, \
  258. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  259. sizeof(KECCAK1600_CTX), \
  260. }; \
  261. static const EVP_MD sha3_##bitlen##_md = { \
  262. NID_sha3_##bitlen, \
  263. NID_RSA_SHA3_##bitlen, \
  264. bitlen / 8, \
  265. EVP_MD_FLAG_DIGALGID_ABSENT, \
  266. sha3_init, \
  267. sha3_update, \
  268. sha3_final, \
  269. NULL, \
  270. NULL, \
  271. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  272. sizeof(KECCAK1600_CTX), \
  273. }; \
  274. return S390X_sha3_##bitlen##_CAPABLE ? \
  275. &s390x_sha3_##bitlen##_md : \
  276. &sha3_##bitlen##_md; \
  277. }
  278. # define EVP_MD_SHAKE(bitlen) \
  279. const EVP_MD *EVP_shake##bitlen(void) \
  280. { \
  281. static const EVP_MD s390x_shake##bitlen##_md = { \
  282. NID_shake##bitlen, \
  283. 0, \
  284. bitlen / 8, \
  285. EVP_MD_FLAG_XOF, \
  286. s390x_shake_init, \
  287. s390x_sha3_update, \
  288. s390x_shake_final, \
  289. NULL, \
  290. NULL, \
  291. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  292. sizeof(KECCAK1600_CTX), \
  293. shake_ctrl \
  294. }; \
  295. static const EVP_MD shake##bitlen##_md = { \
  296. NID_shake##bitlen, \
  297. 0, \
  298. bitlen / 8, \
  299. EVP_MD_FLAG_XOF, \
  300. shake_init, \
  301. sha3_update, \
  302. sha3_final, \
  303. NULL, \
  304. NULL, \
  305. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  306. sizeof(KECCAK1600_CTX), \
  307. shake_ctrl \
  308. }; \
  309. return S390X_shake##bitlen##_CAPABLE ? \
  310. &s390x_shake##bitlen##_md : \
  311. &shake##bitlen##_md; \
  312. }
  313. #else
  314. # define EVP_MD_SHA3(bitlen) \
  315. const EVP_MD *EVP_sha3_##bitlen(void) \
  316. { \
  317. static const EVP_MD sha3_##bitlen##_md = { \
  318. NID_sha3_##bitlen, \
  319. NID_RSA_SHA3_##bitlen, \
  320. bitlen / 8, \
  321. EVP_MD_FLAG_DIGALGID_ABSENT, \
  322. sha3_init, \
  323. sha3_update, \
  324. sha3_final, \
  325. NULL, \
  326. NULL, \
  327. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  328. sizeof(KECCAK1600_CTX), \
  329. }; \
  330. return &sha3_##bitlen##_md; \
  331. }
  332. # define EVP_MD_SHAKE(bitlen) \
  333. const EVP_MD *EVP_shake##bitlen(void) \
  334. { \
  335. static const EVP_MD shake##bitlen##_md = { \
  336. NID_shake##bitlen, \
  337. 0, \
  338. bitlen / 8, \
  339. EVP_MD_FLAG_XOF, \
  340. shake_init, \
  341. sha3_update, \
  342. sha3_final, \
  343. NULL, \
  344. NULL, \
  345. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  346. sizeof(KECCAK1600_CTX), \
  347. shake_ctrl \
  348. }; \
  349. return &shake##bitlen##_md; \
  350. }
  351. #endif
  352. EVP_MD_SHA3(224)
  353. EVP_MD_SHA3(256)
  354. EVP_MD_SHA3(384)
  355. EVP_MD_SHA3(512)
  356. EVP_MD_SHAKE(128)
  357. EVP_MD_SHAKE(256)
  358. # define EVP_MD_KECCAK_KMAC(bitlen) \
  359. const EVP_MD *evp_keccak_kmac##bitlen(void) \
  360. { \
  361. static const EVP_MD kmac_##bitlen##_md = { \
  362. -1, \
  363. 0, \
  364. 2 * bitlen / 8, \
  365. EVP_MD_FLAG_XOF, \
  366. kmac_init, \
  367. sha3_update, \
  368. sha3_final, \
  369. NULL, \
  370. NULL, \
  371. (KECCAK1600_WIDTH - bitlen * 2) / 8, \
  372. sizeof(KECCAK1600_CTX), \
  373. shake_ctrl \
  374. }; \
  375. return &kmac_##bitlen##_md; \
  376. }
  377. EVP_MD_KECCAK_KMAC(128)
  378. EVP_MD_KECCAK_KMAC(256)