the-tree/crypto/sha3_generic.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * Cryptographic API.
0004  *
0005  * SHA-3, as specified in
0006  * https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
0007  *
0008  * SHA-3 code by Jeff Garzik <jeff@garzik.org>
0009  *               Ard Biesheuvel <ard.biesheuvel@linaro.org>
0010  */
0011 #include <crypto/internal/hash.h>
0012 #include <linux/init.h>
0013 #include <linux/module.h>
0014 #include <linux/types.h>
0015 #include <crypto/sha3.h>
0016 #include <asm/unaligned.h>
0017
0018 /*
0019  * On some 32-bit architectures (h8300), GCC ends up using
0020  * over 1 KB of stack if we inline the round calculation into the loop
0021  * in keccakf(). On the other hand, on 64-bit architectures with plenty
0022  * of [64-bit wide] general purpose registers, not inlining it severely
0023  * hurts performance. So let's use 64-bitness as a heuristic to decide
0024  * whether to inline or not.
0025  */
0026 #ifdef CONFIG_64BIT
0027 #define SHA3_INLINE inline
0028 #else
0029 #define SHA3_INLINE noinline
0030 #endif
0031
0032 #define KECCAK_ROUNDS 24
0033
0034 static const u64 keccakf_rndc[24] = {
0035     0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
0036     0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
0037     0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
0038     0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
0039     0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
0040     0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
0041     0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
0042     0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL
0043 };
0044
0045 /* update the state with given number of rounds */
0046
0047 static SHA3_INLINE void keccakf_round(u64 st[25])
0048 {
0049     u64 t[5], tt, bc[5];
0050
0051     /* Theta */
0052     bc[0] = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
0053     bc[1] = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
0054     bc[2] = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
0055     bc[3] = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
0056     bc[4] = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
0057
0058     t[0] = bc[4] ^ rol64(bc[1], 1);
0059     t[1] = bc[0] ^ rol64(bc[2], 1);
0060     t[2] = bc[1] ^ rol64(bc[3], 1);
0061     t[3] = bc[2] ^ rol64(bc[4], 1);
0062     t[4] = bc[3] ^ rol64(bc[0], 1);
0063
0064     st[0] ^= t[0];
0065
0066     /* Rho Pi */
0067     tt = st[1];
0068     st[ 1] = rol64(st[ 6] ^ t[1], 44);
0069     st[ 6] = rol64(st[ 9] ^ t[4], 20);
0070     st[ 9] = rol64(st[22] ^ t[2], 61);
0071     st[22] = rol64(st[14] ^ t[4], 39);
0072     st[14] = rol64(st[20] ^ t[0], 18);
0073     st[20] = rol64(st[ 2] ^ t[2], 62);
0074     st[ 2] = rol64(st[12] ^ t[2], 43);
0075     st[12] = rol64(st[13] ^ t[3], 25);
0076     st[13] = rol64(st[19] ^ t[4],  8);
0077     st[19] = rol64(st[23] ^ t[3], 56);
0078     st[23] = rol64(st[15] ^ t[0], 41);
0079     st[15] = rol64(st[ 4] ^ t[4], 27);
0080     st[ 4] = rol64(st[24] ^ t[4], 14);
0081     st[24] = rol64(st[21] ^ t[1],  2);
0082     st[21] = rol64(st[ 8] ^ t[3], 55);
0083     st[ 8] = rol64(st[16] ^ t[1], 45);
0084     st[16] = rol64(st[ 5] ^ t[0], 36);
0085     st[ 5] = rol64(st[ 3] ^ t[3], 28);
0086     st[ 3] = rol64(st[18] ^ t[3], 21);
0087     st[18] = rol64(st[17] ^ t[2], 15);
0088     st[17] = rol64(st[11] ^ t[1], 10);
0089     st[11] = rol64(st[ 7] ^ t[2],  6);
0090     st[ 7] = rol64(st[10] ^ t[0],  3);
0091     st[10] = rol64(    tt ^ t[1],  1);
0092
0093     /* Chi */
0094     bc[ 0] = ~st[ 1] & st[ 2];
0095     bc[ 1] = ~st[ 2] & st[ 3];
0096     bc[ 2] = ~st[ 3] & st[ 4];
0097     bc[ 3] = ~st[ 4] & st[ 0];
0098     bc[ 4] = ~st[ 0] & st[ 1];
0099     st[ 0] ^= bc[ 0];
0100     st[ 1] ^= bc[ 1];
0101     st[ 2] ^= bc[ 2];
0102     st[ 3] ^= bc[ 3];
0103     st[ 4] ^= bc[ 4];
0104
0105     bc[ 0] = ~st[ 6] & st[ 7];
0106     bc[ 1] = ~st[ 7] & st[ 8];
0107     bc[ 2] = ~st[ 8] & st[ 9];
0108     bc[ 3] = ~st[ 9] & st[ 5];
0109     bc[ 4] = ~st[ 5] & st[ 6];
0110     st[ 5] ^= bc[ 0];
0111     st[ 6] ^= bc[ 1];
0112     st[ 7] ^= bc[ 2];
0113     st[ 8] ^= bc[ 3];
0114     st[ 9] ^= bc[ 4];
0115
0116     bc[ 0] = ~st[11] & st[12];
0117     bc[ 1] = ~st[12] & st[13];
0118     bc[ 2] = ~st[13] & st[14];
0119     bc[ 3] = ~st[14] & st[10];
0120     bc[ 4] = ~st[10] & st[11];
0121     st[10] ^= bc[ 0];
0122     st[11] ^= bc[ 1];
0123     st[12] ^= bc[ 2];
0124     st[13] ^= bc[ 3];
0125     st[14] ^= bc[ 4];
0126
0127     bc[ 0] = ~st[16] & st[17];
0128     bc[ 1] = ~st[17] & st[18];
0129     bc[ 2] = ~st[18] & st[19];
0130     bc[ 3] = ~st[19] & st[15];
0131     bc[ 4] = ~st[15] & st[16];
0132     st[15] ^= bc[ 0];
0133     st[16] ^= bc[ 1];
0134     st[17] ^= bc[ 2];
0135     st[18] ^= bc[ 3];
0136     st[19] ^= bc[ 4];
0137
0138     bc[ 0] = ~st[21] & st[22];
0139     bc[ 1] = ~st[22] & st[23];
0140     bc[ 2] = ~st[23] & st[24];
0141     bc[ 3] = ~st[24] & st[20];
0142     bc[ 4] = ~st[20] & st[21];
0143     st[20] ^= bc[ 0];
0144     st[21] ^= bc[ 1];
0145     st[22] ^= bc[ 2];
0146     st[23] ^= bc[ 3];
0147     st[24] ^= bc[ 4];
0148 }
0149
0150 static void keccakf(u64 st[25])
0151 {
0152     int round;
0153
0154     for (round = 0; round < KECCAK_ROUNDS; round++) {
0155         keccakf_round(st);
0156         /* Iota */
0157         st[0] ^= keccakf_rndc[round];
0158     }
0159 }
0160
0161 int crypto_sha3_init(struct shash_desc *desc)
0162 {
0163     struct sha3_state *sctx = shash_desc_ctx(desc);
0164     unsigned int digest_size = crypto_shash_digestsize(desc->tfm);
0165
0166     sctx->rsiz = 200 - 2 * digest_size;
0167     sctx->rsizw = sctx->rsiz / 8;
0168     sctx->partial = 0;
0169
0170     memset(sctx->st, 0, sizeof(sctx->st));
0171     return 0;
0172 }
0173 EXPORT_SYMBOL(crypto_sha3_init);
0174
0175 int crypto_sha3_update(struct shash_desc *desc, const u8 *data,
0176                unsigned int len)
0177 {
0178     struct sha3_state *sctx = shash_desc_ctx(desc);
0179     unsigned int done;
0180     const u8 *src;
0181
0182     done = 0;
0183     src = data;
0184
0185     if ((sctx->partial + len) > (sctx->rsiz - 1)) {
0186         if (sctx->partial) {
0187             done = -sctx->partial;
0188             memcpy(sctx->buf + sctx->partial, data,
0189                    done + sctx->rsiz);
0190             src = sctx->buf;
0191         }
0192
0193         do {
0194             unsigned int i;
0195
0196             for (i = 0; i < sctx->rsizw; i++)
0197                 sctx->st[i] ^= get_unaligned_le64(src + 8 * i);
0198             keccakf(sctx->st);
0199
0200             done += sctx->rsiz;
0201             src = data + done;
0202         } while (done + (sctx->rsiz - 1) < len);
0203
0204         sctx->partial = 0;
0205     }
0206     memcpy(sctx->buf + sctx->partial, src, len - done);
0207     sctx->partial += (len - done);
0208
0209     return 0;
0210 }
0211 EXPORT_SYMBOL(crypto_sha3_update);
0212
0213 int crypto_sha3_final(struct shash_desc *desc, u8 *out)
0214 {
0215     struct sha3_state *sctx = shash_desc_ctx(desc);
0216     unsigned int i, inlen = sctx->partial;
0217     unsigned int digest_size = crypto_shash_digestsize(desc->tfm);
0218     __le64 *digest = (__le64 *)out;
0219
0220     sctx->buf[inlen++] = 0x06;
0221     memset(sctx->buf + inlen, 0, sctx->rsiz - inlen);
0222     sctx->buf[sctx->rsiz - 1] |= 0x80;
0223
0224     for (i = 0; i < sctx->rsizw; i++)
0225         sctx->st[i] ^= get_unaligned_le64(sctx->buf + 8 * i);
0226
0227     keccakf(sctx->st);
0228
0229     for (i = 0; i < digest_size / 8; i++)
0230         put_unaligned_le64(sctx->st[i], digest++);
0231
0232     if (digest_size & 4)
0233         put_unaligned_le32(sctx->st[i], (__le32 *)digest);
0234
0235     memset(sctx, 0, sizeof(*sctx));
0236     return 0;
0237 }
0238 EXPORT_SYMBOL(crypto_sha3_final);
0239
0240 static struct shash_alg algs[] = { {
0241     .digestsize     = SHA3_224_DIGEST_SIZE,
0242     .init           = crypto_sha3_init,
0243     .update         = crypto_sha3_update,
0244     .final          = crypto_sha3_final,
0245     .descsize       = sizeof(struct sha3_state),
0246     .base.cra_name      = "sha3-224",
0247     .base.cra_driver_name   = "sha3-224-generic",
0248     .base.cra_blocksize = SHA3_224_BLOCK_SIZE,
0249     .base.cra_module    = THIS_MODULE,
0250 }, {
0251     .digestsize     = SHA3_256_DIGEST_SIZE,
0252     .init           = crypto_sha3_init,
0253     .update         = crypto_sha3_update,
0254     .final          = crypto_sha3_final,
0255     .descsize       = sizeof(struct sha3_state),
0256     .base.cra_name      = "sha3-256",
0257     .base.cra_driver_name   = "sha3-256-generic",
0258     .base.cra_blocksize = SHA3_256_BLOCK_SIZE,
0259     .base.cra_module    = THIS_MODULE,
0260 }, {
0261     .digestsize     = SHA3_384_DIGEST_SIZE,
0262     .init           = crypto_sha3_init,
0263     .update         = crypto_sha3_update,
0264     .final          = crypto_sha3_final,
0265     .descsize       = sizeof(struct sha3_state),
0266     .base.cra_name      = "sha3-384",
0267     .base.cra_driver_name   = "sha3-384-generic",
0268     .base.cra_blocksize = SHA3_384_BLOCK_SIZE,
0269     .base.cra_module    = THIS_MODULE,
0270 }, {
0271     .digestsize     = SHA3_512_DIGEST_SIZE,
0272     .init           = crypto_sha3_init,
0273     .update         = crypto_sha3_update,
0274     .final          = crypto_sha3_final,
0275     .descsize       = sizeof(struct sha3_state),
0276     .base.cra_name      = "sha3-512",
0277     .base.cra_driver_name   = "sha3-512-generic",
0278     .base.cra_blocksize = SHA3_512_BLOCK_SIZE,
0279     .base.cra_module    = THIS_MODULE,
0280 } };
0281
0282 static int __init sha3_generic_mod_init(void)
0283 {
0284     return crypto_register_shashes(algs, ARRAY_SIZE(algs));
0285 }
0286
0287 static void __exit sha3_generic_mod_fini(void)
0288 {
0289     crypto_unregister_shashes(algs, ARRAY_SIZE(algs));
0290 }
0291
0292 subsys_initcall(sha3_generic_mod_init);
0293 module_exit(sha3_generic_mod_fini);
0294
0295 MODULE_LICENSE("GPL");
0296 MODULE_DESCRIPTION("SHA-3 Secure Hash Algorithm");
0297
0298 MODULE_ALIAS_CRYPTO("sha3-224");
0299 MODULE_ALIAS_CRYPTO("sha3-224-generic");
0300 MODULE_ALIAS_CRYPTO("sha3-256");
0301 MODULE_ALIAS_CRYPTO("sha3-256-generic");
0302 MODULE_ALIAS_CRYPTO("sha3-384");
0303 MODULE_ALIAS_CRYPTO("sha3-384-generic");
0304 MODULE_ALIAS_CRYPTO("sha3-512");
0305 MODULE_ALIAS_CRYPTO("sha3-512-generic");