diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am index b3cd6637..78c607f8 100644 --- a/src/libsodium/Makefile.am +++ b/src/libsodium/Makefile.am @@ -27,6 +27,9 @@ libsodium_la_SOURCES = \ crypto_core/hchacha20/core_hchacha20.c \ crypto_core/hsalsa20/ref2/core_hsalsa20_ref2.c \ crypto_core/hsalsa20/core_hsalsa20.c \ + crypto_core/keccak1600/keccak1600.c \ + crypto_core/keccak1600/ref/keccak1600_ref.c \ + crypto_core/keccak1600/ref/keccak1600_ref.h \ crypto_core/salsa/ref/core_salsa_ref.c \ crypto_core/softaes/softaes.c \ crypto_generichash/crypto_generichash.c \ @@ -96,12 +99,25 @@ libsodium_la_SOURCES = \ crypto_stream/salsa20/stream_salsa20.h \ crypto_stream/xsalsa20/stream_xsalsa20.c \ crypto_verify/verify.c \ + crypto_xof/shake128/xof_shake128.c \ + crypto_xof/shake128/ref/shake128_ref.c \ + crypto_xof/shake128/ref/shake128_ref.h \ + crypto_xof/shake256/xof_shake256.c \ + crypto_xof/shake256/ref/shake256_ref.c \ + crypto_xof/shake256/ref/shake256_ref.h \ + crypto_xof/turboshake128/xof_turboshake128.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.h \ + crypto_xof/turboshake256/xof_turboshake256.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.h \ include/sodium/private/asm_cet.h \ include/sodium/private/chacha20_ietf_ext.h \ include/sodium/private/common.h \ include/sodium/private/ed25519_ref10.h \ include/sodium/private/implementations.h \ include/sodium/private/mutex.h \ + include/sodium/private/quirks.h \ include/sodium/private/sse2_64_32.h \ include/sodium/private/softaes.h \ randombytes/randombytes.c \ diff --git a/src/libsodium/Makefile.in b/src/libsodium/Makefile.in index e6fdbba9..232b70ff 100644 --- a/src/libsodium/Makefile.in +++ b/src/libsodium/Makefile.in @@ -292,6 +292,9 @@ am__libsodium_la_SOURCES_DIST = \ crypto_core/hchacha20/core_hchacha20.c \ crypto_core/hsalsa20/ref2/core_hsalsa20_ref2.c \ crypto_core/hsalsa20/core_hsalsa20.c \ + crypto_core/keccak1600/keccak1600.c \ + crypto_core/keccak1600/ref/keccak1600_ref.c \ + crypto_core/keccak1600/ref/keccak1600_ref.h \ crypto_core/salsa/ref/core_salsa_ref.c \ crypto_core/softaes/softaes.c \ crypto_generichash/crypto_generichash.c \ @@ -355,12 +358,24 @@ am__libsodium_la_SOURCES_DIST = \ crypto_stream/salsa20/stream_salsa20.c \ crypto_stream/salsa20/stream_salsa20.h \ crypto_stream/xsalsa20/stream_xsalsa20.c \ - crypto_verify/verify.c include/sodium/private/asm_cet.h \ + crypto_verify/verify.c crypto_xof/shake128/xof_shake128.c \ + crypto_xof/shake128/ref/shake128_ref.c \ + crypto_xof/shake128/ref/shake128_ref.h \ + crypto_xof/shake256/xof_shake256.c \ + crypto_xof/shake256/ref/shake256_ref.c \ + crypto_xof/shake256/ref/shake256_ref.h \ + crypto_xof/turboshake128/xof_turboshake128.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.h \ + crypto_xof/turboshake256/xof_turboshake256.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.h \ + include/sodium/private/asm_cet.h \ include/sodium/private/chacha20_ietf_ext.h \ include/sodium/private/common.h \ include/sodium/private/ed25519_ref10.h \ include/sodium/private/implementations.h \ - include/sodium/private/mutex.h \ + include/sodium/private/mutex.h include/sodium/private/quirks.h \ include/sodium/private/sse2_64_32.h \ include/sodium/private/softaes.h randombytes/randombytes.c \ sodium/codecs.c sodium/core.c sodium/runtime.c sodium/utils.c \ @@ -462,6 +477,8 @@ am_libsodium_la_OBJECTS = \ crypto_core/hchacha20/libsodium_la-core_hchacha20.lo \ crypto_core/hsalsa20/ref2/libsodium_la-core_hsalsa20_ref2.lo \ crypto_core/hsalsa20/libsodium_la-core_hsalsa20.lo \ + crypto_core/keccak1600/libsodium_la-keccak1600.lo \ + crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo \ crypto_core/salsa/ref/libsodium_la-core_salsa_ref.lo \ crypto_core/softaes/libsodium_la-softaes.lo \ crypto_generichash/libsodium_la-crypto_generichash.lo \ @@ -511,6 +528,14 @@ am_libsodium_la_OBJECTS = \ crypto_stream/salsa20/libsodium_la-stream_salsa20.lo \ crypto_stream/xsalsa20/libsodium_la-stream_xsalsa20.lo \ crypto_verify/libsodium_la-verify.lo \ + crypto_xof/shake128/libsodium_la-xof_shake128.lo \ + crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo \ + crypto_xof/shake256/libsodium_la-xof_shake256.lo \ + crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo \ + crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo \ + crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo \ + crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo \ + crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo \ randombytes/libsodium_la-randombytes.lo \ sodium/libsodium_la-codecs.lo sodium/libsodium_la-core.lo \ sodium/libsodium_la-runtime.lo sodium/libsodium_la-utils.lo \ @@ -598,6 +623,8 @@ am__depfiles_remade = crypto_aead/aegis128l/$(DEPDIR)/libaesni_la-aegis128l_aesn crypto_core/hchacha20/$(DEPDIR)/libsodium_la-core_hchacha20.Plo \ crypto_core/hsalsa20/$(DEPDIR)/libsodium_la-core_hsalsa20.Plo \ crypto_core/hsalsa20/ref2/$(DEPDIR)/libsodium_la-core_hsalsa20_ref2.Plo \ + crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Plo \ + crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Plo \ crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Plo \ crypto_core/softaes/$(DEPDIR)/libsodium_la-softaes.Plo \ crypto_generichash/$(DEPDIR)/libsodium_la-crypto_generichash.Plo \ @@ -682,6 +709,14 @@ am__depfiles_remade = crypto_aead/aegis128l/$(DEPDIR)/libaesni_la-aegis128l_aesn crypto_stream/xchacha20/$(DEPDIR)/libsodium_la-stream_xchacha20.Plo \ crypto_stream/xsalsa20/$(DEPDIR)/libsodium_la-stream_xsalsa20.Plo \ crypto_verify/$(DEPDIR)/libsodium_la-verify.Plo \ + crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Plo \ + crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Plo \ + crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Plo \ + crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Plo \ + crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Plo \ + crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Plo \ + crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Plo \ + crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Plo \ randombytes/$(DEPDIR)/libsodium_la-randombytes.Plo \ randombytes/internal/$(DEPDIR)/librdrand_la-randombytes_internal_random.Plo \ randombytes/sysrandom/$(DEPDIR)/libsodium_la-randombytes_sysrandom.Plo \ @@ -996,6 +1031,9 @@ libsodium_la_SOURCES = crypto_aead/aegis128l/aead_aegis128l.c \ crypto_core/hchacha20/core_hchacha20.c \ crypto_core/hsalsa20/ref2/core_hsalsa20_ref2.c \ crypto_core/hsalsa20/core_hsalsa20.c \ + crypto_core/keccak1600/keccak1600.c \ + crypto_core/keccak1600/ref/keccak1600_ref.c \ + crypto_core/keccak1600/ref/keccak1600_ref.h \ crypto_core/salsa/ref/core_salsa_ref.c \ crypto_core/softaes/softaes.c \ crypto_generichash/crypto_generichash.c \ @@ -1059,12 +1097,24 @@ libsodium_la_SOURCES = crypto_aead/aegis128l/aead_aegis128l.c \ crypto_stream/salsa20/stream_salsa20.c \ crypto_stream/salsa20/stream_salsa20.h \ crypto_stream/xsalsa20/stream_xsalsa20.c \ - crypto_verify/verify.c include/sodium/private/asm_cet.h \ + crypto_verify/verify.c crypto_xof/shake128/xof_shake128.c \ + crypto_xof/shake128/ref/shake128_ref.c \ + crypto_xof/shake128/ref/shake128_ref.h \ + crypto_xof/shake256/xof_shake256.c \ + crypto_xof/shake256/ref/shake256_ref.c \ + crypto_xof/shake256/ref/shake256_ref.h \ + crypto_xof/turboshake128/xof_turboshake128.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.c \ + crypto_xof/turboshake128/ref/turboshake128_ref.h \ + crypto_xof/turboshake256/xof_turboshake256.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.c \ + crypto_xof/turboshake256/ref/turboshake256_ref.h \ + include/sodium/private/asm_cet.h \ include/sodium/private/chacha20_ietf_ext.h \ include/sodium/private/common.h \ include/sodium/private/ed25519_ref10.h \ include/sodium/private/implementations.h \ - include/sodium/private/mutex.h \ + include/sodium/private/mutex.h include/sodium/private/quirks.h \ include/sodium/private/sse2_64_32.h \ include/sodium/private/softaes.h randombytes/randombytes.c \ sodium/codecs.c sodium/core.c sodium/runtime.c sodium/utils.c \ @@ -1497,6 +1547,24 @@ crypto_core/hsalsa20/$(DEPDIR)/$(am__dirstamp): crypto_core/hsalsa20/libsodium_la-core_hsalsa20.lo: \ crypto_core/hsalsa20/$(am__dirstamp) \ crypto_core/hsalsa20/$(DEPDIR)/$(am__dirstamp) +crypto_core/keccak1600/$(am__dirstamp): + @$(MKDIR_P) crypto_core/keccak1600 + @: >>crypto_core/keccak1600/$(am__dirstamp) +crypto_core/keccak1600/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_core/keccak1600/$(DEPDIR) + @: >>crypto_core/keccak1600/$(DEPDIR)/$(am__dirstamp) +crypto_core/keccak1600/libsodium_la-keccak1600.lo: \ + crypto_core/keccak1600/$(am__dirstamp) \ + crypto_core/keccak1600/$(DEPDIR)/$(am__dirstamp) +crypto_core/keccak1600/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_core/keccak1600/ref + @: >>crypto_core/keccak1600/ref/$(am__dirstamp) +crypto_core/keccak1600/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_core/keccak1600/ref/$(DEPDIR) + @: >>crypto_core/keccak1600/ref/$(DEPDIR)/$(am__dirstamp) +crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo: \ + crypto_core/keccak1600/ref/$(am__dirstamp) \ + crypto_core/keccak1600/ref/$(DEPDIR)/$(am__dirstamp) crypto_core/salsa/ref/$(am__dirstamp): @$(MKDIR_P) crypto_core/salsa/ref @: >>crypto_core/salsa/ref/$(am__dirstamp) @@ -1849,6 +1917,78 @@ crypto_verify/$(DEPDIR)/$(am__dirstamp): @: >>crypto_verify/$(DEPDIR)/$(am__dirstamp) crypto_verify/libsodium_la-verify.lo: crypto_verify/$(am__dirstamp) \ crypto_verify/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake128/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake128 + @: >>crypto_xof/shake128/$(am__dirstamp) +crypto_xof/shake128/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake128/$(DEPDIR) + @: >>crypto_xof/shake128/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake128/libsodium_la-xof_shake128.lo: \ + crypto_xof/shake128/$(am__dirstamp) \ + crypto_xof/shake128/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake128/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake128/ref + @: >>crypto_xof/shake128/ref/$(am__dirstamp) +crypto_xof/shake128/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake128/ref/$(DEPDIR) + @: >>crypto_xof/shake128/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo: \ + crypto_xof/shake128/ref/$(am__dirstamp) \ + crypto_xof/shake128/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake256/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake256 + @: >>crypto_xof/shake256/$(am__dirstamp) +crypto_xof/shake256/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake256/$(DEPDIR) + @: >>crypto_xof/shake256/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake256/libsodium_la-xof_shake256.lo: \ + crypto_xof/shake256/$(am__dirstamp) \ + crypto_xof/shake256/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake256/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake256/ref + @: >>crypto_xof/shake256/ref/$(am__dirstamp) +crypto_xof/shake256/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/shake256/ref/$(DEPDIR) + @: >>crypto_xof/shake256/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo: \ + crypto_xof/shake256/ref/$(am__dirstamp) \ + crypto_xof/shake256/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake128/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake128 + @: >>crypto_xof/turboshake128/$(am__dirstamp) +crypto_xof/turboshake128/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake128/$(DEPDIR) + @: >>crypto_xof/turboshake128/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo: \ + crypto_xof/turboshake128/$(am__dirstamp) \ + crypto_xof/turboshake128/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake128/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake128/ref + @: >>crypto_xof/turboshake128/ref/$(am__dirstamp) +crypto_xof/turboshake128/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake128/ref/$(DEPDIR) + @: >>crypto_xof/turboshake128/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo: \ + crypto_xof/turboshake128/ref/$(am__dirstamp) \ + crypto_xof/turboshake128/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake256/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake256 + @: >>crypto_xof/turboshake256/$(am__dirstamp) +crypto_xof/turboshake256/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake256/$(DEPDIR) + @: >>crypto_xof/turboshake256/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo: \ + crypto_xof/turboshake256/$(am__dirstamp) \ + crypto_xof/turboshake256/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake256/ref/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake256/ref + @: >>crypto_xof/turboshake256/ref/$(am__dirstamp) +crypto_xof/turboshake256/ref/$(DEPDIR)/$(am__dirstamp): + @$(MKDIR_P) crypto_xof/turboshake256/ref/$(DEPDIR) + @: >>crypto_xof/turboshake256/ref/$(DEPDIR)/$(am__dirstamp) +crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo: \ + crypto_xof/turboshake256/ref/$(am__dirstamp) \ + crypto_xof/turboshake256/ref/$(DEPDIR)/$(am__dirstamp) randombytes/$(am__dirstamp): @$(MKDIR_P) randombytes @: >>randombytes/$(am__dirstamp) @@ -2139,6 +2279,10 @@ mostlyclean-compile: -rm -f crypto_core/hsalsa20/*.lo -rm -f crypto_core/hsalsa20/ref2/*.$(OBJEXT) -rm -f crypto_core/hsalsa20/ref2/*.lo + -rm -f crypto_core/keccak1600/*.$(OBJEXT) + -rm -f crypto_core/keccak1600/*.lo + -rm -f crypto_core/keccak1600/ref/*.$(OBJEXT) + -rm -f crypto_core/keccak1600/ref/*.lo -rm -f crypto_core/salsa/ref/*.$(OBJEXT) -rm -f crypto_core/salsa/ref/*.lo -rm -f crypto_core/softaes/*.$(OBJEXT) @@ -2247,6 +2391,22 @@ mostlyclean-compile: -rm -f crypto_stream/xsalsa20/*.lo -rm -f crypto_verify/*.$(OBJEXT) -rm -f crypto_verify/*.lo + -rm -f crypto_xof/shake128/*.$(OBJEXT) + -rm -f crypto_xof/shake128/*.lo + -rm -f crypto_xof/shake128/ref/*.$(OBJEXT) + -rm -f crypto_xof/shake128/ref/*.lo + -rm -f crypto_xof/shake256/*.$(OBJEXT) + -rm -f crypto_xof/shake256/*.lo + -rm -f crypto_xof/shake256/ref/*.$(OBJEXT) + -rm -f crypto_xof/shake256/ref/*.lo + -rm -f crypto_xof/turboshake128/*.$(OBJEXT) + -rm -f crypto_xof/turboshake128/*.lo + -rm -f crypto_xof/turboshake128/ref/*.$(OBJEXT) + -rm -f crypto_xof/turboshake128/ref/*.lo + -rm -f crypto_xof/turboshake256/*.$(OBJEXT) + -rm -f crypto_xof/turboshake256/*.lo + -rm -f crypto_xof/turboshake256/ref/*.$(OBJEXT) + -rm -f crypto_xof/turboshake256/ref/*.lo -rm -f randombytes/*.$(OBJEXT) -rm -f randombytes/*.lo -rm -f randombytes/internal/*.$(OBJEXT) @@ -2288,6 +2448,8 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@crypto_core/hchacha20/$(DEPDIR)/libsodium_la-core_hchacha20.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_core/hsalsa20/$(DEPDIR)/libsodium_la-core_hsalsa20.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_core/hsalsa20/ref2/$(DEPDIR)/libsodium_la-core_hsalsa20_ref2.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_core/softaes/$(DEPDIR)/libsodium_la-softaes.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_generichash/$(DEPDIR)/libsodium_la-crypto_generichash.Plo@am__quote@ # am--include-marker @@ -2372,6 +2534,14 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@crypto_stream/xchacha20/$(DEPDIR)/libsodium_la-stream_xchacha20.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_stream/xsalsa20/$(DEPDIR)/libsodium_la-stream_xsalsa20.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@crypto_verify/$(DEPDIR)/libsodium_la-verify.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Plo@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@randombytes/$(DEPDIR)/libsodium_la-randombytes.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@randombytes/internal/$(DEPDIR)/librdrand_la-randombytes_internal_random.Plo@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@randombytes/sysrandom/$(DEPDIR)/libsodium_la-randombytes_sysrandom.Plo@am__quote@ # am--include-marker @@ -2666,6 +2836,20 @@ crypto_core/hsalsa20/libsodium_la-core_hsalsa20.lo: crypto_core/hsalsa20/core_hs @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_core/hsalsa20/libsodium_la-core_hsalsa20.lo `test -f 'crypto_core/hsalsa20/core_hsalsa20.c' || echo '$(srcdir)/'`crypto_core/hsalsa20/core_hsalsa20.c +crypto_core/keccak1600/libsodium_la-keccak1600.lo: crypto_core/keccak1600/keccak1600.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_core/keccak1600/libsodium_la-keccak1600.lo -MD -MP -MF crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Tpo -c -o crypto_core/keccak1600/libsodium_la-keccak1600.lo `test -f 'crypto_core/keccak1600/keccak1600.c' || echo '$(srcdir)/'`crypto_core/keccak1600/keccak1600.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Tpo crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_core/keccak1600/keccak1600.c' object='crypto_core/keccak1600/libsodium_la-keccak1600.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_core/keccak1600/libsodium_la-keccak1600.lo `test -f 'crypto_core/keccak1600/keccak1600.c' || echo '$(srcdir)/'`crypto_core/keccak1600/keccak1600.c + +crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo: crypto_core/keccak1600/ref/keccak1600_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo -MD -MP -MF crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Tpo -c -o crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo `test -f 'crypto_core/keccak1600/ref/keccak1600_ref.c' || echo '$(srcdir)/'`crypto_core/keccak1600/ref/keccak1600_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Tpo crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_core/keccak1600/ref/keccak1600_ref.c' object='crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_core/keccak1600/ref/libsodium_la-keccak1600_ref.lo `test -f 'crypto_core/keccak1600/ref/keccak1600_ref.c' || echo '$(srcdir)/'`crypto_core/keccak1600/ref/keccak1600_ref.c + crypto_core/salsa/ref/libsodium_la-core_salsa_ref.lo: crypto_core/salsa/ref/core_salsa_ref.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_core/salsa/ref/libsodium_la-core_salsa_ref.lo -MD -MP -MF crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Tpo -c -o crypto_core/salsa/ref/libsodium_la-core_salsa_ref.lo `test -f 'crypto_core/salsa/ref/core_salsa_ref.c' || echo '$(srcdir)/'`crypto_core/salsa/ref/core_salsa_ref.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Tpo crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Plo @@ -3009,6 +3193,62 @@ crypto_verify/libsodium_la-verify.lo: crypto_verify/verify.c @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_verify/libsodium_la-verify.lo `test -f 'crypto_verify/verify.c' || echo '$(srcdir)/'`crypto_verify/verify.c +crypto_xof/shake128/libsodium_la-xof_shake128.lo: crypto_xof/shake128/xof_shake128.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/shake128/libsodium_la-xof_shake128.lo -MD -MP -MF crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Tpo -c -o crypto_xof/shake128/libsodium_la-xof_shake128.lo `test -f 'crypto_xof/shake128/xof_shake128.c' || echo '$(srcdir)/'`crypto_xof/shake128/xof_shake128.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Tpo crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/shake128/xof_shake128.c' object='crypto_xof/shake128/libsodium_la-xof_shake128.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/shake128/libsodium_la-xof_shake128.lo `test -f 'crypto_xof/shake128/xof_shake128.c' || echo '$(srcdir)/'`crypto_xof/shake128/xof_shake128.c + +crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo: crypto_xof/shake128/ref/shake128_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo -MD -MP -MF crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Tpo -c -o crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo `test -f 'crypto_xof/shake128/ref/shake128_ref.c' || echo '$(srcdir)/'`crypto_xof/shake128/ref/shake128_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Tpo crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/shake128/ref/shake128_ref.c' object='crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/shake128/ref/libsodium_la-shake128_ref.lo `test -f 'crypto_xof/shake128/ref/shake128_ref.c' || echo '$(srcdir)/'`crypto_xof/shake128/ref/shake128_ref.c + +crypto_xof/shake256/libsodium_la-xof_shake256.lo: crypto_xof/shake256/xof_shake256.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/shake256/libsodium_la-xof_shake256.lo -MD -MP -MF crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Tpo -c -o crypto_xof/shake256/libsodium_la-xof_shake256.lo `test -f 'crypto_xof/shake256/xof_shake256.c' || echo '$(srcdir)/'`crypto_xof/shake256/xof_shake256.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Tpo crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/shake256/xof_shake256.c' object='crypto_xof/shake256/libsodium_la-xof_shake256.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/shake256/libsodium_la-xof_shake256.lo `test -f 'crypto_xof/shake256/xof_shake256.c' || echo '$(srcdir)/'`crypto_xof/shake256/xof_shake256.c + +crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo: crypto_xof/shake256/ref/shake256_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo -MD -MP -MF crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Tpo -c -o crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo `test -f 'crypto_xof/shake256/ref/shake256_ref.c' || echo '$(srcdir)/'`crypto_xof/shake256/ref/shake256_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Tpo crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/shake256/ref/shake256_ref.c' object='crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/shake256/ref/libsodium_la-shake256_ref.lo `test -f 'crypto_xof/shake256/ref/shake256_ref.c' || echo '$(srcdir)/'`crypto_xof/shake256/ref/shake256_ref.c + +crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo: crypto_xof/turboshake128/xof_turboshake128.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo -MD -MP -MF crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Tpo -c -o crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo `test -f 'crypto_xof/turboshake128/xof_turboshake128.c' || echo '$(srcdir)/'`crypto_xof/turboshake128/xof_turboshake128.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Tpo crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/turboshake128/xof_turboshake128.c' object='crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/turboshake128/libsodium_la-xof_turboshake128.lo `test -f 'crypto_xof/turboshake128/xof_turboshake128.c' || echo '$(srcdir)/'`crypto_xof/turboshake128/xof_turboshake128.c + +crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo: crypto_xof/turboshake128/ref/turboshake128_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo -MD -MP -MF crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Tpo -c -o crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo `test -f 'crypto_xof/turboshake128/ref/turboshake128_ref.c' || echo '$(srcdir)/'`crypto_xof/turboshake128/ref/turboshake128_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Tpo crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/turboshake128/ref/turboshake128_ref.c' object='crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/turboshake128/ref/libsodium_la-turboshake128_ref.lo `test -f 'crypto_xof/turboshake128/ref/turboshake128_ref.c' || echo '$(srcdir)/'`crypto_xof/turboshake128/ref/turboshake128_ref.c + +crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo: crypto_xof/turboshake256/xof_turboshake256.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo -MD -MP -MF crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Tpo -c -o crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo `test -f 'crypto_xof/turboshake256/xof_turboshake256.c' || echo '$(srcdir)/'`crypto_xof/turboshake256/xof_turboshake256.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Tpo crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/turboshake256/xof_turboshake256.c' object='crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/turboshake256/libsodium_la-xof_turboshake256.lo `test -f 'crypto_xof/turboshake256/xof_turboshake256.c' || echo '$(srcdir)/'`crypto_xof/turboshake256/xof_turboshake256.c + +crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo: crypto_xof/turboshake256/ref/turboshake256_ref.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo -MD -MP -MF crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Tpo -c -o crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo `test -f 'crypto_xof/turboshake256/ref/turboshake256_ref.c' || echo '$(srcdir)/'`crypto_xof/turboshake256/ref/turboshake256_ref.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Tpo crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='crypto_xof/turboshake256/ref/turboshake256_ref.c' object='crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o crypto_xof/turboshake256/ref/libsodium_la-turboshake256_ref.lo `test -f 'crypto_xof/turboshake256/ref/turboshake256_ref.c' || echo '$(srcdir)/'`crypto_xof/turboshake256/ref/turboshake256_ref.c + randombytes/libsodium_la-randombytes.lo: randombytes/randombytes.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libsodium_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT randombytes/libsodium_la-randombytes.lo -MD -MP -MF randombytes/$(DEPDIR)/libsodium_la-randombytes.Tpo -c -o randombytes/libsodium_la-randombytes.lo `test -f 'randombytes/randombytes.c' || echo '$(srcdir)/'`randombytes/randombytes.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) randombytes/$(DEPDIR)/libsodium_la-randombytes.Tpo randombytes/$(DEPDIR)/libsodium_la-randombytes.Plo @@ -3306,6 +3546,8 @@ clean-libtool: -rm -rf crypto_core/hchacha20/.libs crypto_core/hchacha20/_libs -rm -rf crypto_core/hsalsa20/.libs crypto_core/hsalsa20/_libs -rm -rf crypto_core/hsalsa20/ref2/.libs crypto_core/hsalsa20/ref2/_libs + -rm -rf crypto_core/keccak1600/.libs crypto_core/keccak1600/_libs + -rm -rf crypto_core/keccak1600/ref/.libs crypto_core/keccak1600/ref/_libs -rm -rf crypto_core/salsa/ref/.libs crypto_core/salsa/ref/_libs -rm -rf crypto_core/softaes/.libs crypto_core/softaes/_libs -rm -rf crypto_generichash/.libs crypto_generichash/_libs @@ -3360,6 +3602,14 @@ clean-libtool: -rm -rf crypto_stream/xchacha20/.libs crypto_stream/xchacha20/_libs -rm -rf crypto_stream/xsalsa20/.libs crypto_stream/xsalsa20/_libs -rm -rf crypto_verify/.libs crypto_verify/_libs + -rm -rf crypto_xof/shake128/.libs crypto_xof/shake128/_libs + -rm -rf crypto_xof/shake128/ref/.libs crypto_xof/shake128/ref/_libs + -rm -rf crypto_xof/shake256/.libs crypto_xof/shake256/_libs + -rm -rf crypto_xof/shake256/ref/.libs crypto_xof/shake256/ref/_libs + -rm -rf crypto_xof/turboshake128/.libs crypto_xof/turboshake128/_libs + -rm -rf crypto_xof/turboshake128/ref/.libs crypto_xof/turboshake128/ref/_libs + -rm -rf crypto_xof/turboshake256/.libs crypto_xof/turboshake256/_libs + -rm -rf crypto_xof/turboshake256/ref/.libs crypto_xof/turboshake256/ref/_libs -rm -rf randombytes/.libs randombytes/_libs -rm -rf randombytes/internal/.libs randombytes/internal/_libs -rm -rf randombytes/sysrandom/.libs randombytes/sysrandom/_libs @@ -3616,6 +3866,10 @@ distclean-generic: -$(am__rm_f) crypto_core/hsalsa20/$(am__dirstamp) -$(am__rm_f) crypto_core/hsalsa20/ref2/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) crypto_core/hsalsa20/ref2/$(am__dirstamp) + -$(am__rm_f) crypto_core/keccak1600/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_core/keccak1600/$(am__dirstamp) + -$(am__rm_f) crypto_core/keccak1600/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_core/keccak1600/ref/$(am__dirstamp) -$(am__rm_f) crypto_core/salsa/ref/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) crypto_core/salsa/ref/$(am__dirstamp) -$(am__rm_f) crypto_core/softaes/$(DEPDIR)/$(am__dirstamp) @@ -3724,6 +3978,22 @@ distclean-generic: -$(am__rm_f) crypto_stream/xsalsa20/$(am__dirstamp) -$(am__rm_f) crypto_verify/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) crypto_verify/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake128/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake128/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake128/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake128/ref/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake256/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake256/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake256/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/shake256/ref/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake128/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake128/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake128/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake128/ref/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake256/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake256/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake256/ref/$(DEPDIR)/$(am__dirstamp) + -$(am__rm_f) crypto_xof/turboshake256/ref/$(am__dirstamp) -$(am__rm_f) randombytes/$(DEPDIR)/$(am__dirstamp) -$(am__rm_f) randombytes/$(am__dirstamp) -$(am__rm_f) randombytes/internal/$(DEPDIR)/$(am__dirstamp) @@ -3771,6 +4041,8 @@ distclean: distclean-recursive -rm -f crypto_core/hchacha20/$(DEPDIR)/libsodium_la-core_hchacha20.Plo -rm -f crypto_core/hsalsa20/$(DEPDIR)/libsodium_la-core_hsalsa20.Plo -rm -f crypto_core/hsalsa20/ref2/$(DEPDIR)/libsodium_la-core_hsalsa20_ref2.Plo + -rm -f crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Plo + -rm -f crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Plo -rm -f crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Plo -rm -f crypto_core/softaes/$(DEPDIR)/libsodium_la-softaes.Plo -rm -f crypto_generichash/$(DEPDIR)/libsodium_la-crypto_generichash.Plo @@ -3855,6 +4127,14 @@ distclean: distclean-recursive -rm -f crypto_stream/xchacha20/$(DEPDIR)/libsodium_la-stream_xchacha20.Plo -rm -f crypto_stream/xsalsa20/$(DEPDIR)/libsodium_la-stream_xsalsa20.Plo -rm -f crypto_verify/$(DEPDIR)/libsodium_la-verify.Plo + -rm -f crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Plo + -rm -f crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Plo + -rm -f crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Plo + -rm -f crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Plo + -rm -f crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Plo + -rm -f crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Plo + -rm -f crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Plo + -rm -f crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Plo -rm -f randombytes/$(DEPDIR)/libsodium_la-randombytes.Plo -rm -f randombytes/internal/$(DEPDIR)/librdrand_la-randombytes_internal_random.Plo -rm -f randombytes/sysrandom/$(DEPDIR)/libsodium_la-randombytes_sysrandom.Plo @@ -3937,6 +4217,8 @@ maintainer-clean: maintainer-clean-recursive -rm -f crypto_core/hchacha20/$(DEPDIR)/libsodium_la-core_hchacha20.Plo -rm -f crypto_core/hsalsa20/$(DEPDIR)/libsodium_la-core_hsalsa20.Plo -rm -f crypto_core/hsalsa20/ref2/$(DEPDIR)/libsodium_la-core_hsalsa20_ref2.Plo + -rm -f crypto_core/keccak1600/$(DEPDIR)/libsodium_la-keccak1600.Plo + -rm -f crypto_core/keccak1600/ref/$(DEPDIR)/libsodium_la-keccak1600_ref.Plo -rm -f crypto_core/salsa/ref/$(DEPDIR)/libsodium_la-core_salsa_ref.Plo -rm -f crypto_core/softaes/$(DEPDIR)/libsodium_la-softaes.Plo -rm -f crypto_generichash/$(DEPDIR)/libsodium_la-crypto_generichash.Plo @@ -4021,6 +4303,14 @@ maintainer-clean: maintainer-clean-recursive -rm -f crypto_stream/xchacha20/$(DEPDIR)/libsodium_la-stream_xchacha20.Plo -rm -f crypto_stream/xsalsa20/$(DEPDIR)/libsodium_la-stream_xsalsa20.Plo -rm -f crypto_verify/$(DEPDIR)/libsodium_la-verify.Plo + -rm -f crypto_xof/shake128/$(DEPDIR)/libsodium_la-xof_shake128.Plo + -rm -f crypto_xof/shake128/ref/$(DEPDIR)/libsodium_la-shake128_ref.Plo + -rm -f crypto_xof/shake256/$(DEPDIR)/libsodium_la-xof_shake256.Plo + -rm -f crypto_xof/shake256/ref/$(DEPDIR)/libsodium_la-shake256_ref.Plo + -rm -f crypto_xof/turboshake128/$(DEPDIR)/libsodium_la-xof_turboshake128.Plo + -rm -f crypto_xof/turboshake128/ref/$(DEPDIR)/libsodium_la-turboshake128_ref.Plo + -rm -f crypto_xof/turboshake256/$(DEPDIR)/libsodium_la-xof_turboshake256.Plo + -rm -f crypto_xof/turboshake256/ref/$(DEPDIR)/libsodium_la-turboshake256_ref.Plo -rm -f randombytes/$(DEPDIR)/libsodium_la-randombytes.Plo -rm -f randombytes/internal/$(DEPDIR)/librdrand_la-randombytes_internal_random.Plo -rm -f randombytes/sysrandom/$(DEPDIR)/libsodium_la-randombytes_sysrandom.Plo diff --git a/src/libsodium/crypto_core/keccak1600/keccak1600.c b/src/libsodium/crypto_core/keccak1600/keccak1600.c new file mode 100644 index 00000000..ff9f73f6 --- /dev/null +++ b/src/libsodium/crypto_core/keccak1600/keccak1600.c @@ -0,0 +1,40 @@ +#include "crypto_core_keccak1600.h" +#include "ref/keccak1600_ref.h" + +size_t +crypto_core_keccak1600_statebytes(void) +{ + return crypto_core_keccak1600_STATEBYTES; +} + +void +crypto_core_keccak1600_init(void *state) +{ + keccak1600_ref_init(state); +} + +void +crypto_core_keccak1600_xor_bytes(void *state, const unsigned char *bytes, size_t offset, + size_t length) +{ + keccak1600_ref_xor_bytes(state, bytes, offset, length); +} + +void +crypto_core_keccak1600_extract_bytes(const void *state, unsigned char *bytes, size_t offset, + size_t length) +{ + keccak1600_ref_extract_bytes(state, bytes, offset, length); +} + +void +crypto_core_keccak1600_permute_24(void *state) +{ + keccak1600_ref_permute_24(state); +} + +void +crypto_core_keccak1600_permute_12(void *state) +{ + keccak1600_ref_permute_12(state); +} diff --git a/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.c b/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.c new file mode 100644 index 00000000..3eddfdf1 --- /dev/null +++ b/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.c @@ -0,0 +1,455 @@ +#include +#include + +#include "keccak1600_ref.h" +#include "private/common.h" + +#define KECCAK1600_STATEBYTES 200 + +static const uint64_t keccak_round_constants[24] = { + 0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL, + 0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL, + 0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL, + 0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL, + 0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL, + 0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL +}; + +static const unsigned int keccak_rotc[24] = { 1U, 3U, 6U, 10U, 15U, 21U, 28U, 36U, + 45U, 55U, 2U, 14U, 27U, 41U, 56U, 8U, + 25U, 43U, 62U, 18U, 39U, 61U, 20U, 44U }; + +static const unsigned int keccak_piln[24] = { 10U, 7U, 11U, 17U, 18U, 3U, 5U, 16U, + 8U, 21U, 24U, 4U, 15U, 23U, 19U, 13U, + 12U, 2U, 20U, 14U, 22U, 9U, 6U, 1U }; + +#define KECCAK_DECLARE_STATE \ + uint64_t Aba, Abe, Abi, Abo, Abu; \ + uint64_t Aga, Age, Agi, Ago, Agu; \ + uint64_t Aka, Ake, Aki, Ako, Aku; \ + uint64_t Ama, Ame, Ami, Amo, Amu; \ + uint64_t Asa, Ase, Asi, Aso, Asu; \ + uint64_t Bba, Bbe, Bbi, Bbo, Bbu; \ + uint64_t Bga, Bge, Bgi, Bgo, Bgu; \ + uint64_t Bka, Bke, Bki, Bko, Bku; \ + uint64_t Bma, Bme, Bmi, Bmo, Bmu; \ + uint64_t Bsa, Bse, Bsi, Bso, Bsu; \ + uint64_t Ca, Ce, Ci, Co, Cu; \ + uint64_t Da, De, Di, Do, Du; \ + uint64_t Eba, Ebe, Ebi, Ebo, Ebu; \ + uint64_t Ega, Ege, Egi, Ego, Egu; \ + uint64_t Eka, Eke, Eki, Eko, Eku; \ + uint64_t Ema, Eme, Emi, Emo, Emu; \ + uint64_t Esa, Ese, Esi, Eso, Esu + +#define KECCAK_PREPARE_THETA \ + Ca = Aba ^ Aga ^ Aka ^ Ama ^ Asa; \ + Ce = Abe ^ Age ^ Ake ^ Ame ^ Ase; \ + Ci = Abi ^ Agi ^ Aki ^ Ami ^ Asi; \ + Co = Abo ^ Ago ^ Ako ^ Amo ^ Aso; \ + Cu = Abu ^ Agu ^ Aku ^ Amu ^ Asu + +#define KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(round_idx, A, E) \ + Da = Cu ^ ROTL64(Ce, 1); \ + De = Ca ^ ROTL64(Ci, 1); \ + Di = Ce ^ ROTL64(Co, 1); \ + Do = Ci ^ ROTL64(Cu, 1); \ + Du = Co ^ ROTL64(Ca, 1); \ + \ + A##ba ^= Da; \ + Bba = A##ba; \ + A##ge ^= De; \ + Bbe = ROTL64(A##ge, 44); \ + A##ki ^= Di; \ + Bbi = ROTL64(A##ki, 43); \ + A##mo ^= Do; \ + Bbo = ROTL64(A##mo, 21); \ + A##su ^= Du; \ + Bbu = ROTL64(A##su, 14); \ + E##ba = Bba ^ ((~Bbe) & Bbi); \ + E##ba ^= keccak_round_constants[round_idx]; \ + Ca = E##ba; \ + E##be = Bbe ^ ((~Bbi) & Bbo); \ + Ce = E##be; \ + E##bi = Bbi ^ ((~Bbo) & Bbu); \ + Ci = E##bi; \ + E##bo = Bbo ^ ((~Bbu) & Bba); \ + Co = E##bo; \ + E##bu = Bbu ^ ((~Bba) & Bbe); \ + Cu = E##bu; \ + \ + A##bo ^= Do; \ + Bga = ROTL64(A##bo, 28); \ + A##gu ^= Du; \ + Bge = ROTL64(A##gu, 20); \ + A##ka ^= Da; \ + Bgi = ROTL64(A##ka, 3); \ + A##me ^= De; \ + Bgo = ROTL64(A##me, 45); \ + A##si ^= Di; \ + Bgu = ROTL64(A##si, 61); \ + E##ga = Bga ^ ((~Bge) & Bgi); \ + Ca ^= E##ga; \ + E##ge = Bge ^ ((~Bgi) & Bgo); \ + Ce ^= E##ge; \ + E##gi = Bgi ^ ((~Bgo) & Bgu); \ + Ci ^= E##gi; \ + E##go = Bgo ^ ((~Bgu) & Bga); \ + Co ^= E##go; \ + E##gu = Bgu ^ ((~Bga) & Bge); \ + Cu ^= E##gu; \ + \ + A##be ^= De; \ + Bka = ROTL64(A##be, 1); \ + A##gi ^= Di; \ + Bke = ROTL64(A##gi, 6); \ + A##ko ^= Do; \ + Bki = ROTL64(A##ko, 25); \ + A##mu ^= Du; \ + Bko = ROTL64(A##mu, 8); \ + A##sa ^= Da; \ + Bku = ROTL64(A##sa, 18); \ + E##ka = Bka ^ ((~Bke) & Bki); \ + Ca ^= E##ka; \ + E##ke = Bke ^ ((~Bki) & Bko); \ + Ce ^= E##ke; \ + E##ki = Bki ^ ((~Bko) & Bku); \ + Ci ^= E##ki; \ + E##ko = Bko ^ ((~Bku) & Bka); \ + Co ^= E##ko; \ + E##ku = Bku ^ ((~Bka) & Bke); \ + Cu ^= E##ku; \ + \ + A##bu ^= Du; \ + Bma = ROTL64(A##bu, 27); \ + A##ga ^= Da; \ + Bme = ROTL64(A##ga, 36); \ + A##ke ^= De; \ + Bmi = ROTL64(A##ke, 10); \ + A##mi ^= Di; \ + Bmo = ROTL64(A##mi, 15); \ + A##so ^= Do; \ + Bmu = ROTL64(A##so, 56); \ + E##ma = Bma ^ ((~Bme) & Bmi); \ + Ca ^= E##ma; \ + E##me = Bme ^ ((~Bmi) & Bmo); \ + Ce ^= E##me; \ + E##mi = Bmi ^ ((~Bmo) & Bmu); \ + Ci ^= E##mi; \ + E##mo = Bmo ^ ((~Bmu) & Bma); \ + Co ^= E##mo; \ + E##mu = Bmu ^ ((~Bma) & Bme); \ + Cu ^= E##mu; \ + \ + A##bi ^= Di; \ + Bsa = ROTL64(A##bi, 62); \ + A##go ^= Do; \ + Bse = ROTL64(A##go, 55); \ + A##ku ^= Du; \ + Bsi = ROTL64(A##ku, 39); \ + A##ma ^= Da; \ + Bso = ROTL64(A##ma, 41); \ + A##se ^= De; \ + Bsu = ROTL64(A##se, 2); \ + E##sa = Bsa ^ ((~Bse) & Bsi); \ + Ca ^= E##sa; \ + E##se = Bse ^ ((~Bsi) & Bso); \ + Ce ^= E##se; \ + E##si = Bsi ^ ((~Bso) & Bsu); \ + Ci ^= E##si; \ + E##so = Bso ^ ((~Bsu) & Bsa); \ + Co ^= E##so; \ + E##su = Bsu ^ ((~Bsa) & Bse); \ + Cu ^= E##su + +#define KECCAK_THETA_RHO_PI_CHI_IOTA(round_idx, A, E) \ + Da = Cu ^ ROTL64(Ce, 1); \ + De = Ca ^ ROTL64(Ci, 1); \ + Di = Ce ^ ROTL64(Co, 1); \ + Do = Ci ^ ROTL64(Cu, 1); \ + Du = Co ^ ROTL64(Ca, 1); \ + \ + A##ba ^= Da; \ + Bba = A##ba; \ + A##ge ^= De; \ + Bbe = ROTL64(A##ge, 44); \ + A##ki ^= Di; \ + Bbi = ROTL64(A##ki, 43); \ + A##mo ^= Do; \ + Bbo = ROTL64(A##mo, 21); \ + A##su ^= Du; \ + Bbu = ROTL64(A##su, 14); \ + E##ba = Bba ^ ((~Bbe) & Bbi); \ + E##ba ^= keccak_round_constants[round_idx]; \ + E##be = Bbe ^ ((~Bbi) & Bbo); \ + E##bi = Bbi ^ ((~Bbo) & Bbu); \ + E##bo = Bbo ^ ((~Bbu) & Bba); \ + E##bu = Bbu ^ ((~Bba) & Bbe); \ + \ + A##bo ^= Do; \ + Bga = ROTL64(A##bo, 28); \ + A##gu ^= Du; \ + Bge = ROTL64(A##gu, 20); \ + A##ka ^= Da; \ + Bgi = ROTL64(A##ka, 3); \ + A##me ^= De; \ + Bgo = ROTL64(A##me, 45); \ + A##si ^= Di; \ + Bgu = ROTL64(A##si, 61); \ + E##ga = Bga ^ ((~Bge) & Bgi); \ + E##ge = Bge ^ ((~Bgi) & Bgo); \ + E##gi = Bgi ^ ((~Bgo) & Bgu); \ + E##go = Bgo ^ ((~Bgu) & Bga); \ + E##gu = Bgu ^ ((~Bga) & Bge); \ + \ + A##be ^= De; \ + Bka = ROTL64(A##be, 1); \ + A##gi ^= Di; \ + Bke = ROTL64(A##gi, 6); \ + A##ko ^= Do; \ + Bki = ROTL64(A##ko, 25); \ + A##mu ^= Du; \ + Bko = ROTL64(A##mu, 8); \ + A##sa ^= Da; \ + Bku = ROTL64(A##sa, 18); \ + E##ka = Bka ^ ((~Bke) & Bki); \ + E##ke = Bke ^ ((~Bki) & Bko); \ + E##ki = Bki ^ ((~Bko) & Bku); \ + E##ko = Bko ^ ((~Bku) & Bka); \ + E##ku = Bku ^ ((~Bka) & Bke); \ + \ + A##bu ^= Du; \ + Bma = ROTL64(A##bu, 27); \ + A##ga ^= Da; \ + Bme = ROTL64(A##ga, 36); \ + A##ke ^= De; \ + Bmi = ROTL64(A##ke, 10); \ + A##mi ^= Di; \ + Bmo = ROTL64(A##mi, 15); \ + A##so ^= Do; \ + Bmu = ROTL64(A##so, 56); \ + E##ma = Bma ^ ((~Bme) & Bmi); \ + E##me = Bme ^ ((~Bmi) & Bmo); \ + E##mi = Bmi ^ ((~Bmo) & Bmu); \ + E##mo = Bmo ^ ((~Bmu) & Bma); \ + E##mu = Bmu ^ ((~Bma) & Bme); \ + \ + A##bi ^= Di; \ + Bsa = ROTL64(A##bi, 62); \ + A##go ^= Do; \ + Bse = ROTL64(A##go, 55); \ + A##ku ^= Du; \ + Bsi = ROTL64(A##ku, 39); \ + A##ma ^= Da; \ + Bso = ROTL64(A##ma, 41); \ + A##se ^= De; \ + Bsu = ROTL64(A##se, 2); \ + E##sa = Bsa ^ ((~Bse) & Bsi); \ + E##se = Bse ^ ((~Bsi) & Bso); \ + E##si = Bsi ^ ((~Bso) & Bsu); \ + E##so = Bso ^ ((~Bsu) & Bsa); \ + E##su = Bsu ^ ((~Bsa) & Bse) + +#define KECCAK_COPY_FROM_STATE(prefix, src) \ + prefix##ba = (src)[0]; \ + prefix##be = (src)[1]; \ + prefix##bi = (src)[2]; \ + prefix##bo = (src)[3]; \ + prefix##bu = (src)[4]; \ + prefix##ga = (src)[5]; \ + prefix##ge = (src)[6]; \ + prefix##gi = (src)[7]; \ + prefix##go = (src)[8]; \ + prefix##gu = (src)[9]; \ + prefix##ka = (src)[10]; \ + prefix##ke = (src)[11]; \ + prefix##ki = (src)[12]; \ + prefix##ko = (src)[13]; \ + prefix##ku = (src)[14]; \ + prefix##ma = (src)[15]; \ + prefix##me = (src)[16]; \ + prefix##mi = (src)[17]; \ + prefix##mo = (src)[18]; \ + prefix##mu = (src)[19]; \ + prefix##sa = (src)[20]; \ + prefix##se = (src)[21]; \ + prefix##si = (src)[22]; \ + prefix##so = (src)[23]; \ + prefix##su = (src)[24] + +#define KECCAK_COPY_TO_STATE(dst, prefix) \ + (dst)[0] = prefix##ba; \ + (dst)[1] = prefix##be; \ + (dst)[2] = prefix##bi; \ + (dst)[3] = prefix##bo; \ + (dst)[4] = prefix##bu; \ + (dst)[5] = prefix##ga; \ + (dst)[6] = prefix##ge; \ + (dst)[7] = prefix##gi; \ + (dst)[8] = prefix##go; \ + (dst)[9] = prefix##gu; \ + (dst)[10] = prefix##ka; \ + (dst)[11] = prefix##ke; \ + (dst)[12] = prefix##ki; \ + (dst)[13] = prefix##ko; \ + (dst)[14] = prefix##ku; \ + (dst)[15] = prefix##ma; \ + (dst)[16] = prefix##me; \ + (dst)[17] = prefix##mi; \ + (dst)[18] = prefix##mo; \ + (dst)[19] = prefix##mu; \ + (dst)[20] = prefix##sa; \ + (dst)[21] = prefix##se; \ + (dst)[22] = prefix##si; \ + (dst)[23] = prefix##so; \ + (dst)[24] = prefix##su + +#define KECCAK_COPY_STATE(prefix_dst, prefix_src) \ + prefix_dst##ba = prefix_src##ba; \ + prefix_dst##be = prefix_src##be; \ + prefix_dst##bi = prefix_src##bi; \ + prefix_dst##bo = prefix_src##bo; \ + prefix_dst##bu = prefix_src##bu; \ + prefix_dst##ga = prefix_src##ga; \ + prefix_dst##ge = prefix_src##ge; \ + prefix_dst##gi = prefix_src##gi; \ + prefix_dst##go = prefix_src##go; \ + prefix_dst##gu = prefix_src##gu; \ + prefix_dst##ka = prefix_src##ka; \ + prefix_dst##ke = prefix_src##ke; \ + prefix_dst##ki = prefix_src##ki; \ + prefix_dst##ko = prefix_src##ko; \ + prefix_dst##ku = prefix_src##ku; \ + prefix_dst##ma = prefix_src##ma; \ + prefix_dst##me = prefix_src##me; \ + prefix_dst##mi = prefix_src##mi; \ + prefix_dst##mo = prefix_src##mo; \ + prefix_dst##mu = prefix_src##mu; \ + prefix_dst##sa = prefix_src##sa; \ + prefix_dst##se = prefix_src##se; \ + prefix_dst##si = prefix_src##si; \ + prefix_dst##so = prefix_src##so; \ + prefix_dst##su = prefix_src##su + +static void +keccakf_24_rounds(uint64_t st[25]) +{ + uint64_t *state = st; + + KECCAK_DECLARE_STATE; + + KECCAK_COPY_FROM_STATE(A, state); + KECCAK_PREPARE_THETA; + + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(0, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(1, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(2, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(3, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(4, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(5, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(6, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(7, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(8, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(9, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(10, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(11, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(12, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(13, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(14, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(15, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(16, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(17, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(18, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(19, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(20, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(21, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(22, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA(23, E, A); + + KECCAK_COPY_TO_STATE(state, A); +} + +static void +keccakf_12_rounds(uint64_t st[25]) +{ + uint64_t *state = st; + + KECCAK_DECLARE_STATE; + + KECCAK_COPY_FROM_STATE(A, state); + KECCAK_PREPARE_THETA; + + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(12, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(13, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(14, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(15, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(16, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(17, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(18, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(19, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(20, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(21, E, A); + KECCAK_THETA_RHO_PI_CHI_IOTA_PRE(22, A, E); + KECCAK_THETA_RHO_PI_CHI_IOTA(23, E, A); + + KECCAK_COPY_TO_STATE(state, A); +} + +void +keccak1600_ref_permute_24(void *state) +{ + uint64_t st[25]; + unsigned int i; + + for (i = 0U; i < 25U; i++) { + st[i] = LOAD64_LE((const unsigned char *) state + i * 8U); + } + + keccakf_24_rounds(st); + + for (i = 0U; i < 25U; i++) { + STORE64_LE((unsigned char *) state + i * 8U, st[i]); + } +} + +void +keccak1600_ref_permute_12(void *state) +{ + uint64_t st[25]; + unsigned int i; + + for (i = 0U; i < 25U; i++) { + st[i] = LOAD64_LE((const unsigned char *) state + i * 8U); + } + + keccakf_12_rounds(st); + + for (i = 0U; i < 25U; i++) { + STORE64_LE((unsigned char *) state + i * 8U, st[i]); + } +} + +void +keccak1600_ref_init(void *state) +{ + memset(state, 0, KECCAK1600_STATEBYTES); +} + +void +keccak1600_ref_xor_bytes(void *state, const unsigned char *data, size_t offset, size_t length) +{ + unsigned char *st = (unsigned char *) state; + size_t i; + + for (i = 0U; i < length; i++) { + st[offset + i] ^= data[i]; + } +} + +void +keccak1600_ref_extract_bytes(const void *state, unsigned char *data, size_t offset, size_t length) +{ + const unsigned char *st = (const unsigned char *) state; + + memcpy(data, st + offset, length); +} diff --git a/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.h b/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.h new file mode 100644 index 00000000..e91253ee --- /dev/null +++ b/src/libsodium/crypto_core/keccak1600/ref/keccak1600_ref.h @@ -0,0 +1,20 @@ +#ifndef keccak1600_ref_H +#define keccak1600_ref_H + +#include + +#include "private/quirks.h" + +void keccak1600_ref_init(void *state); + +void keccak1600_ref_xor_bytes(void *state, const unsigned char *bytes, + size_t offset, size_t length); + +void keccak1600_ref_extract_bytes(const void *state, unsigned char *bytes, + size_t offset, size_t length); + +void keccak1600_ref_permute_24(void *state); + +void keccak1600_ref_permute_12(void *state); + +#endif /* keccak1600_ref_H */ diff --git a/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c new file mode 100644 index 00000000..fb0366e1 --- /dev/null +++ b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c @@ -0,0 +1,122 @@ +#include +#include + +#include "crypto_core_keccak1600.h" +#include "crypto_xof_shake128.h" +#include "private/common.h" +#include "shake128_ref.h" + +int +shake128_ref_init_with_domain(shake128_state_internal *state, unsigned char domain) +{ + crypto_core_keccak1600_init(state->state); + state->offset = 0; + state->phase = SHAKE128_PHASE_ABSORBING; + state->domain = domain; + + return 0; +} + +int +shake128_ref_init(shake128_state_internal *state) +{ + return shake128_ref_init_with_domain(state, crypto_xof_shake128_DOMAIN_STANDARD); +} + +int +shake128_ref_update(shake128_state_internal *state, const unsigned char *in, size_t inlen) +{ + size_t consumed = 0; + size_t chunk_size; + + if (state->phase != SHAKE128_PHASE_ABSORBING) { + state->phase = SHAKE128_PHASE_ABSORBING; + state->offset = 0; + } + + while (consumed < inlen) { + if (state->offset == SHAKE128_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + chunk_size = SHAKE128_RATE - state->offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state->state, &in[consumed], state->offset, chunk_size); + state->offset += chunk_size; + consumed += chunk_size; + } + + return 0; +} + +static void +shake128_finalize(shake128_state_internal *state) +{ + unsigned char pad; + + /* If the rate is exactly full, process that block before padding */ + if (state->offset == SHAKE128_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + + /* Apply padding: domain byte at current position, 0x80 at last byte */ + if (state->offset == SHAKE128_RATE - 1) { + /* Special case: padding fits in one byte */ + pad = (unsigned char) (state->domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1); + } else { + /* Normal case: domain and 0x80 at different positions */ + crypto_core_keccak1600_xor_bytes(state->state, &state->domain, state->offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state->state, &pad, SHAKE128_RATE - 1, 1); + } + + /* Final permutation */ + crypto_core_keccak1600_permute_24(state->state); + + state->offset = 0; + state->phase = SHAKE128_PHASE_SQUEEZING; +} + +int +shake128_ref_squeeze(shake128_state_internal *state, unsigned char *out, size_t outlen) +{ + size_t extracted = 0; + size_t chunk_size; + + if (state->phase == SHAKE128_PHASE_ABSORBING) { + shake128_finalize(state); + } + + while (extracted < outlen) { + if (state->offset == SHAKE128_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + chunk_size = SHAKE128_RATE - state->offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state->state, &out[extracted], state->offset, + chunk_size); + state->offset += chunk_size; + extracted += chunk_size; + } + + return 0; +} + +int +shake128_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen) +{ + shake128_state_internal state; + + shake128_ref_init(&state); + shake128_ref_update(&state, in, inlen); + shake128_ref_squeeze(&state, out, outlen); + + return 0; +} diff --git a/src/libsodium/crypto_xof/shake128/ref/shake128_ref.h b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.h new file mode 100644 index 00000000..34021def --- /dev/null +++ b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.h @@ -0,0 +1,28 @@ +#ifndef shake128_ref_H +#define shake128_ref_H + +#include +#include + +#define SHAKE128_RATE 168 + +typedef enum { SHAKE128_PHASE_ABSORBING = 0, SHAKE128_PHASE_SQUEEZING = 1 } shake128_phase; + +typedef struct shake128_state_internal_ { + unsigned char state[200]; + size_t offset; + uint8_t phase; + unsigned char domain; /* Domain separation byte */ +} shake128_state_internal; + +int shake128_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen); + +int shake128_ref_init(shake128_state_internal *state); + +int shake128_ref_init_with_domain(shake128_state_internal *state, unsigned char domain); + +int shake128_ref_update(shake128_state_internal *state, const unsigned char *in, size_t inlen); + +int shake128_ref_squeeze(shake128_state_internal *state, unsigned char *out, size_t outlen); + +#endif /* shake128_ref_H */ diff --git a/src/libsodium/crypto_xof/shake128/xof_shake128.c b/src/libsodium/crypto_xof/shake128/xof_shake128.c new file mode 100644 index 00000000..c16c7628 --- /dev/null +++ b/src/libsodium/crypto_xof/shake128/xof_shake128.c @@ -0,0 +1,68 @@ +#include "crypto_xof_shake128.h" +#include "private/common.h" +#include "ref/shake128_ref.h" + +size_t +crypto_xof_shake128_blockbytes(void) +{ + return crypto_xof_shake128_BLOCKBYTES; +} + +size_t +crypto_xof_shake128_statebytes(void) +{ + return crypto_xof_shake128_STATEBYTES; +} + +unsigned char +crypto_xof_shake128_domain_standard(void) +{ + return crypto_xof_shake128_DOMAIN_STANDARD; +} + +int +crypto_xof_shake128(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) +{ + COMPILER_ASSERT(sizeof(crypto_xof_shake128_state) >= sizeof(shake128_state_internal)); + + return shake128_ref(out, outlen, in, (size_t) inlen); +} + +int +crypto_xof_shake128_init(crypto_xof_shake128_state *state) +{ + shake128_state_internal *st = (shake128_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_shake128_state) >= sizeof(shake128_state_internal)); + + return shake128_ref_init(st); +} + +int +crypto_xof_shake128_init_with_domain(crypto_xof_shake128_state *state, unsigned char domain) +{ + shake128_state_internal *st = (shake128_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_shake128_state) >= sizeof(shake128_state_internal)); + + return shake128_ref_init_with_domain(st, domain); +} + +int +crypto_xof_shake128_update(crypto_xof_shake128_state *state, + const unsigned char *in, + unsigned long long inlen) +{ + shake128_state_internal *st = (shake128_state_internal *) (void *) state; + + return shake128_ref_update(st, in, (size_t) inlen); +} + +int +crypto_xof_shake128_squeeze(crypto_xof_shake128_state *state, unsigned char *out, size_t outlen) +{ + shake128_state_internal *st = (shake128_state_internal *) (void *) state; + + return shake128_ref_squeeze(st, out, outlen); +} diff --git a/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c new file mode 100644 index 00000000..7fe50a93 --- /dev/null +++ b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c @@ -0,0 +1,122 @@ +#include +#include + +#include "crypto_core_keccak1600.h" +#include "crypto_xof_shake256.h" +#include "private/common.h" +#include "shake256_ref.h" + +int +shake256_ref_init_with_domain(shake256_state_internal *state, unsigned char domain) +{ + crypto_core_keccak1600_init(state->state); + state->offset = 0; + state->phase = SHAKE256_PHASE_ABSORBING; + state->domain = domain; + + return 0; +} + +int +shake256_ref_init(shake256_state_internal *state) +{ + return shake256_ref_init_with_domain(state, crypto_xof_shake256_DOMAIN_STANDARD); +} + +int +shake256_ref_update(shake256_state_internal *state, const unsigned char *in, size_t inlen) +{ + size_t consumed = 0; + size_t chunk_size; + + if (state->phase != SHAKE256_PHASE_ABSORBING) { + state->phase = SHAKE256_PHASE_ABSORBING; + state->offset = 0; + } + + while (consumed < inlen) { + if (state->offset == SHAKE256_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + chunk_size = SHAKE256_RATE - state->offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state->state, &in[consumed], state->offset, chunk_size); + state->offset += chunk_size; + consumed += chunk_size; + } + + return 0; +} + +static void +shake256_finalize(shake256_state_internal *state) +{ + unsigned char pad; + + /* If the rate is exactly full, process that block before padding */ + if (state->offset == SHAKE256_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + + /* Apply padding: domain byte at current position, 0x80 at last byte */ + if (state->offset == SHAKE256_RATE - 1) { + /* Special case: padding fits in one byte */ + pad = (unsigned char) (state->domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1); + } else { + /* Normal case: domain and 0x80 at different positions */ + crypto_core_keccak1600_xor_bytes(state->state, &state->domain, state->offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state->state, &pad, SHAKE256_RATE - 1, 1); + } + + /* Final permutation */ + crypto_core_keccak1600_permute_24(state->state); + + state->offset = 0; + state->phase = SHAKE256_PHASE_SQUEEZING; +} + +int +shake256_ref_squeeze(shake256_state_internal *state, unsigned char *out, size_t outlen) +{ + size_t extracted = 0; + size_t chunk_size; + + if (state->phase == SHAKE256_PHASE_ABSORBING) { + shake256_finalize(state); + } + + while (extracted < outlen) { + if (state->offset == SHAKE256_RATE) { + crypto_core_keccak1600_permute_24(state->state); + state->offset = 0; + } + chunk_size = SHAKE256_RATE - state->offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state->state, &out[extracted], state->offset, + chunk_size); + state->offset += chunk_size; + extracted += chunk_size; + } + + return 0; +} + +int +shake256_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen) +{ + shake256_state_internal state; + + shake256_ref_init(&state); + shake256_ref_update(&state, in, inlen); + shake256_ref_squeeze(&state, out, outlen); + + return 0; +} diff --git a/src/libsodium/crypto_xof/shake256/ref/shake256_ref.h b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.h new file mode 100644 index 00000000..69b03eab --- /dev/null +++ b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.h @@ -0,0 +1,28 @@ +#ifndef shake256_ref_H +#define shake256_ref_H + +#include +#include + +#define SHAKE256_RATE 136 + +typedef enum { SHAKE256_PHASE_ABSORBING = 0, SHAKE256_PHASE_SQUEEZING = 1 } shake256_phase; + +typedef struct shake256_state_internal_ { + unsigned char state[200]; + size_t offset; + uint8_t phase; + unsigned char domain; /* Domain separation byte */ +} shake256_state_internal; + +int shake256_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen); + +int shake256_ref_init(shake256_state_internal *state); + +int shake256_ref_init_with_domain(shake256_state_internal *state, unsigned char domain); + +int shake256_ref_update(shake256_state_internal *state, const unsigned char *in, size_t inlen); + +int shake256_ref_squeeze(shake256_state_internal *state, unsigned char *out, size_t outlen); + +#endif /* shake256_ref_H */ diff --git a/src/libsodium/crypto_xof/shake256/xof_shake256.c b/src/libsodium/crypto_xof/shake256/xof_shake256.c new file mode 100644 index 00000000..c5430ac3 --- /dev/null +++ b/src/libsodium/crypto_xof/shake256/xof_shake256.c @@ -0,0 +1,68 @@ +#include "crypto_xof_shake256.h" +#include "private/common.h" +#include "ref/shake256_ref.h" + +size_t +crypto_xof_shake256_blockbytes(void) +{ + return crypto_xof_shake256_BLOCKBYTES; +} + +size_t +crypto_xof_shake256_statebytes(void) +{ + return crypto_xof_shake256_STATEBYTES; +} + +unsigned char +crypto_xof_shake256_domain_standard(void) +{ + return crypto_xof_shake256_DOMAIN_STANDARD; +} + +int +crypto_xof_shake256(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) +{ + COMPILER_ASSERT(sizeof(crypto_xof_shake256_state) >= sizeof(shake256_state_internal)); + + return shake256_ref(out, outlen, in, (size_t) inlen); +} + +int +crypto_xof_shake256_init(crypto_xof_shake256_state *state) +{ + shake256_state_internal *st = (shake256_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_shake256_state) >= sizeof(shake256_state_internal)); + + return shake256_ref_init(st); +} + +int +crypto_xof_shake256_init_with_domain(crypto_xof_shake256_state *state, unsigned char domain) +{ + shake256_state_internal *st = (shake256_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_shake256_state) >= sizeof(shake256_state_internal)); + + return shake256_ref_init_with_domain(st, domain); +} + +int +crypto_xof_shake256_update(crypto_xof_shake256_state *state, + const unsigned char *in, + unsigned long long inlen) +{ + shake256_state_internal *st = (shake256_state_internal *) (void *) state; + + return shake256_ref_update(st, in, (size_t) inlen); +} + +int +crypto_xof_shake256_squeeze(crypto_xof_shake256_state *state, unsigned char *out, size_t outlen) +{ + shake256_state_internal *st = (shake256_state_internal *) (void *) state; + + return shake256_ref_squeeze(st, out, outlen); +} diff --git a/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c new file mode 100644 index 00000000..9d4dab27 --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c @@ -0,0 +1,122 @@ +#include +#include + +#include "crypto_core_keccak1600.h" +#include "crypto_xof_turboshake128.h" +#include "private/common.h" +#include "turboshake128_ref.h" + +int +turboshake128_ref_init_with_domain(turboshake128_state_internal *state, unsigned char domain) +{ + crypto_core_keccak1600_init(state->state); + state->offset = 0; + state->phase = TURBOSHAKE128_PHASE_ABSORBING; + state->domain = domain; + + return 0; +} + +int +turboshake128_ref_init(turboshake128_state_internal *state) +{ + return turboshake128_ref_init_with_domain(state, crypto_xof_turboshake128_DOMAIN_STANDARD); +} + +int +turboshake128_ref_update(turboshake128_state_internal *state, const unsigned char *in, size_t inlen) +{ + size_t consumed = 0; + size_t chunk_size; + + if (state->phase != TURBOSHAKE128_PHASE_ABSORBING) { + state->phase = TURBOSHAKE128_PHASE_ABSORBING; + state->offset = 0; + } + + while (consumed < inlen) { + if (state->offset == TURBOSHAKE128_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + chunk_size = TURBOSHAKE128_RATE - state->offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state->state, &in[consumed], state->offset, chunk_size); + state->offset += chunk_size; + consumed += chunk_size; + } + + return 0; +} + +static void +turboshake128_finalize(turboshake128_state_internal *state) +{ + unsigned char pad; + + /* If the rate is exactly full, process that block before padding */ + if (state->offset == TURBOSHAKE128_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + + /* Apply padding: domain byte at current position, 0x80 at last byte */ + if (state->offset == TURBOSHAKE128_RATE - 1) { + /* Special case: padding fits in one byte */ + pad = (unsigned char) (state->domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1); + } else { + /* Normal case: domain and 0x80 at different positions */ + crypto_core_keccak1600_xor_bytes(state->state, &state->domain, state->offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state->state, &pad, TURBOSHAKE128_RATE - 1, 1); + } + + /* Final permutation (12 rounds for TurboSHAKE) */ + crypto_core_keccak1600_permute_12(state->state); + + state->offset = 0; + state->phase = TURBOSHAKE128_PHASE_SQUEEZING; +} + +int +turboshake128_ref_squeeze(turboshake128_state_internal *state, unsigned char *out, size_t outlen) +{ + size_t extracted = 0; + size_t chunk_size; + + if (state->phase == TURBOSHAKE128_PHASE_ABSORBING) { + turboshake128_finalize(state); + } + + while (extracted < outlen) { + if (state->offset == TURBOSHAKE128_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + chunk_size = TURBOSHAKE128_RATE - state->offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state->state, &out[extracted], state->offset, + chunk_size); + state->offset += chunk_size; + extracted += chunk_size; + } + + return 0; +} + +int +turboshake128_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen) +{ + turboshake128_state_internal state; + + turboshake128_ref_init(&state); + turboshake128_ref_update(&state, in, inlen); + turboshake128_ref_squeeze(&state, out, outlen); + + return 0; +} diff --git a/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.h b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.h new file mode 100644 index 00000000..30c5acd8 --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.h @@ -0,0 +1,34 @@ +#ifndef turboshake128_ref_H +#define turboshake128_ref_H + +#include +#include + +#define TURBOSHAKE128_RATE 168 + +typedef enum { + TURBOSHAKE128_PHASE_ABSORBING = 0, + TURBOSHAKE128_PHASE_SQUEEZING = 1 +} turboshake128_phase; + +typedef struct turboshake128_state_internal_ { + unsigned char state[200]; + size_t offset; + uint8_t phase; + unsigned char domain; /* Domain separation byte */ +} turboshake128_state_internal; + +int turboshake128_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen); + +int turboshake128_ref_init(turboshake128_state_internal *state); + +int turboshake128_ref_init_with_domain(turboshake128_state_internal *state, unsigned char domain); + +int turboshake128_ref_update(turboshake128_state_internal *state, + const unsigned char *in, + size_t inlen); + +int turboshake128_ref_squeeze(turboshake128_state_internal *state, unsigned char *out, + size_t outlen); + +#endif /* turboshake128_ref_H */ diff --git a/src/libsodium/crypto_xof/turboshake128/xof_turboshake128.c b/src/libsodium/crypto_xof/turboshake128/xof_turboshake128.c new file mode 100644 index 00000000..cbd80634 --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake128/xof_turboshake128.c @@ -0,0 +1,70 @@ +#include "crypto_xof_turboshake128.h" +#include "private/common.h" +#include "ref/turboshake128_ref.h" + +size_t +crypto_xof_turboshake128_blockbytes(void) +{ + return crypto_xof_turboshake128_BLOCKBYTES; +} + +size_t +crypto_xof_turboshake128_statebytes(void) +{ + return crypto_xof_turboshake128_STATEBYTES; +} + +unsigned char +crypto_xof_turboshake128_domain_standard(void) +{ + return crypto_xof_turboshake128_DOMAIN_STANDARD; +} + +int +crypto_xof_turboshake128(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) +{ + COMPILER_ASSERT(sizeof(crypto_xof_turboshake128_state) >= sizeof(turboshake128_state_internal)); + + return turboshake128_ref(out, outlen, in, (size_t) inlen); +} + +int +crypto_xof_turboshake128_init(crypto_xof_turboshake128_state *state) +{ + turboshake128_state_internal *st = (turboshake128_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_turboshake128_state) >= sizeof(turboshake128_state_internal)); + + return turboshake128_ref_init(st); +} + +int +crypto_xof_turboshake128_init_with_domain(crypto_xof_turboshake128_state *state, + unsigned char domain) +{ + turboshake128_state_internal *st = (turboshake128_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_turboshake128_state) >= sizeof(turboshake128_state_internal)); + + return turboshake128_ref_init_with_domain(st, domain); +} + +int +crypto_xof_turboshake128_update(crypto_xof_turboshake128_state *state, + const unsigned char *in, + unsigned long long inlen) +{ + turboshake128_state_internal *st = (turboshake128_state_internal *) (void *) state; + + return turboshake128_ref_update(st, in, (size_t) inlen); +} + +int +crypto_xof_turboshake128_squeeze(crypto_xof_turboshake128_state *state, unsigned char *out, + size_t outlen) +{ + turboshake128_state_internal *st = (turboshake128_state_internal *) (void *) state; + + return turboshake128_ref_squeeze(st, out, outlen); +} diff --git a/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c new file mode 100644 index 00000000..f648a7fa --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c @@ -0,0 +1,122 @@ +#include +#include + +#include "crypto_core_keccak1600.h" +#include "crypto_xof_turboshake256.h" +#include "private/common.h" +#include "turboshake256_ref.h" + +int +turboshake256_ref_init_with_domain(turboshake256_state_internal *state, unsigned char domain) +{ + crypto_core_keccak1600_init(state->state); + state->offset = 0; + state->phase = TURBOSHAKE256_PHASE_ABSORBING; + state->domain = domain; + + return 0; +} + +int +turboshake256_ref_init(turboshake256_state_internal *state) +{ + return turboshake256_ref_init_with_domain(state, crypto_xof_turboshake256_DOMAIN_STANDARD); +} + +int +turboshake256_ref_update(turboshake256_state_internal *state, const unsigned char *in, size_t inlen) +{ + size_t consumed = 0; + size_t chunk_size; + + if (state->phase != TURBOSHAKE256_PHASE_ABSORBING) { + state->phase = TURBOSHAKE256_PHASE_ABSORBING; + state->offset = 0; + } + + while (consumed < inlen) { + if (state->offset == TURBOSHAKE256_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + chunk_size = TURBOSHAKE256_RATE - state->offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state->state, &in[consumed], state->offset, chunk_size); + state->offset += chunk_size; + consumed += chunk_size; + } + + return 0; +} + +static void +turboshake256_finalize(turboshake256_state_internal *state) +{ + unsigned char pad; + + /* If the rate is exactly full, process that block before padding */ + if (state->offset == TURBOSHAKE256_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + + /* Apply padding: domain byte at current position, 0x80 at last byte */ + if (state->offset == TURBOSHAKE256_RATE - 1) { + /* Special case: padding fits in one byte */ + pad = (unsigned char) (state->domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1); + } else { + /* Normal case: domain and 0x80 at different positions */ + crypto_core_keccak1600_xor_bytes(state->state, &state->domain, state->offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state->state, &pad, TURBOSHAKE256_RATE - 1, 1); + } + + /* Final permutation (12 rounds for TurboSHAKE) */ + crypto_core_keccak1600_permute_12(state->state); + + state->offset = 0; + state->phase = TURBOSHAKE256_PHASE_SQUEEZING; +} + +int +turboshake256_ref_squeeze(turboshake256_state_internal *state, unsigned char *out, size_t outlen) +{ + size_t extracted = 0; + size_t chunk_size; + + if (state->phase == TURBOSHAKE256_PHASE_ABSORBING) { + turboshake256_finalize(state); + } + + while (extracted < outlen) { + if (state->offset == TURBOSHAKE256_RATE) { + crypto_core_keccak1600_permute_12(state->state); + state->offset = 0; + } + chunk_size = TURBOSHAKE256_RATE - state->offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state->state, &out[extracted], state->offset, + chunk_size); + state->offset += chunk_size; + extracted += chunk_size; + } + + return 0; +} + +int +turboshake256_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen) +{ + turboshake256_state_internal state; + + turboshake256_ref_init(&state); + turboshake256_ref_update(&state, in, inlen); + turboshake256_ref_squeeze(&state, out, outlen); + + return 0; +} diff --git a/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.h b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.h new file mode 100644 index 00000000..d154f24b --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.h @@ -0,0 +1,34 @@ +#ifndef turboshake256_ref_H +#define turboshake256_ref_H + +#include +#include + +#define TURBOSHAKE256_RATE 136 + +typedef enum { + TURBOSHAKE256_PHASE_ABSORBING = 0, + TURBOSHAKE256_PHASE_SQUEEZING = 1 +} turboshake256_phase; + +typedef struct turboshake256_state_internal_ { + unsigned char state[200]; + size_t offset; + uint8_t phase; + unsigned char domain; /* Domain separation byte */ +} turboshake256_state_internal; + +int turboshake256_ref(unsigned char *out, size_t outlen, const unsigned char *in, size_t inlen); + +int turboshake256_ref_init(turboshake256_state_internal *state); + +int turboshake256_ref_init_with_domain(turboshake256_state_internal *state, unsigned char domain); + +int turboshake256_ref_update(turboshake256_state_internal *state, + const unsigned char *in, + size_t inlen); + +int turboshake256_ref_squeeze(turboshake256_state_internal *state, unsigned char *out, + size_t outlen); + +#endif /* turboshake256_ref_H */ diff --git a/src/libsodium/crypto_xof/turboshake256/xof_turboshake256.c b/src/libsodium/crypto_xof/turboshake256/xof_turboshake256.c new file mode 100644 index 00000000..a8771364 --- /dev/null +++ b/src/libsodium/crypto_xof/turboshake256/xof_turboshake256.c @@ -0,0 +1,70 @@ +#include "crypto_xof_turboshake256.h" +#include "private/common.h" +#include "ref/turboshake256_ref.h" + +size_t +crypto_xof_turboshake256_blockbytes(void) +{ + return crypto_xof_turboshake256_BLOCKBYTES; +} + +size_t +crypto_xof_turboshake256_statebytes(void) +{ + return crypto_xof_turboshake256_STATEBYTES; +} + +unsigned char +crypto_xof_turboshake256_domain_standard(void) +{ + return crypto_xof_turboshake256_DOMAIN_STANDARD; +} + +int +crypto_xof_turboshake256(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) +{ + COMPILER_ASSERT(sizeof(crypto_xof_turboshake256_state) >= sizeof(turboshake256_state_internal)); + + return turboshake256_ref(out, outlen, in, (size_t) inlen); +} + +int +crypto_xof_turboshake256_init(crypto_xof_turboshake256_state *state) +{ + turboshake256_state_internal *st = (turboshake256_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_turboshake256_state) >= sizeof(turboshake256_state_internal)); + + return turboshake256_ref_init(st); +} + +int +crypto_xof_turboshake256_init_with_domain(crypto_xof_turboshake256_state *state, + unsigned char domain) +{ + turboshake256_state_internal *st = (turboshake256_state_internal *) (void *) state; + + COMPILER_ASSERT(sizeof(crypto_xof_turboshake256_state) >= sizeof(turboshake256_state_internal)); + + return turboshake256_ref_init_with_domain(st, domain); +} + +int +crypto_xof_turboshake256_update(crypto_xof_turboshake256_state *state, + const unsigned char *in, + unsigned long long inlen) +{ + turboshake256_state_internal *st = (turboshake256_state_internal *) (void *) state; + + return turboshake256_ref_update(st, in, (size_t) inlen); +} + +int +crypto_xof_turboshake256_squeeze(crypto_xof_turboshake256_state *state, unsigned char *out, + size_t outlen) +{ + turboshake256_state_internal *st = (turboshake256_state_internal *) (void *) state; + + return turboshake256_ref_squeeze(st, out, outlen); +} diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am index 3146ec8e..c35e247d 100644 --- a/src/libsodium/include/Makefile.am +++ b/src/libsodium/include/Makefile.am @@ -18,6 +18,7 @@ SODIUM_EXPORT = \ sodium/crypto_core_ristretto255.h \ sodium/crypto_core_hchacha20.h \ sodium/crypto_core_hsalsa20.h \ + sodium/crypto_core_keccak1600.h \ sodium/crypto_core_salsa20.h \ sodium/crypto_core_salsa2012.h \ sodium/crypto_core_salsa208.h \ @@ -60,6 +61,10 @@ SODIUM_EXPORT = \ sodium/crypto_verify_16.h \ sodium/crypto_verify_32.h \ sodium/crypto_verify_64.h \ + sodium/crypto_xof_shake128.h \ + sodium/crypto_xof_shake256.h \ + sodium/crypto_xof_turboshake128.h \ + sodium/crypto_xof_turboshake256.h \ sodium/export.h \ sodium/randombytes.h \ sodium/randombytes_internal_random.h \ diff --git a/src/libsodium/include/Makefile.in b/src/libsodium/include/Makefile.in index 5ebfbb58..a7e94008 100644 --- a/src/libsodium/include/Makefile.in +++ b/src/libsodium/include/Makefile.in @@ -368,6 +368,7 @@ SODIUM_EXPORT = \ sodium/crypto_core_ristretto255.h \ sodium/crypto_core_hchacha20.h \ sodium/crypto_core_hsalsa20.h \ + sodium/crypto_core_keccak1600.h \ sodium/crypto_core_salsa20.h \ sodium/crypto_core_salsa2012.h \ sodium/crypto_core_salsa208.h \ @@ -410,6 +411,10 @@ SODIUM_EXPORT = \ sodium/crypto_verify_16.h \ sodium/crypto_verify_32.h \ sodium/crypto_verify_64.h \ + sodium/crypto_xof_shake128.h \ + sodium/crypto_xof_shake256.h \ + sodium/crypto_xof_turboshake128.h \ + sodium/crypto_xof_turboshake256.h \ sodium/export.h \ sodium/randombytes.h \ sodium/randombytes_internal_random.h \ diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h index 86b7a4d2..953fd588 100644 --- a/src/libsodium/include/sodium.h +++ b/src/libsodium/include/sodium.h @@ -18,6 +18,7 @@ #include "sodium/crypto_box_curve25519xsalsa20poly1305.h" #include "sodium/crypto_core_hchacha20.h" #include "sodium/crypto_core_hsalsa20.h" +#include "sodium/crypto_core_keccak1600.h" #include "sodium/crypto_core_salsa20.h" #include "sodium/crypto_core_salsa2012.h" #include "sodium/crypto_core_salsa208.h" @@ -53,6 +54,10 @@ #include "sodium/crypto_verify_16.h" #include "sodium/crypto_verify_32.h" #include "sodium/crypto_verify_64.h" +#include "sodium/crypto_xof_shake128.h" +#include "sodium/crypto_xof_shake256.h" +#include "sodium/crypto_xof_turboshake128.h" +#include "sodium/crypto_xof_turboshake256.h" #include "sodium/randombytes.h" #include "sodium/randombytes_internal_random.h" #include "sodium/randombytes_sysrandom.h" diff --git a/src/libsodium/include/sodium/crypto_core_keccak1600.h b/src/libsodium/include/sodium/crypto_core_keccak1600.h new file mode 100644 index 00000000..1c84c720 --- /dev/null +++ b/src/libsodium/include/sodium/crypto_core_keccak1600.h @@ -0,0 +1,50 @@ +#ifndef crypto_core_keccak1600_H +#define crypto_core_keccak1600_H + +#include + +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +#define crypto_core_keccak1600_STATEBYTES 200U +SODIUM_EXPORT +size_t crypto_core_keccak1600_statebytes(void); + +/* Initialize state to all zeros */ +SODIUM_EXPORT +void crypto_core_keccak1600_init(void *state) + __attribute__ ((nonnull)); + +/* XOR bytes into state (for absorbing) */ +SODIUM_EXPORT +void crypto_core_keccak1600_xor_bytes(void *state, const unsigned char *bytes, + size_t offset, size_t length) + __attribute__ ((nonnull)); + +/* Extract bytes from state (for squeezing) */ +SODIUM_EXPORT +void crypto_core_keccak1600_extract_bytes(const void *state, unsigned char *bytes, + size_t offset, size_t length) + __attribute__ ((nonnull)); + +/* Keccak-f[1600]: 24 rounds (for SHAKE) */ +SODIUM_EXPORT +void crypto_core_keccak1600_permute_24(void *state) + __attribute__ ((nonnull)); + +/* Keccak-p[1600,12]: 12 rounds (for TurboSHAKE) */ +SODIUM_EXPORT +void crypto_core_keccak1600_permute_12(void *state) + __attribute__ ((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_xof_shake128.h b/src/libsodium/include/sodium/crypto_xof_shake128.h new file mode 100644 index 00000000..2a33239a --- /dev/null +++ b/src/libsodium/include/sodium/crypto_xof_shake128.h @@ -0,0 +1,55 @@ +#ifndef crypto_xof_shake128_H +#define crypto_xof_shake128_H + +#include + +#include "export.h" + +#ifdef __cplusplus +# ifdef __GNUC__ +# pragma GCC diagnostic ignored "-Wlong-long" +# endif +extern "C" { +#endif + +#define crypto_xof_shake128_BLOCKBYTES 168U +SODIUM_EXPORT +size_t crypto_xof_shake128_blockbytes(void); + +#define crypto_xof_shake128_STATEBYTES 256U +SODIUM_EXPORT +size_t crypto_xof_shake128_statebytes(void); + +#define crypto_xof_shake128_DOMAIN_STANDARD 0x1FU +SODIUM_EXPORT +unsigned char crypto_xof_shake128_domain_standard(void); + +typedef struct CRYPTO_ALIGN(64) crypto_xof_shake128_state { + unsigned char opaque[256]; +} crypto_xof_shake128_state; + +SODIUM_EXPORT +int crypto_xof_shake128(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +SODIUM_EXPORT +int crypto_xof_shake128_init(crypto_xof_shake128_state *state) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_xof_shake128_init_with_domain(crypto_xof_shake128_state *state, unsigned char domain) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_xof_shake128_update(crypto_xof_shake128_state *state, + const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +SODIUM_EXPORT +int crypto_xof_shake128_squeeze(crypto_xof_shake128_state *state, unsigned char *out, size_t outlen) + __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_xof_shake256.h b/src/libsodium/include/sodium/crypto_xof_shake256.h new file mode 100644 index 00000000..05401b0e --- /dev/null +++ b/src/libsodium/include/sodium/crypto_xof_shake256.h @@ -0,0 +1,54 @@ +#ifndef crypto_xof_shake256_H +#define crypto_xof_shake256_H + +#include "export.h" +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define crypto_xof_shake256_BLOCKBYTES 136U +SODIUM_EXPORT +size_t crypto_xof_shake256_blockbytes(void); + +#define crypto_xof_shake256_STATEBYTES 256U +SODIUM_EXPORT +size_t crypto_xof_shake256_statebytes(void); + +#define crypto_xof_shake256_DOMAIN_STANDARD 0x1FU +SODIUM_EXPORT +unsigned char crypto_xof_shake256_domain_standard(void); + +typedef struct CRYPTO_ALIGN(64) crypto_xof_shake256_state { + unsigned char opaque[256]; +} crypto_xof_shake256_state; + +/* One-shot API */ +SODIUM_EXPORT +int crypto_xof_shake256(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +/* Streaming API with standard domain */ +SODIUM_EXPORT +int crypto_xof_shake256_init(crypto_xof_shake256_state *state) __attribute__((nonnull)); + +/* Streaming API with custom domain */ +SODIUM_EXPORT +int crypto_xof_shake256_init_with_domain(crypto_xof_shake256_state *state, unsigned char domain) + __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_xof_shake256_update(crypto_xof_shake256_state *state, + const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +SODIUM_EXPORT +int crypto_xof_shake256_squeeze(crypto_xof_shake256_state *state, unsigned char *out, size_t outlen) + __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_xof_turboshake128.h b/src/libsodium/include/sodium/crypto_xof_turboshake128.h new file mode 100644 index 00000000..f097bb73 --- /dev/null +++ b/src/libsodium/include/sodium/crypto_xof_turboshake128.h @@ -0,0 +1,54 @@ +#ifndef crypto_xof_turboshake128_H +#define crypto_xof_turboshake128_H + +#include "export.h" +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define crypto_xof_turboshake128_BLOCKBYTES 168U +SODIUM_EXPORT +size_t crypto_xof_turboshake128_blockbytes(void); + +#define crypto_xof_turboshake128_STATEBYTES 256U +SODIUM_EXPORT +size_t crypto_xof_turboshake128_statebytes(void); + +#define crypto_xof_turboshake128_DOMAIN_STANDARD 0x1FU +SODIUM_EXPORT +unsigned char crypto_xof_turboshake128_domain_standard(void); + +typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake128_state { + unsigned char opaque[256]; +} crypto_xof_turboshake128_state; + +/* One-shot API */ +SODIUM_EXPORT +int crypto_xof_turboshake128(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +/* Streaming API with standard domain */ +SODIUM_EXPORT +int crypto_xof_turboshake128_init(crypto_xof_turboshake128_state *state) __attribute__((nonnull)); + +/* Streaming API with custom domain */ +SODIUM_EXPORT +int crypto_xof_turboshake128_init_with_domain(crypto_xof_turboshake128_state *state, + unsigned char domain) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_xof_turboshake128_update(crypto_xof_turboshake128_state *state, + const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +SODIUM_EXPORT +int crypto_xof_turboshake128_squeeze(crypto_xof_turboshake128_state *state, unsigned char *out, + size_t outlen) __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/crypto_xof_turboshake256.h b/src/libsodium/include/sodium/crypto_xof_turboshake256.h new file mode 100644 index 00000000..40d6465a --- /dev/null +++ b/src/libsodium/include/sodium/crypto_xof_turboshake256.h @@ -0,0 +1,54 @@ +#ifndef crypto_xof_turboshake256_H +#define crypto_xof_turboshake256_H + +#include "export.h" +#include + +#ifdef __cplusplus +extern "C" { +#endif + +#define crypto_xof_turboshake256_BLOCKBYTES 136U +SODIUM_EXPORT +size_t crypto_xof_turboshake256_blockbytes(void); + +#define crypto_xof_turboshake256_STATEBYTES 256U +SODIUM_EXPORT +size_t crypto_xof_turboshake256_statebytes(void); + +#define crypto_xof_turboshake256_DOMAIN_STANDARD 0x1FU +SODIUM_EXPORT +unsigned char crypto_xof_turboshake256_domain_standard(void); + +typedef struct CRYPTO_ALIGN(64) crypto_xof_turboshake256_state { + unsigned char opaque[256]; +} crypto_xof_turboshake256_state; + +/* One-shot API */ +SODIUM_EXPORT +int crypto_xof_turboshake256(unsigned char *out, size_t outlen, const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +/* Streaming API with standard domain */ +SODIUM_EXPORT +int crypto_xof_turboshake256_init(crypto_xof_turboshake256_state *state) __attribute__((nonnull)); + +/* Streaming API with custom domain */ +SODIUM_EXPORT +int crypto_xof_turboshake256_init_with_domain(crypto_xof_turboshake256_state *state, + unsigned char domain) __attribute__((nonnull)); + +SODIUM_EXPORT +int crypto_xof_turboshake256_update(crypto_xof_turboshake256_state *state, + const unsigned char *in, + unsigned long long inlen) __attribute__((nonnull(1))); + +SODIUM_EXPORT +int crypto_xof_turboshake256_squeeze(crypto_xof_turboshake256_state *state, unsigned char *out, + size_t outlen) __attribute__((nonnull)); + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/src/libsodium/include/sodium/private/quirks.h b/src/libsodium/include/sodium/private/quirks.h new file mode 100644 index 00000000..15533c90 --- /dev/null +++ b/src/libsodium/include/sodium/private/quirks.h @@ -0,0 +1,33 @@ +/* Minimal quirks.h for Keccak/SHAKE/TurboSHAKE symbol prefixing */ + +#ifndef quirks_H +#ifndef NO_QUIRKS + +#define keccak1600_ref_extract_bytes _sodium_keccak1600_ref_extract_bytes +#define keccak1600_ref_init _sodium_keccak1600_ref_init +#define keccak1600_ref_permute_12 _sodium_keccak1600_ref_permute_12 +#define keccak1600_ref_permute_24 _sodium_keccak1600_ref_permute_24 +#define keccak1600_ref_xor_bytes _sodium_keccak1600_ref_xor_bytes +#define shake128_ref _sodium_shake128_ref +#define shake128_ref_init _sodium_shake128_ref_init +#define shake128_ref_init_with_domain _sodium_shake128_ref_init_with_domain +#define shake128_ref_squeeze _sodium_shake128_ref_squeeze +#define shake128_ref_update _sodium_shake128_ref_update +#define shake256_ref _sodium_shake256_ref +#define shake256_ref_init _sodium_shake256_ref_init +#define shake256_ref_init_with_domain _sodium_shake256_ref_init_with_domain +#define shake256_ref_squeeze _sodium_shake256_ref_squeeze +#define shake256_ref_update _sodium_shake256_ref_update +#define turboshake128_ref _sodium_turboshake128_ref +#define turboshake128_ref_init _sodium_turboshake128_ref_init +#define turboshake128_ref_init_with_domain _sodium_turboshake128_ref_init_with_domain +#define turboshake128_ref_squeeze _sodium_turboshake128_ref_squeeze +#define turboshake128_ref_update _sodium_turboshake128_ref_update +#define turboshake256_ref _sodium_turboshake256_ref +#define turboshake256_ref_init _sodium_turboshake256_ref_init +#define turboshake256_ref_init_with_domain _sodium_turboshake256_ref_init_with_domain +#define turboshake256_ref_squeeze _sodium_turboshake256_ref_squeeze +#define turboshake256_ref_update _sodium_turboshake256_ref_update + +#endif +#endif diff --git a/test/default/Makefile.am b/test/default/Makefile.am index ad9da78b..fa188c8a 100644 --- a/test/default/Makefile.am +++ b/test/default/Makefile.am @@ -29,6 +29,7 @@ EXTRA_DIST = \ chacha20.exp \ codecs.exp \ core_ed25519.exp \ + core_keccak1600.exp \ core_ristretto255.exp \ core1.exp \ core2.exp \ @@ -84,7 +85,11 @@ EXTRA_DIST = \ stream3.exp \ stream4.exp \ verify1.exp \ - xchacha20.exp + xchacha20.exp \ + xof_shake128.exp \ + xof_shake256.exp \ + xof_turboshake128.exp \ + xof_turboshake256.exp DISTCLEANFILES = \ aead_aegis128l.res \ @@ -111,6 +116,7 @@ DISTCLEANFILES = \ chacha20.res \ codecs.res \ core_ed25519.res \ + core_keccak1600.res \ core_ristretto255.res \ core1.res \ core2.res \ @@ -167,7 +173,11 @@ DISTCLEANFILES = \ stream3.res \ stream4.res \ verify1.res \ - xchacha20.res + xchacha20.res \ + xof_shake128.res \ + xof_shake256.res \ + xof_turboshake128.res \ + xof_turboshake256.res AM_CPPFLAGS = \ -DTEST_SRCDIR=\"@srcdir@\" \ @@ -203,6 +213,7 @@ TESTS_TARGETS = \ box_seed \ chacha20 \ codecs \ + core_keccak1600 \ core1 \ core2 \ core3 \ @@ -248,7 +259,11 @@ TESTS_TARGETS = \ stream2 \ stream3 \ stream4 \ - verify1 + verify1 \ + xof_shake128 \ + xof_shake256 \ + xof_turboshake128 \ + xof_turboshake256 if !EMSCRIPTEN TESTS_TARGETS += \ @@ -335,6 +350,9 @@ codecs_LDADD = $(TESTS_LDADD) core_ed25519_SOURCE = cmptest.h core_ed25519.c core_ed25519_LDADD = $(TESTS_LDADD) +core_keccak1600_SOURCE = cmptest.h core_keccak1600.c +core_keccak1600_LDADD = $(TESTS_LDADD) + core_ristretto255_SOURCE = cmptest.h core_ristretto255.c core_ristretto255_LDADD = $(TESTS_LDADD) @@ -503,6 +521,18 @@ verify1_LDADD = $(TESTS_LDADD) xchacha20_SOURCE = cmptest.h xchacha20.c xchacha20_LDADD = $(TESTS_LDADD) +xof_shake128_SOURCE = cmptest.h xof_shake128.c +xof_shake128_LDADD = $(TESTS_LDADD) + +xof_shake256_SOURCE = cmptest.h xof_shake256.c +xof_shake256_LDADD = $(TESTS_LDADD) + +xof_turboshake128_SOURCE = cmptest.h xof_turboshake128.c +xof_turboshake128_LDADD = $(TESTS_LDADD) + +xof_turboshake256_SOURCE = cmptest.h xof_turboshake256.c +xof_turboshake256_LDADD = $(TESTS_LDADD) + if !MINIMAL TESTS_TARGETS += \ core_ed25519 \ diff --git a/test/default/Makefile.in b/test/default/Makefile.in index b64781c5..cf5b1aca 100644 --- a/test/default/Makefile.in +++ b/test/default/Makefile.in @@ -144,23 +144,25 @@ am__EXEEXT_3 = aead_aegis128l$(EXEEXT) aead_aegis256$(EXEEXT) \ box$(EXEEXT) box2$(EXEEXT) box7$(EXEEXT) box8$(EXEEXT) \ box_easy$(EXEEXT) box_easy2$(EXEEXT) box_seal$(EXEEXT) \ box_seed$(EXEEXT) chacha20$(EXEEXT) codecs$(EXEEXT) \ - core1$(EXEEXT) core2$(EXEEXT) core3$(EXEEXT) core4$(EXEEXT) \ - core5$(EXEEXT) core6$(EXEEXT) ed25519_convert$(EXEEXT) \ - generichash$(EXEEXT) generichash2$(EXEEXT) \ - generichash3$(EXEEXT) hash$(EXEEXT) hash3$(EXEEXT) \ - kdf$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) metamorphic$(EXEEXT) \ - misuse$(EXEEXT) onetimeauth$(EXEEXT) onetimeauth2$(EXEEXT) \ - onetimeauth7$(EXEEXT) pwhash_argon2i$(EXEEXT) \ - pwhash_argon2id$(EXEEXT) randombytes$(EXEEXT) \ - scalarmult$(EXEEXT) scalarmult2$(EXEEXT) scalarmult5$(EXEEXT) \ - scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) scalarmult8$(EXEEXT) \ - secretbox$(EXEEXT) secretbox2$(EXEEXT) secretbox7$(EXEEXT) \ - secretbox8$(EXEEXT) secretbox_easy$(EXEEXT) \ - secretbox_easy2$(EXEEXT) \ + core_keccak1600$(EXEEXT) core1$(EXEEXT) core2$(EXEEXT) \ + core3$(EXEEXT) core4$(EXEEXT) core5$(EXEEXT) core6$(EXEEXT) \ + ed25519_convert$(EXEEXT) generichash$(EXEEXT) \ + generichash2$(EXEEXT) generichash3$(EXEEXT) hash$(EXEEXT) \ + hash3$(EXEEXT) kdf$(EXEEXT) keygen$(EXEEXT) kx$(EXEEXT) \ + metamorphic$(EXEEXT) misuse$(EXEEXT) onetimeauth$(EXEEXT) \ + onetimeauth2$(EXEEXT) onetimeauth7$(EXEEXT) \ + pwhash_argon2i$(EXEEXT) pwhash_argon2id$(EXEEXT) \ + randombytes$(EXEEXT) scalarmult$(EXEEXT) scalarmult2$(EXEEXT) \ + scalarmult5$(EXEEXT) scalarmult6$(EXEEXT) scalarmult7$(EXEEXT) \ + scalarmult8$(EXEEXT) secretbox$(EXEEXT) secretbox2$(EXEEXT) \ + secretbox7$(EXEEXT) secretbox8$(EXEEXT) \ + secretbox_easy$(EXEEXT) secretbox_easy2$(EXEEXT) \ secretstream_xchacha20poly1305$(EXEEXT) shorthash$(EXEEXT) \ sign$(EXEEXT) sodium_core$(EXEEXT) sodium_utils$(EXEEXT) \ sodium_version$(EXEEXT) stream$(EXEEXT) stream2$(EXEEXT) \ stream3$(EXEEXT) stream4$(EXEEXT) verify1$(EXEEXT) \ + xof_shake128$(EXEEXT) xof_shake256$(EXEEXT) \ + xof_turboshake128$(EXEEXT) xof_turboshake256$(EXEEXT) \ $(am__EXEEXT_1) $(am__EXEEXT_2) aead_aegis128l_SOURCES = aead_aegis128l.c aead_aegis128l_OBJECTS = aead_aegis128l.$(OBJEXT) @@ -256,6 +258,9 @@ core6_DEPENDENCIES = $(TESTS_LDADD) core_ed25519_SOURCES = core_ed25519.c core_ed25519_OBJECTS = core_ed25519.$(OBJEXT) core_ed25519_DEPENDENCIES = $(TESTS_LDADD) +core_keccak1600_SOURCES = core_keccak1600.c +core_keccak1600_OBJECTS = core_keccak1600.$(OBJEXT) +core_keccak1600_DEPENDENCIES = $(TESTS_LDADD) core_ristretto255_SOURCES = core_ristretto255.c core_ristretto255_OBJECTS = core_ristretto255.$(OBJEXT) core_ristretto255_DEPENDENCIES = $(TESTS_LDADD) @@ -408,6 +413,18 @@ verify1_DEPENDENCIES = $(TESTS_LDADD) xchacha20_SOURCES = xchacha20.c xchacha20_OBJECTS = xchacha20.$(OBJEXT) xchacha20_DEPENDENCIES = $(TESTS_LDADD) +xof_shake128_SOURCES = xof_shake128.c +xof_shake128_OBJECTS = xof_shake128.$(OBJEXT) +xof_shake128_DEPENDENCIES = $(TESTS_LDADD) +xof_shake256_SOURCES = xof_shake256.c +xof_shake256_OBJECTS = xof_shake256.$(OBJEXT) +xof_shake256_DEPENDENCIES = $(TESTS_LDADD) +xof_turboshake128_SOURCES = xof_turboshake128.c +xof_turboshake128_OBJECTS = xof_turboshake128.$(OBJEXT) +xof_turboshake128_DEPENDENCIES = $(TESTS_LDADD) +xof_turboshake256_SOURCES = xof_turboshake256.c +xof_turboshake256_OBJECTS = xof_turboshake256.$(OBJEXT) +xof_turboshake256_DEPENDENCIES = $(TESTS_LDADD) AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false @@ -437,7 +454,8 @@ am__depfiles_remade = ./$(DEPDIR)/aead_aegis128l.Po \ ./$(DEPDIR)/chacha20.Po ./$(DEPDIR)/codecs.Po \ ./$(DEPDIR)/core1.Po ./$(DEPDIR)/core2.Po ./$(DEPDIR)/core3.Po \ ./$(DEPDIR)/core4.Po ./$(DEPDIR)/core5.Po ./$(DEPDIR)/core6.Po \ - ./$(DEPDIR)/core_ed25519.Po ./$(DEPDIR)/core_ristretto255.Po \ + ./$(DEPDIR)/core_ed25519.Po ./$(DEPDIR)/core_keccak1600.Po \ + ./$(DEPDIR)/core_ristretto255.Po \ ./$(DEPDIR)/ed25519_convert.Po ./$(DEPDIR)/generichash.Po \ ./$(DEPDIR)/generichash2.Po ./$(DEPDIR)/generichash3.Po \ ./$(DEPDIR)/hash.Po ./$(DEPDIR)/hash3.Po ./$(DEPDIR)/kdf.Po \ @@ -462,7 +480,10 @@ am__depfiles_remade = ./$(DEPDIR)/aead_aegis128l.Po \ ./$(DEPDIR)/sodium_utils3.Po ./$(DEPDIR)/sodium_version.Po \ ./$(DEPDIR)/stream.Po ./$(DEPDIR)/stream2.Po \ ./$(DEPDIR)/stream3.Po ./$(DEPDIR)/stream4.Po \ - ./$(DEPDIR)/verify1.Po ./$(DEPDIR)/xchacha20.Po + ./$(DEPDIR)/verify1.Po ./$(DEPDIR)/xchacha20.Po \ + ./$(DEPDIR)/xof_shake128.Po ./$(DEPDIR)/xof_shake256.Po \ + ./$(DEPDIR)/xof_turboshake128.Po \ + ./$(DEPDIR)/xof_turboshake256.Po am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) @@ -488,38 +509,42 @@ SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \ auth2.c auth3.c auth5.c auth6.c auth7.c box.c box2.c box7.c \ box8.c box_easy.c box_easy2.c box_seal.c box_seed.c chacha20.c \ codecs.c core1.c core2.c core3.c core4.c core5.c core6.c \ - core_ed25519.c core_ristretto255.c ed25519_convert.c \ - generichash.c generichash2.c generichash3.c hash.c hash3.c \ - kdf.c kdf_hkdf.c keygen.c kx.c metamorphic.c misuse.c \ - onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \ - pwhash_argon2id.c pwhash_scrypt.c pwhash_scrypt_ll.c \ - randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \ - scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \ - scalarmult_ristretto255.c secretbox.c secretbox2.c \ - secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \ - secretstream_xchacha20poly1305.c shorthash.c sign.c \ - siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \ - sodium_utils3.c sodium_version.c stream.c stream2.c stream3.c \ - stream4.c verify1.c xchacha20.c + core_ed25519.c core_keccak1600.c core_ristretto255.c \ + ed25519_convert.c generichash.c generichash2.c generichash3.c \ + hash.c hash3.c kdf.c kdf_hkdf.c keygen.c kx.c metamorphic.c \ + misuse.c onetimeauth.c onetimeauth2.c onetimeauth7.c \ + pwhash_argon2i.c pwhash_argon2id.c pwhash_scrypt.c \ + pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \ + scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \ + scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \ + secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \ + secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \ + sign.c siphashx24.c sodium_core.c sodium_utils.c \ + sodium_utils2.c sodium_utils3.c sodium_version.c stream.c \ + stream2.c stream3.c stream4.c verify1.c xchacha20.c \ + xof_shake128.c xof_shake256.c xof_turboshake128.c \ + xof_turboshake256.c DIST_SOURCES = aead_aegis128l.c aead_aegis256.c aead_aes256gcm.c \ aead_aes256gcm2.c aead_chacha20poly1305.c \ aead_chacha20poly13052.c aead_xchacha20poly1305.c auth.c \ auth2.c auth3.c auth5.c auth6.c auth7.c box.c box2.c box7.c \ box8.c box_easy.c box_easy2.c box_seal.c box_seed.c chacha20.c \ codecs.c core1.c core2.c core3.c core4.c core5.c core6.c \ - core_ed25519.c core_ristretto255.c ed25519_convert.c \ - generichash.c generichash2.c generichash3.c hash.c hash3.c \ - kdf.c kdf_hkdf.c keygen.c kx.c metamorphic.c misuse.c \ - onetimeauth.c onetimeauth2.c onetimeauth7.c pwhash_argon2i.c \ - pwhash_argon2id.c pwhash_scrypt.c pwhash_scrypt_ll.c \ - randombytes.c scalarmult.c scalarmult2.c scalarmult5.c \ - scalarmult6.c scalarmult7.c scalarmult8.c scalarmult_ed25519.c \ - scalarmult_ristretto255.c secretbox.c secretbox2.c \ - secretbox7.c secretbox8.c secretbox_easy.c secretbox_easy2.c \ - secretstream_xchacha20poly1305.c shorthash.c sign.c \ - siphashx24.c sodium_core.c sodium_utils.c sodium_utils2.c \ - sodium_utils3.c sodium_version.c stream.c stream2.c stream3.c \ - stream4.c verify1.c xchacha20.c + core_ed25519.c core_keccak1600.c core_ristretto255.c \ + ed25519_convert.c generichash.c generichash2.c generichash3.c \ + hash.c hash3.c kdf.c kdf_hkdf.c keygen.c kx.c metamorphic.c \ + misuse.c onetimeauth.c onetimeauth2.c onetimeauth7.c \ + pwhash_argon2i.c pwhash_argon2id.c pwhash_scrypt.c \ + pwhash_scrypt_ll.c randombytes.c scalarmult.c scalarmult2.c \ + scalarmult5.c scalarmult6.c scalarmult7.c scalarmult8.c \ + scalarmult_ed25519.c scalarmult_ristretto255.c secretbox.c \ + secretbox2.c secretbox7.c secretbox8.c secretbox_easy.c \ + secretbox_easy2.c secretstream_xchacha20poly1305.c shorthash.c \ + sign.c siphashx24.c sodium_core.c sodium_utils.c \ + sodium_utils2.c sodium_utils3.c sodium_version.c stream.c \ + stream2.c stream3.c stream4.c verify1.c xchacha20.c \ + xof_shake128.c xof_shake256.c xof_turboshake128.c \ + xof_turboshake256.c am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ @@ -957,6 +982,7 @@ EXTRA_DIST = \ chacha20.exp \ codecs.exp \ core_ed25519.exp \ + core_keccak1600.exp \ core_ristretto255.exp \ core1.exp \ core2.exp \ @@ -1012,7 +1038,11 @@ EXTRA_DIST = \ stream3.exp \ stream4.exp \ verify1.exp \ - xchacha20.exp + xchacha20.exp \ + xof_shake128.exp \ + xof_shake256.exp \ + xof_turboshake128.exp \ + xof_turboshake256.exp DISTCLEANFILES = \ aead_aegis128l.res \ @@ -1039,6 +1069,7 @@ DISTCLEANFILES = \ chacha20.res \ codecs.res \ core_ed25519.res \ + core_keccak1600.res \ core_ristretto255.res \ core1.res \ core2.res \ @@ -1095,7 +1126,11 @@ DISTCLEANFILES = \ stream3.res \ stream4.res \ verify1.res \ - xchacha20.res + xchacha20.res \ + xof_shake128.res \ + xof_shake256.res \ + xof_turboshake128.res \ + xof_turboshake256.res AM_CPPFLAGS = \ -DTEST_SRCDIR=\"@srcdir@\" \ @@ -1110,15 +1145,17 @@ TESTS_TARGETS = aead_aegis128l aead_aegis256 aead_aes256gcm \ aead_aes256gcm2 aead_chacha20poly1305 aead_chacha20poly13052 \ aead_xchacha20poly1305 auth auth2 auth3 auth5 auth6 auth7 box \ box2 box7 box8 box_easy box_easy2 box_seal box_seed chacha20 \ - codecs core1 core2 core3 core4 core5 core6 ed25519_convert \ - generichash generichash2 generichash3 hash hash3 kdf keygen kx \ - metamorphic misuse onetimeauth onetimeauth2 onetimeauth7 \ - pwhash_argon2i pwhash_argon2id randombytes scalarmult \ - scalarmult2 scalarmult5 scalarmult6 scalarmult7 scalarmult8 \ - secretbox secretbox2 secretbox7 secretbox8 secretbox_easy \ - secretbox_easy2 secretstream_xchacha20poly1305 shorthash sign \ - sodium_core sodium_utils sodium_version stream stream2 stream3 \ - stream4 verify1 $(am__append_1) $(am__append_2) + codecs core_keccak1600 core1 core2 core3 core4 core5 core6 \ + ed25519_convert generichash generichash2 generichash3 hash \ + hash3 kdf keygen kx metamorphic misuse onetimeauth \ + onetimeauth2 onetimeauth7 pwhash_argon2i pwhash_argon2id \ + randombytes scalarmult scalarmult2 scalarmult5 scalarmult6 \ + scalarmult7 scalarmult8 secretbox secretbox2 secretbox7 \ + secretbox8 secretbox_easy secretbox_easy2 \ + secretstream_xchacha20poly1305 shorthash sign sodium_core \ + sodium_utils sodium_version stream stream2 stream3 stream4 \ + verify1 xof_shake128 xof_shake256 xof_turboshake128 \ + xof_turboshake256 $(am__append_1) $(am__append_2) TESTS_LDADD = \ ${top_builddir}/src/libsodium/libsodium.la @@ -1170,6 +1207,8 @@ codecs_SOURCE = cmptest.h codecs.c codecs_LDADD = $(TESTS_LDADD) core_ed25519_SOURCE = cmptest.h core_ed25519.c core_ed25519_LDADD = $(TESTS_LDADD) +core_keccak1600_SOURCE = cmptest.h core_keccak1600.c +core_keccak1600_LDADD = $(TESTS_LDADD) core_ristretto255_SOURCE = cmptest.h core_ristretto255.c core_ristretto255_LDADD = $(TESTS_LDADD) core1_SOURCE = cmptest.h core1.c @@ -1282,6 +1321,14 @@ verify1_SOURCE = cmptest.h verify1.c verify1_LDADD = $(TESTS_LDADD) xchacha20_SOURCE = cmptest.h xchacha20.c xchacha20_LDADD = $(TESTS_LDADD) +xof_shake128_SOURCE = cmptest.h xof_shake128.c +xof_shake128_LDADD = $(TESTS_LDADD) +xof_shake256_SOURCE = cmptest.h xof_shake256.c +xof_shake256_LDADD = $(TESTS_LDADD) +xof_turboshake128_SOURCE = cmptest.h xof_turboshake128.c +xof_turboshake128_LDADD = $(TESTS_LDADD) +xof_turboshake256_SOURCE = cmptest.h xof_turboshake256.c +xof_turboshake256_LDADD = $(TESTS_LDADD) @WASI_TRUE@LOG_COMPILER = ./wasi-test-wrapper.sh all: all-am @@ -1441,6 +1488,10 @@ core_ed25519$(EXEEXT): $(core_ed25519_OBJECTS) $(core_ed25519_DEPENDENCIES) $(EX @rm -f core_ed25519$(EXEEXT) $(AM_V_CCLD)$(LINK) $(core_ed25519_OBJECTS) $(core_ed25519_LDADD) $(LIBS) +core_keccak1600$(EXEEXT): $(core_keccak1600_OBJECTS) $(core_keccak1600_DEPENDENCIES) $(EXTRA_core_keccak1600_DEPENDENCIES) + @rm -f core_keccak1600$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(core_keccak1600_OBJECTS) $(core_keccak1600_LDADD) $(LIBS) + core_ristretto255$(EXEEXT): $(core_ristretto255_OBJECTS) $(core_ristretto255_DEPENDENCIES) $(EXTRA_core_ristretto255_DEPENDENCIES) @rm -f core_ristretto255$(EXEEXT) $(AM_V_CCLD)$(LINK) $(core_ristretto255_OBJECTS) $(core_ristretto255_LDADD) $(LIBS) @@ -1641,6 +1692,22 @@ xchacha20$(EXEEXT): $(xchacha20_OBJECTS) $(xchacha20_DEPENDENCIES) $(EXTRA_xchac @rm -f xchacha20$(EXEEXT) $(AM_V_CCLD)$(LINK) $(xchacha20_OBJECTS) $(xchacha20_LDADD) $(LIBS) +xof_shake128$(EXEEXT): $(xof_shake128_OBJECTS) $(xof_shake128_DEPENDENCIES) $(EXTRA_xof_shake128_DEPENDENCIES) + @rm -f xof_shake128$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(xof_shake128_OBJECTS) $(xof_shake128_LDADD) $(LIBS) + +xof_shake256$(EXEEXT): $(xof_shake256_OBJECTS) $(xof_shake256_DEPENDENCIES) $(EXTRA_xof_shake256_DEPENDENCIES) + @rm -f xof_shake256$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(xof_shake256_OBJECTS) $(xof_shake256_LDADD) $(LIBS) + +xof_turboshake128$(EXEEXT): $(xof_turboshake128_OBJECTS) $(xof_turboshake128_DEPENDENCIES) $(EXTRA_xof_turboshake128_DEPENDENCIES) + @rm -f xof_turboshake128$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(xof_turboshake128_OBJECTS) $(xof_turboshake128_LDADD) $(LIBS) + +xof_turboshake256$(EXEEXT): $(xof_turboshake256_OBJECTS) $(xof_turboshake256_DEPENDENCIES) $(EXTRA_xof_turboshake256_DEPENDENCIES) + @rm -f xof_turboshake256$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(xof_turboshake256_OBJECTS) $(xof_turboshake256_LDADD) $(LIBS) + mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -1677,6 +1744,7 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/core5.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/core6.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/core_ed25519.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/core_keccak1600.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/core_ristretto255.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ed25519_convert.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/generichash.Po@am__quote@ # am--include-marker @@ -1727,6 +1795,10 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/stream4.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/verify1.Po@am__quote@ # am--include-marker @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xchacha20.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xof_shake128.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xof_shake256.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xof_turboshake128.Po@am__quote@ # am--include-marker +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/xof_turboshake256.Po@am__quote@ # am--include-marker $(am__depfiles_remade): @$(MKDIR_P) $(@D) @@ -2143,6 +2215,13 @@ codecs.log: codecs$(EXEEXT) --log-file $$b.log --trs-file $$b.trs \ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ "$$tst" $(AM_TESTS_FD_REDIRECT) +core_keccak1600.log: core_keccak1600$(EXEEXT) + @p='core_keccak1600$(EXEEXT)'; \ + b='core_keccak1600'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) core1.log: core1$(EXEEXT) @p='core1$(EXEEXT)'; \ b='core1'; \ @@ -2465,6 +2544,34 @@ verify1.log: verify1$(EXEEXT) --log-file $$b.log --trs-file $$b.trs \ $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ "$$tst" $(AM_TESTS_FD_REDIRECT) +xof_shake128.log: xof_shake128$(EXEEXT) + @p='xof_shake128$(EXEEXT)'; \ + b='xof_shake128'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) +xof_shake256.log: xof_shake256$(EXEEXT) + @p='xof_shake256$(EXEEXT)'; \ + b='xof_shake256'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) +xof_turboshake128.log: xof_turboshake128$(EXEEXT) + @p='xof_turboshake128$(EXEEXT)'; \ + b='xof_turboshake128'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) +xof_turboshake256.log: xof_turboshake256$(EXEEXT) + @p='xof_turboshake256$(EXEEXT)'; \ + b='xof_turboshake256'; \ + $(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \ + --log-file $$b.log --trs-file $$b.trs \ + $(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \ + "$$tst" $(AM_TESTS_FD_REDIRECT) sodium_utils2.log: sodium_utils2$(EXEEXT) @p='sodium_utils2$(EXEEXT)'; \ b='sodium_utils2'; \ @@ -2666,6 +2773,7 @@ distclean: distclean-am -rm -f ./$(DEPDIR)/core5.Po -rm -f ./$(DEPDIR)/core6.Po -rm -f ./$(DEPDIR)/core_ed25519.Po + -rm -f ./$(DEPDIR)/core_keccak1600.Po -rm -f ./$(DEPDIR)/core_ristretto255.Po -rm -f ./$(DEPDIR)/ed25519_convert.Po -rm -f ./$(DEPDIR)/generichash.Po @@ -2716,6 +2824,10 @@ distclean: distclean-am -rm -f ./$(DEPDIR)/stream4.Po -rm -f ./$(DEPDIR)/verify1.Po -rm -f ./$(DEPDIR)/xchacha20.Po + -rm -f ./$(DEPDIR)/xof_shake128.Po + -rm -f ./$(DEPDIR)/xof_shake256.Po + -rm -f ./$(DEPDIR)/xof_turboshake128.Po + -rm -f ./$(DEPDIR)/xof_turboshake256.Po -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags @@ -2791,6 +2903,7 @@ maintainer-clean: maintainer-clean-am -rm -f ./$(DEPDIR)/core5.Po -rm -f ./$(DEPDIR)/core6.Po -rm -f ./$(DEPDIR)/core_ed25519.Po + -rm -f ./$(DEPDIR)/core_keccak1600.Po -rm -f ./$(DEPDIR)/core_ristretto255.Po -rm -f ./$(DEPDIR)/ed25519_convert.Po -rm -f ./$(DEPDIR)/generichash.Po @@ -2841,6 +2954,10 @@ maintainer-clean: maintainer-clean-am -rm -f ./$(DEPDIR)/stream4.Po -rm -f ./$(DEPDIR)/verify1.Po -rm -f ./$(DEPDIR)/xchacha20.Po + -rm -f ./$(DEPDIR)/xof_shake128.Po + -rm -f ./$(DEPDIR)/xof_shake256.Po + -rm -f ./$(DEPDIR)/xof_turboshake128.Po + -rm -f ./$(DEPDIR)/xof_turboshake256.Po -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic diff --git a/test/default/core_keccak1600.c b/test/default/core_keccak1600.c new file mode 100644 index 00000000..6f6db72a --- /dev/null +++ b/test/default/core_keccak1600.c @@ -0,0 +1,235 @@ + +#define TEST_NAME "core_keccak1600" +#include "cmptest.h" + +static void +print_hex(const char *label, const unsigned char *data, size_t len) +{ + size_t i; + printf("%s", label); + for (i = 0; i < len; i++) { + printf("%02x", data[i]); + } + printf("\n"); +} + +static int +compare_states(const char *label, const unsigned char *actual, const unsigned char *expected, + size_t len) +{ + size_t i; + for (i = 0; i < len; i++) { + if (actual[i] != expected[i]) { + printf("FAIL: %s mismatch at byte %u\n", label, (unsigned int) i); + printf(" Expected: "); + for (size_t j = 0; j < len; j++) { + printf("%02x", expected[j]); + } + printf("\n Got: "); + for (size_t j = 0; j < len; j++) { + printf("%02x", actual[j]); + } + printf("\n"); + return -1; + } + } + printf("PASS: %s\n", label); + return 0; +} + +int +main(void) +{ + unsigned char state[crypto_core_keccak1600_STATEBYTES]; + unsigned char extracted[64]; + size_t i; + int test_failures = 0; + + /* Test vectors for Keccak-f[1600] (24 rounds) */ + /* Test vector 1: All-zero input for Keccak-f[1600] */ + static const unsigned char keccak_f_1600_zero_input[200] = { 0 }; + static const unsigned char keccak_f_1600_zero_expected[200] = { + 0xe7, 0xdd, 0xe1, 0x40, 0x79, 0x8f, 0x25, 0xf1, 0x8a, 0x47, 0xc0, 0x33, 0xf9, 0xcc, 0xd5, + 0x84, 0xee, 0xa9, 0x5a, 0xa6, 0x1e, 0x26, 0x98, 0xd5, 0x4d, 0x49, 0x80, 0x6f, 0x30, 0x47, + 0x15, 0xbd, 0x57, 0xd0, 0x53, 0x62, 0x05, 0x4e, 0x28, 0x8b, 0xd4, 0x6f, 0x8e, 0x7f, 0x2d, + 0xa4, 0x97, 0xff, 0xc4, 0x47, 0x46, 0xa4, 0xa0, 0xe5, 0xfe, 0x90, 0x76, 0x2e, 0x19, 0xd6, + 0x0c, 0xda, 0x5b, 0x8c, 0x9c, 0x05, 0x19, 0x1b, 0xf7, 0xa6, 0x30, 0xad, 0x64, 0xfc, 0x8f, + 0xd0, 0xb7, 0x5a, 0x93, 0x30, 0x35, 0xd6, 0x17, 0x23, 0x3f, 0xa9, 0x5a, 0xeb, 0x03, 0x21, + 0x71, 0x0d, 0x26, 0xe6, 0xa6, 0xa9, 0x5f, 0x55, 0xcf, 0xdb, 0x16, 0x7c, 0xa5, 0x81, 0x26, + 0xc8, 0x47, 0x03, 0xcd, 0x31, 0xb8, 0x43, 0x9f, 0x56, 0xa5, 0x11, 0x1a, 0x2f, 0xf2, 0x01, + 0x61, 0xae, 0xd9, 0x21, 0x5a, 0x63, 0xe5, 0x05, 0xf2, 0x70, 0xc9, 0x8c, 0xf2, 0xfe, 0xbe, + 0x64, 0x11, 0x66, 0xc4, 0x7b, 0x95, 0x70, 0x36, 0x61, 0xcb, 0x0e, 0xd0, 0x4f, 0x55, 0x5a, + 0x7c, 0xb8, 0xc8, 0x32, 0xcf, 0x1c, 0x8a, 0xe8, 0x3e, 0x8c, 0x14, 0x26, 0x3a, 0xae, 0x22, + 0x79, 0x0c, 0x94, 0xe4, 0x09, 0xc5, 0xa2, 0x24, 0xf9, 0x41, 0x18, 0xc2, 0x65, 0x04, 0xe7, + 0x26, 0x35, 0xf5, 0x16, 0x3b, 0xa1, 0x30, 0x7f, 0xe9, 0x44, 0xf6, 0x75, 0x49, 0xa2, 0xec, + 0x5c, 0x7b, 0xff, 0xf1, 0xea + }; + + /* Test vector 2: Pattern input for Keccak-f[1600] */ + static const unsigned char keccak_f_1600_pattern_input[200] = { + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, 0xa3, + 0xa3, 0xa3, 0xa3, 0xa3, 0xa3 + }; + static const unsigned char keccak_f_1600_pattern_expected[200] = { + 0xcc, 0x44, 0x83, 0xfe, 0xb5, 0x5e, 0x43, 0xf4, 0x6d, 0x88, 0x81, 0xbd, 0x35, 0x8e, 0xbf, + 0x75, 0x9a, 0x06, 0xe7, 0xcd, 0x81, 0xf5, 0xca, 0x48, 0xbf, 0xb7, 0x1b, 0x19, 0xc8, 0x02, + 0x61, 0x45, 0x00, 0x0a, 0x17, 0x39, 0xb1, 0x18, 0x89, 0xc7, 0x3d, 0x53, 0xa9, 0x78, 0x17, + 0xd2, 0x82, 0x4e, 0x52, 0xe6, 0x76, 0xbd, 0xe5, 0xce, 0xee, 0x9a, 0x86, 0x6e, 0x8b, 0x4c, + 0xca, 0x8c, 0xf2, 0x99, 0xd8, 0x18, 0x53, 0xa0, 0x06, 0x15, 0x02, 0xff, 0x1a, 0x7b, 0x11, + 0x82, 0x7c, 0x96, 0x7d, 0x8c, 0xf2, 0xc6, 0x21, 0xa6, 0x24, 0xda, 0x96, 0x75, 0xd2, 0xab, + 0xc9, 0x30, 0x89, 0x22, 0x18, 0x14, 0x7e, 0xa9, 0x07, 0xa6, 0xf0, 0x88, 0x7a, 0x86, 0x6c, + 0x7b, 0x79, 0x89, 0xe0, 0x6c, 0xcf, 0x82, 0x66, 0x62, 0x63, 0x79, 0x98, 0x37, 0x44, 0xce, + 0x1d, 0xe1, 0xb1, 0xb5, 0x12, 0xca, 0x63, 0x6f, 0x25, 0x47, 0x14, 0x1d, 0xef, 0x48, 0x47, + 0xac, 0x64, 0x6a, 0x76, 0xbc, 0x25, 0xbc, 0xed, 0x98, 0xb7, 0x34, 0xfd, 0xd6, 0x65, 0x15, + 0x4d, 0x85, 0xe8, 0x1e, 0x65, 0x08, 0x09, 0x28, 0x19, 0x39, 0x04, 0xf7, 0x6f, 0xec, 0x96, + 0x27, 0xa2, 0x23, 0x3b, 0x2f, 0x75, 0x02, 0x09, 0x25, 0x0d, 0x46, 0xb9, 0x77, 0x65, 0xd0, + 0x19, 0xa5, 0x5a, 0x97, 0xc8, 0xf9, 0x81, 0x4b, 0xfd, 0xb5, 0x38, 0xb9, 0xbc, 0x68, 0x55, + 0xac, 0x35, 0x1b, 0xf1, 0xe4 + }; + + /* Test vectors for Keccak-p[1600,12] (12 rounds, TurboSHAKE) */ + /* Test vector 3: All-zero input for Keccak-p[1600,12] */ + static const unsigned char keccak_p_12_zero_expected[200] = { + 0x17, 0x86, 0xa7, 0xb9, 0x38, 0x54, 0x5e, 0x8e, 0x1e, 0xd0, 0x59, 0xf2, 0x50, 0x6a, 0xcd, + 0xd9, 0x35, 0x1f, 0xa9, 0x52, 0xc6, 0xe7, 0xb8, 0x87, 0xc5, 0xe0, 0xe4, 0xcd, 0x67, 0xe0, + 0x93, 0x10, 0x45, 0x5a, 0xd9, 0xf2, 0x90, 0xab, 0x33, 0xb0, 0x45, 0x1a, 0xdd, 0xa8, 0x72, + 0x2f, 0xa7, 0xe0, 0x9c, 0x2f, 0x67, 0x14, 0xaa, 0x80, 0x37, 0xc5, 0x1d, 0x07, 0x51, 0x00, + 0xf5, 0x47, 0xdd, 0x3e, 0xcc, 0x8a, 0x17, 0x0c, 0x31, 0x1d, 0xa3, 0xb3, 0xa0, 0xaa, 0x57, + 0x92, 0xa5, 0x86, 0xb5, 0x79, 0x9b, 0xf9, 0xb1, 0xb3, 0x3d, 0x7c, 0x4a, 0xbc, 0x93, 0x67, + 0x8a, 0xe6, 0x63, 0x40, 0x87, 0x68, 0x66, 0x25, 0x0e, 0x2e, 0x33, 0x03, 0x6c, 0x5c, 0xda, + 0x30, 0xf0, 0xb9, 0x02, 0x12, 0xaa, 0x9c, 0x9f, 0x7a, 0xcf, 0x2b, 0x78, 0x9a, 0x3b, 0x5f, + 0x23, 0x79, 0xae, 0x61, 0xe0, 0xc1, 0x36, 0xe5, 0xec, 0x87, 0x3c, 0xb7, 0x18, 0xb6, 0xe9, + 0x6d, 0xc2, 0x8a, 0x91, 0x70, 0xf1, 0xd1, 0xbe, 0x2a, 0xb7, 0x24, 0xed, 0xda, 0x53, 0xbd, + 0xab, 0x6a, 0x5a, 0xe1, 0x2e, 0x2c, 0x6a, 0x41, 0xc1, 0xbf, 0xaf, 0x52, 0x09, 0xb9, 0x36, + 0xe0, 0xcf, 0xc6, 0xd7, 0x60, 0x70, 0xdc, 0x17, 0x36, 0x50, 0x45, 0xe4, 0x7a, 0x9f, 0xc2, + 0xb2, 0x11, 0x56, 0x62, 0x7a, 0x64, 0x30, 0x2c, 0xdb, 0x71, 0x36, 0xd4, 0x1c, 0xa0, 0x2c, + 0x22, 0x76, 0x0d, 0xfd, 0xcf + }; + + printf("=== Keccak-1600 Core Function Tests ===\n\n"); + + /* Basic API tests */ + printf("Test 1: API constants\n"); + printf(" statebytes: %u\n", (unsigned int) crypto_core_keccak1600_statebytes()); + assert(crypto_core_keccak1600_statebytes() == crypto_core_keccak1600_STATEBYTES); + assert(crypto_core_keccak1600_STATEBYTES == 200U); + printf(" PASS: statebytes = 200\n\n"); + + /* Test 2: Init function */ + printf("Test 2: crypto_core_keccak1600_init\n"); + memset(state, 0xFF, sizeof state); + crypto_core_keccak1600_init(state); + for (i = 0; i < crypto_core_keccak1600_STATEBYTES; i++) { + if (state[i] != 0) { + printf(" FAIL: State not zeroed at byte %u\n", (unsigned int) i); + test_failures++; + break; + } + } + if (i == crypto_core_keccak1600_STATEBYTES) { + printf(" PASS: State initialized to zeros\n\n"); + } + + /* Test 3: XOR and extract functions */ + printf("Test 3: crypto_core_keccak1600_xor_bytes and extract_bytes\n"); + crypto_core_keccak1600_init(state); + unsigned char test_data[64]; + for (i = 0; i < sizeof test_data; i++) { + test_data[i] = (unsigned char) i; + } + crypto_core_keccak1600_xor_bytes(state, test_data, 0, sizeof test_data); + crypto_core_keccak1600_extract_bytes(state, extracted, 0, sizeof test_data); + if (memcmp(extracted, test_data, sizeof test_data) == 0) { + printf(" PASS: XOR and extract work correctly\n\n"); + } else { + printf(" FAIL: XOR/extract mismatch\n\n"); + test_failures++; + } + + /* Test 4: Keccak-f[1600] with all-zero input (24 rounds) */ + printf("Test 4: Keccak-f[1600] (24 rounds) - Zero input\n"); + memcpy(state, keccak_f_1600_zero_input, 200); + crypto_core_keccak1600_permute_24(state); + test_failures += + compare_states(" Keccak-f[1600] zero", state, keccak_f_1600_zero_expected, 200); + printf("\n"); + + /* Test 5: Keccak-f[1600] with pattern input (24 rounds) */ + printf("Test 5: Keccak-f[1600] (24 rounds) - Pattern 0xa3 input\n"); + memcpy(state, keccak_f_1600_pattern_input, 200); + crypto_core_keccak1600_permute_24(state); + test_failures += + compare_states(" Keccak-f[1600] pattern", state, keccak_f_1600_pattern_expected, 200); + printf("\n"); + + /* Test 6: Keccak-p[1600,12] with all-zero input (12 rounds) */ + printf("Test 6: Keccak-p[1600,12] (12 rounds) - Zero input\n"); + crypto_core_keccak1600_init(state); + crypto_core_keccak1600_permute_12(state); + test_failures += + compare_states(" Keccak-p[1600,12] zero", state, keccak_p_12_zero_expected, 200); + printf("\n"); + + /* Test 7: Verify 12 and 24 rounds produce different outputs */ + printf("Test 7: Verify 12-round and 24-round differ\n"); + unsigned char state_12[200], state_24[200]; + crypto_core_keccak1600_init(state_12); + crypto_core_keccak1600_init(state_24); + crypto_core_keccak1600_permute_12(state_12); + crypto_core_keccak1600_permute_24(state_24); + + int differs = 0; + for (i = 0; i < 200; i++) { + if (state_12[i] != state_24[i]) { + differs = 1; + break; + } + } + if (differs) { + printf(" PASS: 12-round and 24-round produce different outputs\n"); + printf(" First difference at byte %u: 12-round=0x%02x, 24-round=0x%02x\n\n", + (unsigned int) i, state_12[i], state_24[i]); + } else { + printf(" FAIL: 12-round and 24-round produce identical outputs\n\n"); + test_failures++; + } + + /* Test 8: Multiple permutations */ + printf("Test 8: Double permutation consistency\n"); + crypto_core_keccak1600_init(state); + crypto_core_keccak1600_permute_24(state); + memcpy(state_24, state, 200); + crypto_core_keccak1600_permute_24(state); + printf(" After 24+24 rounds: "); + print_hex("", state, 32); + + crypto_core_keccak1600_init(state); + crypto_core_keccak1600_permute_12(state); + memcpy(state_12, state, 200); + crypto_core_keccak1600_permute_12(state); + printf(" After 12+12 rounds: "); + print_hex("", state, 32); + printf("\n"); + + /* Final summary */ + printf("=== Test Summary ===\n"); + if (test_failures == 0) { + printf("All tests PASSED!\n"); + return 0; + } else { + printf("FAILED: %d test(s) failed\n", test_failures); + return 1; + } +} diff --git a/test/default/core_keccak1600.exp b/test/default/core_keccak1600.exp new file mode 100644 index 00000000..6660f0db --- /dev/null +++ b/test/default/core_keccak1600.exp @@ -0,0 +1,31 @@ +=== Keccak-1600 Core Function Tests === + +Test 1: API constants + statebytes: 200 + PASS: statebytes = 200 + +Test 2: crypto_core_keccak1600_init + PASS: State initialized to zeros + +Test 3: crypto_core_keccak1600_xor_bytes and extract_bytes + PASS: XOR and extract work correctly + +Test 4: Keccak-f[1600] (24 rounds) - Zero input +PASS: Keccak-f[1600] zero + +Test 5: Keccak-f[1600] (24 rounds) - Pattern 0xa3 input +PASS: Keccak-f[1600] pattern + +Test 6: Keccak-p[1600,12] (12 rounds) - Zero input +PASS: Keccak-p[1600,12] zero + +Test 7: Verify 12-round and 24-round differ + PASS: 12-round and 24-round produce different outputs + First difference at byte 0: 12-round=0x17, 24-round=0xe7 + +Test 8: Double permutation consistency + After 24+24 rounds: 3ccb6ef94d955c2d6db55770d02c336a6c6bd770128d3d0994d06955b2d9208a + After 12+12 rounds: 048cbb36dc66034bc96a2de69835165f46e73b55de051b436c7a6154c9469f48 + +=== Test Summary === +All tests PASSED! diff --git a/test/default/xof_shake128.c b/test/default/xof_shake128.c new file mode 100644 index 00000000..fabe107b --- /dev/null +++ b/test/default/xof_shake128.c @@ -0,0 +1,215 @@ + +#define TEST_NAME "xof_shake128" +#include "cmptest.h" + +typedef struct { + const unsigned char *msg; + size_t msg_len; + const unsigned char *out; + size_t out_len; +} testvector; + +static void +shake128_manual_with_domain(unsigned char *out, size_t outlen, const unsigned char *in, + size_t inlen, unsigned char domain) +{ + unsigned char state[crypto_core_keccak1600_STATEBYTES]; + size_t rate = crypto_xof_shake128_blockbytes(); + size_t offset = 0; + size_t consumed = 0; + size_t chunk_size; + size_t extracted = 0; + unsigned char pad; + + crypto_core_keccak1600_init(state); + + while (consumed < inlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state, &in[consumed], offset, chunk_size); + offset += chunk_size; + consumed += chunk_size; + } + + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + + if (offset == rate - 1) { + pad = (unsigned char) (domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state, &pad, offset, 1); + } else { + crypto_core_keccak1600_xor_bytes(state, &domain, offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state, &pad, rate - 1, 1); + } + + crypto_core_keccak1600_permute_24(state); + offset = 0; + + while (extracted < outlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state, &out[extracted], offset, chunk_size); + offset += chunk_size; + extracted += chunk_size; + } +} + +int +main(void) +{ + /* Test vectors from NIST and various sources */ + static const unsigned char msg_empty[] = ""; + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + static const unsigned char msg_fox[] = { 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, + 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, + 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, 0x73, 0x20, 0x6f, + 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 }; + static const unsigned char msg_rate_block[168] = { 0 }; + + static const unsigned char out_empty_32[] = { 0x7f, 0x9c, 0x2b, 0xa4, 0xe8, 0x8f, 0x82, 0x7d, + 0x61, 0x60, 0x45, 0x50, 0x76, 0x05, 0x85, 0x3e, + 0xd7, 0x3b, 0x80, 0x93, 0xf6, 0xef, 0xbc, 0x88, + 0xeb, 0x1a, 0x6e, 0xac, 0xfa, 0x66, 0xef, 0x26 }; + + static const unsigned char out_empty_64[] = { + 0x7f, 0x9c, 0x2b, 0xa4, 0xe8, 0x8f, 0x82, 0x7d, 0x61, 0x60, 0x45, 0x50, 0x76, + 0x05, 0x85, 0x3e, 0xd7, 0x3b, 0x80, 0x93, 0xf6, 0xef, 0xbc, 0x88, 0xeb, 0x1a, + 0x6e, 0xac, 0xfa, 0x66, 0xef, 0x26, 0x3c, 0xb1, 0xee, 0xa9, 0x88, 0x00, 0x4b, + 0x93, 0x10, 0x3c, 0xfb, 0x0a, 0xee, 0xfd, 0x2a, 0x68, 0x6e, 0x01, 0xfa, 0x4a, + 0x58, 0xe8, 0xa3, 0x63, 0x9c, 0xa8, 0xa1, 0xe3, 0xf9, 0xae, 0x57, 0xe2 + }; + + static const unsigned char out_abc_32[] = { 0x58, 0x81, 0x09, 0x2d, 0xd8, 0x18, 0xbf, 0x5c, + 0xf8, 0xa3, 0xdd, 0xb7, 0x93, 0xfb, 0xcb, 0xa7, + 0x40, 0x97, 0xd5, 0xc5, 0x26, 0xa6, 0xd3, 0x5f, + 0x97, 0xb8, 0x33, 0x51, 0x94, 0x0f, 0x2c, 0xc8 }; + + static const unsigned char out_fox_32[] = { 0xf4, 0x20, 0x2e, 0x3c, 0x58, 0x52, 0xf9, 0x18, + 0x2a, 0x04, 0x30, 0xfd, 0x81, 0x44, 0xf0, 0xa7, + 0x4b, 0x95, 0xe7, 0x41, 0x7e, 0xca, 0xe1, 0x7d, + 0xb0, 0xf8, 0xcf, 0xee, 0xd0, 0xe3, 0xe6, 0x6e }; + + static const unsigned char out_fox_64[] = { + 0xf4, 0x20, 0x2e, 0x3c, 0x58, 0x52, 0xf9, 0x18, 0x2a, 0x04, 0x30, 0xfd, 0x81, + 0x44, 0xf0, 0xa7, 0x4b, 0x95, 0xe7, 0x41, 0x7e, 0xca, 0xe1, 0x7d, 0xb0, 0xf8, + 0xcf, 0xee, 0xd0, 0xe3, 0xe6, 0x6e, 0xb5, 0x58, 0x5e, 0xc6, 0xf8, 0x60, 0x21, + 0xca, 0xcf, 0x27, 0x2c, 0x79, 0x8b, 0xcf, 0x97, 0xd3, 0x68, 0xb8, 0x86, 0xb1, + 0x8f, 0xec, 0x3a, 0x57, 0x1f, 0x09, 0x60, 0x86, 0xa5, 0x23, 0x71, 0x7a + }; + + static const unsigned char out_rate_block_32[] = { 0x7c, 0x00, 0xff, 0x47, 0x48, 0x87, 0x0c, + 0xb2, 0x6d, 0xa4, 0xdc, 0x07, 0x8a, 0xff, + 0x74, 0x47, 0x7a, 0xb1, 0x53, 0xfa, 0x11, + 0x91, 0xc7, 0xb6, 0x36, 0xfe, 0xa6, 0xc0, + 0x1e, 0xcc, 0x1f, 0xab }; + + testvector vectors[] = { { msg_empty, 0, out_empty_32, 32 }, + { msg_empty, 0, out_empty_64, 64 }, + { msg_abc, 3, out_abc_32, 32 }, + { msg_fox, 43, out_fox_32, 32 }, + { msg_fox, 43, out_fox_64, 64 }, + { msg_rate_block, sizeof msg_rate_block, out_rate_block_32, 32 } }; + + unsigned char out[256]; + crypto_xof_shake128_state state; + size_t i; + + /* Test constants */ + assert(crypto_xof_shake128_blockbytes() == 168); + assert(crypto_xof_shake128_statebytes() == 256); + assert(crypto_xof_shake128_domain_standard() == 0x1F); + + /* Test one-shot API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_shake128(out, vectors[i].out_len, vectors[i].msg, vectors[i].msg_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (one-shot)\n", i); + return 1; + } + } + + /* Test streaming API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_shake128_init(&state); + crypto_xof_shake128_update(&state, vectors[i].msg, vectors[i].msg_len); + crypto_xof_shake128_squeeze(&state, out, vectors[i].out_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (streaming)\n", i); + return 1; + } + } + + /* Test multiple squeeze calls */ + crypto_xof_shake128_init(&state); + crypto_xof_shake128_update(&state, msg_abc, 3); + crypto_xof_shake128_squeeze(&state, out, 16); + crypto_xof_shake128_squeeze(&state, out + 16, 16); + if (memcmp(out, out_abc_32, 32) != 0) { + printf("Multiple squeeze test failed\n"); + return 1; + } + + /* Test custom domain byte produces different output */ + crypto_xof_shake128_init(&state); + crypto_xof_shake128_update(&state, msg_abc, 3); + crypto_xof_shake128_squeeze(&state, out, 32); + + crypto_xof_shake128_init_with_domain(&state, 0x99); + crypto_xof_shake128_update(&state, msg_abc, 3); + crypto_xof_shake128_squeeze(&state, out + 32, 32); + + if (memcmp(out, out + 32, 32) == 0) { + printf("Custom domain byte test failed (outputs should differ)\n"); + return 1; + } + + /* Test standard domain constant */ + crypto_xof_shake128_init_with_domain(&state, crypto_xof_shake128_domain_standard()); + crypto_xof_shake128_update(&state, msg_abc, 3); + crypto_xof_shake128_squeeze(&state, out + 64, 32); + + if (memcmp(out, out + 64, 32) != 0) { + printf("Domain constant test failed (should match standard init)\n"); + return 1; + } + + /* Test domain byte with MSB set when padding overlaps */ + { + unsigned char msg[crypto_xof_shake128_BLOCKBYTES - 1]; + unsigned char out_manual[32]; + unsigned char out_impl[32]; + const unsigned char domain = 0x99; + + memset(msg, 0xAA, sizeof msg); + + shake128_manual_with_domain(out_manual, sizeof out_manual, msg, sizeof msg, domain); + + crypto_xof_shake128_init_with_domain(&state, domain); + crypto_xof_shake128_update(&state, msg, sizeof msg); + crypto_xof_shake128_squeeze(&state, out_impl, sizeof out_impl); + + if (memcmp(out_manual, out_impl, sizeof out_manual) != 0) { + printf("Domain MSB padding test failed\n"); + return 1; + } + } + + printf("All SHAKE-128 tests passed\n"); + return 0; +} diff --git a/test/default/xof_shake128.exp b/test/default/xof_shake128.exp new file mode 100644 index 00000000..bce522cb --- /dev/null +++ b/test/default/xof_shake128.exp @@ -0,0 +1 @@ +All SHAKE-128 tests passed diff --git a/test/default/xof_shake256.c b/test/default/xof_shake256.c new file mode 100644 index 00000000..112b783b --- /dev/null +++ b/test/default/xof_shake256.c @@ -0,0 +1,216 @@ + +#define TEST_NAME "xof_shake256" +#include "cmptest.h" + +typedef struct { + const unsigned char *msg; + size_t msg_len; + const unsigned char *out; + size_t out_len; +} testvector; + +static void +shake256_manual_with_domain(unsigned char *out, size_t outlen, const unsigned char *in, + size_t inlen, unsigned char domain) +{ + unsigned char state[crypto_core_keccak1600_STATEBYTES]; + size_t rate = crypto_xof_shake256_blockbytes(); + size_t offset = 0; + size_t consumed = 0; + size_t chunk_size; + size_t extracted = 0; + unsigned char pad; + + crypto_core_keccak1600_init(state); + + while (consumed < inlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state, &in[consumed], offset, chunk_size); + offset += chunk_size; + consumed += chunk_size; + } + + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + + if (offset == rate - 1) { + pad = (unsigned char) (domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state, &pad, offset, 1); + } else { + crypto_core_keccak1600_xor_bytes(state, &domain, offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state, &pad, rate - 1, 1); + } + + crypto_core_keccak1600_permute_24(state); + offset = 0; + + while (extracted < outlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_24(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state, &out[extracted], offset, chunk_size); + offset += chunk_size; + extracted += chunk_size; + } +} + +int +main(void) +{ + /* Test vectors from NIST FIPS 202 and various sources */ + static const unsigned char msg_empty[] = ""; + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + static const unsigned char msg_fox[] = { 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, + 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, + 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, 0x73, 0x20, 0x6f, + 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 }; + static const unsigned char msg_rate_block[136] = { 0 }; + + /* SHAKE-256 test vectors */ + static const unsigned char out_empty_32[] = { 0x46, 0xb9, 0xdd, 0x2b, 0x0b, 0xa8, 0x8d, 0x13, + 0x23, 0x3b, 0x3f, 0xeb, 0x74, 0x3e, 0xeb, 0x24, + 0x3f, 0xcd, 0x52, 0xea, 0x62, 0xb8, 0x1b, 0x82, + 0xb5, 0x0c, 0x27, 0x64, 0x6e, 0xd5, 0x76, 0x2f }; + + static const unsigned char out_empty_64[] = { + 0x46, 0xb9, 0xdd, 0x2b, 0x0b, 0xa8, 0x8d, 0x13, 0x23, 0x3b, 0x3f, 0xeb, 0x74, + 0x3e, 0xeb, 0x24, 0x3f, 0xcd, 0x52, 0xea, 0x62, 0xb8, 0x1b, 0x82, 0xb5, 0x0c, + 0x27, 0x64, 0x6e, 0xd5, 0x76, 0x2f, 0xd7, 0x5d, 0xc4, 0xdd, 0xd8, 0xc0, 0xf2, + 0x00, 0xcb, 0x05, 0x01, 0x9d, 0x67, 0xb5, 0x92, 0xf6, 0xfc, 0x82, 0x1c, 0x49, + 0x47, 0x9a, 0xb4, 0x86, 0x40, 0x29, 0x2e, 0xac, 0xb3, 0xb7, 0xc4, 0xbe + }; + + static const unsigned char out_abc_32[] = { 0x48, 0x33, 0x66, 0x60, 0x13, 0x60, 0xa8, 0x77, + 0x1c, 0x68, 0x63, 0x08, 0x0c, 0xc4, 0x11, 0x4d, + 0x8d, 0xb4, 0x45, 0x30, 0xf8, 0xf1, 0xe1, 0xee, + 0x4f, 0x94, 0xea, 0x37, 0xe7, 0x8b, 0x57, 0x39 }; + + static const unsigned char out_fox_32[] = { 0x2f, 0x67, 0x13, 0x43, 0xd9, 0xb2, 0xe1, 0x60, + 0x4d, 0xc9, 0xdc, 0xf0, 0x75, 0x3e, 0x5f, 0xe1, + 0x5c, 0x7c, 0x64, 0xa0, 0xd2, 0x83, 0xcb, 0xbf, + 0x72, 0x2d, 0x41, 0x1a, 0x0e, 0x36, 0xf6, 0xca }; + + static const unsigned char out_fox_64[] = { + 0x2f, 0x67, 0x13, 0x43, 0xd9, 0xb2, 0xe1, 0x60, 0x4d, 0xc9, 0xdc, 0xf0, 0x75, + 0x3e, 0x5f, 0xe1, 0x5c, 0x7c, 0x64, 0xa0, 0xd2, 0x83, 0xcb, 0xbf, 0x72, 0x2d, + 0x41, 0x1a, 0x0e, 0x36, 0xf6, 0xca, 0x1d, 0x01, 0xd1, 0x36, 0x9a, 0x23, 0x53, + 0x9c, 0xd8, 0x0f, 0x7c, 0x05, 0x4b, 0x6e, 0x5d, 0xaf, 0x9c, 0x96, 0x2c, 0xad, + 0x5b, 0x8e, 0xd5, 0xbd, 0x11, 0x99, 0x8b, 0x40, 0xd5, 0x73, 0x44, 0x42 + }; + + static const unsigned char out_rate_block_32[] = { 0xea, 0x94, 0x7b, 0x83, 0x5f, 0xec, 0x1f, + 0x9b, 0x0a, 0x7e, 0xab, 0xba, 0x90, 0x1d, + 0xeb, 0x78, 0x81, 0xfd, 0x99, 0x99, 0xa1, + 0xcb, 0xd5, 0xcc, 0xbb, 0x5a, 0x9a, 0xfa, + 0xb7, 0xf6, 0xfe, 0x70 }; + + testvector vectors[] = { { msg_empty, 0, out_empty_32, 32 }, + { msg_empty, 0, out_empty_64, 64 }, + { msg_abc, 3, out_abc_32, 32 }, + { msg_fox, 43, out_fox_32, 32 }, + { msg_fox, 43, out_fox_64, 64 }, + { msg_rate_block, sizeof msg_rate_block, out_rate_block_32, 32 } }; + + unsigned char out[256]; + crypto_xof_shake256_state state; + size_t i; + + /* Test constants */ + assert(crypto_xof_shake256_blockbytes() == 136); + assert(crypto_xof_shake256_statebytes() == 256); + assert(crypto_xof_shake256_domain_standard() == 0x1F); + + /* Test one-shot API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_shake256(out, vectors[i].out_len, vectors[i].msg, vectors[i].msg_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (one-shot)\n", i); + return 1; + } + } + + /* Test streaming API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_shake256_init(&state); + crypto_xof_shake256_update(&state, vectors[i].msg, vectors[i].msg_len); + crypto_xof_shake256_squeeze(&state, out, vectors[i].out_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (streaming)\n", i); + return 1; + } + } + + /* Test multiple squeeze calls */ + crypto_xof_shake256_init(&state); + crypto_xof_shake256_update(&state, msg_abc, 3); + crypto_xof_shake256_squeeze(&state, out, 16); + crypto_xof_shake256_squeeze(&state, out + 16, 16); + if (memcmp(out, out_abc_32, 32) != 0) { + printf("Multiple squeeze test failed\n"); + return 1; + } + + /* Test custom domain byte produces different output */ + crypto_xof_shake256_init(&state); + crypto_xof_shake256_update(&state, msg_abc, 3); + crypto_xof_shake256_squeeze(&state, out, 32); + + crypto_xof_shake256_init_with_domain(&state, 0x99); + crypto_xof_shake256_update(&state, msg_abc, 3); + crypto_xof_shake256_squeeze(&state, out + 32, 32); + + if (memcmp(out, out + 32, 32) == 0) { + printf("Custom domain byte test failed (outputs should differ)\n"); + return 1; + } + + /* Test standard domain constant */ + crypto_xof_shake256_init_with_domain(&state, crypto_xof_shake256_domain_standard()); + crypto_xof_shake256_update(&state, msg_abc, 3); + crypto_xof_shake256_squeeze(&state, out + 64, 32); + + if (memcmp(out, out + 64, 32) != 0) { + printf("Domain constant test failed (should match standard init)\n"); + return 1; + } + + /* Test domain byte with MSB set when padding overlaps */ + { + unsigned char msg[crypto_xof_shake256_BLOCKBYTES - 1]; + unsigned char out_manual[32]; + unsigned char out_impl[32]; + const unsigned char domain = 0x99; + + memset(msg, 0xAA, sizeof msg); + + shake256_manual_with_domain(out_manual, sizeof out_manual, msg, sizeof msg, domain); + + crypto_xof_shake256_init_with_domain(&state, domain); + crypto_xof_shake256_update(&state, msg, sizeof msg); + crypto_xof_shake256_squeeze(&state, out_impl, sizeof out_impl); + + if (memcmp(out_manual, out_impl, sizeof out_manual) != 0) { + printf("Domain MSB padding test failed\n"); + return 1; + } + } + + printf("All SHAKE-256 tests passed\n"); + return 0; +} diff --git a/test/default/xof_shake256.exp b/test/default/xof_shake256.exp new file mode 100644 index 00000000..f9e7f729 --- /dev/null +++ b/test/default/xof_shake256.exp @@ -0,0 +1 @@ +All SHAKE-256 tests passed diff --git a/test/default/xof_turboshake128.c b/test/default/xof_turboshake128.c new file mode 100644 index 00000000..c03f5ec1 --- /dev/null +++ b/test/default/xof_turboshake128.c @@ -0,0 +1,215 @@ + +#define TEST_NAME "xof_turboshake128" +#include "cmptest.h" + +typedef struct { + const unsigned char *msg; + size_t msg_len; + const unsigned char *out; + size_t out_len; +} testvector; + +static void +turboshake128_manual_with_domain(unsigned char *out, size_t outlen, const unsigned char *in, + size_t inlen, unsigned char domain) +{ + unsigned char state[crypto_core_keccak1600_STATEBYTES]; + size_t rate = crypto_xof_turboshake128_blockbytes(); + size_t offset = 0; + size_t consumed = 0; + size_t chunk_size; + size_t extracted = 0; + unsigned char pad; + + crypto_core_keccak1600_init(state); + + while (consumed < inlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state, &in[consumed], offset, chunk_size); + offset += chunk_size; + consumed += chunk_size; + } + + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + + if (offset == rate - 1) { + pad = (unsigned char) (domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state, &pad, offset, 1); + } else { + crypto_core_keccak1600_xor_bytes(state, &domain, offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state, &pad, rate - 1, 1); + } + + crypto_core_keccak1600_permute_12(state); + offset = 0; + + while (extracted < outlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state, &out[extracted], offset, chunk_size); + offset += chunk_size; + extracted += chunk_size; + } +} + +int +main(void) +{ + /* Test vectors from Zig standard library (domain byte 0x1F) */ + static const unsigned char msg_empty[] = ""; + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + static const unsigned char msg_fox[] = { 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, + 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, + 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, 0x73, 0x20, 0x6f, + 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 }; + static const unsigned char msg_rate_block[168] = { 0 }; + + static const unsigned char out_empty_32[] = { 0x1e, 0x41, 0x5f, 0x1c, 0x59, 0x83, 0xaf, 0xf2, + 0x16, 0x92, 0x17, 0x27, 0x7d, 0x17, 0xbb, 0x53, + 0x8c, 0xd9, 0x45, 0xa3, 0x97, 0xdd, 0xec, 0x54, + 0x1f, 0x1c, 0xe4, 0x1a, 0xf2, 0xc1, 0xb7, 0x4c }; + + static const unsigned char out_empty_64[] = { + 0x1e, 0x41, 0x5f, 0x1c, 0x59, 0x83, 0xaf, 0xf2, 0x16, 0x92, 0x17, 0x27, 0x7d, + 0x17, 0xbb, 0x53, 0x8c, 0xd9, 0x45, 0xa3, 0x97, 0xdd, 0xec, 0x54, 0x1f, 0x1c, + 0xe4, 0x1a, 0xf2, 0xc1, 0xb7, 0x4c, 0x3e, 0x8c, 0xca, 0xe2, 0xa4, 0xda, 0xe5, + 0x6c, 0x84, 0xa0, 0x4c, 0x23, 0x85, 0xc0, 0x3c, 0x15, 0xe8, 0x19, 0x3b, 0xdf, + 0x58, 0x73, 0x73, 0x63, 0x32, 0x16, 0x91, 0xc0, 0x54, 0x62, 0xc8, 0xdf + }; + + static const unsigned char out_abc_32[] = { 0xdc, 0xf1, 0x64, 0x6d, 0xfe, 0x99, 0x3a, 0x8e, + 0xb6, 0xb7, 0x82, 0xd1, 0xfa, 0xac, 0xa6, 0xd8, + 0x24, 0x16, 0xa5, 0xdc, 0xf1, 0xde, 0x98, 0xee, + 0x3c, 0x6d, 0xbc, 0x5e, 0x1d, 0xc6, 0x30, 0x18 }; + + static const unsigned char out_fox_32[] = { 0x76, 0xa1, 0x72, 0x0a, 0x48, 0x48, 0xab, 0x64, + 0xe6, 0x7e, 0x56, 0x3f, 0x16, 0xb8, 0xc5, 0xaa, + 0x49, 0x2b, 0x69, 0x8a, 0x4d, 0x93, 0x42, 0x97, + 0x35, 0xfd, 0x02, 0x35, 0x46, 0x57, 0xfb, 0xf7 }; + + static const unsigned char out_fox_64[] = { + 0x76, 0xa1, 0x72, 0x0a, 0x48, 0x48, 0xab, 0x64, 0xe6, 0x7e, 0x56, 0x3f, 0x16, + 0xb8, 0xc5, 0xaa, 0x49, 0x2b, 0x69, 0x8a, 0x4d, 0x93, 0x42, 0x97, 0x35, 0xfd, + 0x02, 0x35, 0x46, 0x57, 0xfb, 0xf7, 0xa0, 0x68, 0x9e, 0xc7, 0x7b, 0x4c, 0x79, + 0x5f, 0xda, 0x9d, 0xaa, 0xb4, 0x10, 0xc6, 0x30, 0x92, 0xf5, 0x42, 0x00, 0x84, + 0x6c, 0x34, 0x12, 0x0f, 0xf2, 0xb2, 0x53, 0xe9, 0xfd, 0x8d, 0x9f, 0xc4 + }; + + static const unsigned char out_rate_block_32[] = { 0xdb, 0xa6, 0xe2, 0x67, 0xbd, 0xd5, 0x67, + 0xdb, 0x0a, 0xd2, 0x63, 0x6e, 0x61, 0xf1, + 0xae, 0x58, 0x9a, 0x81, 0xc1, 0xa9, 0xc1, + 0x1f, 0x7f, 0x76, 0x93, 0x0a, 0x35, 0xea, + 0x42, 0x47, 0x56, 0xd0 }; + + testvector vectors[] = { { msg_empty, 0, out_empty_32, 32 }, + { msg_empty, 0, out_empty_64, 64 }, + { msg_abc, 3, out_abc_32, 32 }, + { msg_fox, 43, out_fox_32, 32 }, + { msg_fox, 43, out_fox_64, 64 }, + { msg_rate_block, sizeof msg_rate_block, out_rate_block_32, 32 } }; + + unsigned char out[256]; + crypto_xof_turboshake128_state state; + size_t i; + + /* Test constants */ + assert(crypto_xof_turboshake128_blockbytes() == 168); + assert(crypto_xof_turboshake128_statebytes() == 256); + assert(crypto_xof_turboshake128_domain_standard() == 0x1F); + + /* Test one-shot API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_turboshake128(out, vectors[i].out_len, vectors[i].msg, vectors[i].msg_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (one-shot)\n", i); + return 1; + } + } + + /* Test streaming API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_turboshake128_init(&state); + crypto_xof_turboshake128_update(&state, vectors[i].msg, vectors[i].msg_len); + crypto_xof_turboshake128_squeeze(&state, out, vectors[i].out_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (streaming)\n", i); + return 1; + } + } + + /* Test multiple squeeze calls */ + crypto_xof_turboshake128_init(&state); + crypto_xof_turboshake128_update(&state, msg_abc, 3); + crypto_xof_turboshake128_squeeze(&state, out, 16); + crypto_xof_turboshake128_squeeze(&state, out + 16, 16); + if (memcmp(out, out_abc_32, 32) != 0) { + printf("Multiple squeeze test failed\n"); + return 1; + } + + /* Test custom domain byte produces different output */ + crypto_xof_turboshake128_init(&state); + crypto_xof_turboshake128_update(&state, msg_abc, 3); + crypto_xof_turboshake128_squeeze(&state, out, 32); + + crypto_xof_turboshake128_init_with_domain(&state, 0x99); + crypto_xof_turboshake128_update(&state, msg_abc, 3); + crypto_xof_turboshake128_squeeze(&state, out + 32, 32); + + if (memcmp(out, out + 32, 32) == 0) { + printf("Custom domain byte test failed (outputs should differ)\n"); + return 1; + } + + /* Test standard domain constant */ + crypto_xof_turboshake128_init_with_domain(&state, crypto_xof_turboshake128_domain_standard()); + crypto_xof_turboshake128_update(&state, msg_abc, 3); + crypto_xof_turboshake128_squeeze(&state, out + 64, 32); + + if (memcmp(out, out + 64, 32) != 0) { + printf("Domain constant test failed (should match standard init)\n"); + return 1; + } + + /* Test domain byte with MSB set when padding overlaps */ + { + unsigned char msg[crypto_xof_turboshake128_BLOCKBYTES - 1]; + unsigned char out_manual[32]; + unsigned char out_impl[32]; + const unsigned char domain = 0x99; + + memset(msg, 0xAA, sizeof msg); + + turboshake128_manual_with_domain(out_manual, sizeof out_manual, msg, sizeof msg, domain); + + crypto_xof_turboshake128_init_with_domain(&state, domain); + crypto_xof_turboshake128_update(&state, msg, sizeof msg); + crypto_xof_turboshake128_squeeze(&state, out_impl, sizeof out_impl); + + if (memcmp(out_manual, out_impl, sizeof out_manual) != 0) { + printf("Domain MSB padding test failed\n"); + return 1; + } + } + + printf("All TurboSHAKE-128 tests passed\n"); + return 0; +} diff --git a/test/default/xof_turboshake128.exp b/test/default/xof_turboshake128.exp new file mode 100644 index 00000000..12233c5f --- /dev/null +++ b/test/default/xof_turboshake128.exp @@ -0,0 +1 @@ +All TurboSHAKE-128 tests passed diff --git a/test/default/xof_turboshake256.c b/test/default/xof_turboshake256.c new file mode 100644 index 00000000..43c9ab0d --- /dev/null +++ b/test/default/xof_turboshake256.c @@ -0,0 +1,215 @@ + +#define TEST_NAME "xof_turboshake256" +#include "cmptest.h" + +typedef struct { + const unsigned char *msg; + size_t msg_len; + const unsigned char *out; + size_t out_len; +} testvector; + +static void +turboshake256_manual_with_domain(unsigned char *out, size_t outlen, const unsigned char *in, + size_t inlen, unsigned char domain) +{ + unsigned char state[crypto_core_keccak1600_STATEBYTES]; + size_t rate = crypto_xof_turboshake256_blockbytes(); + size_t offset = 0; + size_t consumed = 0; + size_t chunk_size; + size_t extracted = 0; + unsigned char pad; + + crypto_core_keccak1600_init(state); + + while (consumed < inlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > inlen - consumed) { + chunk_size = inlen - consumed; + } + crypto_core_keccak1600_xor_bytes(state, &in[consumed], offset, chunk_size); + offset += chunk_size; + consumed += chunk_size; + } + + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + + if (offset == rate - 1) { + pad = (unsigned char) (domain ^ 0x80); + crypto_core_keccak1600_xor_bytes(state, &pad, offset, 1); + } else { + crypto_core_keccak1600_xor_bytes(state, &domain, offset, 1); + pad = 0x80; + crypto_core_keccak1600_xor_bytes(state, &pad, rate - 1, 1); + } + + crypto_core_keccak1600_permute_12(state); + offset = 0; + + while (extracted < outlen) { + if (offset == rate) { + crypto_core_keccak1600_permute_12(state); + offset = 0; + } + chunk_size = rate - offset; + if (chunk_size > outlen - extracted) { + chunk_size = outlen - extracted; + } + crypto_core_keccak1600_extract_bytes(state, &out[extracted], offset, chunk_size); + offset += chunk_size; + extracted += chunk_size; + } +} + +int +main(void) +{ + /* Test vectors from Zig standard library (domain byte 0x1F) */ + static const unsigned char msg_empty[] = ""; + static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 }; + static const unsigned char msg_fox[] = { 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, + 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, + 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70, 0x73, 0x20, 0x6f, + 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c, + 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67 }; + static const unsigned char msg_rate_block[136] = { 0 }; + + static const unsigned char out_empty_32[] = { 0x36, 0x7a, 0x32, 0x9d, 0xaf, 0xea, 0x87, 0x1c, + 0x78, 0x02, 0xec, 0x67, 0xf9, 0x05, 0xae, 0x13, + 0xc5, 0x76, 0x95, 0xdc, 0x2c, 0x66, 0x63, 0xc6, + 0x10, 0x35, 0xf5, 0x9a, 0x18, 0xf8, 0xe7, 0xdb }; + + static const unsigned char out_empty_64[] = { + 0x36, 0x7a, 0x32, 0x9d, 0xaf, 0xea, 0x87, 0x1c, 0x78, 0x02, 0xec, 0x67, 0xf9, + 0x05, 0xae, 0x13, 0xc5, 0x76, 0x95, 0xdc, 0x2c, 0x66, 0x63, 0xc6, 0x10, 0x35, + 0xf5, 0x9a, 0x18, 0xf8, 0xe7, 0xdb, 0x11, 0xed, 0xc0, 0xe1, 0x2e, 0x91, 0xea, + 0x60, 0xeb, 0x6b, 0x32, 0xdf, 0x06, 0xdd, 0x7f, 0x00, 0x2f, 0xba, 0xfa, 0xbb, + 0x6e, 0x13, 0xec, 0x1c, 0xc2, 0x0d, 0x99, 0x55, 0x47, 0x60, 0x0d, 0xb0 + }; + + static const unsigned char out_abc_32[] = { 0x63, 0x82, 0x4b, 0x14, 0x31, 0xa7, 0x37, 0x2e, + 0x85, 0xed, 0xc0, 0x22, 0xc9, 0xd7, 0xaf, 0xdd, + 0x02, 0x74, 0x72, 0xfc, 0xfa, 0x33, 0xc8, 0x87, + 0xd6, 0xf5, 0xaa, 0xf8, 0xdc, 0x5d, 0x4d, 0xb6 }; + + static const unsigned char out_fox_32[] = { 0xb6, 0xe9, 0x1a, 0x41, 0x2c, 0x26, 0x2c, 0x79, + 0x36, 0xb0, 0x69, 0xf6, 0x7b, 0xd2, 0x1c, 0x2f, + 0x8e, 0xcc, 0x48, 0xbd, 0xa8, 0xdc, 0x6e, 0xeb, + 0xfb, 0xaf, 0x6f, 0xca, 0xa8, 0x21, 0x91, 0xc3 }; + + static const unsigned char out_fox_64[] = { + 0xb6, 0xe9, 0x1a, 0x41, 0x2c, 0x26, 0x2c, 0x79, 0x36, 0xb0, 0x69, 0xf6, 0x7b, + 0xd2, 0x1c, 0x2f, 0x8e, 0xcc, 0x48, 0xbd, 0xa8, 0xdc, 0x6e, 0xeb, 0xfb, 0xaf, + 0x6f, 0xca, 0xa8, 0x21, 0x91, 0xc3, 0x97, 0x44, 0x62, 0x70, 0x7a, 0xb2, 0xa5, + 0xc5, 0xd7, 0x04, 0xb0, 0xe8, 0x74, 0x86, 0x0a, 0x2a, 0x3f, 0xdd, 0xb5, 0x88, + 0xf5, 0x07, 0xc9, 0xb4, 0xf0, 0x41, 0x7e, 0x2b, 0x66, 0x31, 0x60, 0x90 + }; + + static const unsigned char out_rate_block_32[] = { 0x91, 0xef, 0xfd, 0x08, 0xdd, 0x4c, 0xcc, + 0xb6, 0x89, 0xc6, 0x26, 0xb4, 0x64, 0x93, + 0x67, 0xad, 0x5a, 0x2e, 0xbf, 0xab, 0x61, + 0x61, 0x17, 0x69, 0xa3, 0x74, 0x93, 0xfa, + 0x70, 0x12, 0x28, 0xea }; + + testvector vectors[] = { { msg_empty, 0, out_empty_32, 32 }, + { msg_empty, 0, out_empty_64, 64 }, + { msg_abc, 3, out_abc_32, 32 }, + { msg_fox, 43, out_fox_32, 32 }, + { msg_fox, 43, out_fox_64, 64 }, + { msg_rate_block, sizeof msg_rate_block, out_rate_block_32, 32 } }; + + unsigned char out[256]; + crypto_xof_turboshake256_state state; + size_t i; + + /* Test constants */ + assert(crypto_xof_turboshake256_blockbytes() == 136); + assert(crypto_xof_turboshake256_statebytes() == 256); + assert(crypto_xof_turboshake256_domain_standard() == 0x1F); + + /* Test one-shot API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_turboshake256(out, vectors[i].out_len, vectors[i].msg, vectors[i].msg_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (one-shot)\n", i); + return 1; + } + } + + /* Test streaming API */ + for (i = 0; i < sizeof(vectors) / sizeof(vectors[0]); i++) { + crypto_xof_turboshake256_init(&state); + crypto_xof_turboshake256_update(&state, vectors[i].msg, vectors[i].msg_len); + crypto_xof_turboshake256_squeeze(&state, out, vectors[i].out_len); + if (memcmp(out, vectors[i].out, vectors[i].out_len) != 0) { + printf("Test vector %zu failed (streaming)\n", i); + return 1; + } + } + + /* Test multiple squeeze calls */ + crypto_xof_turboshake256_init(&state); + crypto_xof_turboshake256_update(&state, msg_abc, 3); + crypto_xof_turboshake256_squeeze(&state, out, 16); + crypto_xof_turboshake256_squeeze(&state, out + 16, 16); + if (memcmp(out, out_abc_32, 32) != 0) { + printf("Multiple squeeze test failed\n"); + return 1; + } + + /* Test custom domain byte produces different output */ + crypto_xof_turboshake256_init(&state); + crypto_xof_turboshake256_update(&state, msg_abc, 3); + crypto_xof_turboshake256_squeeze(&state, out, 32); + + crypto_xof_turboshake256_init_with_domain(&state, 0x99); + crypto_xof_turboshake256_update(&state, msg_abc, 3); + crypto_xof_turboshake256_squeeze(&state, out + 32, 32); + + if (memcmp(out, out + 32, 32) == 0) { + printf("Custom domain byte test failed (outputs should differ)\n"); + return 1; + } + + /* Test standard domain constant */ + crypto_xof_turboshake256_init_with_domain(&state, crypto_xof_turboshake256_domain_standard()); + crypto_xof_turboshake256_update(&state, msg_abc, 3); + crypto_xof_turboshake256_squeeze(&state, out + 64, 32); + + if (memcmp(out, out + 64, 32) != 0) { + printf("Domain constant test failed (should match standard init)\n"); + return 1; + } + + /* Test domain byte with MSB set when padding overlaps */ + { + unsigned char msg[crypto_xof_turboshake256_BLOCKBYTES - 1]; + unsigned char out_manual[32]; + unsigned char out_impl[32]; + const unsigned char domain = 0x99; + + memset(msg, 0xAA, sizeof msg); + + turboshake256_manual_with_domain(out_manual, sizeof out_manual, msg, sizeof msg, domain); + + crypto_xof_turboshake256_init_with_domain(&state, domain); + crypto_xof_turboshake256_update(&state, msg, sizeof msg); + crypto_xof_turboshake256_squeeze(&state, out_impl, sizeof out_impl); + + if (memcmp(out_manual, out_impl, sizeof out_manual) != 0) { + printf("Domain MSB padding test failed\n"); + return 1; + } + } + + printf("All TurboSHAKE-256 tests passed\n"); + return 0; +} diff --git a/test/default/xof_turboshake256.exp b/test/default/xof_turboshake256.exp new file mode 100644 index 00000000..1c8fc7b0 --- /dev/null +++ b/test/default/xof_turboshake256.exp @@ -0,0 +1 @@ +All TurboSHAKE-256 tests passed