//

// Shake.c

//

// Copyright (c) Microsoft Corporation. Licensed under the MIT license.

//

#include "precomp.h"

//

// See the symcrypt.h file for documentation on what the various functions do.

//

//

//  SHAKE128

//

#define Alg Shake128

#define ALG SHAKE128

#define SYMCRYPT_SHAKEXXX_INPUT_BLOCK_SIZE      SYMCRYPT_SHAKE128_INPUT_BLOCK_SIZE

#define SYMCRYPT_SHAKEXXX_RESULT_SIZE           SYMCRYPT_SHAKE128_RESULT_SIZE

#include "shake_pattern.c"

#undef SYMCRYPT_SHAKEXXX_RESULT_SIZE

#undef SYMCRYPT_SHAKEXXX_INPUT_BLOCK_SIZE

#undef ALG

#undef Alg

const SYMCRYPT_HASH SymCryptShake128HashAlgorithm_default = {

    &SymCryptShake128Init,

    &SymCryptShake128Append,

    &SymCryptShake128Result,

    NULL,                           // AppendBlocks function is not implemented for SHA-3

    &SymCryptShake128StateCopy,

    sizeof(SYMCRYPT_SHAKE128_STATE),

    SYMCRYPT_SHAKE128_RESULT_SIZE,

    SYMCRYPT_SHAKE128_INPUT_BLOCK_SIZE,

    SYMCRYPT_FIELD_OFFSET(SYMCRYPT_SHAKE128_STATE, ks.state),

    SYMCRYPT_FIELD_SIZE(SYMCRYPT_SHAKE128_STATE, ks.state),

};

const PCSYMCRYPT_HASH SymCryptShake128HashAlgorithm = &SymCryptShake128HashAlgorithm_default;

static const BYTE shake128KATAnswer[SYMCRYPT_SHAKE128_RESULT_SIZE] = {

    0x58, 0x81, 0x09, 0x2d, 0xd8, 0x18, 0xbf, 0x5c,

    0xf8, 0xa3, 0xdd, 0xb7, 0x93, 0xfb, 0xcb, 0xa7,

    0x40, 0x97, 0xd5, 0xc5, 0x26, 0xa6, 0xd3, 0x5f,

    0x97, 0xb8, 0x33, 0x51, 0x94, 0x0f, 0x2c ,0xc8

};

VOID

SYMCRYPT_CALL

SymCryptShake128Selftest(void)

{

    BYTE result[SYMCRYPT_SHAKE128_RESULT_SIZE];

    SymCryptShake128(SymCryptTestMsg3, sizeof(SymCryptTestMsg3), result, sizeof(result));

    SymCryptInjectError(result, sizeof(result));

    if (memcmp(result, shake128KATAnswer, sizeof(result)) != 0)

    {

        SymCryptFatal('shk1');

    }

}

//

//  SHAKE256 

//

#define Alg Shake256

#define ALG SHAKE256

#define SYMCRYPT_SHAKEXXX_INPUT_BLOCK_SIZE      SYMCRYPT_SHAKE256_INPUT_BLOCK_SIZE

#define SYMCRYPT_SHAKEXXX_RESULT_SIZE           SYMCRYPT_SHAKE256_RESULT_SIZE

#include "shake_pattern.c"

#undef SYMCRYPT_SHAKEXXX_RESULT_SIZE

#undef SYMCRYPT_SHAKEXXX_INPUT_BLOCK_SIZE

#undef ALG

#undef Alg

const SYMCRYPT_HASH SymCryptShake256HashAlgorithm_default = {

    &SymCryptShake256Init,

    &SymCryptShake256Append,

    &SymCryptShake256Result,

    NULL,                           // AppendBlocks function is not implemented for SHA-3

    &SymCryptShake256StateCopy,

    sizeof(SYMCRYPT_SHAKE256_STATE),

    SYMCRYPT_SHAKE256_RESULT_SIZE,

    SYMCRYPT_SHAKE256_INPUT_BLOCK_SIZE,

    SYMCRYPT_FIELD_OFFSET(SYMCRYPT_SHAKE256_STATE, ks.state),

    SYMCRYPT_FIELD_SIZE(SYMCRYPT_SHAKE256_STATE, ks.state),

};

const PCSYMCRYPT_HASH SymCryptShake256HashAlgorithm = &SymCryptShake256HashAlgorithm_default;

static const BYTE shake256KATAnswer[SYMCRYPT_SHAKE256_RESULT_SIZE] = {

    0x48, 0x33, 0x66, 0x60, 0x13, 0x60, 0xa8, 0x77, 0x1c, 0x68, 0x63, 0x08, 0x0c, 0xc4, 0x11, 0x4d,

    0x8d, 0xb4, 0x45, 0x30, 0xf8, 0xf1, 0xe1, 0xee, 0x4f, 0x94, 0xea, 0x37, 0xe7, 0x8b, 0x57, 0x39,

    0xd5, 0xa1, 0x5b, 0xef, 0x18, 0x6a, 0x53, 0x86, 0xc7, 0x57, 0x44, 0xc0, 0x52, 0x7e, 0x1f, 0xaa,

    0x9f, 0x87, 0x26, 0xe4, 0x62, 0xa1, 0x2a, 0x4f, 0xeb, 0x06, 0xbd, 0x88, 0x01, 0xe7, 0x51, 0xe4

};

VOID

SYMCRYPT_CALL

SymCryptShake256Selftest(void)

{

    BYTE result[SYMCRYPT_SHAKE256_RESULT_SIZE];

    SymCryptShake256(SymCryptTestMsg3, sizeof(SymCryptTestMsg3), result, sizeof(result));

    SymCryptInjectError(result, sizeof(result));

    if (memcmp(result, shake256KATAnswer, sizeof(result)) != 0)

    {

        SymCryptFatal('shk2');

    }

}

//

//  CSHAKE128

//

#define Alg CShake128

#define ALG CSHAKE128

#define SYMCRYPT_SHAKEXXX_INIT                  SymCryptShake128Init

#define SYMCRYPT_SHAKEXXX_STATE                 SYMCRYPT_SHAKE128_STATE

#define SYMCRYPT_CSHAKEXXX_INPUT_BLOCK_SIZE     SYMCRYPT_CSHAKE128_INPUT_BLOCK_SIZE

#define SYMCRYPT_CSHAKEXXX_RESULT_SIZE          SYMCRYPT_CSHAKE128_RESULT_SIZE

#include "cshake_pattern.c"

#undef SYMCRYPT_CSHAKEXXX_RESULT_SIZE

#undef SYMCRYPT_CSHAKEXXX_INPUT_BLOCK_SIZE

#undef SYMCRYPT_SHAKEXXX_STATE

#undef SYMCRYPT_SHAKEXXX_INIT

#undef ALG

#undef Alg

static const BYTE cshake128KATAnswer[SYMCRYPT_CSHAKE128_RESULT_SIZE] = {

    0x14, 0xe5, 0xdf, 0xf3, 0xae, 0xfd, 0xfe, 0x8e,

    0xa6, 0xae, 0xed, 0xfd, 0x99, 0xe6, 0x84, 0x74,

    0xbc, 0x61, 0xb9, 0xd6, 0x17, 0x4e, 0x9f, 0x4a,

    0xe3, 0xbd, 0x87, 0xdf, 0x0e, 0xf2, 0x16, 0xdb,

};

VOID

SYMCRYPT_CALL

SymCryptCShake128Selftest(void)

{

    BYTE result[SYMCRYPT_CSHAKE128_RESULT_SIZE];

    static const unsigned char Nstr[] = { 'N' };

    static const unsigned char Sstr[] = { 'S' };

    SymCryptCShake128(  Nstr, sizeof(Nstr), 

                        Sstr, sizeof(Sstr), 

                        SymCryptTestMsg3, sizeof(SymCryptTestMsg3), 

                        result, sizeof(result));

    SymCryptInjectError(result, sizeof(result));

    if (memcmp(result, cshake128KATAnswer, sizeof(result)) != 0)

    {

        SymCryptFatal('cshk');

    }

}

//

//  CSHAKE256 

//

#define Alg CShake256

#define ALG CSHAKE256

#define SYMCRYPT_SHAKEXXX_INIT                  SymCryptShake256Init

#define SYMCRYPT_SHAKEXXX_STATE                 SYMCRYPT_SHAKE256_STATE

#define SYMCRYPT_CSHAKEXXX_INPUT_BLOCK_SIZE     SYMCRYPT_CSHAKE256_INPUT_BLOCK_SIZE

#define SYMCRYPT_CSHAKEXXX_RESULT_SIZE          SYMCRYPT_CSHAKE256_RESULT_SIZE

#include "cshake_pattern.c"

#undef SYMCRYPT_CSHAKEXXX_RESULT_SIZE

#undef SYMCRYPT_CSHAKEXXX_INPUT_BLOCK_SIZE

#undef SYMCRYPT_SHAKEXXX_STATE

#undef SYMCRYPT_SHAKEXXX_INIT

#undef ALG

#undef Alg

static const BYTE cshake256KATAnswer[SYMCRYPT_CSHAKE256_RESULT_SIZE] = {

    0x4d, 0xe8, 0x71, 0x6c, 0x4a, 0x16, 0x7e, 0x28, 0x2c, 0x18, 0xc5, 0x1e, 0xed, 0xa6, 0x00, 0xb8,

    0x91, 0x92, 0x4f, 0xea, 0x2e, 0x20, 0x7f, 0x71, 0x2c, 0xfd, 0xe2, 0x95, 0xfd, 0x1c, 0x67, 0x32,

    0x31, 0x49, 0x98, 0x23, 0xc0, 0x5e, 0x6a, 0xe3, 0x89, 0xad, 0x4d, 0xa2, 0x32, 0x9c, 0xc9, 0x2e,

    0x0f, 0xd6, 0x90, 0xb9, 0xee, 0x91, 0x0e, 0x86, 0xf7, 0x1d, 0x03, 0x88, 0xb5, 0x95, 0x61, 0x95

};

VOID

SYMCRYPT_CALL

SymCryptCShake256Selftest(void)

{

    BYTE result[SYMCRYPT_CSHAKE256_RESULT_SIZE];

    static const unsigned char Nstr[] = { 'N' };

    static const unsigned char Sstr[] = { 'S' };

    SymCryptCShake256(Nstr, sizeof(Nstr),

        Sstr, sizeof(Sstr),

        SymCryptTestMsg3, sizeof(SymCryptTestMsg3),

        result, sizeof(result));

    SymCryptInjectError(result, sizeof(result));

    if (memcmp(result, cshake256KATAnswer, sizeof(result)) != 0)

    {

        SymCryptFatal('cshk');

    }

}

//

// CShake helper functions

//

//

// SymCryptCShakeEncodeInputStrings

//

VOID

SYMCRYPT_CALL

SymCryptCShakeEncodeInputStrings(

    _Inout_                             PSYMCRYPT_KECCAK_STATE  pState,

    _In_reads_( cbFunctionNameString )  PCBYTE                  pbFunctionNameString,

                                        SIZE_T                  cbFunctionNameString,

    _In_reads_( cbCustomizationString ) PCBYTE                  pbCustomizationString,

                                        SIZE_T                  cbCustomizationString)

{

    SYMCRYPT_ASSERT((cbFunctionNameString > 0) || (cbCustomizationString > 0));

    // left_encode( inputBlockSize ) for byte_pad function

    //

    // SymCryptKeccakEncodeTimes8 function encodes 8 times the value passed to 

    // it. Here, we want the actual value of pState->inputBlockSize to be encoded,

    // hence the division by 8.

    SymCryptKeccakAppendEncodeTimes8(pState, pState->inputBlockSize / 8, TRUE);

    SymCryptKeccakAppendEncodedString(pState, pbFunctionNameString, cbFunctionNameString);

    SymCryptKeccakAppendEncodedString(pState, pbCustomizationString, cbCustomizationString);

    // Appending of Customization String may have already called the permutation

    // if the appended data is aligned to input block size, in which case the zero

    // padding has been done.

    if (pState->stateIndex != 0)

    {

        SymCryptKeccakZeroAppendBlock(pState);

    }

}

//

// SymCryptKeccakEncodeTimes8

//

SIZE_T

SYMCRYPT_CALL

SymCryptKeccakEncodeTimes8(

                            UINT64  uInput,

    _Out_writes_(cbOutput)  PBYTE   pbOutput,

                            SIZE_T  cbOutput,

                            BOOLEAN bLeftEncode)

{

    BYTE encoding[1 + sizeof(UINT64)];

    SIZE_T ret = 0;

    // longest encoding is 1 byte for length + 9 bytes for uInput * 8

    SYMCRYPT_ASSERT(cbOutput >= (1 + sizeof(encoding)));

    UNREFERENCED_PARAMETER(cbOutput);

    //

    // encoding[0] .. encoding[8] will contain (uInput * 8) in big endian form

    encoding[0] = (BYTE)(uInput >> 61);

    SYMCRYPT_STORE_MSBFIRST64(&encoding[1], uInput * 8);

    SIZE_T length = 1;                              // number of bytes required to encode uInput

    PCBYTE pbMsb = &encoding[sizeof(encoding) - 1]; // pointer to the most significant byte

    // Locate the most significant non-zero byte

    for (int i = 0; i < sizeof(encoding); i++)

    {

        // Do not early terminate on the most significant byte

        if (encoding[i] != 0 && length == 1)

        {

            length = sizeof(encoding) - i;

            pbMsb = &encoding[i];

        }

    }

    ret = 1 + length;

    if (bLeftEncode)

    {

        // length for left_encode

        *pbOutput++ = (BYTE)length;

    }

    memcpy(pbOutput, pbMsb, length);

    if(!bLeftEncode)

    {

        // length for right_encode

        pbOutput[length] = (BYTE)length;

    }

    return ret; // total number of bytes written to pbOutput

}

//

// SymCryptKeccakAppendEncodeTimes8

//

VOID

SYMCRYPT_CALL

SymCryptKeccakAppendEncodeTimes8(

    _Inout_ SYMCRYPT_KECCAK_STATE *pState,

            UINT64  uValue,

            BOOLEAN bLeftEncode)

{

    BYTE encoding[1 + (1 + sizeof(UINT64))];

    SIZE_T ret;

    ret = SymCryptKeccakEncodeTimes8(uValue, encoding, sizeof(encoding), bLeftEncode);

    SymCryptKeccakAppend(pState, encoding, ret);

}

//

// SymCryptKeccakAppendEncodedString

//

VOID

SYMCRYPT_CALL

SymCryptKeccakAppendEncodedString(

    _Inout_                 PSYMCRYPT_KECCAK_STATE  pState,

    _In_reads_(cbString)    PCBYTE                  pbString,

                            SIZE_T                  cbString)

{

    SymCryptKeccakAppendEncodeTimes8(pState, cbString, TRUE);

    SymCryptKeccakAppend(pState, pbString, cbString);

}