diff --git a/.gitignore b/.gitignore
index 55637891..b4b14f68 100644
--- a/.gitignore
+++ b/.gitignore
@@ -123,6 +123,8 @@ test/default/generichash2
test/default/generichash3
test/default/hash
test/default/hash3
+test/default/hash_sha3256
+test/default/hash_sha3512
test/default/ipcrypt
test/default/kdf
test/default/kdf_hkdf
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
index 62da89b0..dcd2e524 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj
@@ -174,6 +174,8 @@
+
+
@@ -222,6 +224,7 @@
+
@@ -271,6 +274,7 @@
+
@@ -348,6 +352,7 @@
+
diff --git a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2010/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
index 9d0f3559..0f4b5982 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj
@@ -174,6 +174,8 @@
+
+
@@ -222,6 +224,7 @@
+
@@ -271,6 +274,7 @@
+
@@ -348,6 +352,7 @@
+
diff --git a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2012/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
index 4b5690df..2d446790 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj
@@ -174,6 +174,8 @@
+
+
@@ -222,6 +224,7 @@
+
@@ -271,6 +274,7 @@
+
@@ -348,6 +352,7 @@
+
diff --git a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2013/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
index 308955c9..bcc37163 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj
@@ -174,6 +174,8 @@
+
+
@@ -222,6 +224,7 @@
+
@@ -271,6 +274,7 @@
+
@@ -348,6 +352,7 @@
+
diff --git a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2015/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
index 4ba30ebb..eb3abecb 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj
@@ -174,6 +174,8 @@
+
+
@@ -222,6 +224,7 @@
+
@@ -271,6 +274,7 @@
+
@@ -348,6 +352,7 @@
+
diff --git a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2017/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
index 6f5734a7..fe2db490 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj
@@ -198,6 +198,8 @@
+
+
@@ -246,6 +248,7 @@
+
@@ -295,6 +298,7 @@
+
@@ -372,6 +376,7 @@
+
diff --git a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2019/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
index 580ecfef..ffe420d7 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj
@@ -198,6 +198,8 @@
+
+
@@ -246,6 +248,7 @@
+
@@ -295,6 +298,7 @@
+
@@ -372,6 +376,7 @@
+
diff --git a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2022/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
index a63bcff3..b4b12242 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj
@@ -198,6 +198,8 @@
+
+
@@ -246,6 +248,7 @@
+
@@ -295,6 +298,7 @@
+
@@ -372,6 +376,7 @@
+
diff --git a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
index 5582a2e7..ac568c3e 100644
--- a/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
+++ b/builds/msvc/vs2026/libsodium/libsodium.vcxproj.filters
@@ -342,6 +342,12 @@
crypto_hash\sha512\cp
+
+ crypto_hash\sha3
+
+
+ crypto_hash\sha3\ref
+
crypto_hash\sha256
@@ -482,6 +488,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -629,6 +638,9 @@
include\sodium
+
+ include\sodium
+
include\sodium
@@ -860,6 +872,9 @@
crypto_stream\salsa20\xmm6
+
+ crypto_hash\sha3\ref
+
crypto_aead\aegis128l
@@ -1033,6 +1048,12 @@
{8c7d8b62-7b4f-3eb9-85b7-18e8d925be14}
+
+ {6df763e3-9707-3014-8cfe-2f9a8a83a872}
+
+
+ {11ec7cd9-b861-3226-bf76-510c4ca28c10}
+
{8fb6a906-dbd6-3746-9b0f-f49e7028daec}
diff --git a/ci/appveyor/libsodium.vcxproj b/ci/appveyor/libsodium.vcxproj
index 73786c50..414bfcd3 100644
--- a/ci/appveyor/libsodium.vcxproj
+++ b/ci/appveyor/libsodium.vcxproj
@@ -422,6 +422,8 @@
+
+
@@ -470,6 +472,7 @@
+
@@ -519,6 +522,7 @@
+
@@ -596,6 +600,7 @@
+
diff --git a/ci/appveyor/libsodium.vcxproj.filters b/ci/appveyor/libsodium.vcxproj.filters
index e35abe42..3e08ed9d 100644
--- a/ci/appveyor/libsodium.vcxproj.filters
+++ b/ci/appveyor/libsodium.vcxproj.filters
@@ -333,6 +333,12 @@
Source Files
+
+ Source Files
+
+
+ Source Files
+
Source Files
@@ -473,6 +479,9 @@
Header Files
+
+ Header Files
+
Header Files
@@ -620,6 +629,9 @@
Header Files
+
+ Header Files
+
Header Files
@@ -851,6 +863,9 @@
Header Files
+
+ Header Files
+
Header Files
diff --git a/src/libsodium/Makefile.am b/src/libsodium/Makefile.am
index c75aeb3a..521aa757 100644
--- a/src/libsodium/Makefile.am
+++ b/src/libsodium/Makefile.am
@@ -50,6 +50,9 @@ libsodium_la_SOURCES = \
crypto_hash/sha256/cp/hash_sha256_cp.c \
crypto_hash/sha512/hash_sha512.c \
crypto_hash/sha512/cp/hash_sha512_cp.c \
+ crypto_hash/sha3/hash_sha3.c \
+ crypto_hash/sha3/ref/sha3_ref.c \
+ crypto_hash/sha3/ref/sha3_ref.h \
crypto_ipcrypt/crypto_ipcrypt.c \
crypto_ipcrypt/ipcrypt_soft.c \
crypto_ipcrypt/ipcrypt_soft.h \
diff --git a/src/libsodium/crypto_hash/sha3/hash_sha3.c b/src/libsodium/crypto_hash/sha3/hash_sha3.c
new file mode 100644
index 00000000..fb2c6122
--- /dev/null
+++ b/src/libsodium/crypto_hash/sha3/hash_sha3.c
@@ -0,0 +1,81 @@
+#include "crypto_hash_sha3.h"
+#include "private/common.h"
+#include "ref/sha3_ref.h"
+
+size_t
+crypto_hash_sha3256_bytes(void)
+{
+ return crypto_hash_sha3256_BYTES;
+}
+
+size_t
+crypto_hash_sha3256_statebytes(void)
+{
+ return sizeof(crypto_hash_sha3256_state);
+}
+
+int
+crypto_hash_sha3256(unsigned char *out, const unsigned char *in, unsigned long long inlen)
+{
+ COMPILER_ASSERT(sizeof(crypto_hash_sha3256_state) >= sizeof(sha3_state_internal));
+ return sha3256_ref(out, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3256_init(crypto_hash_sha3256_state *state)
+{
+ COMPILER_ASSERT(sizeof(crypto_hash_sha3256_state) >= sizeof(sha3_state_internal));
+ return sha3256_ref_init((sha3_state_internal *) (void *) state);
+}
+
+int
+crypto_hash_sha3256_update(crypto_hash_sha3256_state *state,
+ const unsigned char *in, unsigned long long inlen)
+{
+ return sha3256_ref_update((sha3_state_internal *) (void *) state, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3256_final(crypto_hash_sha3256_state *state, unsigned char *out)
+{
+ return sha3256_ref_final((sha3_state_internal *) (void *) state, out);
+}
+
+size_t
+crypto_hash_sha3512_bytes(void)
+{
+ return crypto_hash_sha3512_BYTES;
+}
+
+size_t
+crypto_hash_sha3512_statebytes(void)
+{
+ return sizeof(crypto_hash_sha3512_state);
+}
+
+int
+crypto_hash_sha3512(unsigned char *out, const unsigned char *in, unsigned long long inlen)
+{
+ COMPILER_ASSERT(sizeof(crypto_hash_sha3512_state) >= sizeof(sha3_state_internal));
+ return sha3512_ref(out, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3512_init(crypto_hash_sha3512_state *state)
+{
+ COMPILER_ASSERT(sizeof(crypto_hash_sha3512_state) >= sizeof(sha3_state_internal));
+ return sha3512_ref_init((sha3_state_internal *) (void *) state);
+}
+
+int
+crypto_hash_sha3512_update(crypto_hash_sha3512_state *state,
+ const unsigned char *in, unsigned long long inlen)
+{
+ return sha3512_ref_update((sha3_state_internal *) (void *) state, in, (size_t) inlen);
+}
+
+int
+crypto_hash_sha3512_final(crypto_hash_sha3512_state *state, unsigned char *out)
+{
+ return sha3512_ref_final((sha3_state_internal *) (void *) state, out);
+}
diff --git a/src/libsodium/crypto_hash/sha3/ref/sha3_ref.c b/src/libsodium/crypto_hash/sha3/ref/sha3_ref.c
new file mode 100644
index 00000000..c09037fd
--- /dev/null
+++ b/src/libsodium/crypto_hash/sha3/ref/sha3_ref.c
@@ -0,0 +1,132 @@
+#include
+#include
+
+#include "crypto_core_keccak1600.h"
+#include "crypto_hash_sha3.h"
+#include "private/common.h"
+#include "sha3_ref.h"
+#include "utils.h"
+
+static int
+sha3_ref_init(sha3_state_internal *state, size_t rate, size_t outlen)
+{
+ crypto_core_keccak1600_init(&state->state);
+ state->offset = 0;
+ state->rate = rate;
+ state->outlen = outlen;
+ state->phase = SHA3_PHASE_ABSORBING;
+
+ return 0;
+}
+
+static int
+sha3_ref_update(sha3_state_internal *state, const unsigned char *in, size_t inlen)
+{
+ size_t consumed = 0;
+ size_t chunk_size;
+
+ while (consumed < inlen) {
+ if (state->offset == state->rate) {
+ crypto_core_keccak1600_permute_24(&state->state);
+ state->offset = 0;
+ }
+ chunk_size = state->rate - state->offset;
+ if (chunk_size > inlen - consumed) {
+ chunk_size = inlen - consumed;
+ }
+ crypto_core_keccak1600_xor_bytes(&state->state, &in[consumed], state->offset, chunk_size);
+ state->offset += chunk_size;
+ consumed += chunk_size;
+ }
+
+ return 0;
+}
+
+static int
+sha3_ref_final(sha3_state_internal *state, unsigned char *out)
+{
+ unsigned char pad;
+
+ if (state->offset == state->rate) {
+ crypto_core_keccak1600_permute_24(&state->state);
+ state->offset = 0;
+ }
+
+ if (state->offset == state->rate - 1) {
+ pad = (unsigned char) (SHA3_DOMAIN ^ 0x80);
+ crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1);
+ } else {
+ pad = SHA3_DOMAIN;
+ crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->offset, 1);
+ pad = 0x80;
+ crypto_core_keccak1600_xor_bytes(&state->state, &pad, state->rate - 1, 1);
+ }
+
+ crypto_core_keccak1600_permute_24(&state->state);
+
+ crypto_core_keccak1600_extract_bytes(&state->state, out, 0, state->outlen);
+
+ sodium_memzero(state, sizeof *state);
+
+ return 0;
+}
+
+int
+sha3256_ref_init(sha3_state_internal *state)
+{
+ return sha3_ref_init(state, SHA3_256_RATE, crypto_hash_sha3256_BYTES);
+}
+
+int
+sha3256_ref_update(sha3_state_internal *state, const unsigned char *in, size_t inlen)
+{
+ return sha3_ref_update(state, in, inlen);
+}
+
+int
+sha3256_ref_final(sha3_state_internal *state, unsigned char *out)
+{
+ return sha3_ref_final(state, out);
+}
+
+int
+sha3256_ref(unsigned char *out, const unsigned char *in, size_t inlen)
+{
+ sha3_state_internal state;
+
+ sha3256_ref_init(&state);
+ sha3256_ref_update(&state, in, inlen);
+ sha3256_ref_final(&state, out);
+
+ return 0;
+}
+
+int
+sha3512_ref_init(sha3_state_internal *state)
+{
+ return sha3_ref_init(state, SHA3_512_RATE, crypto_hash_sha3512_BYTES);
+}
+
+int
+sha3512_ref_update(sha3_state_internal *state, const unsigned char *in, size_t inlen)
+{
+ return sha3_ref_update(state, in, inlen);
+}
+
+int
+sha3512_ref_final(sha3_state_internal *state, unsigned char *out)
+{
+ return sha3_ref_final(state, out);
+}
+
+int
+sha3512_ref(unsigned char *out, const unsigned char *in, size_t inlen)
+{
+ sha3_state_internal state;
+
+ sha3512_ref_init(&state);
+ sha3512_ref_update(&state, in, inlen);
+ sha3512_ref_final(&state, out);
+
+ return 0;
+}
diff --git a/src/libsodium/crypto_hash/sha3/ref/sha3_ref.h b/src/libsodium/crypto_hash/sha3/ref/sha3_ref.h
new file mode 100644
index 00000000..5e7d0cf1
--- /dev/null
+++ b/src/libsodium/crypto_hash/sha3/ref/sha3_ref.h
@@ -0,0 +1,33 @@
+#ifndef sha3_ref_H
+#define sha3_ref_H
+
+#include
+#include
+
+#include "crypto_core_keccak1600.h"
+
+#define SHA3_256_RATE 136
+#define SHA3_512_RATE 72
+#define SHA3_DOMAIN 0x06
+
+typedef enum { SHA3_PHASE_ABSORBING = 0, SHA3_PHASE_FINALIZED = 1 } sha3_phase;
+
+typedef struct sha3_state_internal_ {
+ crypto_core_keccak1600_state state;
+ size_t offset;
+ size_t rate;
+ size_t outlen;
+ uint8_t phase;
+} sha3_state_internal;
+
+int sha3256_ref(unsigned char *out, const unsigned char *in, size_t inlen);
+int sha3256_ref_init(sha3_state_internal *state);
+int sha3256_ref_update(sha3_state_internal *state, const unsigned char *in, size_t inlen);
+int sha3256_ref_final(sha3_state_internal *state, unsigned char *out);
+
+int sha3512_ref(unsigned char *out, const unsigned char *in, size_t inlen);
+int sha3512_ref_init(sha3_state_internal *state);
+int sha3512_ref_update(sha3_state_internal *state, const unsigned char *in, size_t inlen);
+int sha3512_ref_final(sha3_state_internal *state, unsigned char *out);
+
+#endif
diff --git a/src/libsodium/include/Makefile.am b/src/libsodium/include/Makefile.am
index db1c7bc7..693df80c 100644
--- a/src/libsodium/include/Makefile.am
+++ b/src/libsodium/include/Makefile.am
@@ -26,6 +26,7 @@ SODIUM_EXPORT = \
sodium/crypto_generichash_blake2b.h \
sodium/crypto_hash.h \
sodium/crypto_hash_sha256.h \
+ sodium/crypto_hash_sha3.h \
sodium/crypto_hash_sha512.h \
sodium/crypto_ipcrypt.h \
sodium/crypto_kdf.h \
diff --git a/src/libsodium/include/sodium.h b/src/libsodium/include/sodium.h
index bf1ad011..bd27cd8c 100644
--- a/src/libsodium/include/sodium.h
+++ b/src/libsodium/include/sodium.h
@@ -26,6 +26,7 @@
#include "sodium/crypto_generichash_blake2b.h"
#include "sodium/crypto_hash.h"
#include "sodium/crypto_hash_sha256.h"
+#include "sodium/crypto_hash_sha3.h"
#include "sodium/crypto_hash_sha512.h"
#include "sodium/crypto_ipcrypt.h"
#include "sodium/crypto_kdf.h"
diff --git a/src/libsodium/include/sodium/crypto_hash_sha3.h b/src/libsodium/include/sodium/crypto_hash_sha3.h
new file mode 100644
index 00000000..d018296f
--- /dev/null
+++ b/src/libsodium/include/sodium/crypto_hash_sha3.h
@@ -0,0 +1,80 @@
+#ifndef crypto_hash_sha3_H
+#define crypto_hash_sha3_H
+
+#include
+#include
+
+#include "export.h"
+
+#ifdef __cplusplus
+# ifdef __GNUC__
+# pragma GCC diagnostic ignored "-Wlong-long"
+# endif
+extern "C" {
+#endif
+
+typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3256_state {
+ unsigned char opaque[256];
+} crypto_hash_sha3256_state;
+
+SODIUM_EXPORT
+size_t crypto_hash_sha3256_statebytes(void);
+
+#define crypto_hash_sha3256_BYTES 32U
+SODIUM_EXPORT
+size_t crypto_hash_sha3256_bytes(void);
+
+SODIUM_EXPORT
+int crypto_hash_sha3256(unsigned char *out, const unsigned char *in,
+ unsigned long long inlen) __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_init(crypto_hash_sha3256_state *state)
+ __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_update(crypto_hash_sha3256_state *state,
+ const unsigned char *in,
+ unsigned long long inlen)
+ __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3256_final(crypto_hash_sha3256_state *state,
+ unsigned char *out)
+ __attribute__ ((nonnull));
+
+typedef struct CRYPTO_ALIGN(16) crypto_hash_sha3512_state {
+ unsigned char opaque[256];
+} crypto_hash_sha3512_state;
+
+SODIUM_EXPORT
+size_t crypto_hash_sha3512_statebytes(void);
+
+#define crypto_hash_sha3512_BYTES 64U
+SODIUM_EXPORT
+size_t crypto_hash_sha3512_bytes(void);
+
+SODIUM_EXPORT
+int crypto_hash_sha3512(unsigned char *out, const unsigned char *in,
+ unsigned long long inlen) __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_init(crypto_hash_sha3512_state *state)
+ __attribute__ ((nonnull));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_update(crypto_hash_sha3512_state *state,
+ const unsigned char *in,
+ unsigned long long inlen)
+ __attribute__ ((nonnull(1)));
+
+SODIUM_EXPORT
+int crypto_hash_sha3512_final(crypto_hash_sha3512_state *state,
+ unsigned char *out)
+ __attribute__ ((nonnull));
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/test/default/Makefile.am b/test/default/Makefile.am
index d95a6b5c..b8e15daf 100644
--- a/test/default/Makefile.am
+++ b/test/default/Makefile.am
@@ -44,6 +44,8 @@ EXTRA_DIST = \
generichash3.exp \
hash.exp \
hash3.exp \
+ hash_sha3256.exp \
+ hash_sha3512.exp \
ipcrypt.exp \
kdf.exp \
kdf_hkdf.exp \
@@ -136,6 +138,8 @@ DISTCLEANFILES = \
hash.res \
hash2.res \
hash3.res \
+ hash_sha3256.res \
+ hash_sha3512.res \
ipcrypt.res \
kdf.res \
kdf_hkdf.res \
@@ -234,6 +238,8 @@ TESTS_TARGETS = \
generichash3 \
hash \
hash3 \
+ hash_sha3256 \
+ hash_sha3512 \
ipcrypt \
kdf \
kem_mlkem768 \
@@ -406,6 +412,12 @@ hash_LDADD = $(TESTS_LDADD)
hash3_SOURCE = cmptest.h hash3.c
hash3_LDADD = $(TESTS_LDADD)
+hash_sha3256_SOURCE = cmptest.h hash_sha3256.c
+hash_sha3256_LDADD = $(TESTS_LDADD)
+
+hash_sha3512_SOURCE = cmptest.h hash_sha3512.c
+hash_sha3512_LDADD = $(TESTS_LDADD)
+
ipcrypt_SOURCE = cmptest.h ipcrypt.c
ipcrypt_LDADD = $(TESTS_LDADD)
diff --git a/test/default/hash_sha3256.c b/test/default/hash_sha3256.c
new file mode 100644
index 00000000..fef5660c
--- /dev/null
+++ b/test/default/hash_sha3256.c
@@ -0,0 +1,131 @@
+
+#define TEST_NAME "hash_sha3256"
+#include "cmptest.h"
+
+int
+main(void)
+{
+ static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 };
+
+ static const unsigned char msg_fox[] = {
+ 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72,
+ 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70,
+ 0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c,
+ 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67
+ };
+
+ static const unsigned char out_empty[32] = {
+ 0xa7, 0xff, 0xc6, 0xf8, 0xbf, 0x1e, 0xd7, 0x66, 0x51, 0xc1, 0x47, 0x56,
+ 0xa0, 0x61, 0xd6, 0x62, 0xf5, 0x80, 0xff, 0x4d, 0xe4, 0x3b, 0x49, 0xfa,
+ 0x82, 0xd8, 0x0a, 0x4b, 0x80, 0xf8, 0x43, 0x4a
+ };
+
+ static const unsigned char out_abc[32] = {
+ 0x3a, 0x98, 0x5d, 0xa7, 0x4f, 0xe2, 0x25, 0xb2, 0x04, 0x5c, 0x17, 0x2d,
+ 0x6b, 0xd3, 0x90, 0xbd, 0x85, 0x5f, 0x08, 0x6e, 0x3e, 0x9d, 0x52, 0x5b,
+ 0x46, 0xbf, 0xe2, 0x45, 0x11, 0x43, 0x15, 0x32
+ };
+
+ static const unsigned char out_fox[32] = {
+ 0x69, 0x07, 0x0d, 0xda, 0x01, 0x97, 0x5c, 0x8c, 0x12, 0x0c, 0x3a, 0xad,
+ 0xa1, 0xb2, 0x82, 0x39, 0x4e, 0x7f, 0x03, 0x2f, 0xa9, 0xcf, 0x32, 0xf4,
+ 0xcb, 0x22, 0x59, 0xa0, 0x89, 0x7d, 0xfc, 0x04
+ };
+
+ unsigned char out[32];
+ crypto_hash_sha3256_state state;
+ size_t i;
+
+ assert(crypto_hash_sha3256_bytes() == 32);
+ assert(crypto_hash_sha3256_statebytes() > 0);
+
+ crypto_hash_sha3256(out, NULL, 0);
+ assert(memcmp(out, out_empty, 32) == 0);
+ printf("SHA3-256(\"\") = ");
+ for (i = 0; i < 32; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3256(out, msg_abc, 3);
+ assert(memcmp(out, out_abc, 32) == 0);
+ printf("SHA3-256(\"abc\") = ");
+ for (i = 0; i < 32; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3256(out, msg_fox, 43);
+ assert(memcmp(out, out_fox, 32) == 0);
+ printf("SHA3-256(\"The quick brown fox...\") = ");
+ for (i = 0; i < 32; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, msg_abc, 3);
+ crypto_hash_sha3256_final(&state, out);
+ assert(memcmp(out, out_abc, 32) == 0);
+ printf("Streaming API test passed\n");
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, msg_abc, 1);
+ crypto_hash_sha3256_update(&state, msg_abc + 1, 1);
+ crypto_hash_sha3256_update(&state, msg_abc + 2, 1);
+ crypto_hash_sha3256_final(&state, out);
+ assert(memcmp(out, out_abc, 32) == 0);
+ printf("Chunked update test passed\n");
+
+ {
+ unsigned char msg_rate[136];
+ unsigned char out_rate[32];
+ unsigned char out_rate_stream[32];
+
+ memset(msg_rate, 0xAB, sizeof msg_rate);
+ crypto_hash_sha3256(out_rate, msg_rate, sizeof msg_rate);
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, msg_rate, sizeof msg_rate);
+ crypto_hash_sha3256_final(&state, out_rate_stream);
+
+ assert(memcmp(out_rate, out_rate_stream, 32) == 0);
+ printf("Rate boundary test passed\n");
+ }
+
+ {
+ unsigned char msg_rate_plus1[137];
+ unsigned char out_rate_plus1[32];
+ unsigned char out_rate_plus1_stream[32];
+
+ memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1);
+ crypto_hash_sha3256(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1);
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, msg_rate_plus1, 100);
+ crypto_hash_sha3256_update(&state, msg_rate_plus1 + 100, 37);
+ crypto_hash_sha3256_final(&state, out_rate_plus1_stream);
+
+ assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 32) == 0);
+ printf("Rate+1 boundary test passed\n");
+ }
+
+ {
+ unsigned char msg_rate_minus1[135];
+ unsigned char out1[32], out2[32];
+
+ memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1);
+ crypto_hash_sha3256(out1, msg_rate_minus1, sizeof msg_rate_minus1);
+
+ crypto_hash_sha3256_init(&state);
+ crypto_hash_sha3256_update(&state, msg_rate_minus1, sizeof msg_rate_minus1);
+ crypto_hash_sha3256_final(&state, out2);
+
+ assert(memcmp(out1, out2, 32) == 0);
+ printf("Rate-1 boundary test passed\n");
+ }
+
+ printf("OK\n");
+
+ return 0;
+}
diff --git a/test/default/hash_sha3256.exp b/test/default/hash_sha3256.exp
new file mode 100644
index 00000000..01031e7a
--- /dev/null
+++ b/test/default/hash_sha3256.exp
@@ -0,0 +1,9 @@
+SHA3-256("") = a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
+SHA3-256("abc") = 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532
+SHA3-256("The quick brown fox...") = 69070dda01975c8c120c3aada1b282394e7f032fa9cf32f4cb2259a0897dfc04
+Streaming API test passed
+Chunked update test passed
+Rate boundary test passed
+Rate+1 boundary test passed
+Rate-1 boundary test passed
+OK
diff --git a/test/default/hash_sha3512.c b/test/default/hash_sha3512.c
new file mode 100644
index 00000000..ae858cbd
--- /dev/null
+++ b/test/default/hash_sha3512.c
@@ -0,0 +1,140 @@
+
+#define TEST_NAME "hash_sha3512"
+#include "cmptest.h"
+
+int
+main(void)
+{
+ static const unsigned char msg_abc[] = { 0x61, 0x62, 0x63 };
+
+ static const unsigned char msg_fox[] = {
+ 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72,
+ 0x6f, 0x77, 0x6e, 0x20, 0x66, 0x6f, 0x78, 0x20, 0x6a, 0x75, 0x6d, 0x70,
+ 0x73, 0x20, 0x6f, 0x76, 0x65, 0x72, 0x20, 0x74, 0x68, 0x65, 0x20, 0x6c,
+ 0x61, 0x7a, 0x79, 0x20, 0x64, 0x6f, 0x67
+ };
+
+ static const unsigned char out_empty[64] = {
+ 0xa6, 0x9f, 0x73, 0xcc, 0xa2, 0x3a, 0x9a, 0xc5, 0xc8, 0xb5, 0x67, 0xdc,
+ 0x18, 0x5a, 0x75, 0x6e, 0x97, 0xc9, 0x82, 0x16, 0x4f, 0xe2, 0x58, 0x59,
+ 0xe0, 0xd1, 0xdc, 0xc1, 0x47, 0x5c, 0x80, 0xa6, 0x15, 0xb2, 0x12, 0x3a,
+ 0xf1, 0xf5, 0xf9, 0x4c, 0x11, 0xe3, 0xe9, 0x40, 0x2c, 0x3a, 0xc5, 0x58,
+ 0xf5, 0x00, 0x19, 0x9d, 0x95, 0xb6, 0xd3, 0xe3, 0x01, 0x75, 0x85, 0x86,
+ 0x28, 0x1d, 0xcd, 0x26
+ };
+
+ static const unsigned char out_abc[64] = {
+ 0xb7, 0x51, 0x85, 0x0b, 0x1a, 0x57, 0x16, 0x8a, 0x56, 0x93, 0xcd, 0x92,
+ 0x4b, 0x6b, 0x09, 0x6e, 0x08, 0xf6, 0x21, 0x82, 0x74, 0x44, 0xf7, 0x0d,
+ 0x88, 0x4f, 0x5d, 0x02, 0x40, 0xd2, 0x71, 0x2e, 0x10, 0xe1, 0x16, 0xe9,
+ 0x19, 0x2a, 0xf3, 0xc9, 0x1a, 0x7e, 0xc5, 0x76, 0x47, 0xe3, 0x93, 0x40,
+ 0x57, 0x34, 0x0b, 0x4c, 0xf4, 0x08, 0xd5, 0xa5, 0x65, 0x92, 0xf8, 0x27,
+ 0x4e, 0xec, 0x53, 0xf0
+ };
+
+ static const unsigned char out_fox[64] = {
+ 0x01, 0xde, 0xdd, 0x5d, 0xe4, 0xef, 0x14, 0x64, 0x24, 0x45, 0xba, 0x5f,
+ 0x5b, 0x97, 0xc1, 0x5e, 0x47, 0xb9, 0xad, 0x93, 0x13, 0x26, 0xe4, 0xb0,
+ 0x72, 0x7c, 0xd9, 0x4c, 0xef, 0xc4, 0x4f, 0xff, 0x23, 0xf0, 0x7b, 0xf5,
+ 0x43, 0x13, 0x99, 0x39, 0xb4, 0x91, 0x28, 0xca, 0xf4, 0x36, 0xdc, 0x1b,
+ 0xde, 0xe5, 0x4f, 0xcb, 0x24, 0x02, 0x3a, 0x08, 0xd9, 0x40, 0x3f, 0x9b,
+ 0x4b, 0xf0, 0xd4, 0x50
+ };
+
+ unsigned char out[64];
+ crypto_hash_sha3512_state state;
+ size_t i;
+
+ assert(crypto_hash_sha3512_bytes() == 64);
+ assert(crypto_hash_sha3512_statebytes() > 0);
+
+ crypto_hash_sha3512(out, NULL, 0);
+ assert(memcmp(out, out_empty, 64) == 0);
+ printf("SHA3-512(\"\") = ");
+ for (i = 0; i < 64; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3512(out, msg_abc, 3);
+ assert(memcmp(out, out_abc, 64) == 0);
+ printf("SHA3-512(\"abc\") = ");
+ for (i = 0; i < 64; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3512(out, msg_fox, 43);
+ assert(memcmp(out, out_fox, 64) == 0);
+ printf("SHA3-512(\"The quick brown fox...\") = ");
+ for (i = 0; i < 64; i++) {
+ printf("%02x", out[i]);
+ }
+ printf("\n");
+
+ crypto_hash_sha3512_init(&state);
+ crypto_hash_sha3512_update(&state, msg_abc, 3);
+ crypto_hash_sha3512_final(&state, out);
+ assert(memcmp(out, out_abc, 64) == 0);
+ printf("Streaming API test passed\n");
+
+ crypto_hash_sha3512_init(&state);
+ crypto_hash_sha3512_update(&state, msg_abc, 1);
+ crypto_hash_sha3512_update(&state, msg_abc + 1, 1);
+ crypto_hash_sha3512_update(&state, msg_abc + 2, 1);
+ crypto_hash_sha3512_final(&state, out);
+ assert(memcmp(out, out_abc, 64) == 0);
+ printf("Chunked update test passed\n");
+
+ {
+ unsigned char msg_rate[72];
+ unsigned char out_rate[64];
+ unsigned char out_rate_stream[64];
+
+ memset(msg_rate, 0xAB, sizeof msg_rate);
+ crypto_hash_sha3512(out_rate, msg_rate, sizeof msg_rate);
+
+ crypto_hash_sha3512_init(&state);
+ crypto_hash_sha3512_update(&state, msg_rate, sizeof msg_rate);
+ crypto_hash_sha3512_final(&state, out_rate_stream);
+
+ assert(memcmp(out_rate, out_rate_stream, 64) == 0);
+ printf("Rate boundary test passed\n");
+ }
+
+ {
+ unsigned char msg_rate_plus1[73];
+ unsigned char out_rate_plus1[64];
+ unsigned char out_rate_plus1_stream[64];
+
+ memset(msg_rate_plus1, 0xCD, sizeof msg_rate_plus1);
+ crypto_hash_sha3512(out_rate_plus1, msg_rate_plus1, sizeof msg_rate_plus1);
+
+ crypto_hash_sha3512_init(&state);
+ crypto_hash_sha3512_update(&state, msg_rate_plus1, 50);
+ crypto_hash_sha3512_update(&state, msg_rate_plus1 + 50, 23);
+ crypto_hash_sha3512_final(&state, out_rate_plus1_stream);
+
+ assert(memcmp(out_rate_plus1, out_rate_plus1_stream, 64) == 0);
+ printf("Rate+1 boundary test passed\n");
+ }
+
+ {
+ unsigned char msg_rate_minus1[71];
+ unsigned char out1[64], out2[64];
+
+ memset(msg_rate_minus1, 0xEF, sizeof msg_rate_minus1);
+ crypto_hash_sha3512(out1, msg_rate_minus1, sizeof msg_rate_minus1);
+
+ crypto_hash_sha3512_init(&state);
+ crypto_hash_sha3512_update(&state, msg_rate_minus1, sizeof msg_rate_minus1);
+ crypto_hash_sha3512_final(&state, out2);
+
+ assert(memcmp(out1, out2, 64) == 0);
+ printf("Rate-1 boundary test passed\n");
+ }
+
+ printf("OK\n");
+
+ return 0;
+}
diff --git a/test/default/hash_sha3512.exp b/test/default/hash_sha3512.exp
new file mode 100644
index 00000000..c19eb9d3
--- /dev/null
+++ b/test/default/hash_sha3512.exp
@@ -0,0 +1,9 @@
+SHA3-512("") = a69f73cca23a9ac5c8b567dc185a756e97c982164fe25859e0d1dcc1475c80a615b2123af1f5f94c11e3e9402c3ac558f500199d95b6d3e301758586281dcd26
+SHA3-512("abc") = b751850b1a57168a5693cd924b6b096e08f621827444f70d884f5d0240d2712e10e116e9192af3c91a7ec57647e3934057340b4cf408d5a56592f8274eec53f0
+SHA3-512("The quick brown fox...") = 01dedd5de4ef14642445ba5f5b97c15e47b9ad931326e4b0727cd94cefc44fff23f07bf543139939b49128caf436dc1bdee54fcb24023a08d9403f9b4bf0d450
+Streaming API test passed
+Chunked update test passed
+Rate boundary test passed
+Rate+1 boundary test passed
+Rate-1 boundary test passed
+OK