@cryptotaxi247 / kubo / commits / 7bbc0084b

updated go.crypto/sha3

Juan Batiz-Benet committed Dec 24, 2014 at 10:30 UTC 7bbc0084be6c623b85046b9d1e6a652b25e106fa
9 files changed +907 -459
Godeps/Godeps.json
+4 -4
@@ -21,13 +21,13 @@
21 },
22 {
23 "ImportPath": "code.google.com/p/go.crypto/blowfish",
24 - "Comment": "null-219",
25 - "Rev": "00a7d3b31bbab5795b4a51933c04fc2768242970"
24 + "Comment": "null-236",
25 + "Rev": "69e2a90ed92d03812364aeb947b7068dc42e561e"
26 },
27 {
28 "ImportPath": "code.google.com/p/go.crypto/sha3",
29 - "Comment": "null-219",
30 - "Rev": "00a7d3b31bbab5795b4a51933c04fc2768242970"
29 + "Comment": "null-236",
30 + "Rev": "69e2a90ed92d03812364aeb947b7068dc42e561e"
31 },
32 {
33 "ImportPath": "code.google.com/p/go.net/context",
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/doc.go new
+68
@@ -0,0 +1,68 @@
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 +// Use of this source code is governed by a BSD-style
3 +// license that can be found in the LICENSE file.
4 +
5 +// Package sha3 implements the SHA-3 fixed-output-length hash functions and
6 +// the SHAKE variable-output-length hash functions defined by FIPS-202.
7 +//
8 +// Both types of hash function use the "sponge" construction and the Keccak
9 +// permutation. For a detailed specification see http://keccak.noekeon.org/
10 +//
11 +//
12 +// Guidance
13 +//
14 +// If you aren't sure what function you need, use SHAKE256 with at least 64
15 +// bytes of output.
16 +//
17 +// If you need a secret-key MAC (message authentication code), prepend the
18 +// secret key to the input, hash with SHAKE256 and read at least 32 bytes of
19 +// output.
20 +//
21 +//
22 +// Security strengths
23 +//
24 +// The SHA3-x functions have a security strength against preimage attacks of x
25 +// bits. Since they only produce x bits of output, their collision-resistance
26 +// is only x/2 bits.
27 +//
28 +// The SHAKE-x functions have a generic security strength of x bits against
29 +// all attacks, provided that at least 2x bits of their output is used.
30 +// Requesting more than 2x bits of output does not increase the collision-
31 +// resistance of the SHAKE functions.
32 +//
33 +//
34 +// The sponge construction
35 +//
36 +// A sponge builds a pseudo-random function from a pseudo-random permutation,
37 +// by applying the permutation to a state of "rate + capacity" bytes, but
38 +// hiding "capacity" of the bytes.
39 +//
40 +// A sponge starts out with a zero state. To hash an input using a sponge, up
41 +// to "rate" bytes of the input are XORed into the sponge's state. The sponge
42 +// has thus been "filled up" and the permutation is applied. This process is
43 +// repeated until all the input has been "absorbed". The input is then padded.
44 +// The digest is "squeezed" from the sponge by the same method, except that
45 +// output is copied out.
46 +//
47 +// A sponge is parameterized by its generic security strength, which is equal
48 +// to half its capacity; capacity + rate is equal to the permutation's width.
49 +//
50 +// Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means
51 +// that security_strength == (1600 - bitrate) / 2.
52 +//
53 +//
54 +// Recommendations, detailed
55 +//
56 +// The SHAKE functions are recommended for most new uses. They can produce
57 +// output of arbitrary length. SHAKE256, with an output length of at least
58 +// 64 bytes, provides 256-bit security against all attacks.
59 +//
60 +// The Keccak team recommends SHAKE256 for most applications upgrading from
61 +// SHA2-512. (NIST chose a much stronger, but much slower, sponge instance
62 +// for SHA3-512.)
63 +//
64 +// The SHA-3 functions are "drop-in" replacements for the SHA-2 functions.
65 +// They produce output of the same length, with the same security strengths
66 +// against all attacks. This means, in particular, that SHA3-256 only has
67 +// 128-bit collision resistance, because its output length is 32 bytes.
68 +package sha3
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/hashes.go new
+65
@@ -0,0 +1,65 @@
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 +// Use of this source code is governed by a BSD-style
3 +// license that can be found in the LICENSE file.
4 +
5 +package sha3
6 +
7 +// This file provides functions for creating instances of the SHA-3
8 +// and SHAKE hash functions, as well as utility functions for hashing
9 +// bytes.
10 +
11 +import (
12 + "hash"
13 +)
14 +
15 +// New224 creates a new SHA3-224 hash.
16 +// Its generic security strength is 224 bits against preimage attacks,
17 +// and 112 bits against collision attacks.
18 +func New224() hash.Hash { return &state{rate: 144, outputLen: 28, dsbyte: 0x06} }
19 +
20 +// New256 creates a new SHA3-256 hash.
21 +// Its generic security strength is 256 bits against preimage attacks,
22 +// and 128 bits against collision attacks.
23 +func New256() hash.Hash { return &state{rate: 136, outputLen: 32, dsbyte: 0x06} }
24 +
25 +// New384 creates a new SHA3-384 hash.
26 +// Its generic security strength is 384 bits against preimage attacks,
27 +// and 192 bits against collision attacks.
28 +func New384() hash.Hash { return &state{rate: 104, outputLen: 48, dsbyte: 0x06} }
29 +
30 +// New512 creates a new SHA3-512 hash.
31 +// Its generic security strength is 512 bits against preimage attacks,
32 +// and 256 bits against collision attacks.
33 +func New512() hash.Hash { return &state{rate: 72, outputLen: 64, dsbyte: 0x06} }
34 +
35 +// Sum224 returns the SHA3-224 digest of the data.
36 +func Sum224(data []byte) (digest [28]byte) {
37 + h := New224()
38 + h.Write(data)
39 + h.Sum(digest[:0])
40 + return
41 +}
42 +
43 +// Sum256 returns the SHA3-256 digest of the data.
44 +func Sum256(data []byte) (digest [32]byte) {
45 + h := New256()
46 + h.Write(data)
47 + h.Sum(digest[:0])
48 + return
49 +}
50 +
51 +// Sum384 returns the SHA3-384 digest of the data.
52 +func Sum384(data []byte) (digest [48]byte) {
53 + h := New384()
54 + h.Write(data)
55 + h.Sum(digest[:0])
56 + return
57 +}
58 +
59 +// Sum512 returns the SHA3-512 digest of the data.
60 +func Sum512(data []byte) (digest [64]byte) {
61 + h := New512()
62 + h.Write(data)
63 + h.Sum(digest[:0])
64 + return
65 +}
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/keccakKats.json.deflate
Binary files /dev/null and b/Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/keccakKats.json.deflate differ
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/keccakf.go
+371 -126
@@ -1,16 +1,11 @@
1 -// Copyright 2013 The Go Authors. All rights reserved.
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
4
5 package sha3
6
7 -// This file implements the core Keccak permutation function necessary for computing SHA3.
8 -// This is implemented in a separate file to allow for replacement by an optimized implementation.
9 -// Nothing in this package is exported.
10 -// For the detailed specification, refer to the Keccak web site (http://keccak.noekeon.org/).
11 -
7 // rc stores the round constants for use in the ι step.
13 -var rc = [...]uint64{
8 +var rc = [24]uint64{
9 0x0000000000000001,
10 0x0000000000008082,
11 0x800000000000808A,
@@ -37,129 +32,379 @@ var rc = [...]uint64{
32 0x8000000080008008,
33 }
34
40 -// keccakF computes the complete Keccak-f function consisting of 24 rounds with a different
41 -// constant (rc) in each round. This implementation fully unrolls the round function to avoid
42 -// inner loops, as well as pre-calculating shift offsets.
43 -func keccakF(a *[numLanes]uint64) {
44 - var t, bc0, bc1, bc2, bc3, bc4 uint64
45 - for _, roundConstant := range rc {
46 - // θ step
35 +// keccakF1600 applies the Keccak permutation to a 1600b-wide
36 +// state represented as a slice of 25 uint64s.
37 +func keccakF1600(a *[25]uint64) {
38 + // Implementation translated from Keccak-inplace.c
39 + // in the keccak reference code.
40 + var t, bc0, bc1, bc2, bc3, bc4, d0, d1, d2, d3, d4 uint64
41 +
42 + for i := 0; i < 24; i += 4 {
43 + // Combines the 5 steps in each round into 2 steps.
44 + // Unrolls 4 rounds per loop and spreads some steps across rounds.
45 +
46 + // Round 1
47 bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
48 bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
49 bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
50 bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
51 bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
52 - t = bc4 ^ (bc1<<1 ^ bc1>>63)
53 - a[0] ^= t
54 - a[5] ^= t
55 - a[10] ^= t
56 - a[15] ^= t
57 - a[20] ^= t
58 - t = bc0 ^ (bc2<<1 ^ bc2>>63)
59 - a[1] ^= t
60 - a[6] ^= t
61 - a[11] ^= t
62 - a[16] ^= t
63 - a[21] ^= t
64 - t = bc1 ^ (bc3<<1 ^ bc3>>63)
65 - a[2] ^= t
66 - a[7] ^= t
67 - a[12] ^= t
68 - a[17] ^= t
69 - a[22] ^= t
70 - t = bc2 ^ (bc4<<1 ^ bc4>>63)
71 - a[3] ^= t
72 - a[8] ^= t
73 - a[13] ^= t
74 - a[18] ^= t
75 - a[23] ^= t
76 - t = bc3 ^ (bc0<<1 ^ bc0>>63)
77 - a[4] ^= t
78 - a[9] ^= t
79 - a[14] ^= t
80 - a[19] ^= t
81 - a[24] ^= t
82 -
83 - // ρ and π steps
84 - t = a[1]
85 - t, a[10] = a[10], t<<1^t>>(64-1)
86 - t, a[7] = a[7], t<<3^t>>(64-3)
87 - t, a[11] = a[11], t<<6^t>>(64-6)
88 - t, a[17] = a[17], t<<10^t>>(64-10)
89 - t, a[18] = a[18], t<<15^t>>(64-15)
90 - t, a[3] = a[3], t<<21^t>>(64-21)
91 - t, a[5] = a[5], t<<28^t>>(64-28)
92 - t, a[16] = a[16], t<<36^t>>(64-36)
93 - t, a[8] = a[8], t<<45^t>>(64-45)
94 - t, a[21] = a[21], t<<55^t>>(64-55)
95 - t, a[24] = a[24], t<<2^t>>(64-2)
96 - t, a[4] = a[4], t<<14^t>>(64-14)
97 - t, a[15] = a[15], t<<27^t>>(64-27)
98 - t, a[23] = a[23], t<<41^t>>(64-41)
99 - t, a[19] = a[19], t<<56^t>>(64-56)
100 - t, a[13] = a[13], t<<8^t>>(64-8)
101 - t, a[12] = a[12], t<<25^t>>(64-25)
102 - t, a[2] = a[2], t<<43^t>>(64-43)
103 - t, a[20] = a[20], t<<62^t>>(64-62)
104 - t, a[14] = a[14], t<<18^t>>(64-18)
105 - t, a[22] = a[22], t<<39^t>>(64-39)
106 - t, a[9] = a[9], t<<61^t>>(64-61)
107 - t, a[6] = a[6], t<<20^t>>(64-20)
108 - a[1] = t<<44 ^ t>>(64-44)
109 -
110 - // χ step
111 - bc0 = a[0]
112 - bc1 = a[1]
113 - bc2 = a[2]
114 - bc3 = a[3]
115 - bc4 = a[4]
116 - a[0] ^= bc2 &^ bc1
117 - a[1] ^= bc3 &^ bc2
118 - a[2] ^= bc4 &^ bc3
119 - a[3] ^= bc0 &^ bc4
120 - a[4] ^= bc1 &^ bc0
121 - bc0 = a[5]
122 - bc1 = a[6]
123 - bc2 = a[7]
124 - bc3 = a[8]
125 - bc4 = a[9]
126 - a[5] ^= bc2 &^ bc1
127 - a[6] ^= bc3 &^ bc2
128 - a[7] ^= bc4 &^ bc3
129 - a[8] ^= bc0 &^ bc4
130 - a[9] ^= bc1 &^ bc0
131 - bc0 = a[10]
132 - bc1 = a[11]
133 - bc2 = a[12]
134 - bc3 = a[13]
135 - bc4 = a[14]
136 - a[10] ^= bc2 &^ bc1
137 - a[11] ^= bc3 &^ bc2
138 - a[12] ^= bc4 &^ bc3
139 - a[13] ^= bc0 &^ bc4
140 - a[14] ^= bc1 &^ bc0
141 - bc0 = a[15]
142 - bc1 = a[16]
143 - bc2 = a[17]
144 - bc3 = a[18]
145 - bc4 = a[19]
146 - a[15] ^= bc2 &^ bc1
147 - a[16] ^= bc3 &^ bc2
148 - a[17] ^= bc4 &^ bc3
149 - a[18] ^= bc0 &^ bc4
150 - a[19] ^= bc1 &^ bc0
151 - bc0 = a[20]
152 - bc1 = a[21]
153 - bc2 = a[22]
154 - bc3 = a[23]
155 - bc4 = a[24]
156 - a[20] ^= bc2 &^ bc1
157 - a[21] ^= bc3 &^ bc2
158 - a[22] ^= bc4 &^ bc3
159 - a[23] ^= bc0 &^ bc4
160 - a[24] ^= bc1 &^ bc0
161 -
162 - // ι step
163 - a[0] ^= roundConstant
52 + d0 = bc4 ^ (bc1<<1 | bc1>>63)
53 + d1 = bc0 ^ (bc2<<1 | bc2>>63)
54 + d2 = bc1 ^ (bc3<<1 | bc3>>63)
55 + d3 = bc2 ^ (bc4<<1 | bc4>>63)
56 + d4 = bc3 ^ (bc0<<1 | bc0>>63)
57 +
58 + bc0 = a[0] ^ d0
59 + t = a[6] ^ d1
60 + bc1 = t<<44 | t>>(64-44)
61 + t = a[12] ^ d2
62 + bc2 = t<<43 | t>>(64-43)
63 + t = a[18] ^ d3
64 + bc3 = t<<21 | t>>(64-21)
65 + t = a[24] ^ d4
66 + bc4 = t<<14 | t>>(64-14)
67 + a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i]
68 + a[6] = bc1 ^ (bc3 &^ bc2)
69 + a[12] = bc2 ^ (bc4 &^ bc3)
70 + a[18] = bc3 ^ (bc0 &^ bc4)
71 + a[24] = bc4 ^ (bc1 &^ bc0)
72 +
73 + t = a[10] ^ d0
74 + bc2 = t<<3 | t>>(64-3)
75 + t = a[16] ^ d1
76 + bc3 = t<<45 | t>>(64-45)
77 + t = a[22] ^ d2
78 + bc4 = t<<61 | t>>(64-61)
79 + t = a[3] ^ d3
80 + bc0 = t<<28 | t>>(64-28)
81 + t = a[9] ^ d4
82 + bc1 = t<<20 | t>>(64-20)
83 + a[10] = bc0 ^ (bc2 &^ bc1)
84 + a[16] = bc1 ^ (bc3 &^ bc2)
85 + a[22] = bc2 ^ (bc4 &^ bc3)
86 + a[3] = bc3 ^ (bc0 &^ bc4)
87 + a[9] = bc4 ^ (bc1 &^ bc0)
88 +
89 + t = a[20] ^ d0
90 + bc4 = t<<18 | t>>(64-18)
91 + t = a[1] ^ d1
92 + bc0 = t<<1 | t>>(64-1)
93 + t = a[7] ^ d2
94 + bc1 = t<<6 | t>>(64-6)
95 + t = a[13] ^ d3
96 + bc2 = t<<25 | t>>(64-25)
97 + t = a[19] ^ d4
98 + bc3 = t<<8 | t>>(64-8)
99 + a[20] = bc0 ^ (bc2 &^ bc1)
100 + a[1] = bc1 ^ (bc3 &^ bc2)
101 + a[7] = bc2 ^ (bc4 &^ bc3)
102 + a[13] = bc3 ^ (bc0 &^ bc4)
103 + a[19] = bc4 ^ (bc1 &^ bc0)
104 +
105 + t = a[5] ^ d0
106 + bc1 = t<<36 | t>>(64-36)
107 + t = a[11] ^ d1
108 + bc2 = t<<10 | t>>(64-10)
109 + t = a[17] ^ d2
110 + bc3 = t<<15 | t>>(64-15)
111 + t = a[23] ^ d3
112 + bc4 = t<<56 | t>>(64-56)
113 + t = a[4] ^ d4
114 + bc0 = t<<27 | t>>(64-27)
115 + a[5] = bc0 ^ (bc2 &^ bc1)
116 + a[11] = bc1 ^ (bc3 &^ bc2)
117 + a[17] = bc2 ^ (bc4 &^ bc3)
118 + a[23] = bc3 ^ (bc0 &^ bc4)
119 + a[4] = bc4 ^ (bc1 &^ bc0)
120 +
121 + t = a[15] ^ d0
122 + bc3 = t<<41 | t>>(64-41)
123 + t = a[21] ^ d1
124 + bc4 = t<<2 | t>>(64-2)
125 + t = a[2] ^ d2
126 + bc0 = t<<62 | t>>(64-62)
127 + t = a[8] ^ d3
128 + bc1 = t<<55 | t>>(64-55)
129 + t = a[14] ^ d4
130 + bc2 = t<<39 | t>>(64-39)
131 + a[15] = bc0 ^ (bc2 &^ bc1)
132 + a[21] = bc1 ^ (bc3 &^ bc2)
133 + a[2] = bc2 ^ (bc4 &^ bc3)
134 + a[8] = bc3 ^ (bc0 &^ bc4)
135 + a[14] = bc4 ^ (bc1 &^ bc0)
136 +
137 + // Round 2
138 + bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
139 + bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
140 + bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
141 + bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
142 + bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
143 + d0 = bc4 ^ (bc1<<1 | bc1>>63)
144 + d1 = bc0 ^ (bc2<<1 | bc2>>63)
145 + d2 = bc1 ^ (bc3<<1 | bc3>>63)
146 + d3 = bc2 ^ (bc4<<1 | bc4>>63)
147 + d4 = bc3 ^ (bc0<<1 | bc0>>63)
148 +
149 + bc0 = a[0] ^ d0
150 + t = a[16] ^ d1
151 + bc1 = t<<44 | t>>(64-44)
152 + t = a[7] ^ d2
153 + bc2 = t<<43 | t>>(64-43)
154 + t = a[23] ^ d3
155 + bc3 = t<<21 | t>>(64-21)
156 + t = a[14] ^ d4
157 + bc4 = t<<14 | t>>(64-14)
158 + a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+1]
159 + a[16] = bc1 ^ (bc3 &^ bc2)
160 + a[7] = bc2 ^ (bc4 &^ bc3)
161 + a[23] = bc3 ^ (bc0 &^ bc4)
162 + a[14] = bc4 ^ (bc1 &^ bc0)
163 +
164 + t = a[20] ^ d0
165 + bc2 = t<<3 | t>>(64-3)
166 + t = a[11] ^ d1
167 + bc3 = t<<45 | t>>(64-45)
168 + t = a[2] ^ d2
169 + bc4 = t<<61 | t>>(64-61)
170 + t = a[18] ^ d3
171 + bc0 = t<<28 | t>>(64-28)
172 + t = a[9] ^ d4
173 + bc1 = t<<20 | t>>(64-20)
174 + a[20] = bc0 ^ (bc2 &^ bc1)
175 + a[11] = bc1 ^ (bc3 &^ bc2)
176 + a[2] = bc2 ^ (bc4 &^ bc3)
177 + a[18] = bc3 ^ (bc0 &^ bc4)
178 + a[9] = bc4 ^ (bc1 &^ bc0)
179 +
180 + t = a[15] ^ d0
181 + bc4 = t<<18 | t>>(64-18)
182 + t = a[6] ^ d1
183 + bc0 = t<<1 | t>>(64-1)
184 + t = a[22] ^ d2
185 + bc1 = t<<6 | t>>(64-6)
186 + t = a[13] ^ d3
187 + bc2 = t<<25 | t>>(64-25)
188 + t = a[4] ^ d4
189 + bc3 = t<<8 | t>>(64-8)
190 + a[15] = bc0 ^ (bc2 &^ bc1)
191 + a[6] = bc1 ^ (bc3 &^ bc2)
192 + a[22] = bc2 ^ (bc4 &^ bc3)
193 + a[13] = bc3 ^ (bc0 &^ bc4)
194 + a[4] = bc4 ^ (bc1 &^ bc0)
195 +
196 + t = a[10] ^ d0
197 + bc1 = t<<36 | t>>(64-36)
198 + t = a[1] ^ d1
199 + bc2 = t<<10 | t>>(64-10)
200 + t = a[17] ^ d2
201 + bc3 = t<<15 | t>>(64-15)
202 + t = a[8] ^ d3
203 + bc4 = t<<56 | t>>(64-56)
204 + t = a[24] ^ d4
205 + bc0 = t<<27 | t>>(64-27)
206 + a[10] = bc0 ^ (bc2 &^ bc1)
207 + a[1] = bc1 ^ (bc3 &^ bc2)
208 + a[17] = bc2 ^ (bc4 &^ bc3)
209 + a[8] = bc3 ^ (bc0 &^ bc4)
210 + a[24] = bc4 ^ (bc1 &^ bc0)
211 +
212 + t = a[5] ^ d0
213 + bc3 = t<<41 | t>>(64-41)
214 + t = a[21] ^ d1
215 + bc4 = t<<2 | t>>(64-2)
216 + t = a[12] ^ d2
217 + bc0 = t<<62 | t>>(64-62)
218 + t = a[3] ^ d3
219 + bc1 = t<<55 | t>>(64-55)
220 + t = a[19] ^ d4
221 + bc2 = t<<39 | t>>(64-39)
222 + a[5] = bc0 ^ (bc2 &^ bc1)
223 + a[21] = bc1 ^ (bc3 &^ bc2)
224 + a[12] = bc2 ^ (bc4 &^ bc3)
225 + a[3] = bc3 ^ (bc0 &^ bc4)
226 + a[19] = bc4 ^ (bc1 &^ bc0)
227 +
228 + // Round 3
229 + bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
230 + bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
231 + bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
232 + bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
233 + bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
234 + d0 = bc4 ^ (bc1<<1 | bc1>>63)
235 + d1 = bc0 ^ (bc2<<1 | bc2>>63)
236 + d2 = bc1 ^ (bc3<<1 | bc3>>63)
237 + d3 = bc2 ^ (bc4<<1 | bc4>>63)
238 + d4 = bc3 ^ (bc0<<1 | bc0>>63)
239 +
240 + bc0 = a[0] ^ d0
241 + t = a[11] ^ d1
242 + bc1 = t<<44 | t>>(64-44)
243 + t = a[22] ^ d2
244 + bc2 = t<<43 | t>>(64-43)
245 + t = a[8] ^ d3
246 + bc3 = t<<21 | t>>(64-21)
247 + t = a[19] ^ d4
248 + bc4 = t<<14 | t>>(64-14)
249 + a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+2]
250 + a[11] = bc1 ^ (bc3 &^ bc2)
251 + a[22] = bc2 ^ (bc4 &^ bc3)
252 + a[8] = bc3 ^ (bc0 &^ bc4)
253 + a[19] = bc4 ^ (bc1 &^ bc0)
254 +
255 + t = a[15] ^ d0
256 + bc2 = t<<3 | t>>(64-3)
257 + t = a[1] ^ d1
258 + bc3 = t<<45 | t>>(64-45)
259 + t = a[12] ^ d2
260 + bc4 = t<<61 | t>>(64-61)
261 + t = a[23] ^ d3
262 + bc0 = t<<28 | t>>(64-28)
263 + t = a[9] ^ d4
264 + bc1 = t<<20 | t>>(64-20)
265 + a[15] = bc0 ^ (bc2 &^ bc1)
266 + a[1] = bc1 ^ (bc3 &^ bc2)
267 + a[12] = bc2 ^ (bc4 &^ bc3)
268 + a[23] = bc3 ^ (bc0 &^ bc4)
269 + a[9] = bc4 ^ (bc1 &^ bc0)
270 +
271 + t = a[5] ^ d0
272 + bc4 = t<<18 | t>>(64-18)
273 + t = a[16] ^ d1
274 + bc0 = t<<1 | t>>(64-1)
275 + t = a[2] ^ d2
276 + bc1 = t<<6 | t>>(64-6)
277 + t = a[13] ^ d3
278 + bc2 = t<<25 | t>>(64-25)
279 + t = a[24] ^ d4
280 + bc3 = t<<8 | t>>(64-8)
281 + a[5] = bc0 ^ (bc2 &^ bc1)
282 + a[16] = bc1 ^ (bc3 &^ bc2)
283 + a[2] = bc2 ^ (bc4 &^ bc3)
284 + a[13] = bc3 ^ (bc0 &^ bc4)
285 + a[24] = bc4 ^ (bc1 &^ bc0)
286 +
287 + t = a[20] ^ d0
288 + bc1 = t<<36 | t>>(64-36)
289 + t = a[6] ^ d1
290 + bc2 = t<<10 | t>>(64-10)
291 + t = a[17] ^ d2
292 + bc3 = t<<15 | t>>(64-15)
293 + t = a[3] ^ d3
294 + bc4 = t<<56 | t>>(64-56)
295 + t = a[14] ^ d4
296 + bc0 = t<<27 | t>>(64-27)
297 + a[20] = bc0 ^ (bc2 &^ bc1)
298 + a[6] = bc1 ^ (bc3 &^ bc2)
299 + a[17] = bc2 ^ (bc4 &^ bc3)
300 + a[3] = bc3 ^ (bc0 &^ bc4)
301 + a[14] = bc4 ^ (bc1 &^ bc0)
302 +
303 + t = a[10] ^ d0
304 + bc3 = t<<41 | t>>(64-41)
305 + t = a[21] ^ d1
306 + bc4 = t<<2 | t>>(64-2)
307 + t = a[7] ^ d2
308 + bc0 = t<<62 | t>>(64-62)
309 + t = a[18] ^ d3
310 + bc1 = t<<55 | t>>(64-55)
311 + t = a[4] ^ d4
312 + bc2 = t<<39 | t>>(64-39)
313 + a[10] = bc0 ^ (bc2 &^ bc1)
314 + a[21] = bc1 ^ (bc3 &^ bc2)
315 + a[7] = bc2 ^ (bc4 &^ bc3)
316 + a[18] = bc3 ^ (bc0 &^ bc4)
317 + a[4] = bc4 ^ (bc1 &^ bc0)
318 +
319 + // Round 4
320 + bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
321 + bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
322 + bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
323 + bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
324 + bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
325 + d0 = bc4 ^ (bc1<<1 | bc1>>63)
326 + d1 = bc0 ^ (bc2<<1 | bc2>>63)
327 + d2 = bc1 ^ (bc3<<1 | bc3>>63)
328 + d3 = bc2 ^ (bc4<<1 | bc4>>63)
329 + d4 = bc3 ^ (bc0<<1 | bc0>>63)
330 +
331 + bc0 = a[0] ^ d0
332 + t = a[1] ^ d1
333 + bc1 = t<<44 | t>>(64-44)
334 + t = a[2] ^ d2
335 + bc2 = t<<43 | t>>(64-43)
336 + t = a[3] ^ d3
337 + bc3 = t<<21 | t>>(64-21)
338 + t = a[4] ^ d4
339 + bc4 = t<<14 | t>>(64-14)
340 + a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+3]
341 + a[1] = bc1 ^ (bc3 &^ bc2)
342 + a[2] = bc2 ^ (bc4 &^ bc3)
343 + a[3] = bc3 ^ (bc0 &^ bc4)
344 + a[4] = bc4 ^ (bc1 &^ bc0)
345 +
346 + t = a[5] ^ d0
347 + bc2 = t<<3 | t>>(64-3)
348 + t = a[6] ^ d1
349 + bc3 = t<<45 | t>>(64-45)
350 + t = a[7] ^ d2
351 + bc4 = t<<61 | t>>(64-61)
352 + t = a[8] ^ d3
353 + bc0 = t<<28 | t>>(64-28)
354 + t = a[9] ^ d4
355 + bc1 = t<<20 | t>>(64-20)
356 + a[5] = bc0 ^ (bc2 &^ bc1)
357 + a[6] = bc1 ^ (bc3 &^ bc2)
358 + a[7] = bc2 ^ (bc4 &^ bc3)
359 + a[8] = bc3 ^ (bc0 &^ bc4)
360 + a[9] = bc4 ^ (bc1 &^ bc0)
361 +
362 + t = a[10] ^ d0
363 + bc4 = t<<18 | t>>(64-18)
364 + t = a[11] ^ d1
365 + bc0 = t<<1 | t>>(64-1)
366 + t = a[12] ^ d2
367 + bc1 = t<<6 | t>>(64-6)
368 + t = a[13] ^ d3
369 + bc2 = t<<25 | t>>(64-25)
370 + t = a[14] ^ d4
371 + bc3 = t<<8 | t>>(64-8)
372 + a[10] = bc0 ^ (bc2 &^ bc1)
373 + a[11] = bc1 ^ (bc3 &^ bc2)
374 + a[12] = bc2 ^ (bc4 &^ bc3)
375 + a[13] = bc3 ^ (bc0 &^ bc4)
376 + a[14] = bc4 ^ (bc1 &^ bc0)
377 +
378 + t = a[15] ^ d0
379 + bc1 = t<<36 | t>>(64-36)
380 + t = a[16] ^ d1
381 + bc2 = t<<10 | t>>(64-10)
382 + t = a[17] ^ d2
383 + bc3 = t<<15 | t>>(64-15)
384 + t = a[18] ^ d3
385 + bc4 = t<<56 | t>>(64-56)
386 + t = a[19] ^ d4
387 + bc0 = t<<27 | t>>(64-27)
388 + a[15] = bc0 ^ (bc2 &^ bc1)
389 + a[16] = bc1 ^ (bc3 &^ bc2)
390 + a[17] = bc2 ^ (bc4 &^ bc3)
391 + a[18] = bc3 ^ (bc0 &^ bc4)
392 + a[19] = bc4 ^ (bc1 &^ bc0)
393 +
394 + t = a[20] ^ d0
395 + bc3 = t<<41 | t>>(64-41)
396 + t = a[21] ^ d1
397 + bc4 = t<<2 | t>>(64-2)
398 + t = a[22] ^ d2
399 + bc0 = t<<62 | t>>(64-62)
400 + t = a[23] ^ d3
401 + bc1 = t<<55 | t>>(64-55)
402 + t = a[24] ^ d4
403 + bc2 = t<<39 | t>>(64-39)
404 + a[20] = bc0 ^ (bc2 &^ bc1)
405 + a[21] = bc1 ^ (bc3 &^ bc2)
406 + a[22] = bc2 ^ (bc4 &^ bc3)
407 + a[23] = bc3 ^ (bc0 &^ bc4)
408 + a[24] = bc4 ^ (bc1 &^ bc0)
409 }
410 }
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/register.go new
+18
@@ -0,0 +1,18 @@
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 +// Use of this source code is governed by a BSD-style
3 +// license that can be found in the LICENSE file.
4 +
5 +// +build go1.4
6 +
7 +package sha3
8 +
9 +import (
10 + "crypto"
11 +)
12 +
13 +func init() {
14 + crypto.RegisterHash(crypto.SHA3_224, New224)
15 + crypto.RegisterHash(crypto.SHA3_256, New256)
16 + crypto.RegisterHash(crypto.SHA3_384, New384)
17 + crypto.RegisterHash(crypto.SHA3_512, New512)
18 +}
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/sha3.go
+184 -171
@@ -1,213 +1,226 @@
1 -// Copyright 2013 The Go Authors. All rights reserved.
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
4
5 -// Package sha3 implements the SHA3 hash algorithm (formerly called Keccak) chosen by NIST in 2012.
6 -// This file provides a SHA3 implementation which implements the standard hash.Hash interface.
7 -// Writing input data, including padding, and reading output data are computed in this file.
8 -// Note that the current implementation can compute the hash of an integral number of bytes only.
9 -// This is a consequence of the hash interface in which a buffer of bytes is passed in.
10 -// The internals of the Keccak-f function are computed in keccakf.go.
11 -// For the detailed specification, refer to the Keccak web site (http://keccak.noekeon.org/).
5 package sha3
6
7 import (
8 "encoding/binary"
16 - "hash"
9 )
10
19 -// laneSize is the size in bytes of each "lane" of the internal state of SHA3 (5 * 5 * 8).
20 -// Note that changing this size would requires using a type other than uint64 to store each lane.
21 -const laneSize = 8
22 -
23 -// sliceSize represents the dimensions of the internal state, a square matrix of
24 -// sliceSize ** 2 lanes. This is the size of both the "rows" and "columns" dimensions in the
25 -// terminology of the SHA3 specification.
26 -const sliceSize = 5
27 -
28 -// numLanes represents the total number of lanes in the state.
29 -const numLanes = sliceSize * sliceSize
30 -
31 -// stateSize is the size in bytes of the internal state of SHA3 (5 * 5 * WSize).
32 -const stateSize = laneSize * numLanes
33 -
34 -// digest represents the partial evaluation of a checksum.
35 -// Note that capacity, and not outputSize, is the critical security parameter, as SHA3 can output
36 -// an arbitrary number of bytes for any given capacity. The Keccak proposal recommends that
37 -// capacity = 2*outputSize to ensure that finding a collision of size outputSize requires
38 -// O(2^{outputSize/2}) computations (the birthday lower bound). Future standards may modify the
39 -// capacity/outputSize ratio to allow for more output with lower cryptographic security.
40 -type digest struct {
41 - a [numLanes]uint64 // main state of the hash
42 - outputSize int // desired output size in bytes
43 - capacity int // number of bytes to leave untouched during squeeze/absorb
44 - absorbed int // number of bytes absorbed thus far
45 -}
11 +// spongeDirection indicates the direction bytes are flowing through the sponge.
12 +type spongeDirection int
13
47 -// minInt returns the lesser of two integer arguments, to simplify the absorption routine.
48 -func minInt(v1, v2 int) int {
49 - if v1 <= v2 {
50 - return v1
51 - }
52 - return v2
53 -}
14 +const (
15 + // spongeAbsorbing indicates that the sponge is absorbing input.
16 + spongeAbsorbing spongeDirection = iota
17 + // spongeSqueezing indicates that the sponge is being squeezed.
18 + spongeSqueezing
19 +)
20
55 -// rate returns the number of bytes of the internal state which can be absorbed or squeezed
56 -// in between calls to the permutation function.
57 -func (d *digest) rate() int {
58 - return stateSize - d.capacity
59 -}
21 +const (
22 + // maxRate is the maximum size of the internal buffer. SHAKE-256
23 + // currently needs the largest buffer.
24 + maxRate = 168
25 +)
26
61 -// Reset clears the internal state by zeroing bytes in the state buffer.
62 -// This can be skipped for a newly-created hash state; the default zero-allocated state is correct.
63 -func (d *digest) Reset() {
64 - d.absorbed = 0
65 - for i := range d.a {
66 - d.a[i] = 0
67 - }
27 +type state struct {
28 + // Generic sponge components.
29 + a [25]uint64 // main state of the hash
30 + buf []byte // points into storage
31 + rate int // the number of bytes of state to use
32 +
33 + // dsbyte contains the "domain separation" value and the first bit of
34 + // the padding. In sections 6.1 and 6.2 of [1], the SHA-3 and SHAKE
35 + // functions are defined with bits appended to the message: SHA-3
36 + // functions have 01 and SHAKE functions have 1111. Because of the way
37 + // that bits are numbered from the LSB upwards, that ends up as
38 + // 00000010b and 00001111b, respectively. Then the padding rule from
39 + // section 5.1 is applied to pad to a multiple of the rate, which
40 + // involves adding a 1 bit, zero or more zero bits and then a final one
41 + // bit. The first one bit from the padding is merged into the dsbyte
42 + // value giving 00000110b (0x06) and 00011111b (0x1f), respectively.
43 + //
44 + // [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf,
45 + dsbyte byte
46 + storage [maxRate]byte
47 +
48 + // Specific to SHA-3 and SHAKE.
49 + fixedOutput bool // whether this is a fixed-ouput-length instance
50 + outputLen int // the default output size in bytes
51 + state spongeDirection // current direction of the sponge
52 }
53
70 -// BlockSize, required by the hash.Hash interface, does not have a standard intepretation
71 -// for a sponge-based construction like SHA3. We return the data rate: the number of bytes which
72 -// can be absorbed per invocation of the permutation function. For Merkle-Damgård based hashes
73 -// (ie SHA1, SHA2, MD5) the output size of the internal compression function is returned.
74 -// We consider this to be roughly equivalent because it represents the number of bytes of output
75 -// produced per cryptographic operation.
76 -func (d *digest) BlockSize() int { return d.rate() }
54 +// BlockSize returns the rate of sponge underlying this hash function.
55 +func (d *state) BlockSize() int { return d.rate }
56
57 // Size returns the output size of the hash function in bytes.
79 -func (d *digest) Size() int {
80 - return d.outputSize
81 -}
58 +func (d *state) Size() int { return d.outputLen }
59
83 -// unalignedAbsorb is a helper function for Write, which absorbs data that isn't aligned with an
84 -// 8-byte lane. This requires shifting the individual bytes into position in a uint64.
85 -func (d *digest) unalignedAbsorb(p []byte) {
86 - var t uint64
87 - for i := len(p) - 1; i >= 0; i-- {
88 - t <<= 8
89 - t |= uint64(p[i])
60 +// Reset clears the internal state by zeroing the sponge state and
61 +// the byte buffer, and setting Sponge.state to absorbing.
62 +func (d *state) Reset() {
63 + // Zero the permutation's state.
64 + for i := range d.a {
65 + d.a[i] = 0
66 }
91 - offset := (d.absorbed) % d.rate()
92 - t <<= 8 * uint(offset%laneSize)
93 - d.a[offset/laneSize] ^= t
94 - d.absorbed += len(p)
67 + d.state = spongeAbsorbing
68 + d.buf = d.storage[:0]
69 }
70
97 -// Write "absorbs" bytes into the state of the SHA3 hash, updating as needed when the sponge
98 -// "fills up" with rate() bytes. Since lanes are stored internally as type uint64, this requires
99 -// converting the incoming bytes into uint64s using a little endian interpretation. This
100 -// implementation is optimized for large, aligned writes of multiples of 8 bytes (laneSize).
101 -// Non-aligned or uneven numbers of bytes require shifting and are slower.
102 -func (d *digest) Write(p []byte) (int, error) {
103 - // An initial offset is needed if the we aren't absorbing to the first lane initially.
104 - offset := d.absorbed % d.rate()
105 - toWrite := len(p)
106 -
107 - // The first lane may need to absorb unaligned and/or incomplete data.
108 - if (offset%laneSize != 0 || len(p) < 8) && len(p) > 0 {
109 - toAbsorb := minInt(laneSize-(offset%laneSize), len(p))
110 - d.unalignedAbsorb(p[:toAbsorb])
111 - p = p[toAbsorb:]
112 - offset = (d.absorbed) % d.rate()
113 -
114 - // For every rate() bytes absorbed, the state must be permuted via the F Function.
115 - if (d.absorbed)%d.rate() == 0 {
116 - keccakF(&d.a)
117 - }
71 +func (d *state) clone() *state {
72 + ret := *d
73 + if ret.state == spongeAbsorbing {
74 + ret.buf = ret.storage[:len(ret.buf)]
75 + } else {
76 + ret.buf = ret.storage[d.rate-cap(d.buf) : d.rate]
77 }
78
120 - // This loop should absorb the bulk of the data into full, aligned lanes.
121 - // It will call the update function as necessary.
122 - for len(p) > 7 {
123 - firstLane := offset / laneSize
124 - lastLane := minInt(d.rate()/laneSize, firstLane+len(p)/laneSize)
79 + return &ret
80 +}
81
126 - // This inner loop absorbs input bytes into the state in groups of 8, converted to uint64s.
127 - for lane := firstLane; lane < lastLane; lane++ {
128 - d.a[lane] ^= binary.LittleEndian.Uint64(p[:laneSize])
129 - p = p[laneSize:]
130 - }
131 - d.absorbed += (lastLane - firstLane) * laneSize
132 - // For every rate() bytes absorbed, the state must be permuted via the F Function.
133 - if (d.absorbed)%d.rate() == 0 {
134 - keccakF(&d.a)
135 - }
82 +// xorIn xors a buffer into the state, byte-swapping to
83 +// little-endian as necessary; it returns the number of bytes
84 +// copied, including any zeros appended to the bytestring.
85 +func (d *state) xorIn(buf []byte) {
86 + n := len(buf) / 8
87
137 - offset = 0
88 + for i := 0; i < n; i++ {
89 + a := binary.LittleEndian.Uint64(buf)
90 + d.a[i] ^= a
91 + buf = buf[8:]
92 }
93 + if len(buf) != 0 {
94 + // XOR in the last partial ulint64.
95 + a := uint64(0)
96 + for i, v := range buf {
97 + a |= uint64(v) << uint64(8*i)
98 + }
99 + d.a[n] ^= a
100 + }
101 +}
102
140 - // If there are insufficient bytes to fill the final lane, an unaligned absorption.
141 - // This should always start at a correct lane boundary though, or else it would be caught
142 - // by the uneven opening lane case above.
143 - if len(p) > 0 {
144 - d.unalignedAbsorb(p)
103 +// copyOut copies ulint64s to a byte buffer.
104 +func (d *state) copyOut(b []byte) {
105 + for i := 0; len(b) >= 8; i++ {
106 + binary.LittleEndian.PutUint64(b, d.a[i])
107 + b = b[8:]
108 }
109 +}
110
147 - return toWrite, nil
111 +// permute applies the KeccakF-1600 permutation. It handles
112 +// any input-output buffering.
113 +func (d *state) permute() {
114 + switch d.state {
115 + case spongeAbsorbing:
116 + // If we're absorbing, we need to xor the input into the state
117 + // before applying the permutation.
118 + d.xorIn(d.buf)
119 + d.buf = d.storage[:0]
120 + keccakF1600(&d.a)
121 + case spongeSqueezing:
122 + // If we're squeezing, we need to apply the permutatin before
123 + // copying more output.
124 + keccakF1600(&d.a)
125 + d.buf = d.storage[:d.rate]
126 + d.copyOut(d.buf)
127 + }
128 }
129
150 -// pad computes the SHA3 padding scheme based on the number of bytes absorbed.
151 -// The padding is a 1 bit, followed by an arbitrary number of 0s and then a final 1 bit, such that
152 -// the input bits plus padding bits are a multiple of rate(). Adding the padding simply requires
153 -// xoring an opening and closing bit into the appropriate lanes.
154 -func (d *digest) pad() {
155 - offset := d.absorbed % d.rate()
156 - // The opening pad bit must be shifted into position based on the number of bytes absorbed
157 - padOpenLane := offset / laneSize
158 - d.a[padOpenLane] ^= 0x0000000000000001 << uint(8*(offset%laneSize))
159 - // The closing padding bit is always in the last position
160 - padCloseLane := (d.rate() / laneSize) - 1
161 - d.a[padCloseLane] ^= 0x8000000000000000
130 +// pads appends the domain separation bits in dsbyte, applies
131 +// the multi-bitrate 10..1 padding rule, and permutes the state.
132 +func (d *state) padAndPermute(dsbyte byte) {
133 + if d.buf == nil {
134 + d.buf = d.storage[:0]
135 + }
136 + // Pad with this instance's domain-separator bits. We know that there's
137 + // at least one byte of space in d.buf because, if it were full,
138 + // permute would have been called to empty it. dsbyte also contains the
139 + // first one bit for the padding. See the comment in the state struct.
140 + d.buf = append(d.buf, dsbyte)
141 + zerosStart := len(d.buf)
142 + d.buf = d.storage[:d.rate]
143 + for i := zerosStart; i < d.rate; i++ {
144 + d.buf[i] = 0
145 + }
146 + // This adds the final one bit for the padding. Because of the way that
147 + // bits are numbered from the LSB upwards, the final bit is the MSB of
148 + // the last byte.
149 + d.buf[d.rate-1] ^= 0x80
150 + // Apply the permutation
151 + d.permute()
152 + d.state = spongeSqueezing
153 + d.buf = d.storage[:d.rate]
154 + d.copyOut(d.buf)
155 }
156
164 -// finalize prepares the hash to output data by padding and one final permutation of the state.
165 -func (d *digest) finalize() {
166 - d.pad()
167 - keccakF(&d.a)
157 +// Write absorbs more data into the hash's state. It produces an error
158 +// if more data is written to the ShakeHash after writing
159 +func (d *state) Write(p []byte) (written int, err error) {
160 + if d.state != spongeAbsorbing {
161 + panic("sha3: write to sponge after read")
162 + }
163 + if d.buf == nil {
164 + d.buf = d.storage[:0]
165 + }
166 + written = len(p)
167 +
168 + for len(p) > 0 {
169 + if len(d.buf) == 0 && len(p) >= d.rate {
170 + // The fast path; absorb a full "rate" bytes of input and apply the permutation.
171 + d.xorIn(p[:d.rate])
172 + p = p[d.rate:]
173 + keccakF1600(&d.a)
174 + } else {
175 + // The slow path; buffer the input until we can fill the sponge, and then xor it in.
176 + todo := d.rate - len(d.buf)
177 + if todo > len(p) {
178 + todo = len(p)
179 + }
180 + d.buf = append(d.buf, p[:todo]...)
181 + p = p[todo:]
182 +
183 + // If the sponge is full, apply the permutation.
184 + if len(d.buf) == d.rate {
185 + d.permute()
186 + }
187 + }
188 + }
189 +
190 + return
191 }
192
170 -// squeeze outputs an arbitrary number of bytes from the hash state.
171 -// Squeezing can require multiple calls to the F function (one per rate() bytes squeezed),
172 -// although this is not the case for standard SHA3 parameters. This implementation only supports
173 -// squeezing a single time, subsequent squeezes may lose alignment. Future implementations
174 -// may wish to support multiple squeeze calls, for example to support use as a PRNG.
175 -func (d *digest) squeeze(in []byte, toSqueeze int) []byte {
176 - // Because we read in blocks of laneSize, we need enough room to read
177 - // an integral number of lanes
178 - needed := toSqueeze + (laneSize-toSqueeze%laneSize)%laneSize
179 - if cap(in)-len(in) < needed {
180 - newIn := make([]byte, len(in), len(in)+needed)
181 - copy(newIn, in)
182 - in = newIn
193 +// Read squeezes an arbitrary number of bytes from the sponge.
194 +func (d *state) Read(out []byte) (n int, err error) {
195 + // If we're still absorbing, pad and apply the permutation.
196 + if d.state == spongeAbsorbing {
197 + d.padAndPermute(d.dsbyte)
198 }
184 - out := in[len(in) : len(in)+needed]
199
200 + n = len(out)
201 +
202 + // Now, do the squeezing.
203 for len(out) > 0 {
187 - for i := 0; i < d.rate() && len(out) > 0; i += laneSize {
188 - binary.LittleEndian.PutUint64(out[:], d.a[i/laneSize])
189 - out = out[laneSize:]
190 - }
191 - if len(out) > 0 {
192 - keccakF(&d.a)
204 + n := copy(out, d.buf)
205 + d.buf = d.buf[n:]
206 + out = out[n:]
207 +
208 + // Apply the permutation if we've squeezed the sponge dry.
209 + if len(d.buf) == 0 {
210 + d.permute()
211 }
212 }
195 - return in[:len(in)+toSqueeze] // Re-slice in case we wrote extra data.
196 -}
213
198 -// Sum applies padding to the hash state and then squeezes out the desired nubmer of output bytes.
199 -func (d *digest) Sum(in []byte) []byte {
200 - // Make a copy of the original hash so that caller can keep writing and summing.
201 - dup := *d
202 - dup.finalize()
203 - return dup.squeeze(in, dup.outputSize)
214 + return
215 }
216
206 -// The NewKeccakX constructors enable initializing a hash in any of the four recommend sizes
207 -// from the Keccak specification, all of which set capacity=2*outputSize. Note that the final
208 -// NIST standard for SHA3 may specify different input/output lengths.
209 -// The output size is indicated in bits but converted into bytes internally.
210 -func NewKeccak224() hash.Hash { return &digest{outputSize: 224 / 8, capacity: 2 * 224 / 8} }
211 -func NewKeccak256() hash.Hash { return &digest{outputSize: 256 / 8, capacity: 2 * 256 / 8} }
212 -func NewKeccak384() hash.Hash { return &digest{outputSize: 384 / 8, capacity: 2 * 384 / 8} }
213 -func NewKeccak512() hash.Hash { return &digest{outputSize: 512 / 8, capacity: 2 * 512 / 8} }
217 +// Sum applies padding to the hash state and then squeezes out the desired
218 +// number of output bytes.
219 +func (d *state) Sum(in []byte) []byte {
220 + // Make a copy of the original hash so that caller can keep writing
221 + // and summing.
222 + dup := d.clone()
223 + hash := make([]byte, dup.outputLen)
224 + dup.Read(hash)
225 + return append(in, hash...)
226 +}
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/sha3_test.go
+137 -158
@@ -1,34 +1,56 @@
1 -// Copyright 2013 The Go Authors. All rights reserved.
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
4
5 package sha3
6
7 -// These tests are a subset of those provided by the Keccak web site(http://keccak.noekeon.org/).
7 +// Tests include all the ShortMsgKATs provided by the Keccak team at
8 +// https://github.com/gvanas/KeccakCodePackage
9 +//
10 +// They only include the zero-bit case of the utterly useless bitwise
11 +// testvectors published by NIST in the draft of FIPS-202.
12
13 import (
14 "bytes"
15 + "compress/flate"
16 "encoding/hex"
12 - "fmt"
17 + "encoding/json"
18 "hash"
19 + "os"
20 "strings"
21 "testing"
22 )
23
18 -// testDigests maintains a digest state of each standard type.
19 -var testDigests = map[string]*digest{
20 - "Keccak224": {outputSize: 224 / 8, capacity: 2 * 224 / 8},
21 - "Keccak256": {outputSize: 256 / 8, capacity: 2 * 256 / 8},
22 - "Keccak384": {outputSize: 384 / 8, capacity: 2 * 384 / 8},
23 - "Keccak512": {outputSize: 512 / 8, capacity: 2 * 512 / 8},
24 +const (
25 + testString = "brekeccakkeccak koax koax"
26 + katFilename = "keccakKats.json.deflate"
27 +)
28 +
29 +// Internal-use instances of SHAKE used to test against KATs.
30 +func newHashShake128() hash.Hash {
31 + return &state{rate: 168, dsbyte: 0x1f, outputLen: 512}
32 +}
33 +func newHashShake256() hash.Hash {
34 + return &state{rate: 136, dsbyte: 0x1f, outputLen: 512}
35 }
36
26 -// testVector represents a test input and expected outputs from multiple algorithm variants.
27 -type testVector struct {
28 - desc string
29 - input []byte
30 - repeat int // input will be concatenated the input this many times.
31 - want map[string]string
37 +// testDigests contains functions returning hash.Hash instances
38 +// with output-length equal to the KAT length for both SHA-3 and
39 +// SHAKE instances.
40 +var testDigests = map[string]func() hash.Hash{
41 + "SHA3-224": New224,
42 + "SHA3-256": New256,
43 + "SHA3-384": New384,
44 + "SHA3-512": New512,
45 + "SHAKE128": newHashShake128,
46 + "SHAKE256": newHashShake256,
47 +}
48 +
49 +// testShakes contains functions returning ShakeHash instances for
50 +// testing the ShakeHash-specific interface.
51 +var testShakes = map[string]func() ShakeHash{
52 + "SHAKE128": NewShake128,
53 + "SHAKE256": NewShake256,
54 }
55
56 // decodeHex converts an hex-encoded string into a raw byte string.
@@ -40,102 +62,61 @@ func decodeHex(s string) []byte {
62 return b
63 }
64
43 -// shortTestVectors stores a series of short testVectors.
44 -// Inputs of 8, 248, and 264 bits from http://keccak.noekeon.org/ are included below.
45 -// The standard defines additional test inputs of all sizes between 0 and 2047 bits.
46 -// Because the current implementation can only handle an integral number of bytes,
47 -// most of the standard test inputs can't be used.
48 -var shortKeccakTestVectors = []testVector{
49 - {
50 - desc: "short-8b",
51 - input: decodeHex("CC"),
52 - repeat: 1,
53 - want: map[string]string{
54 - "Keccak224": "A9CAB59EB40A10B246290F2D6086E32E3689FAF1D26B470C899F2802",
55 - "Keccak256": "EEAD6DBFC7340A56CAEDC044696A168870549A6A7F6F56961E84A54BD9970B8A",
56 - "Keccak384": "1B84E62A46E5A201861754AF5DC95C4A1A69CAF4A796AE405680161E29572641F5FA1E8641D7958336EE7B11C58F73E9",
57 - "Keccak512": "8630C13CBD066EA74BBE7FE468FEC1DEE10EDC1254FB4C1B7C5FD69B646E44160B8CE01D05A0908CA790DFB080F4B513BC3B6225ECE7A810371441A5AC666EB9",
58 - },
59 - },
60 - {
61 - desc: "short-248b",
62 - input: decodeHex("84FB51B517DF6C5ACCB5D022F8F28DA09B10232D42320FFC32DBECC3835B29"),
63 - repeat: 1,
64 - want: map[string]string{
65 - "Keccak224": "81AF3A7A5BD4C1F948D6AF4B96F93C3B0CF9C0E7A6DA6FCD71EEC7F6",
66 - "Keccak256": "D477FB02CAAA95B3280EC8EE882C29D9E8A654B21EF178E0F97571BF9D4D3C1C",
67 - "Keccak384": "503DCAA4ADDA5A9420B2E436DD62D9AB2E0254295C2982EF67FCE40F117A2400AB492F7BD5D133C6EC2232268BC27B42",
68 - "Keccak512": "9D8098D8D6EDBBAA2BCFC6FB2F89C3EAC67FEC25CDFE75AA7BD570A648E8C8945FF2EC280F6DCF73386109155C5BBC444C707BB42EAB873F5F7476657B1BC1A8",
69 - },
70 - },
71 - {
72 - desc: "short-264b",
73 - input: decodeHex("DE8F1B3FAA4B7040ED4563C3B8E598253178E87E4D0DF75E4FF2F2DEDD5A0BE046"),
74 - repeat: 1,
75 - want: map[string]string{
76 - "Keccak224": "F217812E362EC64D4DC5EACFABC165184BFA456E5C32C2C7900253D0",
77 - "Keccak256": "E78C421E6213AFF8DE1F025759A4F2C943DB62BBDE359C8737E19B3776ED2DD2",
78 - "Keccak384": "CF38764973F1EC1C34B5433AE75A3AAD1AAEF6AB197850C56C8617BCD6A882F6666883AC17B2DCCDBAA647075D0972B5",
79 - "Keccak512": "9A7688E31AAF40C15575FC58C6B39267AAD3722E696E518A9945CF7F7C0FEA84CB3CB2E9F0384A6B5DC671ADE7FB4D2B27011173F3EEEAF17CB451CF26542031",
80 - },
81 - },
82 -}
83 -
84 -// longTestVectors stores longer testVectors (currently only one).
85 -// The computed test vector is 64 MiB long and is a truncated version of the
86 -// ExtremelyLongMsgKAT taken from http://keccak.noekeon.org/.
87 -var longKeccakTestVectors = []testVector{
88 - {
89 - desc: "long-64MiB",
90 - input: []byte("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmno"),
91 - repeat: 1024 * 1024,
92 - want: map[string]string{
93 - "Keccak224": "50E35E40980FEEFF1EA490957B0E970257F75EA0D410EE0F0B8A7A58",
94 - "Keccak256": "5015A4935F0B51E091C6550A94DCD262C08998232CCAA22E7F0756DEAC0DC0D0",
95 - "Keccak384": "7907A8D0FAA7BC6A90FE14C6C958C956A0877E751455D8F13ACDB96F144B5896E716C06EC0CB56557A94EF5C3355F6F3",
96 - "Keccak512": "3EC327D6759F769DEB74E80CA70C831BC29CAB048A4BF4190E4A1DD5C6507CF2B4B58937FDE81D36014E7DFE1B1DD8B0F27CB7614F9A645FEC114F1DAAEFC056",
97 - },
98 - },
65 +// structs used to marshal JSON test-cases.
66 +type KeccakKats struct {
67 + Kats map[string][]struct {
68 + Digest string `json:"digest"`
69 + Length int64 `json:"length"`
70 + Message string `json:"message"`
71 + }
72 }
73
101 -// TestKeccakVectors checks that correct output is produced for a set of known testVectors.
102 -func TestKeccakVectors(t *testing.T) {
103 - testCases := append([]testVector{}, shortKeccakTestVectors...)
104 - if !testing.Short() {
105 - testCases = append(testCases, longKeccakTestVectors...)
74 +// TestKeccakKats tests the SHA-3 and Shake implementations against all the
75 +// ShortMsgKATs from https://github.com/gvanas/KeccakCodePackage
76 +// (The testvectors are stored in keccakKats.json.deflate due to their length.)
77 +func TestKeccakKats(t *testing.T) {
78 + // Read the KATs.
79 + deflated, err := os.Open(katFilename)
80 + if err != nil {
81 + t.Errorf("Error opening %s: %s", katFilename, err)
82 + }
83 + file := flate.NewReader(deflated)
84 + dec := json.NewDecoder(file)
85 + var katSet KeccakKats
86 + err = dec.Decode(&katSet)
87 + if err != nil {
88 + t.Errorf("%s", err)
89 }
107 - for _, tc := range testCases {
108 - for alg, want := range tc.want {
109 - d := testDigests[alg]
90 +
91 + // Do the KATs.
92 + for functionName, kats := range katSet.Kats {
93 + d := testDigests[functionName]()
94 + t.Logf("%s", functionName)
95 + for _, kat := range kats {
96 d.Reset()
111 - for i := 0; i < tc.repeat; i++ {
112 - d.Write(tc.input)
97 + in, err := hex.DecodeString(kat.Message)
98 + if err != nil {
99 + t.Errorf("%s", err)
100 }
101 + d.Write(in[:kat.Length/8])
102 got := strings.ToUpper(hex.EncodeToString(d.Sum(nil)))
103 + want := kat.Digest
104 if got != want {
116 - t.Errorf("%s, alg=%s\ngot %q, want %q", tc.desc, alg, got, want)
105 + t.Errorf("function=%s, length=%d\nmessage:\n %s\ngot:\n %s\nwanted:\n %s",
106 + functionName, kat.Length, kat.Message, got, want)
107 + t.Logf("wanted %+v", kat)
108 + t.FailNow()
109 }
110 }
111 }
112 }
113
122 -// dumpState is a debugging function to pretty-print the internal state of the hash.
123 -func (d *digest) dumpState() {
124 - fmt.Printf("SHA3 hash, %d B output, %d B capacity (%d B rate)\n", d.outputSize, d.capacity, d.rate())
125 - fmt.Printf("Internal state after absorbing %d B:\n", d.absorbed)
126 -
127 - for x := 0; x < sliceSize; x++ {
128 - for y := 0; y < sliceSize; y++ {
129 - fmt.Printf("%v, ", d.a[x*sliceSize+y])
130 - }
131 - fmt.Println("")
132 - }
133 -}
134 -
135 -// TestUnalignedWrite tests that writing data in an arbitrary pattern with small input buffers.
114 +// TestUnalignedWrite tests that writing data in an arbitrary pattern with
115 +// small input buffers.
116 func TestUnalignedWrite(t *testing.T) {
117 buf := sequentialBytes(0x10000)
138 - for alg, d := range testDigests {
118 + for alg, df := range testDigests {
119 + d := df()
120 d.Reset()
121 d.Write(buf)
122 want := d.Sum(nil)
@@ -145,7 +126,9 @@ func TestUnalignedWrite(t *testing.T) {
126 // Because 137 is prime this sequence should exercise all corner cases.
127 offsets := [17]int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 1}
128 for _, j := range offsets {
148 - j = minInt(j, len(buf)-i)
129 + if v := len(buf) - i; v < j {
130 + j = v
131 + }
132 d.Write(buf[i : i+j])
133 i += j
134 }
@@ -157,8 +140,9 @@ func TestUnalignedWrite(t *testing.T) {
140 }
141 }
142
143 +// Test that appending works when reallocation is necessary.
144 func TestAppend(t *testing.T) {
161 - d := NewKeccak224()
145 + d := New224()
146
147 for capacity := 2; capacity < 64; capacity += 64 {
148 // The first time around the loop, Sum will have to reallocate.
@@ -167,24 +151,57 @@ func TestAppend(t *testing.T) {
151 d.Reset()
152 d.Write([]byte{0xcc})
153 buf = d.Sum(buf)
170 - expected := "0000A9CAB59EB40A10B246290F2D6086E32E3689FAF1D26B470C899F2802"
154 + expected := "0000DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"
155 if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {
156 t.Errorf("got %s, want %s", got, expected)
157 }
158 }
159 }
160
161 +// Test that appending works when no reallocation is necessary.
162 func TestAppendNoRealloc(t *testing.T) {
163 buf := make([]byte, 1, 200)
179 - d := NewKeccak224()
164 + d := New224()
165 d.Write([]byte{0xcc})
166 buf = d.Sum(buf)
182 - expected := "00A9CAB59EB40A10B246290F2D6086E32E3689FAF1D26B470C899F2802"
167 + expected := "00DF70ADC49B2E76EEE3A6931B93FA41841C3AF2CDF5B32A18B5478C39"
168 if got := strings.ToUpper(hex.EncodeToString(buf)); got != expected {
169 t.Errorf("got %s, want %s", got, expected)
170 }
171 }
172
173 +// TestSqueezing checks that squeezing the full output a single time produces
174 +// the same output as repeatedly squeezing the instance.
175 +func TestSqueezing(t *testing.T) {
176 + for functionName, newShakeHash := range testShakes {
177 + t.Logf("%s", functionName)
178 + d0 := newShakeHash()
179 + d0.Write([]byte(testString))
180 + ref := make([]byte, 32)
181 + d0.Read(ref)
182 +
183 + d1 := newShakeHash()
184 + d1.Write([]byte(testString))
185 + var multiple []byte
186 + for _ = range ref {
187 + one := make([]byte, 1)
188 + d1.Read(one)
189 + multiple = append(multiple, one...)
190 + }
191 + if !bytes.Equal(ref, multiple) {
192 + t.Errorf("squeezing %d bytes one at a time failed", len(ref))
193 + }
194 + }
195 +}
196 +
197 +func TestReadSimulation(t *testing.T) {
198 + d := NewShake256()
199 + d.Write(nil)
200 + dwr := make([]byte, 32)
201 + d.Read(dwr)
202 +
203 +}
204 +
205 // sequentialBytes produces a buffer of size consecutive bytes 0x00, 0x01, ..., used for testing.
206 func sequentialBytes(size int) []byte {
207 result := make([]byte, size)
@@ -194,77 +211,39 @@ func sequentialBytes(size int) []byte {
211 return result
212 }
213
197 -// benchmarkBlockWrite tests the speed of writing data and never calling the permutation function.
198 -func benchmarkBlockWrite(b *testing.B, d *digest) {
199 - b.StopTimer()
200 - d.Reset()
201 - // Write all but the last byte of a block, to ensure that the permutation is not called.
202 - data := sequentialBytes(d.rate() - 1)
203 - b.SetBytes(int64(len(data)))
204 - b.StartTimer()
205 - for i := 0; i < b.N; i++ {
206 - d.absorbed = 0 // Reset absorbed to avoid ever calling the permutation function
207 - d.Write(data)
208 - }
209 - b.StopTimer()
210 - d.Reset()
211 -}
212 -
213 -// BenchmarkPermutationFunction measures the speed of the permutation function with no input data.
214 +// BenchmarkPermutationFunction measures the speed of the permutation function
215 +// with no input data.
216 func BenchmarkPermutationFunction(b *testing.B) {
215 - b.SetBytes(int64(stateSize))
216 - var lanes [numLanes]uint64
217 + b.SetBytes(int64(200))
218 + var lanes [25]uint64
219 for i := 0; i < b.N; i++ {
218 - keccakF(&lanes)
220 + keccakF1600(&lanes)
221 }
222 }
223
222 -// BenchmarkSingleByteWrite tests the latency from writing a single byte
223 -func BenchmarkSingleByteWrite(b *testing.B) {
224 - b.StopTimer()
225 - d := testDigests["Keccak512"]
226 - d.Reset()
227 - data := sequentialBytes(1) //1 byte buffer
228 - b.SetBytes(int64(d.rate()) - 1)
229 - b.StartTimer()
230 - for i := 0; i < b.N; i++ {
231 - d.absorbed = 0 // Reset absorbed to avoid ever calling the permutation function
232 -
233 - // Write all but the last byte of a block, one byte at a time.
234 - for j := 0; j < d.rate()-1; j++ {
235 - d.Write(data)
236 - }
237 - }
238 - b.StopTimer()
239 - d.Reset()
240 -}
241 -
242 -// BenchmarkSingleByteX measures the block write speed for each size of the digest.
243 -func BenchmarkBlockWrite512(b *testing.B) { benchmarkBlockWrite(b, testDigests["Keccak512"]) }
244 -func BenchmarkBlockWrite384(b *testing.B) { benchmarkBlockWrite(b, testDigests["Keccak384"]) }
245 -func BenchmarkBlockWrite256(b *testing.B) { benchmarkBlockWrite(b, testDigests["Keccak256"]) }
246 -func BenchmarkBlockWrite224(b *testing.B) { benchmarkBlockWrite(b, testDigests["Keccak224"]) }
247 -
248 -// benchmarkBulkHash tests the speed to hash a 16 KiB buffer.
249 -func benchmarkBulkHash(b *testing.B, h hash.Hash) {
224 +// benchmarkBulkHash tests the speed to hash a buffer of buflen.
225 +func benchmarkBulkHash(b *testing.B, h hash.Hash, size int) {
226 b.StopTimer()
227 h.Reset()
252 - size := 1 << 14
228 data := sequentialBytes(size)
229 b.SetBytes(int64(size))
230 b.StartTimer()
231
257 - var digest []byte
232 + var state []byte
233 for i := 0; i < b.N; i++ {
234 h.Write(data)
260 - digest = h.Sum(digest[:0])
235 + state = h.Sum(state[:0])
236 }
237 b.StopTimer()
238 h.Reset()
239 }
240
266 -// benchmarkBulkKeccakX test the speed to hash a 16 KiB buffer by calling benchmarkBulkHash.
267 -func BenchmarkBulkKeccak512(b *testing.B) { benchmarkBulkHash(b, NewKeccak512()) }
268 -func BenchmarkBulkKeccak384(b *testing.B) { benchmarkBulkHash(b, NewKeccak384()) }
269 -func BenchmarkBulkKeccak256(b *testing.B) { benchmarkBulkHash(b, NewKeccak256()) }
270 -func BenchmarkBulkKeccak224(b *testing.B) { benchmarkBulkHash(b, NewKeccak224()) }
241 +func BenchmarkSha3_512_MTU(b *testing.B) { benchmarkBulkHash(b, New512(), 1350) }
242 +func BenchmarkSha3_384_MTU(b *testing.B) { benchmarkBulkHash(b, New384(), 1350) }
243 +func BenchmarkSha3_256_MTU(b *testing.B) { benchmarkBulkHash(b, New256(), 1350) }
244 +func BenchmarkSha3_224_MTU(b *testing.B) { benchmarkBulkHash(b, New224(), 1350) }
245 +func BenchmarkShake256_MTU(b *testing.B) { benchmarkBulkHash(b, newHashShake256(), 1350) }
246 +func BenchmarkShake128_MTU(b *testing.B) { benchmarkBulkHash(b, newHashShake128(), 1350) }
247 +
248 +func BenchmarkSha3_512_1MiB(b *testing.B) { benchmarkBulkHash(b, New512(), 1<<20) }
249 +func BenchmarkShake256_1MiB(b *testing.B) { benchmarkBulkHash(b, newHashShake256(), 1<<20) }
Godeps/_workspace/src/code.google.com/p/go.crypto/sha3/shake.go new
+60
@@ -0,0 +1,60 @@
1 +// Copyright 2014 The Go Authors. All rights reserved.
2 +// Use of this source code is governed by a BSD-style
3 +// license that can be found in the LICENSE file.
4 +
5 +package sha3
6 +
7 +// This file defines the ShakeHash interface, and provides
8 +// functions for creating SHAKE instances, as well as utility
9 +// functions for hashing bytes to arbitrary-length output.
10 +
11 +import (
12 + "io"
13 +)
14 +
15 +// ShakeHash defines the interface to hash functions that
16 +// support arbitrary-length output.
17 +type ShakeHash interface {
18 + // Write absorbs more data into the hash's state. It panics if input is
19 + // written to it after output has been read from it.
20 + io.Writer
21 +
22 + // Read reads more output from the hash; reading affects the hash's
23 + // state. (ShakeHash.Read is thus very different from Hash.Sum)
24 + // It never returns an error.
25 + io.Reader
26 +
27 + // Clone returns a copy of the ShakeHash in its current state.
28 + Clone() ShakeHash
29 +
30 + // Reset resets the ShakeHash to its initial state.
31 + Reset()
32 +}
33 +
34 +func (d *state) Clone() ShakeHash {
35 + return d.clone()
36 +}
37 +
38 +// NewShake128 creates a new SHAKE128 variable-output-length ShakeHash.
39 +// Its generic security strength is 128 bits against all attacks if at
40 +// least 32 bytes of its output are used.
41 +func NewShake128() ShakeHash { return &state{rate: 168, dsbyte: 0x1f} }
42 +
43 +// NewShake256 creates a new SHAKE128 variable-output-length ShakeHash.
44 +// Its generic security strength is 256 bits against all attacks if
45 +// at least 64 bytes of its output are used.
46 +func NewShake256() ShakeHash { return &state{rate: 136, dsbyte: 0x1f} }
47 +
48 +// ShakeSum128 writes an arbitrary-length digest of data into hash.
49 +func ShakeSum128(hash, data []byte) {
50 + h := NewShake128()
51 + h.Write(data)
52 + h.Read(hash)
53 +}
54 +
55 +// ShakeSum256 writes an arbitrary-length digest of data into hash.
56 +func ShakeSum256(hash, data []byte) {
57 + h := NewShake256()
58 + h.Write(data)
59 + h.Read(hash)
60 +}