Botan 2.1.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- File List
- File Members

sha3.cpp
Go to the documentation of this file.
1 /*
2 * SHA-3
3 * (C) 2010,2016 Jack Lloyd
4 *
5 * Botan is released under the Simplified BSD License (see license.txt)
6 */
7
8 #include <botan/sha3.h>
9 #include <botan/parsing.h>
10 #include <botan/exceptn.h>
11
12 namespace Botan {
13
14 //static
15 void SHA_3::permute(uint64_t A[25])
16 {
17 static const uint64_t RC[24] = {
18 0x0000000000000001, 0x0000000000008082, 0x800000000000808A,
19 0x8000000080008000, 0x000000000000808B, 0x0000000080000001,
20 0x8000000080008081, 0x8000000000008009, 0x000000000000008A,
21 0x0000000000000088, 0x0000000080008009, 0x000000008000000A,
22 0x000000008000808B, 0x800000000000008B, 0x8000000000008089,
23 0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
24 0x000000000000800A, 0x800000008000000A, 0x8000000080008081,
25 0x8000000000008080, 0x0000000080000001, 0x8000000080008008
26 };
27
28 for(size_t i = 0; i != 24; ++i)
29 {
30 const uint64_t C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
31 const uint64_t C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
32 const uint64_t C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
33 const uint64_t C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
34 const uint64_t C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
35
36 const uint64_t D0 = rotate_left(C0, 1) ^ C3;
37 const uint64_t D1 = rotate_left(C1, 1) ^ C4;
38 const uint64_t D2 = rotate_left(C2, 1) ^ C0;
39 const uint64_t D3 = rotate_left(C3, 1) ^ C1;
40 const uint64_t D4 = rotate_left(C4, 1) ^ C2;
41
42 const uint64_t B00 = A[ 0] ^ D1;
43 const uint64_t B10 = rotate_left(A[ 1] ^ D2, 1);
44 const uint64_t B20 = rotate_left(A[ 2] ^ D3, 62);
45 const uint64_t B05 = rotate_left(A[ 3] ^ D4, 28);
46 const uint64_t B15 = rotate_left(A[ 4] ^ D0, 27);
47 const uint64_t B16 = rotate_left(A[ 5] ^ D1, 36);
48 const uint64_t B01 = rotate_left(A[ 6] ^ D2, 44);
49 const uint64_t B11 = rotate_left(A[ 7] ^ D3, 6);
50 const uint64_t B21 = rotate_left(A[ 8] ^ D4, 55);
51 const uint64_t B06 = rotate_left(A[ 9] ^ D0, 20);
52 const uint64_t B07 = rotate_left(A[10] ^ D1, 3);
53 const uint64_t B17 = rotate_left(A[11] ^ D2, 10);
54 const uint64_t B02 = rotate_left(A[12] ^ D3, 43);
55 const uint64_t B12 = rotate_left(A[13] ^ D4, 25);
56 const uint64_t B22 = rotate_left(A[14] ^ D0, 39);
57 const uint64_t B23 = rotate_left(A[15] ^ D1, 41);
58 const uint64_t B08 = rotate_left(A[16] ^ D2, 45);
59 const uint64_t B18 = rotate_left(A[17] ^ D3, 15);
60 const uint64_t B03 = rotate_left(A[18] ^ D4, 21);
61 const uint64_t B13 = rotate_left(A[19] ^ D0, 8);
62 const uint64_t B14 = rotate_left(A[20] ^ D1, 18);
63 const uint64_t B24 = rotate_left(A[21] ^ D2, 2);
64 const uint64_t B09 = rotate_left(A[22] ^ D3, 61);
65 const uint64_t B19 = rotate_left(A[23] ^ D4, 56);
66 const uint64_t B04 = rotate_left(A[24] ^ D0, 14);
67
68 A[ 0] = B00 ^ (~B01 & B02);
69 A[ 1] = B01 ^ (~B02 & B03);
70 A[ 2] = B02 ^ (~B03 & B04);
71 A[ 3] = B03 ^ (~B04 & B00);
72 A[ 4] = B04 ^ (~B00 & B01);
73 A[ 5] = B05 ^ (~B06 & B07);
74 A[ 6] = B06 ^ (~B07 & B08);
75 A[ 7] = B07 ^ (~B08 & B09);
76 A[ 8] = B08 ^ (~B09 & B05);
77 A[ 9] = B09 ^ (~B05 & B06);
78 A[10] = B10 ^ (~B11 & B12);
79 A[11] = B11 ^ (~B12 & B13);
80 A[12] = B12 ^ (~B13 & B14);
81 A[13] = B13 ^ (~B14 & B10);
82 A[14] = B14 ^ (~B10 & B11);
83 A[15] = B15 ^ (~B16 & B17);
84 A[16] = B16 ^ (~B17 & B18);
85 A[17] = B17 ^ (~B18 & B19);
86 A[18] = B18 ^ (~B19 & B15);
87 A[19] = B19 ^ (~B15 & B16);
88 A[20] = B20 ^ (~B21 & B22);
89 A[21] = B21 ^ (~B22 & B23);
90 A[22] = B22 ^ (~B23 & B24);
91 A[23] = B23 ^ (~B24 & B20);
92 A[24] = B24 ^ (~B20 & B21);
93
94 A[0] ^= RC[i];
95 }
96 }
97
98 SHA_3::SHA_3(size_t output_bits) :
99 m_output_bits(output_bits),
100 m_bitrate(1600 - 2*output_bits),
101 m_S(25),
102 m_S_pos(0)
103 {
104 // We only support the parameters for SHA-3 in this constructor
105
106 if(output_bits != 224 && output_bits != 256 &&
107 output_bits != 384 && output_bits != 512)
108 throw Invalid_Argument("SHA_3: Invalid output length " +
109 std::to_string(output_bits));
110 }
111
112 std::string SHA_3::name() const
113 {
114 return "SHA-3(" + std::to_string(m_output_bits) + ")";
115 }
116
117 HashFunction* SHA_3::clone() const
118 {
119 return new SHA_3(m_output_bits);
120 }
121
122 void SHA_3::clear()
123 {
124 zeroise(m_S);
125 m_S_pos = 0;
126 }
127
128 //static
129 size_t SHA_3::absorb(size_t bitrate,
130 secure_vector<uint64_t>& S, size_t S_pos,
131 const uint8_t input[], size_t length)
132 {
133 while(length > 0)
134 {
135 size_t to_take = std::min(length, bitrate / 8 - S_pos);
136
137 length -= to_take;
138
139 while(to_take && S_pos % 8)
140 {
141 S[S_pos / 8] ^= static_cast<uint64_t>(input[0]) << (8 * (S_pos % 8));
142
143 ++S_pos;
144 ++input;
145 --to_take;
146 }
147
148 while(to_take && to_take % 8 == 0)
149 {
150 S[S_pos / 8] ^= load_le<uint64_t>(input, 0);
151 S_pos += 8;
152 input += 8;
153 to_take -= 8;
154 }
155
156 while(to_take)
157 {
158 S[S_pos / 8] ^= static_cast<uint64_t>(input[0]) << (8 * (S_pos % 8));
159
160 ++S_pos;
161 ++input;
162 --to_take;
163 }
164
165 if(S_pos == bitrate / 8)
166 {
167 SHA_3::permute(S.data());
168 S_pos = 0;
169 }
170 }
171
172 return S_pos;
173 }
174
175 //static
176 void SHA_3::expand(size_t bitrate,
177 secure_vector<uint64_t>& S,
178 uint8_t output[], size_t output_length)
179 {
180 BOTAN_ARG_CHECK(bitrate % 8 == 0);
181
182 size_t Si = 0;
183
184 for(size_t i = 0; i != output_length; ++i)
185 {
186 if(i > 0)
187 {
188 if(i % (bitrate / 8) == 0)
189 {
190 SHA_3::permute(S.data());
191 Si = 0;
192 }
193 else if(i % 8 == 0)
194 {
195 Si += 1;
196 }
197 }
198
199 output[i] = get_byte(7 - (i % 8), S[Si]);
200 }
201 }
202
203 void SHA_3::add_data(const uint8_t input[], size_t length)
204 {
205 m_S_pos = SHA_3::absorb(m_bitrate, m_S, m_S_pos, input, length);
206 }
207
208 void SHA_3::final_result(uint8_t output[])
209 {
210 std::vector<uint8_t> padding(m_bitrate / 8 - m_S_pos);
211
212 padding[0] = 0x06;
213 padding[padding.size()-1] |= 0x80;
214
215 add_data(padding.data(), padding.size());
216
217 /*
218 * We never have to run the permutation again because we only support
219 * limited output lengths
220 */
221 for(size_t i = 0; i != m_output_bits/8; ++i)
222 output[i] = get_byte(7 - (i % 8), m_S[i/8]);
223
224 clear();
225 }
226
227 }
Botan::SHA_3::name
std::string name() const override
Definition: sha3.cpp:112
Botan::Invalid_Argument
Definition: exceptn.h:34
Botan::SHA_3::expand
static void expand(size_t bitrate, secure_vector< uint64_t > &S, uint8_t output[], size_t output_length)
Definition: sha3.cpp:176
Botan::rotate_left
T rotate_left(T input, size_t rot)
Definition: rotate.h:21
Botan::ASN1::to_string
std::string to_string(const BER_Object &obj)
Definition: asn1_obj.cpp:47
Botan::SHA_3::absorb
static size_t absorb(size_t bitrate, secure_vector< uint64_t > &S, size_t S_pos, const uint8_t input[], size_t length)
Definition: sha3.cpp:129
Botan::SHA_3::clone
HashFunction * clone() const override
Definition: sha3.cpp:117
Botan::secure_vector
std::vector< T, secure_allocator< T >> secure_vector
Definition: secmem.h:121
Botan::SHA_3::output_length
size_t output_length() const override
Definition: sha3.h:31
Botan::load_le< uint64_t >
uint64_t load_le< uint64_t >(const uint8_t in[], size_t off)
Definition: loadstor.h:243
Botan
Definition: alg_id.cpp:13
Botan::SHA_3::permute
static void permute(uint64_t A[25])
Definition: sha3.cpp:15
Botan::SHA_3::clear
void clear() override
Definition: sha3.cpp:122
Botan::HashFunction
Definition: hash.h:19
Botan::CT::min
T min(T a, T b)
Definition: ct_utils.h:180
Botan::get_byte
uint8_t get_byte(size_t byte_num, T input)
Definition: loadstor.h:47
Botan::SHA_3::SHA_3
SHA_3(size_t output_bits)
Definition: sha3.cpp:98
BOTAN_ARG_CHECK
#define BOTAN_ARG_CHECK(expr)
Definition: exceptn.h:44
Botan::zeroise
void zeroise(std::vector< T, Alloc > &vec)
Definition: secmem.h:211