/src/openssl/providers/implementations/digests/sha3_prov.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <string.h> |
11 | | #include <openssl/core_names.h> |
12 | | #include <openssl/crypto.h> |
13 | | #include <openssl/evp.h> |
14 | | #include <openssl/params.h> |
15 | | #include <openssl/err.h> |
16 | | #include <openssl/proverr.h> |
17 | | #include "internal/numbers.h" |
18 | | #include "internal/sha3.h" |
19 | | #include "prov/digestcommon.h" |
20 | | #include "prov/implementations.h" |
21 | | #include "internal/common.h" |
22 | | |
23 | | #define SHA3_FLAGS PROV_DIGEST_FLAG_ALGID_ABSENT |
24 | | #define SHAKE_FLAGS (PROV_DIGEST_FLAG_XOF | PROV_DIGEST_FLAG_ALGID_ABSENT) |
25 | | #define KMAC_FLAGS PROV_DIGEST_FLAG_XOF |
26 | | |
27 | | /* |
28 | | * Forward declaration of any unique methods implemented here. This is not strictly |
29 | | * necessary for the compiler, but provides an assurance that the signatures |
30 | | * of the functions in the dispatch table are correct. |
31 | | */ |
32 | | static OSSL_FUNC_digest_init_fn keccak_init; |
33 | | static OSSL_FUNC_digest_init_fn keccak_init_params; |
34 | | static OSSL_FUNC_digest_update_fn keccak_update; |
35 | | static OSSL_FUNC_digest_final_fn keccak_final; |
36 | | static OSSL_FUNC_digest_freectx_fn keccak_freectx; |
37 | | static OSSL_FUNC_digest_copyctx_fn keccak_copyctx; |
38 | | static OSSL_FUNC_digest_dupctx_fn keccak_dupctx; |
39 | | static OSSL_FUNC_digest_squeeze_fn shake_squeeze; |
40 | | static OSSL_FUNC_digest_get_ctx_params_fn shake_get_ctx_params; |
41 | | static OSSL_FUNC_digest_gettable_ctx_params_fn shake_gettable_ctx_params; |
42 | | static OSSL_FUNC_digest_set_ctx_params_fn shake_set_ctx_params; |
43 | | static OSSL_FUNC_digest_settable_ctx_params_fn shake_settable_ctx_params; |
44 | | static sha3_absorb_fn generic_sha3_absorb; |
45 | | static sha3_final_fn generic_sha3_final; |
46 | | static sha3_squeeze_fn generic_sha3_squeeze; |
47 | | |
48 | | #if defined(OPENSSL_CPUID_OBJ) && defined(__s390__) && defined(KECCAK1600_ASM) |
49 | | /* |
50 | | * IBM S390X support |
51 | | */ |
52 | | # include "s390x_arch.h" |
53 | | # define S390_SHA3 1 |
54 | | # define S390_SHA3_CAPABLE(name) \ |
55 | | ((OPENSSL_s390xcap_P.kimd[0] & S390X_CAPBIT(S390X_##name)) && \ |
56 | | (OPENSSL_s390xcap_P.klmd[0] & S390X_CAPBIT(S390X_##name))) |
57 | | |
58 | | #endif |
59 | | |
60 | | static int keccak_init(void *vctx, ossl_unused const OSSL_PARAM params[]) |
61 | 0 | { |
62 | 0 | if (ossl_unlikely(!ossl_prov_is_running())) |
63 | 0 | return 0; |
64 | | /* The newctx() handles most of the ctx fixed setup. */ |
65 | 0 | ossl_sha3_reset((KECCAK1600_CTX *)vctx); |
66 | 0 | return 1; |
67 | 0 | } |
68 | | |
69 | | static int keccak_init_params(void *vctx, const OSSL_PARAM params[]) |
70 | 0 | { |
71 | 0 | return keccak_init(vctx, NULL) |
72 | 0 | && shake_set_ctx_params(vctx, params); |
73 | 0 | } |
74 | | |
75 | | static int keccak_update(void *vctx, const unsigned char *inp, size_t len) |
76 | 0 | { |
77 | 0 | KECCAK1600_CTX *ctx = vctx; |
78 | 0 | const size_t bsz = ctx->block_size; |
79 | 0 | size_t num, rem; |
80 | |
|
81 | 0 | if (ossl_unlikely(len == 0)) |
82 | 0 | return 1; |
83 | | |
84 | | /* Is there anything in the buffer already ? */ |
85 | 0 | if (ossl_likely((num = ctx->bufsz) != 0)) { |
86 | | /* Calculate how much space is left in the buffer */ |
87 | 0 | rem = bsz - num; |
88 | | /* If the new input does not fill the buffer then just add it */ |
89 | 0 | if (len < rem) { |
90 | 0 | memcpy(ctx->buf + num, inp, len); |
91 | 0 | ctx->bufsz += len; |
92 | 0 | return 1; |
93 | 0 | } |
94 | | /* otherwise fill up the buffer and absorb the buffer */ |
95 | 0 | memcpy(ctx->buf + num, inp, rem); |
96 | | /* Update the input pointer */ |
97 | 0 | inp += rem; |
98 | 0 | len -= rem; |
99 | 0 | ctx->meth.absorb(ctx, ctx->buf, bsz); |
100 | 0 | ctx->bufsz = 0; |
101 | 0 | } |
102 | | /* Absorb the input - rem = leftover part of the input < blocksize) */ |
103 | 0 | rem = ctx->meth.absorb(ctx, inp, len); |
104 | | /* Copy the leftover bit of the input into the buffer */ |
105 | 0 | if (ossl_likely(rem)) { |
106 | 0 | memcpy(ctx->buf, inp + len - rem, rem); |
107 | 0 | ctx->bufsz = rem; |
108 | 0 | } |
109 | 0 | return 1; |
110 | 0 | } |
111 | | |
112 | | static int keccak_final(void *vctx, unsigned char *out, size_t *outl, |
113 | | size_t outlen) |
114 | 0 | { |
115 | 0 | int ret = 1; |
116 | 0 | KECCAK1600_CTX *ctx = vctx; |
117 | |
|
118 | 0 | if (ossl_unlikely(!ossl_prov_is_running())) |
119 | 0 | return 0; |
120 | 0 | if (ossl_unlikely(ctx->md_size == SIZE_MAX)) { |
121 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH); |
122 | 0 | return 0; |
123 | 0 | } |
124 | 0 | if (ossl_likely(outlen > 0)) |
125 | 0 | ret = ctx->meth.final(ctx, out, ctx->md_size); |
126 | |
|
127 | 0 | *outl = ctx->md_size; |
128 | 0 | return ret; |
129 | 0 | } |
130 | | |
131 | | static int shake_squeeze(void *vctx, unsigned char *out, size_t *outl, |
132 | | size_t outlen) |
133 | 0 | { |
134 | 0 | int ret = 1; |
135 | 0 | KECCAK1600_CTX *ctx = vctx; |
136 | |
|
137 | 0 | if (!ossl_prov_is_running()) |
138 | 0 | return 0; |
139 | 0 | if (ctx->meth.squeeze == NULL) |
140 | 0 | return 0; |
141 | 0 | if (outlen > 0) |
142 | 0 | ret = ctx->meth.squeeze(ctx, out, outlen); |
143 | |
|
144 | 0 | *outl = outlen; |
145 | 0 | return ret; |
146 | 0 | } |
147 | | |
148 | | /*- |
149 | | * Generic software version of the absorb() and final(). |
150 | | */ |
151 | | static size_t generic_sha3_absorb(void *vctx, const void *inp, size_t len) |
152 | 0 | { |
153 | 0 | KECCAK1600_CTX *ctx = vctx; |
154 | |
|
155 | 0 | if (!(ctx->xof_state == XOF_STATE_INIT || |
156 | 0 | ctx->xof_state == XOF_STATE_ABSORB)) |
157 | 0 | return 0; |
158 | 0 | ctx->xof_state = XOF_STATE_ABSORB; |
159 | 0 | return SHA3_absorb(ctx->A, inp, len, ctx->block_size); |
160 | 0 | } |
161 | | |
162 | | static int generic_sha3_final(void *vctx, unsigned char *out, size_t outlen) |
163 | 0 | { |
164 | 0 | return ossl_sha3_final((KECCAK1600_CTX *)vctx, out, outlen); |
165 | 0 | } |
166 | | |
167 | | static int generic_sha3_squeeze(void *vctx, unsigned char *out, size_t outlen) |
168 | 0 | { |
169 | 0 | return ossl_sha3_squeeze((KECCAK1600_CTX *)vctx, out, outlen); |
170 | 0 | } |
171 | | |
172 | | static PROV_SHA3_METHOD sha3_generic_md = { |
173 | | generic_sha3_absorb, |
174 | | generic_sha3_final, |
175 | | NULL |
176 | | }; |
177 | | |
178 | | static PROV_SHA3_METHOD shake_generic_md = |
179 | | { |
180 | | generic_sha3_absorb, |
181 | | generic_sha3_final, |
182 | | generic_sha3_squeeze |
183 | | }; |
184 | | |
185 | | #if defined(S390_SHA3) |
186 | | |
187 | | static sha3_absorb_fn s390x_sha3_absorb; |
188 | | static sha3_final_fn s390x_sha3_final; |
189 | | static sha3_final_fn s390x_shake_final; |
190 | | |
191 | | /*- |
192 | | * The platform specific parts of the absorb() and final() for S390X. |
193 | | */ |
194 | | static size_t s390x_sha3_absorb(void *vctx, const void *inp, size_t len) |
195 | | { |
196 | | KECCAK1600_CTX *ctx = vctx; |
197 | | size_t rem = len % ctx->block_size; |
198 | | unsigned int fc; |
199 | | |
200 | | if (!(ctx->xof_state == XOF_STATE_INIT || |
201 | | ctx->xof_state == XOF_STATE_ABSORB)) |
202 | | return 0; |
203 | | if (len - rem > 0) { |
204 | | fc = ctx->pad; |
205 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0; |
206 | | ctx->xof_state = XOF_STATE_ABSORB; |
207 | | s390x_kimd(inp, len - rem, fc, ctx->A); |
208 | | } |
209 | | return rem; |
210 | | } |
211 | | |
212 | | static int s390x_sha3_final(void *vctx, unsigned char *out, size_t outlen) |
213 | | { |
214 | | KECCAK1600_CTX *ctx = vctx; |
215 | | unsigned int fc; |
216 | | |
217 | | if (!ossl_prov_is_running()) |
218 | | return 0; |
219 | | if (!(ctx->xof_state == XOF_STATE_INIT || |
220 | | ctx->xof_state == XOF_STATE_ABSORB)) |
221 | | return 0; |
222 | | fc = ctx->pad | S390X_KLMD_DUFOP; |
223 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0; |
224 | | ctx->xof_state = XOF_STATE_FINAL; |
225 | | s390x_klmd(ctx->buf, ctx->bufsz, NULL, 0, fc, ctx->A); |
226 | | memcpy(out, ctx->A, outlen); |
227 | | return 1; |
228 | | } |
229 | | |
230 | | static int s390x_shake_final(void *vctx, unsigned char *out, size_t outlen) |
231 | | { |
232 | | KECCAK1600_CTX *ctx = vctx; |
233 | | unsigned int fc; |
234 | | |
235 | | if (!ossl_prov_is_running()) |
236 | | return 0; |
237 | | if (!(ctx->xof_state == XOF_STATE_INIT || |
238 | | ctx->xof_state == XOF_STATE_ABSORB)) |
239 | | return 0; |
240 | | fc = ctx->pad | S390X_KLMD_DUFOP; |
241 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0; |
242 | | ctx->xof_state = XOF_STATE_FINAL; |
243 | | s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, fc, ctx->A); |
244 | | return 1; |
245 | | } |
246 | | |
247 | | static int s390x_shake_squeeze(void *vctx, unsigned char *out, size_t outlen) |
248 | | { |
249 | | KECCAK1600_CTX *ctx = vctx; |
250 | | unsigned int fc; |
251 | | size_t len; |
252 | | |
253 | | if (!ossl_prov_is_running()) |
254 | | return 0; |
255 | | if (ctx->xof_state == XOF_STATE_FINAL) |
256 | | return 0; |
257 | | /* |
258 | | * On the first squeeze call, finish the absorb process (incl. padding). |
259 | | */ |
260 | | if (ctx->xof_state != XOF_STATE_SQUEEZE) { |
261 | | fc = ctx->pad; |
262 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0; |
263 | | ctx->xof_state = XOF_STATE_SQUEEZE; |
264 | | s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, fc, ctx->A); |
265 | | ctx->bufsz = outlen % ctx->block_size; |
266 | | /* reuse ctx->bufsz to count bytes squeezed from current sponge */ |
267 | | return 1; |
268 | | } |
269 | | ctx->xof_state = XOF_STATE_SQUEEZE; |
270 | | if (ctx->bufsz != 0) { |
271 | | len = ctx->block_size - ctx->bufsz; |
272 | | if (outlen < len) |
273 | | len = outlen; |
274 | | memcpy(out, (char *)ctx->A + ctx->bufsz, len); |
275 | | out += len; |
276 | | outlen -= len; |
277 | | ctx->bufsz += len; |
278 | | if (ctx->bufsz == ctx->block_size) |
279 | | ctx->bufsz = 0; |
280 | | } |
281 | | if (outlen == 0) |
282 | | return 1; |
283 | | s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A); |
284 | | ctx->bufsz = outlen % ctx->block_size; |
285 | | |
286 | | return 1; |
287 | | } |
288 | | |
289 | | static int s390x_keccakc_final(void *vctx, unsigned char *out, size_t outlen, |
290 | | int padding) |
291 | | { |
292 | | KECCAK1600_CTX *ctx = vctx; |
293 | | size_t bsz = ctx->block_size; |
294 | | size_t num = ctx->bufsz; |
295 | | size_t needed = outlen; |
296 | | unsigned int fc; |
297 | | |
298 | | if (!ossl_prov_is_running()) |
299 | | return 0; |
300 | | if (!(ctx->xof_state == XOF_STATE_INIT || |
301 | | ctx->xof_state == XOF_STATE_ABSORB)) |
302 | | return 0; |
303 | | fc = ctx->pad; |
304 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0; |
305 | | ctx->xof_state = XOF_STATE_FINAL; |
306 | | if (outlen == 0) |
307 | | return 1; |
308 | | memset(ctx->buf + num, 0, bsz - num); |
309 | | ctx->buf[num] = padding; |
310 | | ctx->buf[bsz - 1] |= 0x80; |
311 | | s390x_kimd(ctx->buf, bsz, fc, ctx->A); |
312 | | num = needed > bsz ? bsz : needed; |
313 | | memcpy(out, ctx->A, num); |
314 | | needed -= num; |
315 | | if (needed > 0) |
316 | | s390x_klmd(NULL, 0, out + bsz, needed, |
317 | | ctx->pad | S390X_KLMD_PS | S390X_KLMD_DUFOP, ctx->A); |
318 | | |
319 | | return 1; |
320 | | } |
321 | | |
322 | | static int s390x_keccak_final(void *vctx, unsigned char *out, size_t outlen) |
323 | | { |
324 | | return s390x_keccakc_final(vctx, out, outlen, 0x01); |
325 | | } |
326 | | |
327 | | static int s390x_kmac_final(void *vctx, unsigned char *out, size_t outlen) |
328 | | { |
329 | | return s390x_keccakc_final(vctx, out, outlen, 0x04); |
330 | | } |
331 | | |
332 | | static int s390x_keccakc_squeeze(void *vctx, unsigned char *out, size_t outlen, |
333 | | int padding) |
334 | | { |
335 | | KECCAK1600_CTX *ctx = vctx; |
336 | | size_t len; |
337 | | unsigned int fc; |
338 | | |
339 | | if (!ossl_prov_is_running()) |
340 | | return 0; |
341 | | if (ctx->xof_state == XOF_STATE_FINAL) |
342 | | return 0; |
343 | | /* |
344 | | * On the first squeeze call, finish the absorb process |
345 | | * by adding the trailing padding and then doing |
346 | | * a final absorb. |
347 | | */ |
348 | | if (ctx->xof_state != XOF_STATE_SQUEEZE) { |
349 | | len = ctx->block_size - ctx->bufsz; |
350 | | memset(ctx->buf + ctx->bufsz, 0, len); |
351 | | ctx->buf[ctx->bufsz] = padding; |
352 | | ctx->buf[ctx->block_size - 1] |= 0x80; |
353 | | fc = ctx->pad; |
354 | | fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0; |
355 | | s390x_kimd(ctx->buf, ctx->block_size, fc, ctx->A); |
356 | | ctx->bufsz = 0; |
357 | | /* reuse ctx->bufsz to count bytes squeezed from current sponge */ |
358 | | } |
359 | | if (ctx->bufsz != 0 || ctx->xof_state != XOF_STATE_SQUEEZE) { |
360 | | len = ctx->block_size - ctx->bufsz; |
361 | | if (outlen < len) |
362 | | len = outlen; |
363 | | memcpy(out, (char *)ctx->A + ctx->bufsz, len); |
364 | | out += len; |
365 | | outlen -= len; |
366 | | ctx->bufsz += len; |
367 | | if (ctx->bufsz == ctx->block_size) |
368 | | ctx->bufsz = 0; |
369 | | } |
370 | | ctx->xof_state = XOF_STATE_SQUEEZE; |
371 | | if (outlen == 0) |
372 | | return 1; |
373 | | s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A); |
374 | | ctx->bufsz = outlen % ctx->block_size; |
375 | | |
376 | | return 1; |
377 | | } |
378 | | |
379 | | static int s390x_keccak_squeeze(void *vctx, unsigned char *out, size_t outlen) |
380 | | { |
381 | | return s390x_keccakc_squeeze(vctx, out, outlen, 0x01); |
382 | | } |
383 | | |
384 | | static int s390x_kmac_squeeze(void *vctx, unsigned char *out, size_t outlen) |
385 | | { |
386 | | return s390x_keccakc_squeeze(vctx, out, outlen, 0x04); |
387 | | } |
388 | | |
389 | | static PROV_SHA3_METHOD sha3_s390x_md = { |
390 | | s390x_sha3_absorb, |
391 | | s390x_sha3_final, |
392 | | NULL, |
393 | | }; |
394 | | |
395 | | static PROV_SHA3_METHOD keccak_s390x_md = { |
396 | | s390x_sha3_absorb, |
397 | | s390x_keccak_final, |
398 | | s390x_keccak_squeeze, |
399 | | }; |
400 | | |
401 | | static PROV_SHA3_METHOD shake_s390x_md = { |
402 | | s390x_sha3_absorb, |
403 | | s390x_shake_final, |
404 | | s390x_shake_squeeze, |
405 | | }; |
406 | | |
407 | | static PROV_SHA3_METHOD kmac_s390x_md = { |
408 | | s390x_sha3_absorb, |
409 | | s390x_kmac_final, |
410 | | s390x_kmac_squeeze, |
411 | | }; |
412 | | |
413 | | # define SHAKE_SET_MD(uname, typ) \ |
414 | | if (S390_SHA3_CAPABLE(uname)) { \ |
415 | | ctx->pad = S390X_##uname; \ |
416 | | ctx->meth = typ##_s390x_md; \ |
417 | | } else { \ |
418 | | ctx->meth = shake_generic_md; \ |
419 | | } |
420 | | |
421 | | # define SHA3_SET_MD(uname, typ) \ |
422 | | if (S390_SHA3_CAPABLE(uname)) { \ |
423 | | ctx->pad = S390X_##uname; \ |
424 | | ctx->meth = typ##_s390x_md; \ |
425 | | } else { \ |
426 | | ctx->meth = sha3_generic_md; \ |
427 | | } |
428 | | # define KMAC_SET_MD(bitlen) \ |
429 | | if (S390_SHA3_CAPABLE(SHAKE_##bitlen)) { \ |
430 | | ctx->pad = S390X_SHAKE_##bitlen; \ |
431 | | ctx->meth = kmac_s390x_md; \ |
432 | | } else { \ |
433 | | ctx->meth = sha3_generic_md; \ |
434 | | } |
435 | | #elif defined(__aarch64__) && defined(KECCAK1600_ASM) |
436 | | # include "arm_arch.h" |
437 | | |
438 | | static sha3_absorb_fn armsha3_sha3_absorb; |
439 | | |
440 | | size_t SHA3_absorb_cext(uint64_t A[5][5], const unsigned char *inp, size_t len, |
441 | | size_t r); |
442 | | /*- |
443 | | * Hardware-assisted ARMv8.2 SHA3 extension version of the absorb() |
444 | | */ |
445 | | static size_t armsha3_sha3_absorb(void *vctx, const void *inp, size_t len) |
446 | | { |
447 | | KECCAK1600_CTX *ctx = vctx; |
448 | | |
449 | | return SHA3_absorb_cext(ctx->A, inp, len, ctx->block_size); |
450 | | } |
451 | | |
452 | | static PROV_SHA3_METHOD sha3_ARMSHA3_md = { |
453 | | armsha3_sha3_absorb, |
454 | | generic_sha3_final |
455 | | }; |
456 | | static PROV_SHA3_METHOD shake_ARMSHA3_md = |
457 | | { |
458 | | armsha3_sha3_absorb, |
459 | | generic_sha3_final, |
460 | | generic_sha3_squeeze |
461 | | }; |
462 | | # define SHAKE_SET_MD(uname, typ) \ |
463 | | if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) { \ |
464 | | ctx->meth = shake_ARMSHA3_md; \ |
465 | | } else { \ |
466 | | ctx->meth = shake_generic_md; \ |
467 | | } |
468 | | |
469 | | # define SHA3_SET_MD(uname, typ) \ |
470 | | if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) { \ |
471 | | ctx->meth = sha3_ARMSHA3_md; \ |
472 | | } else { \ |
473 | | ctx->meth = sha3_generic_md; \ |
474 | | } |
475 | | # define KMAC_SET_MD(bitlen) \ |
476 | | if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) { \ |
477 | | ctx->meth = sha3_ARMSHA3_md; \ |
478 | | } else { \ |
479 | | ctx->meth = sha3_generic_md; \ |
480 | | } |
481 | | #else |
482 | 0 | # define SHA3_SET_MD(uname, typ) ctx->meth = sha3_generic_md; |
483 | 0 | # define KMAC_SET_MD(bitlen) ctx->meth = sha3_generic_md; |
484 | 0 | # define SHAKE_SET_MD(uname, typ) ctx->meth = shake_generic_md; |
485 | | #endif /* S390_SHA3 */ |
486 | | |
487 | | #define SHA3_newctx(typ, uname, name, bitlen, pad) \ |
488 | | static OSSL_FUNC_digest_newctx_fn name##_newctx; \ |
489 | 0 | static void *name##_newctx(void *provctx) \ |
490 | 0 | { \ |
491 | 0 | KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \ |
492 | 0 | : NULL; \ |
493 | 0 | \ |
494 | 0 | if (ctx == NULL) \ |
495 | 0 | return NULL; \ |
496 | 0 | ossl_sha3_init(ctx, pad, bitlen); \ |
497 | 0 | SHA3_SET_MD(uname, typ) \ |
498 | 0 | return ctx; \ |
499 | 0 | } Unexecuted instantiation: sha3_prov.c:sha3_224_newctx Unexecuted instantiation: sha3_prov.c:sha3_256_newctx Unexecuted instantiation: sha3_prov.c:sha3_384_newctx Unexecuted instantiation: sha3_prov.c:sha3_512_newctx Unexecuted instantiation: sha3_prov.c:keccak_224_newctx Unexecuted instantiation: sha3_prov.c:keccak_256_newctx Unexecuted instantiation: sha3_prov.c:keccak_384_newctx Unexecuted instantiation: sha3_prov.c:keccak_512_newctx |
500 | | |
501 | | #define SHAKE_newctx(typ, uname, name, bitlen, mdlen, pad) \ |
502 | | static OSSL_FUNC_digest_newctx_fn name##_newctx; \ |
503 | 0 | static void *name##_newctx(void *provctx) \ |
504 | 0 | { \ |
505 | 0 | KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx))\ |
506 | 0 | : NULL; \ |
507 | 0 | \ |
508 | 0 | if (ctx == NULL) \ |
509 | 0 | return NULL; \ |
510 | 0 | ossl_keccak_init(ctx, pad, bitlen, mdlen); \ |
511 | 0 | if (mdlen == 0) \ |
512 | 0 | ctx->md_size = SIZE_MAX; \ |
513 | 0 | SHAKE_SET_MD(uname, typ) \ |
514 | 0 | return ctx; \ |
515 | 0 | } Unexecuted instantiation: sha3_prov.c:shake_128_newctx Unexecuted instantiation: sha3_prov.c:shake_256_newctx |
516 | | |
517 | | #define KMAC_newctx(uname, bitlen, pad) \ |
518 | | static OSSL_FUNC_digest_newctx_fn uname##_newctx; \ |
519 | 0 | static void *uname##_newctx(void *provctx) \ |
520 | 0 | { \ |
521 | 0 | KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \ |
522 | 0 | : NULL; \ |
523 | 0 | \ |
524 | 0 | if (ctx == NULL) \ |
525 | 0 | return NULL; \ |
526 | 0 | ossl_keccak_init(ctx, pad, bitlen, 2 * bitlen); \ |
527 | 0 | KMAC_SET_MD(bitlen) \ |
528 | 0 | return ctx; \ |
529 | 0 | } Unexecuted instantiation: sha3_prov.c:keccak_kmac_128_newctx Unexecuted instantiation: sha3_prov.c:keccak_kmac_256_newctx |
530 | | |
531 | | #define PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags) \ |
532 | | PROV_FUNC_DIGEST_GET_PARAM(name, blksize, dgstsize, flags) \ |
533 | | const OSSL_DISPATCH ossl_##name##_functions[] = { \ |
534 | | { OSSL_FUNC_DIGEST_NEWCTX, (void (*)(void))name##_newctx }, \ |
535 | | { OSSL_FUNC_DIGEST_UPDATE, (void (*)(void))keccak_update }, \ |
536 | | { OSSL_FUNC_DIGEST_FINAL, (void (*)(void))keccak_final }, \ |
537 | | { OSSL_FUNC_DIGEST_FREECTX, (void (*)(void))keccak_freectx }, \ |
538 | | { OSSL_FUNC_DIGEST_DUPCTX, (void (*)(void))keccak_dupctx }, \ |
539 | | { OSSL_FUNC_DIGEST_COPYCTX, (void (*)(void))keccak_copyctx }, \ |
540 | | PROV_DISPATCH_FUNC_DIGEST_GET_PARAMS(name) |
541 | | |
542 | | #define PROV_FUNC_SHA3_DIGEST(name, bitlen, blksize, dgstsize, flags) \ |
543 | | PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags), \ |
544 | | { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init }, \ |
545 | | PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END |
546 | | |
547 | | #define PROV_FUNC_SHAKE_DIGEST(name, bitlen, blksize, dgstsize, flags) \ |
548 | | PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags), \ |
549 | | { OSSL_FUNC_DIGEST_SQUEEZE, (void (*)(void))shake_squeeze }, \ |
550 | | { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init_params }, \ |
551 | | { OSSL_FUNC_DIGEST_SET_CTX_PARAMS, (void (*)(void))shake_set_ctx_params }, \ |
552 | | { OSSL_FUNC_DIGEST_SETTABLE_CTX_PARAMS, \ |
553 | | (void (*)(void))shake_settable_ctx_params }, \ |
554 | | { OSSL_FUNC_DIGEST_GET_CTX_PARAMS, (void (*)(void))shake_get_ctx_params }, \ |
555 | | { OSSL_FUNC_DIGEST_GETTABLE_CTX_PARAMS, \ |
556 | | (void (*)(void))shake_gettable_ctx_params }, \ |
557 | | PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END |
558 | | |
559 | | static void keccak_freectx(void *vctx) |
560 | 0 | { |
561 | 0 | KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx; |
562 | |
|
563 | 0 | OPENSSL_clear_free(ctx, sizeof(*ctx)); |
564 | 0 | } |
565 | | |
566 | | static void keccak_copyctx(void *voutctx, void *vinctx) |
567 | 0 | { |
568 | 0 | KECCAK1600_CTX *outctx = (KECCAK1600_CTX *)voutctx; |
569 | 0 | KECCAK1600_CTX *inctx = (KECCAK1600_CTX *)vinctx; |
570 | |
|
571 | 0 | *outctx = *inctx; |
572 | 0 | } |
573 | | |
574 | | static void *keccak_dupctx(void *ctx) |
575 | 0 | { |
576 | 0 | KECCAK1600_CTX *in = (KECCAK1600_CTX *)ctx; |
577 | 0 | KECCAK1600_CTX *ret = ossl_prov_is_running() ? OPENSSL_malloc(sizeof(*ret)) |
578 | 0 | : NULL; |
579 | |
|
580 | 0 | if (ret != NULL) |
581 | 0 | *ret = *in; |
582 | 0 | return ret; |
583 | 0 | } |
584 | | |
585 | | static const OSSL_PARAM *shake_gettable_ctx_params(ossl_unused void *ctx, |
586 | | ossl_unused void *provctx) |
587 | 0 | { |
588 | 0 | static const OSSL_PARAM known_shake_gettable_ctx_params[] = { |
589 | 0 | {OSSL_DIGEST_PARAM_XOFLEN, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0}, |
590 | 0 | {OSSL_DIGEST_PARAM_SIZE, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0}, |
591 | 0 | OSSL_PARAM_END |
592 | 0 | }; |
593 | 0 | return known_shake_gettable_ctx_params; |
594 | 0 | } |
595 | | |
596 | | static int shake_get_ctx_params(void *vctx, OSSL_PARAM params[]) |
597 | 0 | { |
598 | 0 | OSSL_PARAM *p; |
599 | 0 | KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx; |
600 | |
|
601 | 0 | if (ctx == NULL) |
602 | 0 | return 0; |
603 | 0 | if (ossl_param_is_empty(params)) |
604 | 0 | return 1; |
605 | | |
606 | 0 | p = OSSL_PARAM_locate(params, OSSL_DIGEST_PARAM_XOFLEN); |
607 | 0 | if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->md_size)) { |
608 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); |
609 | 0 | return 0; |
610 | 0 | } |
611 | | /* Size is an alias of xoflen */ |
612 | 0 | p = OSSL_PARAM_locate(params, OSSL_DIGEST_PARAM_SIZE); |
613 | 0 | if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->md_size)) { |
614 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); |
615 | 0 | return 0; |
616 | 0 | } |
617 | 0 | return 1; |
618 | 0 | } |
619 | | |
620 | | static const OSSL_PARAM *shake_settable_ctx_params(ossl_unused void *ctx, |
621 | | ossl_unused void *provctx) |
622 | 0 | { |
623 | 0 | static const OSSL_PARAM known_shake_settable_ctx_params[] = { |
624 | 0 | {OSSL_DIGEST_PARAM_XOFLEN, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0}, |
625 | 0 | {OSSL_DIGEST_PARAM_SIZE, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0}, |
626 | 0 | OSSL_PARAM_END |
627 | 0 | }; |
628 | |
|
629 | 0 | return known_shake_settable_ctx_params; |
630 | 0 | } |
631 | | |
632 | | static int shake_set_ctx_params(void *vctx, const OSSL_PARAM params[]) |
633 | 0 | { |
634 | 0 | const OSSL_PARAM *p; |
635 | 0 | KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx; |
636 | |
|
637 | 0 | if (ossl_unlikely(ctx == NULL)) |
638 | 0 | return 0; |
639 | 0 | if (ossl_param_is_empty(params)) |
640 | 0 | return 1; |
641 | | |
642 | 0 | p = OSSL_PARAM_locate_const(params, OSSL_DIGEST_PARAM_XOFLEN); |
643 | 0 | if (ossl_unlikely(p == NULL)) |
644 | 0 | p = OSSL_PARAM_locate_const(params, OSSL_DIGEST_PARAM_SIZE); |
645 | |
|
646 | 0 | if (ossl_unlikely(p != NULL && !OSSL_PARAM_get_size_t(p, &ctx->md_size))) { |
647 | 0 | ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER); |
648 | 0 | return 0; |
649 | 0 | } |
650 | 0 | return 1; |
651 | 0 | } |
652 | | |
653 | | #define IMPLEMENT_SHA3_functions(bitlen) \ |
654 | | SHA3_newctx(sha3, SHA3_##bitlen, sha3_##bitlen, bitlen, '\x06') \ |
655 | | PROV_FUNC_SHA3_DIGEST(sha3_##bitlen, bitlen, \ |
656 | | SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen), \ |
657 | | SHA3_FLAGS) |
658 | | |
659 | | #define IMPLEMENT_KECCAK_functions(bitlen) \ |
660 | | SHA3_newctx(keccak, KECCAK_##bitlen, keccak_##bitlen, bitlen, '\x01') \ |
661 | | PROV_FUNC_SHA3_DIGEST(keccak_##bitlen, bitlen, \ |
662 | | SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen), \ |
663 | | SHA3_FLAGS) |
664 | | |
665 | | #define IMPLEMENT_SHAKE_functions(bitlen) \ |
666 | | SHAKE_newctx(shake, SHAKE_##bitlen, shake_##bitlen, bitlen, \ |
667 | | 0 /* no default md length */, '\x1f') \ |
668 | | PROV_FUNC_SHAKE_DIGEST(shake_##bitlen, bitlen, \ |
669 | | SHA3_BLOCKSIZE(bitlen), 0, \ |
670 | | SHAKE_FLAGS) |
671 | | |
672 | | #define IMPLEMENT_KMAC_functions(bitlen) \ |
673 | | KMAC_newctx(keccak_kmac_##bitlen, bitlen, '\x04') \ |
674 | | PROV_FUNC_SHAKE_DIGEST(keccak_kmac_##bitlen, bitlen, \ |
675 | | SHA3_BLOCKSIZE(bitlen), KMAC_MDSIZE(bitlen), \ |
676 | | KMAC_FLAGS) |
677 | | |
678 | | /* ossl_sha3_224_functions */ |
679 | | IMPLEMENT_SHA3_functions(224) |
680 | | /* ossl_sha3_256_functions */ |
681 | | IMPLEMENT_SHA3_functions(256) |
682 | | /* ossl_sha3_384_functions */ |
683 | | IMPLEMENT_SHA3_functions(384) |
684 | | /* ossl_sha3_512_functions */ |
685 | | IMPLEMENT_SHA3_functions(512) |
686 | | /* ossl_keccak_224_functions */ |
687 | | IMPLEMENT_KECCAK_functions(224) |
688 | | /* ossl_keccak_256_functions */ |
689 | | IMPLEMENT_KECCAK_functions(256) |
690 | | /* ossl_keccak_384_functions */ |
691 | | IMPLEMENT_KECCAK_functions(384) |
692 | | /* ossl_keccak_512_functions */ |
693 | | IMPLEMENT_KECCAK_functions(512) |
694 | | /* ossl_shake_128_functions */ |
695 | | IMPLEMENT_SHAKE_functions(128) |
696 | | /* ossl_shake_256_functions */ |
697 | | IMPLEMENT_SHAKE_functions(256) |
698 | | /* ossl_keccak_kmac_128_functions */ |
699 | | IMPLEMENT_KMAC_functions(128) |
700 | | /* ossl_keccak_kmac_256_functions */ |
701 | | IMPLEMENT_KMAC_functions(256) |