Coverage Report

Created: 2025-07-23 06:08

/src/openssl/providers/implementations/digests/sha3_prov.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <string.h>
11
#include <openssl/core_names.h>
12
#include <openssl/crypto.h>
13
#include <openssl/evp.h>
14
#include <openssl/params.h>
15
#include <openssl/err.h>
16
#include <openssl/proverr.h>
17
#include "internal/numbers.h"
18
#include "internal/sha3.h"
19
#include "prov/digestcommon.h"
20
#include "prov/implementations.h"
21
#include "internal/common.h"
22
23
#define SHA3_FLAGS PROV_DIGEST_FLAG_ALGID_ABSENT
24
#define SHAKE_FLAGS (PROV_DIGEST_FLAG_XOF | PROV_DIGEST_FLAG_ALGID_ABSENT)
25
#define KMAC_FLAGS PROV_DIGEST_FLAG_XOF
26
27
/*
28
 * Forward declaration of any unique methods implemented here. This is not strictly
29
 * necessary for the compiler, but provides an assurance that the signatures
30
 * of the functions in the dispatch table are correct.
31
 */
32
static OSSL_FUNC_digest_init_fn keccak_init;
33
static OSSL_FUNC_digest_init_fn keccak_init_params;
34
static OSSL_FUNC_digest_update_fn keccak_update;
35
static OSSL_FUNC_digest_final_fn keccak_final;
36
static OSSL_FUNC_digest_freectx_fn keccak_freectx;
37
static OSSL_FUNC_digest_copyctx_fn keccak_copyctx;
38
static OSSL_FUNC_digest_dupctx_fn keccak_dupctx;
39
static OSSL_FUNC_digest_squeeze_fn shake_squeeze;
40
static OSSL_FUNC_digest_get_ctx_params_fn shake_get_ctx_params;
41
static OSSL_FUNC_digest_gettable_ctx_params_fn shake_gettable_ctx_params;
42
static OSSL_FUNC_digest_set_ctx_params_fn shake_set_ctx_params;
43
static OSSL_FUNC_digest_settable_ctx_params_fn shake_settable_ctx_params;
44
static sha3_absorb_fn generic_sha3_absorb;
45
static sha3_final_fn generic_sha3_final;
46
static sha3_squeeze_fn generic_sha3_squeeze;
47
48
#if defined(OPENSSL_CPUID_OBJ) && defined(__s390__) && defined(KECCAK1600_ASM)
49
/*
50
 * IBM S390X support
51
 */
52
# include "s390x_arch.h"
53
# define S390_SHA3 1
54
# define S390_SHA3_CAPABLE(name) \
55
    ((OPENSSL_s390xcap_P.kimd[0] & S390X_CAPBIT(S390X_##name)) && \
56
     (OPENSSL_s390xcap_P.klmd[0] & S390X_CAPBIT(S390X_##name)))
57
58
#endif
59
60
static int keccak_init(void *vctx, ossl_unused const OSSL_PARAM params[])
61
0
{
62
0
    if (ossl_unlikely(!ossl_prov_is_running()))
63
0
        return 0;
64
    /* The newctx() handles most of the ctx fixed setup. */
65
0
    ossl_sha3_reset((KECCAK1600_CTX *)vctx);
66
0
    return 1;
67
0
}
68
69
static int keccak_init_params(void *vctx, const OSSL_PARAM params[])
70
0
{
71
0
    return keccak_init(vctx, NULL)
72
0
            && shake_set_ctx_params(vctx, params);
73
0
}
74
75
static int keccak_update(void *vctx, const unsigned char *inp, size_t len)
76
0
{
77
0
    KECCAK1600_CTX *ctx = vctx;
78
0
    const size_t bsz = ctx->block_size;
79
0
    size_t num, rem;
80
81
0
    if (ossl_unlikely(len == 0))
82
0
        return 1;
83
84
    /* Is there anything in the buffer already ? */
85
0
    if (ossl_likely((num = ctx->bufsz) != 0)) {
86
        /* Calculate how much space is left in the buffer */
87
0
        rem = bsz - num;
88
        /* If the new input does not fill the buffer then just add it */
89
0
        if (len < rem) {
90
0
            memcpy(ctx->buf + num, inp, len);
91
0
            ctx->bufsz += len;
92
0
            return 1;
93
0
        }
94
        /* otherwise fill up the buffer and absorb the buffer */
95
0
        memcpy(ctx->buf + num, inp, rem);
96
        /* Update the input pointer */
97
0
        inp += rem;
98
0
        len -= rem;
99
0
        ctx->meth.absorb(ctx, ctx->buf, bsz);
100
0
        ctx->bufsz = 0;
101
0
    }
102
    /* Absorb the input - rem = leftover part of the input < blocksize) */
103
0
    rem = ctx->meth.absorb(ctx, inp, len);
104
    /* Copy the leftover bit of the input into the buffer */
105
0
    if (ossl_likely(rem)) {
106
0
        memcpy(ctx->buf, inp + len - rem, rem);
107
0
        ctx->bufsz = rem;
108
0
    }
109
0
    return 1;
110
0
}
111
112
static int keccak_final(void *vctx, unsigned char *out, size_t *outl,
113
                        size_t outlen)
114
0
{
115
0
    int ret = 1;
116
0
    KECCAK1600_CTX *ctx = vctx;
117
118
0
    if (ossl_unlikely(!ossl_prov_is_running()))
119
0
        return 0;
120
0
    if (ossl_unlikely(ctx->md_size == SIZE_MAX)) {
121
0
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_DIGEST_LENGTH);
122
0
        return 0;
123
0
    }
124
0
    if (ossl_likely(outlen > 0))
125
0
        ret = ctx->meth.final(ctx, out, ctx->md_size);
126
127
0
    *outl = ctx->md_size;
128
0
    return ret;
129
0
}
130
131
static int shake_squeeze(void *vctx, unsigned char *out, size_t *outl,
132
                         size_t outlen)
133
0
{
134
0
    int ret = 1;
135
0
    KECCAK1600_CTX *ctx = vctx;
136
137
0
    if (!ossl_prov_is_running())
138
0
        return 0;
139
0
    if (ctx->meth.squeeze == NULL)
140
0
        return 0;
141
0
    if (outlen > 0)
142
0
        ret = ctx->meth.squeeze(ctx, out, outlen);
143
144
0
    *outl = outlen;
145
0
    return ret;
146
0
}
147
148
/*-
149
 * Generic software version of the absorb() and final().
150
 */
151
static size_t generic_sha3_absorb(void *vctx, const void *inp, size_t len)
152
0
{
153
0
    KECCAK1600_CTX *ctx = vctx;
154
155
0
    if (!(ctx->xof_state == XOF_STATE_INIT ||
156
0
          ctx->xof_state == XOF_STATE_ABSORB))
157
0
        return 0;
158
0
    ctx->xof_state = XOF_STATE_ABSORB;
159
0
    return SHA3_absorb(ctx->A, inp, len, ctx->block_size);
160
0
}
161
162
static int generic_sha3_final(void *vctx, unsigned char *out, size_t outlen)
163
0
{
164
0
    return ossl_sha3_final((KECCAK1600_CTX *)vctx, out, outlen);
165
0
}
166
167
static int generic_sha3_squeeze(void *vctx, unsigned char *out, size_t outlen)
168
0
{
169
0
    return ossl_sha3_squeeze((KECCAK1600_CTX *)vctx, out, outlen);
170
0
}
171
172
static PROV_SHA3_METHOD sha3_generic_md = {
173
    generic_sha3_absorb,
174
    generic_sha3_final,
175
    NULL
176
};
177
178
static PROV_SHA3_METHOD shake_generic_md =
179
{
180
    generic_sha3_absorb,
181
    generic_sha3_final,
182
    generic_sha3_squeeze
183
};
184
185
#if defined(S390_SHA3)
186
187
static sha3_absorb_fn s390x_sha3_absorb;
188
static sha3_final_fn s390x_sha3_final;
189
static sha3_final_fn s390x_shake_final;
190
191
/*-
192
 * The platform specific parts of the absorb() and final() for S390X.
193
 */
194
static size_t s390x_sha3_absorb(void *vctx, const void *inp, size_t len)
195
{
196
    KECCAK1600_CTX *ctx = vctx;
197
    size_t rem = len % ctx->block_size;
198
    unsigned int fc;
199
200
    if (!(ctx->xof_state == XOF_STATE_INIT ||
201
          ctx->xof_state == XOF_STATE_ABSORB))
202
        return 0;
203
    if (len - rem > 0) {
204
        fc = ctx->pad;
205
        fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0;
206
        ctx->xof_state = XOF_STATE_ABSORB;
207
        s390x_kimd(inp, len - rem, fc, ctx->A);
208
    }
209
    return rem;
210
}
211
212
static int s390x_sha3_final(void *vctx, unsigned char *out, size_t outlen)
213
{
214
    KECCAK1600_CTX *ctx = vctx;
215
    unsigned int fc;
216
217
    if (!ossl_prov_is_running())
218
        return 0;
219
    if (!(ctx->xof_state == XOF_STATE_INIT ||
220
          ctx->xof_state == XOF_STATE_ABSORB))
221
        return 0;
222
    fc = ctx->pad | S390X_KLMD_DUFOP;
223
    fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0;
224
    ctx->xof_state = XOF_STATE_FINAL;
225
    s390x_klmd(ctx->buf, ctx->bufsz, NULL, 0, fc, ctx->A);
226
    memcpy(out, ctx->A, outlen);
227
    return 1;
228
}
229
230
static int s390x_shake_final(void *vctx, unsigned char *out, size_t outlen)
231
{
232
    KECCAK1600_CTX *ctx = vctx;
233
    unsigned int fc;
234
235
    if (!ossl_prov_is_running())
236
        return 0;
237
    if (!(ctx->xof_state == XOF_STATE_INIT ||
238
          ctx->xof_state == XOF_STATE_ABSORB))
239
        return 0;
240
    fc = ctx->pad | S390X_KLMD_DUFOP;
241
    fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0;
242
    ctx->xof_state = XOF_STATE_FINAL;
243
    s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, fc, ctx->A);
244
    return 1;
245
}
246
247
static int s390x_shake_squeeze(void *vctx, unsigned char *out, size_t outlen)
248
{
249
    KECCAK1600_CTX *ctx = vctx;
250
    unsigned int fc;
251
    size_t len;
252
253
    if (!ossl_prov_is_running())
254
        return 0;
255
    if (ctx->xof_state == XOF_STATE_FINAL)
256
        return 0;
257
    /*
258
     * On the first squeeze call, finish the absorb process (incl. padding).
259
     */
260
    if (ctx->xof_state != XOF_STATE_SQUEEZE) {
261
        fc = ctx->pad;
262
        fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KLMD_NIP : 0;
263
        ctx->xof_state = XOF_STATE_SQUEEZE;
264
        s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, fc, ctx->A);
265
        ctx->bufsz = outlen % ctx->block_size;
266
        /* reuse ctx->bufsz to count bytes squeezed from current sponge */
267
        return 1;
268
    }
269
    ctx->xof_state = XOF_STATE_SQUEEZE;
270
    if (ctx->bufsz != 0) {
271
        len = ctx->block_size - ctx->bufsz;
272
        if (outlen < len)
273
            len = outlen;
274
        memcpy(out, (char *)ctx->A + ctx->bufsz, len);
275
        out += len;
276
        outlen -= len;
277
        ctx->bufsz += len;
278
        if (ctx->bufsz == ctx->block_size)
279
            ctx->bufsz = 0;
280
    }
281
    if (outlen == 0)
282
        return 1;
283
    s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A);
284
    ctx->bufsz = outlen % ctx->block_size;
285
286
    return 1;
287
}
288
289
static int s390x_keccakc_final(void *vctx, unsigned char *out, size_t outlen,
290
                               int padding)
291
{
292
    KECCAK1600_CTX *ctx = vctx;
293
    size_t bsz = ctx->block_size;
294
    size_t num = ctx->bufsz;
295
    size_t needed = outlen;
296
    unsigned int fc;
297
298
    if (!ossl_prov_is_running())
299
        return 0;
300
    if (!(ctx->xof_state == XOF_STATE_INIT ||
301
          ctx->xof_state == XOF_STATE_ABSORB))
302
        return 0;
303
    fc = ctx->pad;
304
    fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0;
305
    ctx->xof_state = XOF_STATE_FINAL;
306
    if (outlen == 0)
307
        return 1;
308
    memset(ctx->buf + num, 0, bsz - num);
309
    ctx->buf[num] = padding;
310
    ctx->buf[bsz - 1] |= 0x80;
311
    s390x_kimd(ctx->buf, bsz, fc, ctx->A);
312
    num = needed > bsz ? bsz : needed;
313
    memcpy(out, ctx->A, num);
314
    needed -= num;
315
    if (needed > 0)
316
        s390x_klmd(NULL, 0, out + bsz, needed,
317
                   ctx->pad | S390X_KLMD_PS | S390X_KLMD_DUFOP, ctx->A);
318
319
    return 1;
320
}
321
322
static int s390x_keccak_final(void *vctx, unsigned char *out, size_t outlen)
323
{
324
    return s390x_keccakc_final(vctx, out, outlen, 0x01);
325
}
326
327
static int s390x_kmac_final(void *vctx, unsigned char *out, size_t outlen)
328
{
329
    return s390x_keccakc_final(vctx, out, outlen, 0x04);
330
}
331
332
static int s390x_keccakc_squeeze(void *vctx, unsigned char *out, size_t outlen,
333
                                 int padding)
334
{
335
    KECCAK1600_CTX *ctx = vctx;
336
    size_t len;
337
    unsigned int fc;
338
339
    if (!ossl_prov_is_running())
340
        return 0;
341
    if (ctx->xof_state == XOF_STATE_FINAL)
342
        return 0;
343
    /*
344
     * On the first squeeze call, finish the absorb process
345
     * by adding the trailing padding and then doing
346
     * a final absorb.
347
     */
348
    if (ctx->xof_state != XOF_STATE_SQUEEZE) {
349
        len = ctx->block_size - ctx->bufsz;
350
        memset(ctx->buf + ctx->bufsz, 0, len);
351
        ctx->buf[ctx->bufsz] = padding;
352
        ctx->buf[ctx->block_size - 1] |= 0x80;
353
        fc = ctx->pad;
354
        fc |= ctx->xof_state == XOF_STATE_INIT ? S390X_KIMD_NIP : 0;
355
        s390x_kimd(ctx->buf, ctx->block_size, fc, ctx->A);
356
        ctx->bufsz = 0;
357
        /* reuse ctx->bufsz to count bytes squeezed from current sponge */
358
    }
359
    if (ctx->bufsz != 0 || ctx->xof_state != XOF_STATE_SQUEEZE) {
360
        len = ctx->block_size - ctx->bufsz;
361
        if (outlen < len)
362
            len = outlen;
363
        memcpy(out, (char *)ctx->A + ctx->bufsz, len);
364
        out += len;
365
        outlen -= len;
366
        ctx->bufsz += len;
367
        if (ctx->bufsz == ctx->block_size)
368
            ctx->bufsz = 0;
369
    }
370
    ctx->xof_state = XOF_STATE_SQUEEZE;
371
    if (outlen == 0)
372
        return 1;
373
    s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A);
374
    ctx->bufsz = outlen % ctx->block_size;
375
376
    return 1;
377
}
378
379
static int s390x_keccak_squeeze(void *vctx, unsigned char *out, size_t outlen)
380
{
381
     return s390x_keccakc_squeeze(vctx, out, outlen, 0x01);
382
}
383
384
static int s390x_kmac_squeeze(void *vctx, unsigned char *out, size_t outlen)
385
{
386
     return s390x_keccakc_squeeze(vctx, out, outlen, 0x04);
387
}
388
389
static PROV_SHA3_METHOD sha3_s390x_md = {
390
    s390x_sha3_absorb,
391
    s390x_sha3_final,
392
    NULL,
393
};
394
395
static PROV_SHA3_METHOD keccak_s390x_md = {
396
    s390x_sha3_absorb,
397
    s390x_keccak_final,
398
    s390x_keccak_squeeze,
399
};
400
401
static PROV_SHA3_METHOD shake_s390x_md = {
402
    s390x_sha3_absorb,
403
    s390x_shake_final,
404
    s390x_shake_squeeze,
405
};
406
407
static PROV_SHA3_METHOD kmac_s390x_md = {
408
    s390x_sha3_absorb,
409
    s390x_kmac_final,
410
    s390x_kmac_squeeze,
411
};
412
413
# define SHAKE_SET_MD(uname, typ)                                              \
414
    if (S390_SHA3_CAPABLE(uname)) {                                            \
415
        ctx->pad = S390X_##uname;                                              \
416
        ctx->meth = typ##_s390x_md;                                            \
417
    } else {                                                                   \
418
        ctx->meth = shake_generic_md;                                          \
419
    }
420
421
# define SHA3_SET_MD(uname, typ)                                               \
422
    if (S390_SHA3_CAPABLE(uname)) {                                            \
423
        ctx->pad = S390X_##uname;                                              \
424
        ctx->meth = typ##_s390x_md;                                            \
425
    } else {                                                                   \
426
        ctx->meth = sha3_generic_md;                                           \
427
    }
428
# define KMAC_SET_MD(bitlen)                                                   \
429
    if (S390_SHA3_CAPABLE(SHAKE_##bitlen)) {                                   \
430
        ctx->pad = S390X_SHAKE_##bitlen;                                       \
431
        ctx->meth = kmac_s390x_md;                                             \
432
    } else {                                                                   \
433
        ctx->meth = sha3_generic_md;                                           \
434
    }
435
#elif defined(__aarch64__) && defined(KECCAK1600_ASM)
436
# include "arm_arch.h"
437
438
static sha3_absorb_fn armsha3_sha3_absorb;
439
440
size_t SHA3_absorb_cext(uint64_t A[5][5], const unsigned char *inp, size_t len,
441
                        size_t r);
442
/*-
443
 * Hardware-assisted ARMv8.2 SHA3 extension version of the absorb()
444
 */
445
static size_t armsha3_sha3_absorb(void *vctx, const void *inp, size_t len)
446
{
447
    KECCAK1600_CTX *ctx = vctx;
448
449
    return SHA3_absorb_cext(ctx->A, inp, len, ctx->block_size);
450
}
451
452
static PROV_SHA3_METHOD sha3_ARMSHA3_md = {
453
    armsha3_sha3_absorb,
454
    generic_sha3_final
455
};
456
static PROV_SHA3_METHOD shake_ARMSHA3_md =
457
{
458
    armsha3_sha3_absorb,
459
    generic_sha3_final,
460
    generic_sha3_squeeze
461
};
462
# define SHAKE_SET_MD(uname, typ)                                              \
463
    if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
464
        ctx->meth = shake_ARMSHA3_md;                                          \
465
    } else {                                                                   \
466
        ctx->meth = shake_generic_md;                                          \
467
    }
468
469
# define SHA3_SET_MD(uname, typ)                                               \
470
    if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
471
        ctx->meth = sha3_ARMSHA3_md;                                           \
472
    } else {                                                                   \
473
        ctx->meth = sha3_generic_md;                                           \
474
    }
475
# define KMAC_SET_MD(bitlen)                                                   \
476
    if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
477
        ctx->meth = sha3_ARMSHA3_md;                                           \
478
    } else {                                                                   \
479
        ctx->meth = sha3_generic_md;                                           \
480
    }
481
#else
482
0
# define SHA3_SET_MD(uname, typ) ctx->meth = sha3_generic_md;
483
0
# define KMAC_SET_MD(bitlen) ctx->meth = sha3_generic_md;
484
0
# define SHAKE_SET_MD(uname, typ) ctx->meth = shake_generic_md;
485
#endif /* S390_SHA3 */
486
487
#define SHA3_newctx(typ, uname, name, bitlen, pad)                             \
488
static OSSL_FUNC_digest_newctx_fn name##_newctx;                               \
489
0
static void *name##_newctx(void *provctx)                                      \
490
0
{                                                                              \
491
0
    KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \
492
0
                                                : NULL;                        \
493
0
                                                                               \
494
0
    if (ctx == NULL)                                                           \
495
0
        return NULL;                                                           \
496
0
    ossl_sha3_init(ctx, pad, bitlen);                                          \
497
0
    SHA3_SET_MD(uname, typ)                                                    \
498
0
    return ctx;                                                                \
499
0
}
Unexecuted instantiation: sha3_prov.c:sha3_224_newctx
Unexecuted instantiation: sha3_prov.c:sha3_256_newctx
Unexecuted instantiation: sha3_prov.c:sha3_384_newctx
Unexecuted instantiation: sha3_prov.c:sha3_512_newctx
Unexecuted instantiation: sha3_prov.c:keccak_224_newctx
Unexecuted instantiation: sha3_prov.c:keccak_256_newctx
Unexecuted instantiation: sha3_prov.c:keccak_384_newctx
Unexecuted instantiation: sha3_prov.c:keccak_512_newctx
500
501
#define SHAKE_newctx(typ, uname, name, bitlen, mdlen, pad)                     \
502
static OSSL_FUNC_digest_newctx_fn name##_newctx;                               \
503
0
static void *name##_newctx(void *provctx)                                      \
504
0
{                                                                              \
505
0
    KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx))\
506
0
                                                : NULL;                        \
507
0
                                                                               \
508
0
    if (ctx == NULL)                                                           \
509
0
        return NULL;                                                           \
510
0
    ossl_keccak_init(ctx, pad, bitlen, mdlen);                                 \
511
0
    if (mdlen == 0)                                                            \
512
0
        ctx->md_size = SIZE_MAX;                                               \
513
0
    SHAKE_SET_MD(uname, typ)                                                   \
514
0
    return ctx;                                                                \
515
0
}
Unexecuted instantiation: sha3_prov.c:shake_128_newctx
Unexecuted instantiation: sha3_prov.c:shake_256_newctx
516
517
#define KMAC_newctx(uname, bitlen, pad)                                        \
518
static OSSL_FUNC_digest_newctx_fn uname##_newctx;                              \
519
0
static void *uname##_newctx(void *provctx)                                     \
520
0
{                                                                              \
521
0
    KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \
522
0
                                                : NULL;                        \
523
0
                                                                               \
524
0
    if (ctx == NULL)                                                           \
525
0
        return NULL;                                                           \
526
0
    ossl_keccak_init(ctx, pad, bitlen, 2 * bitlen);                            \
527
0
    KMAC_SET_MD(bitlen)                                                        \
528
0
    return ctx;                                                                \
529
0
}
Unexecuted instantiation: sha3_prov.c:keccak_kmac_128_newctx
Unexecuted instantiation: sha3_prov.c:keccak_kmac_256_newctx
530
531
#define PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags)   \
532
PROV_FUNC_DIGEST_GET_PARAM(name, blksize, dgstsize, flags)                     \
533
const OSSL_DISPATCH ossl_##name##_functions[] = {                              \
534
    { OSSL_FUNC_DIGEST_NEWCTX, (void (*)(void))name##_newctx },                \
535
    { OSSL_FUNC_DIGEST_UPDATE, (void (*)(void))keccak_update },                \
536
    { OSSL_FUNC_DIGEST_FINAL, (void (*)(void))keccak_final },                  \
537
    { OSSL_FUNC_DIGEST_FREECTX, (void (*)(void))keccak_freectx },              \
538
    { OSSL_FUNC_DIGEST_DUPCTX, (void (*)(void))keccak_dupctx },                \
539
    { OSSL_FUNC_DIGEST_COPYCTX, (void (*)(void))keccak_copyctx },              \
540
    PROV_DISPATCH_FUNC_DIGEST_GET_PARAMS(name)
541
542
#define PROV_FUNC_SHA3_DIGEST(name, bitlen, blksize, dgstsize, flags)          \
543
    PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags),      \
544
    { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init },                    \
545
    PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END
546
547
#define PROV_FUNC_SHAKE_DIGEST(name, bitlen, blksize, dgstsize, flags)         \
548
    PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags),      \
549
    { OSSL_FUNC_DIGEST_SQUEEZE, (void (*)(void))shake_squeeze },               \
550
    { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init_params },             \
551
    { OSSL_FUNC_DIGEST_SET_CTX_PARAMS, (void (*)(void))shake_set_ctx_params }, \
552
    { OSSL_FUNC_DIGEST_SETTABLE_CTX_PARAMS,                                    \
553
     (void (*)(void))shake_settable_ctx_params },                              \
554
    { OSSL_FUNC_DIGEST_GET_CTX_PARAMS, (void (*)(void))shake_get_ctx_params }, \
555
    { OSSL_FUNC_DIGEST_GETTABLE_CTX_PARAMS,                                    \
556
     (void (*)(void))shake_gettable_ctx_params },                              \
557
    PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END
558
559
static void keccak_freectx(void *vctx)
560
0
{
561
0
    KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx;
562
563
0
    OPENSSL_clear_free(ctx,  sizeof(*ctx));
564
0
}
565
566
static void keccak_copyctx(void *voutctx, void *vinctx)
567
0
{
568
0
    KECCAK1600_CTX *outctx = (KECCAK1600_CTX *)voutctx;
569
0
    KECCAK1600_CTX *inctx = (KECCAK1600_CTX *)vinctx;
570
571
0
    *outctx = *inctx;
572
0
}
573
574
static void *keccak_dupctx(void *ctx)
575
0
{
576
0
    KECCAK1600_CTX *in = (KECCAK1600_CTX *)ctx;
577
0
    KECCAK1600_CTX *ret = ossl_prov_is_running() ? OPENSSL_malloc(sizeof(*ret))
578
0
                                                 : NULL;
579
580
0
    if (ret != NULL)
581
0
        *ret = *in;
582
0
    return ret;
583
0
}
584
585
static const OSSL_PARAM *shake_gettable_ctx_params(ossl_unused void *ctx,
586
                                                   ossl_unused void *provctx)
587
0
{
588
0
    static const OSSL_PARAM known_shake_gettable_ctx_params[] = {
589
0
        {OSSL_DIGEST_PARAM_XOFLEN, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0},
590
0
        {OSSL_DIGEST_PARAM_SIZE, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0},
591
0
        OSSL_PARAM_END
592
0
    };
593
0
    return known_shake_gettable_ctx_params;
594
0
}
595
596
static int shake_get_ctx_params(void *vctx, OSSL_PARAM params[])
597
0
{
598
0
    OSSL_PARAM *p;
599
0
    KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx;
600
601
0
    if (ctx == NULL)
602
0
        return 0;
603
0
    if (ossl_param_is_empty(params))
604
0
        return 1;
605
606
0
    p = OSSL_PARAM_locate(params, OSSL_DIGEST_PARAM_XOFLEN);
607
0
    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->md_size)) {
608
0
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
609
0
        return 0;
610
0
    }
611
    /* Size is an alias of xoflen */
612
0
    p = OSSL_PARAM_locate(params, OSSL_DIGEST_PARAM_SIZE);
613
0
    if (p != NULL && !OSSL_PARAM_set_size_t(p, ctx->md_size)) {
614
0
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
615
0
        return 0;
616
0
    }
617
0
    return 1;
618
0
}
619
620
static const OSSL_PARAM *shake_settable_ctx_params(ossl_unused void *ctx,
621
                                                   ossl_unused void *provctx)
622
0
{
623
0
    static const OSSL_PARAM known_shake_settable_ctx_params[] = {
624
0
        {OSSL_DIGEST_PARAM_XOFLEN, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0},
625
0
        {OSSL_DIGEST_PARAM_SIZE, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0},
626
0
        OSSL_PARAM_END
627
0
    };
628
629
0
    return known_shake_settable_ctx_params;
630
0
}
631
632
static int shake_set_ctx_params(void *vctx, const OSSL_PARAM params[])
633
0
{
634
0
    const OSSL_PARAM *p;
635
0
    KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx;
636
637
0
    if (ossl_unlikely(ctx == NULL))
638
0
        return 0;
639
0
    if (ossl_param_is_empty(params))
640
0
        return 1;
641
642
0
    p = OSSL_PARAM_locate_const(params, OSSL_DIGEST_PARAM_XOFLEN);
643
0
    if (ossl_unlikely(p == NULL))
644
0
        p = OSSL_PARAM_locate_const(params, OSSL_DIGEST_PARAM_SIZE);
645
646
0
    if (ossl_unlikely(p != NULL && !OSSL_PARAM_get_size_t(p, &ctx->md_size))) {
647
0
        ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
648
0
        return 0;
649
0
    }
650
0
    return 1;
651
0
}
652
653
#define IMPLEMENT_SHA3_functions(bitlen)                                       \
654
    SHA3_newctx(sha3, SHA3_##bitlen, sha3_##bitlen, bitlen, '\x06')            \
655
    PROV_FUNC_SHA3_DIGEST(sha3_##bitlen, bitlen,                               \
656
                          SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen),         \
657
                          SHA3_FLAGS)
658
659
#define IMPLEMENT_KECCAK_functions(bitlen)                                     \
660
    SHA3_newctx(keccak, KECCAK_##bitlen, keccak_##bitlen, bitlen, '\x01')      \
661
    PROV_FUNC_SHA3_DIGEST(keccak_##bitlen, bitlen,                             \
662
                          SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen),         \
663
                          SHA3_FLAGS)
664
665
#define IMPLEMENT_SHAKE_functions(bitlen)                                      \
666
    SHAKE_newctx(shake, SHAKE_##bitlen, shake_##bitlen, bitlen,                \
667
                 0 /* no default md length */, '\x1f')                         \
668
    PROV_FUNC_SHAKE_DIGEST(shake_##bitlen, bitlen,                             \
669
                           SHA3_BLOCKSIZE(bitlen), 0,                          \
670
                           SHAKE_FLAGS)
671
672
#define IMPLEMENT_KMAC_functions(bitlen)                                       \
673
    KMAC_newctx(keccak_kmac_##bitlen, bitlen, '\x04')                          \
674
    PROV_FUNC_SHAKE_DIGEST(keccak_kmac_##bitlen, bitlen,                       \
675
                           SHA3_BLOCKSIZE(bitlen), KMAC_MDSIZE(bitlen),        \
676
                           KMAC_FLAGS)
677
678
/* ossl_sha3_224_functions */
679
IMPLEMENT_SHA3_functions(224)
680
/* ossl_sha3_256_functions */
681
IMPLEMENT_SHA3_functions(256)
682
/* ossl_sha3_384_functions */
683
IMPLEMENT_SHA3_functions(384)
684
/* ossl_sha3_512_functions */
685
IMPLEMENT_SHA3_functions(512)
686
/* ossl_keccak_224_functions */
687
IMPLEMENT_KECCAK_functions(224)
688
/* ossl_keccak_256_functions */
689
IMPLEMENT_KECCAK_functions(256)
690
/* ossl_keccak_384_functions */
691
IMPLEMENT_KECCAK_functions(384)
692
/* ossl_keccak_512_functions */
693
IMPLEMENT_KECCAK_functions(512)
694
/* ossl_shake_128_functions */
695
IMPLEMENT_SHAKE_functions(128)
696
/* ossl_shake_256_functions */
697
IMPLEMENT_SHAKE_functions(256)
698
/* ossl_keccak_kmac_128_functions */
699
IMPLEMENT_KMAC_functions(128)
700
/* ossl_keccak_kmac_256_functions */
701
IMPLEMENT_KMAC_functions(256)