sha3.c File Reference

#include "precomp.h"

Include dependency graph for sha3.c:

Go to the source code of this file.

Macros
#define	KECCAK_COLUMN_SUM(state, c)    (state[0 + (c)] ^ state[5 + (c)] ^ state[10 + (c)] ^ state[15 + (c)] ^ state[20 + (c)])
#define	KECCAK_COLUMN_UPDATE(state, c, w)
#define	KECCAK_THETA(state)
#define	KECCAK_RHO_ROW(state, r)
#define	KECCAK_RHO_ROW0(state)
#define	KECCAK_RHO(state)
#define	KECCAK_PI(state)
#define	KECCAK_CHI_ROW(state, r)
#define	KECCAK_CHI(state)
#define	KECCAK_IOTA(state, rnd)   state[0] ^= KeccakIotaK[rnd]
#define	KECCAK_PERM_ROUND(state, rnd)

Functions
VOID SYMCRYPT_CALL	SymCryptKeccakPermute (_Inout_updates_(25) UINT64 *pState)
VOID SYMCRYPT_CALL	SymCryptKeccakInit (_Out_ PSYMCRYPT_KECCAK_STATE pState, UINT32 inputBlockSize, UINT8 paddingValue)
VOID SYMCRYPT_CALL	SymCryptKeccakReset (_Out_ PSYMCRYPT_KECCAK_STATE pState)
FORCEINLINE VOID SYMCRYPT_CALL	SymCryptKeccakAppendByte (_Inout_ PSYMCRYPT_KECCAK_STATE pState, BYTE val)
FORCEINLINE VOID SYMCRYPT_CALL	SymCryptKeccakAppendBytes (_Inout_ PSYMCRYPT_KECCAK_STATE pState, PCBYTE pbBuffer, SIZE_T cbBuffer)
VOID SYMCRYPT_CALL	SymCryptKeccakAppendLanes (_Inout_ PSYMCRYPT_KECCAK_STATE pState, _In_reads_(uLaneCount *sizeof(UINT64)) PCBYTE pbData, SIZE_T uLaneCount)
VOID SYMCRYPT_CALL	SymCryptKeccakZeroAppendBlock (_Inout_ PSYMCRYPT_KECCAK_STATE pState)
VOID SYMCRYPT_CALL	SymCryptKeccakAppend (_Inout_ PSYMCRYPT_KECCAK_STATE pState, _In_reads_(cbData) PCBYTE pbData, SIZE_T cbData)
VOID SYMCRYPT_CALL	SymCryptKeccakApplyPadding (_Inout_ PSYMCRYPT_KECCAK_STATE pState)
FORCEINLINE BYTE SYMCRYPT_CALL	SymCryptKeccakExtractByte (_Inout_ PSYMCRYPT_KECCAK_STATE pState)
VOID SYMCRYPT_CALL	SymCryptKeccakExtractLanes (_Inout_ PSYMCRYPT_KECCAK_STATE pState, _Out_writes_(uLaneCount *sizeof(UINT64)) PBYTE pbResult, SIZE_T uLaneCount)
VOID SYMCRYPT_CALL	SymCryptKeccakExtract (_Inout_ PSYMCRYPT_KECCAK_STATE pState, _Out_writes_(cbResult) PBYTE pbResult, SIZE_T cbResult, BOOLEAN bWipe)
VOID SYMCRYPT_CALL	SymCryptKeccakStateExport (SYMCRYPT_BLOB_TYPE type, _In_ PCSYMCRYPT_KECCAK_STATE pState, _Out_writes_bytes_(SYMCRYPT_KECCAK_STATE_EXPORT_SIZE) PBYTE pbBlob)
SYMCRYPT_ERROR SYMCRYPT_CALL	SymCryptKeccakStateImport (SYMCRYPT_BLOB_TYPE type, _Out_ PSYMCRYPT_KECCAK_STATE pState, _In_reads_bytes_(SYMCRYPT_KECCAK_STATE_EXPORT_SIZE) PCBYTE pbBlob)

Variables
static const UINT8	KeccakRhoK [25]
static UINT64	KeccakIotaK [24]

Macro Definition Documentation

KECCAK_CHI

#define KECCAK_CHI

(

state

)

Value:

    { \
    KECCAK_CHI_ROW(state, 0); \
    KECCAK_CHI_ROW(state, 1); \
    KECCAK_CHI_ROW(state, 2); \
    KECCAK_CHI_ROW(state, 3); \
    KECCAK_CHI_ROW(state, 4); \
}

Definition at line 134 of file sha3.c.

KECCAK_CHI_ROW

#define KECCAK_CHI_ROW	(		state,
			r
	)

Value:

    { \
    UINT64 t1 = state[5 * (r) + 0] ^ (~state[5 * (r) + 1] & state[5 * (r) + 2]); \
    UINT64 t2 = state[5 * (r) + 1] ^ (~state[5 * (r) + 2] & state[5 * (r) + 3]); \
    state[5 * (r) + 2] = state[5 * (r) + 2] ^ (~state[5 * (r) + 3] & state[5 * (r) + 4]); \
    state[5 * (r) + 3] = state[5 * (r) + 3] ^ (~state[5 * (r) + 4] & state[5 * (r) + 0]); \
    state[5 * (r) + 4] = state[5 * (r) + 4] ^ (~state[5 * (r) + 0] & state[5 * (r) + 1]); \
    state[5 * (r) + 0] = t1; \
    state[5 * (r) + 1] = t2; \
}

Definition at line 123 of file sha3.c.

KECCAK_COLUMN_SUM

#define KECCAK_COLUMN_SUM	(		state,
			c
	)		(state[0 + (c)] ^ state[5 + (c)] ^ state[10 + (c)] ^ state[15 + (c)] ^ state[20 + (c)])

Definition at line 54 of file sha3.c.

KECCAK_COLUMN_UPDATE

#define KECCAK_COLUMN_UPDATE	(		state,
			c,
			w
	)

Value:

    { \
    UINT64 t = (w); \
    state[ 0 + (c)] ^= t; \
    state[ 5 + (c)] ^= t; \
    state[10 + (c)] ^= t; \
    state[15 + (c)] ^= t; \
    state[20 + (c)] ^= t; \
}

Definition at line 60 of file sha3.c.

KECCAK_IOTA

#define KECCAK_IOTA	(		state,
			rnd
	)		state[0] ^= KeccakIotaK[rnd]

Definition at line 143 of file sha3.c.

KECCAK_PERM_ROUND

#define KECCAK_PERM_ROUND	(		state,
			rnd
	)

Value:

    { \
    KECCAK_THETA(state); \
    KECCAK_RHO(state); \
    KECCAK_PI(state); \
    KECCAK_CHI(state); \
    KECCAK_IOTA(state, rnd); \
}

Definition at line 146 of file sha3.c.

KECCAK_PI

#define KECCAK_PI

(

state

)

Value:

    { \
    UINT64 t  = state[ 1]; state[ 1] = state[ 6]; state[ 6] = state[ 9]; state[ 9] = state[22]; state[22] = state[14]; \
    state[14] = state[20]; state[20] = state[ 2]; state[ 2] = state[12]; state[12] = state[13]; state[13] = state[19]; \
    state[19] = state[23]; state[23] = state[15]; state[15] = state[ 4]; state[ 4] = state[24]; state[24] = state[21]; \
    state[21] = state[ 8]; state[ 8] = state[16]; state[16] = state[ 5]; state[ 5] = state[ 3]; state[ 3] = state[18]; \
    state[18] = state[17]; state[17] = state[11]; state[11] = state[ 7]; state[ 7] = state[10]; state[10] = t; \
}

Definition at line 114 of file sha3.c.

KECCAK_RHO

#define KECCAK_RHO

(

state

)

Value:

    { \
    KECCAK_RHO_ROW0(state); \
    KECCAK_RHO_ROW(state, 1); \
    KECCAK_RHO_ROW(state, 2); \
    KECCAK_RHO_ROW(state, 3); \
    KECCAK_RHO_ROW(state, 4); \
}

Definition at line 105 of file sha3.c.

KECCAK_RHO_ROW

#define KECCAK_RHO_ROW	(		state,
			r
	)

Value:

    { \
    state[5 * (r) + 0] = ROL64(state[5 * (r) + 0], KeccakRhoK[5 * (r) + 0]); \
    state[5 * (r) + 1] = ROL64(state[5 * (r) + 1], KeccakRhoK[5 * (r) + 1]); \
    state[5 * (r) + 2] = ROL64(state[5 * (r) + 2], KeccakRhoK[5 * (r) + 2]); \
    state[5 * (r) + 3] = ROL64(state[5 * (r) + 3], KeccakRhoK[5 * (r) + 3]); \
    state[5 * (r) + 4] = ROL64(state[5 * (r) + 4], KeccakRhoK[5 * (r) + 4]); \
}

Definition at line 85 of file sha3.c.

KECCAK_RHO_ROW0

#define KECCAK_RHO_ROW0

(

state

)

Value:

    { \
    state[1] = ROL64(state[1], KeccakRhoK[1]); \
    state[2] = ROL64(state[2], KeccakRhoK[2]); \
    state[3] = ROL64(state[3], KeccakRhoK[3]); \
    state[4] = ROL64(state[4], KeccakRhoK[4]); \
}

Definition at line 97 of file sha3.c.

KECCAK_THETA

#define KECCAK_THETA

(

state

)

Value:

    { \
    UINT64 colSum[5]; \
    colSum[0] = KECCAK_COLUMN_SUM(state, 0); \
    colSum[1] = KECCAK_COLUMN_SUM(state, 1); \
    colSum[2] = KECCAK_COLUMN_SUM(state, 2); \
    colSum[3] = KECCAK_COLUMN_SUM(state, 3); \
    colSum[4] = KECCAK_COLUMN_SUM(state, 4); \
    KECCAK_COLUMN_UPDATE(state, 0, colSum[4] ^ ROL64(colSum[1], 1)); \
    KECCAK_COLUMN_UPDATE(state, 1, colSum[0] ^ ROL64(colSum[2], 1)); \
    KECCAK_COLUMN_UPDATE(state, 2, colSum[1] ^ ROL64(colSum[3], 1)); \
    KECCAK_COLUMN_UPDATE(state, 3, colSum[2] ^ ROL64(colSum[4], 1)); \
    KECCAK_COLUMN_UPDATE(state, 4, colSum[3] ^ ROL64(colSum[0], 1)); \
}

Definition at line 70 of file sha3.c.

Function Documentation

SymCryptKeccakAppend()

VOID SYMCRYPT_CALL SymCryptKeccakAppend	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		_In_reads_(cbData) PCBYTE	pbData,
		SIZE_T	cbData
	)

Definition at line 285 of file sha3.c.

{
    SYMCRYPT_ASSERT(pState->inputBlockSize % 8 == 0);
 
    // If we were in squeeze mode (Append is called after an Extract without wiping),
    // switch to absorb mode to start a new hash computation.
    if (pState->squeezeMode)
    {
        SymCryptKeccakReset(pState);
    }
 
    SYMCRYPT_ASSERT(pState->stateIndex < pState->inputBlockSize);
 
    // Make pState->stateIndex a multiple of 8.
    // Message block boundary will not be crossed, check
    // if permutation is needed after this part.
    while (cbData > 0 && (pState->stateIndex & 0x7))
    {
        SymCryptKeccakAppendByte(pState, *pbData);
        pbData++;
        cbData--;
    }
 
    // Permute if input message block is filled
    if (pState->stateIndex == pState->inputBlockSize)
    {
        SymCryptKeccakPermute(pState->state);
        pState->stateIndex = 0;
    }
 
    // Append full lanes
    SIZE_T uFullLanes = cbData / sizeof(UINT64);
    if (uFullLanes > 0)
    {
        SymCryptKeccakAppendLanes(pState, pbData, uFullLanes);
        pbData += uFullLanes * sizeof(UINT64);
        cbData -= uFullLanes * sizeof(UINT64);
    }
 
    SYMCRYPT_ASSERT(cbData < sizeof(UINT64));
    SymCryptKeccakAppendBytes(pState, pbData, cbData);
 
    SYMCRYPT_ASSERT(pState->stateIndex != pState->inputBlockSize);
}

Referenced by SYMCRYPT_XxxAppend(), SymCryptKeccakAppendEncodedString(), SymCryptKeccakAppendEncodeTimes8(), SymCryptSha3_224Append(), SymCryptSha3_256Append(), SymCryptSha3_384Append(), and SymCryptSha3_512Append().

SymCryptKeccakAppendByte()

FORCEINLINE VOID SYMCRYPT_CALL SymCryptKeccakAppendByte	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		BYTE	val
	)

Definition at line 205 of file sha3.c.

{
    SYMCRYPT_ASSERT(!pState->squeezeMode);
    SYMCRYPT_ASSERT(pState->stateIndex < pState->inputBlockSize);
 
    pState->state[pState->stateIndex / sizeof(UINT64)] ^= ((UINT64)val << (8 * (pState->stateIndex % 8)));
    pState->stateIndex++;
}

Referenced by SymCryptKeccakAppend().

SymCryptKeccakAppendBytes()

FORCEINLINE VOID SYMCRYPT_CALL SymCryptKeccakAppendBytes	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		PCBYTE	pbBuffer,
		SIZE_T	cbBuffer
	)

Definition at line 220 of file sha3.c.

{
    SYMCRYPT_ASSERT(!pState->squeezeMode);
    SYMCRYPT_ASSERT((pState->stateIndex + cbBuffer) <= pState->inputBlockSize);
 
    for (SIZE_T i = 0; i < cbBuffer; i++)
    {
        pState->state[(pState->stateIndex + i) / sizeof(UINT64)] ^= ((UINT64)pbBuffer[i] << (8 * ((pState->stateIndex + i) % 8)));
    }
 
    pState->stateIndex += (UINT32)cbBuffer;
}

Referenced by SymCryptKeccakAppend().

SymCryptKeccakAppendLanes()

VOID SYMCRYPT_CALL SymCryptKeccakAppendLanes	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		_In_reads_(uLaneCount *sizeof(UINT64)) PCBYTE	pbData,
		SIZE_T	uLaneCount
	)

Definition at line 239 of file sha3.c.

{
    SYMCRYPT_ASSERT(!pState->squeezeMode);
    SYMCRYPT_ASSERT((pState->inputBlockSize & 0x7) == 0);
    SYMCRYPT_ASSERT((pState->stateIndex & 0x7) == 0);
    SYMCRYPT_ASSERT(pState->stateIndex != pState->inputBlockSize);
 
    // Locate the lane in the state for next append.
    // Currently, pState->stateIndex/sizeof(UINT64) of the lanes are used.
    UINT32 uLaneIndex = pState->stateIndex / sizeof(UINT64);
 
    for (SIZE_T i = 0; i < uLaneCount; i++)
    {
        pState->state[uLaneIndex] ^= SYMCRYPT_LOAD_LSBFIRST64(pbData + i * sizeof(UINT64));
        pState->stateIndex += sizeof(UINT64);
        uLaneIndex++;
 
        if (pState->stateIndex == pState->inputBlockSize)
        {
            SymCryptKeccakPermute(pState->state);
            pState->stateIndex = 0;
            uLaneIndex = 0;
        }
    }
}

Referenced by SymCryptKeccakAppend().

SymCryptKeccakApplyPadding()

VOID SYMCRYPT_CALL SymCryptKeccakApplyPadding

(

_Inout_ PSYMCRYPT_KECCAK_STATE

pState

)

Definition at line 338 of file sha3.c.

{
    SYMCRYPT_ASSERT(!pState->squeezeMode);
 
    // Locate the lane and byte position for the padding byte
    UINT32 uLanePos = pState->stateIndex / sizeof(UINT64);
    UINT32 uBytePos = pState->stateIndex % sizeof(UINT64);
    pState->state[uLanePos] ^= ((UINT64)pState->paddingValue << (8 * uBytePos));
 
    // Pad the final 1 bit to the msb of the last lane in the rate portion of the state
    pState->state[pState->inputBlockSize / sizeof(UINT64) - 1] ^= (1ULL << 63);
 
    // Process the padded block and switch to squeeze mode
    SymCryptKeccakPermute(pState->state);
    pState->stateIndex = 0;
    pState->squeezeMode = TRUE;
}

Referenced by SymCryptKeccakExtract().

SymCryptKeccakExtract()

VOID SYMCRYPT_CALL SymCryptKeccakExtract	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		_Out_writes_(cbResult) PBYTE	pbResult,
		SIZE_T	cbResult,
		BOOLEAN	bWipe
	)

Definition at line 411 of file sha3.c.

{
    // Apply padding and switch to squeeze mode if this is the first call to Extract
    if (!pState->squeezeMode)
    {
        SymCryptKeccakApplyPadding(pState);
    }
 
    // Do the permutation if there are no bytes available in the state
    if ( (cbResult > 0) && (pState->stateIndex == pState->inputBlockSize) )
    {
        SymCryptKeccakPermute(pState->state);
        pState->stateIndex= 0;
    }
 
    // Make stateIndex a multiple of 8 so that the extraction can be performed in lanes.
    // We don't call the permutation as soon as the stateIndex reaches inputBlockSize,
    // cbResult must also be non-zero for that. This condition is checked
    // in ExtractLanes or in the 'remaining bytes' block that follows it.
    while (cbResult > 0 && (pState->stateIndex & 0x7))
    {
        *pbResult = SymCryptKeccakExtractByte(pState);
        pbResult++;
        cbResult--;
    }
 
    SYMCRYPT_ASSERT((cbResult == 0) || ((pState->stateIndex & 0x7) == 0));
 
    // Extract full lanes
    SIZE_T uFullLanes = cbResult / sizeof(UINT64);
    if (uFullLanes > 0)
    {
        SymCryptKeccakExtractLanes(pState, pbResult, uFullLanes);
        pbResult += uFullLanes * sizeof(UINT64);
        cbResult -= uFullLanes * sizeof(UINT64);
    }
 
    // Extract the remaining bytes
    SYMCRYPT_ASSERT(cbResult < sizeof(UINT64));
    while (cbResult > 0)
    {
        if (pState->stateIndex == pState->inputBlockSize)
        {
            SymCryptKeccakPermute(pState->state);
            pState->stateIndex = 0;
        }
 
        *pbResult = SymCryptKeccakExtractByte(pState);
        pbResult++;
        cbResult--;
    }
 
    if (bWipe)
    {
        // Wipe the Keccak state and make it ready for a new hash computation
        SymCryptKeccakReset(pState);
    }
}

Referenced by SYMCRYPT_XxxExtract(), SYMCRYPT_XxxResult(), SYMCRYPT_XxxResultEx(), SymCryptSha3_224Result(), SymCryptSha3_256Result(), SymCryptSha3_384Result(), and SymCryptSha3_512Result().

SymCryptKeccakExtractByte()

FORCEINLINE BYTE SYMCRYPT_CALL SymCryptKeccakExtractByte

(

_Inout_ PSYMCRYPT_KECCAK_STATE

pState

)

Definition at line 362 of file sha3.c.

{
    SYMCRYPT_ASSERT(pState->squeezeMode);
    SYMCRYPT_ASSERT(pState->stateIndex < pState->inputBlockSize);
 
    BYTE ret = (BYTE)((pState->state[pState->stateIndex / sizeof(UINT64)] >> (8 * (pState->stateIndex % 8))) & 0xff);
    pState->stateIndex++;
    return ret;
}

Referenced by SymCryptKeccakExtract().

SymCryptKeccakExtractLanes()

VOID SYMCRYPT_CALL SymCryptKeccakExtractLanes	(	_Inout_ PSYMCRYPT_KECCAK_STATE	pState,
		_Out_writes_(uLaneCount *sizeof(UINT64)) PBYTE	pbResult,
		SIZE_T	uLaneCount
	)

Definition at line 377 of file sha3.c.

{
    SYMCRYPT_ASSERT(pState->squeezeMode);
    SYMCRYPT_ASSERT((pState->inputBlockSize & 0x7) == 0);
    SYMCRYPT_ASSERT((pState->stateIndex & 0x7) == 0);
 
    // Locate the lane in the state for next extraction
    UINT32 uLaneIndex = pState->stateIndex / sizeof(UINT64);
 
    for (SIZE_T i = 0; i < uLaneCount; i++)
    {
        SYMCRYPT_ASSERT(pState->stateIndex <= pState->inputBlockSize);
 
        if (pState->stateIndex == pState->inputBlockSize)
        {
            SymCryptKeccakPermute(pState->state);
            pState->stateIndex = 0;
            uLaneIndex = 0;
        }
 
        SYMCRYPT_STORE_LSBFIRST64(pbResult + i * sizeof(UINT64), pState->state[uLaneIndex]);
        pState->stateIndex += sizeof(UINT64);
        uLaneIndex++;
    }
}

Referenced by SymCryptKeccakExtract().

SymCryptKeccakInit()

VOID SYMCRYPT_CALL SymCryptKeccakInit	(	_Out_ PSYMCRYPT_KECCAK_STATE	pState,
		UINT32	inputBlockSize,
		UINT8	paddingValue
	)

Definition at line 174 of file sha3.c.

{
    pState->inputBlockSize = inputBlockSize;
    pState->paddingValue = paddingValue;
 
    // Initialize the Keccak permutation state and set mutable state variables
    // to their default values.
    SymCryptKeccakReset(pState);
}

Referenced by SYMCRYPT_XxxInit(), SymCryptSha3_224Init(), SymCryptSha3_256Init(), SymCryptSha3_384Init(), and SymCryptSha3_512Init().

SymCryptKeccakPermute()

VOID SYMCRYPT_CALL SymCryptKeccakPermute

(

_Inout_updates_(25) UINT64 *

pState

)

Definition at line 160 of file sha3.c.

{
    for (int r = 0; r < 24; r++)
    {
        KECCAK_PERM_ROUND(pState, r);
    }
}

Referenced by SymCryptKeccakAppend(), SymCryptKeccakAppendLanes(), SymCryptKeccakApplyPadding(), SymCryptKeccakExtract(), SymCryptKeccakExtractLanes(), and SymCryptKeccakZeroAppendBlock().

SymCryptKeccakReset()

VOID SYMCRYPT_CALL SymCryptKeccakReset

(

_Out_ PSYMCRYPT_KECCAK_STATE

pState

)

Definition at line 186 of file sha3.c.

{
    //
    // Wipe & re-initialize
    //
    // Wipe the Keccak permutation state and set the mutable state variables to their
    // default values. Non-mutable state variables retain their values. State becomes
    // re-initialized after this call.
    SymCryptWipeKnownSize(pState->state, sizeof(pState->state));
    pState->stateIndex = 0;
    pState->squeezeMode = FALSE;
}

Referenced by SymCryptKeccakAppend(), SymCryptKeccakExtract(), and SymCryptKeccakInit().

SymCryptKeccakStateExport()

VOID SYMCRYPT_CALL SymCryptKeccakStateExport	(	SYMCRYPT_BLOB_TYPE	type,
		_In_ PCSYMCRYPT_KECCAK_STATE	pState,
		_Out_writes_bytes_(SYMCRYPT_KECCAK_STATE_EXPORT_SIZE) PBYTE	pbBlob
	)

Definition at line 479 of file sha3.c.

{
 
    SYMCRYPT_ALIGN SYMCRYPT_KECCAK_STATE_EXPORT_BLOB    blob;           // local copy to have proper alignment.
    C_ASSERT(sizeof(blob) == SYMCRYPT_KECCAK_STATE_EXPORT_SIZE);
 
    SymCryptWipeKnownSize(&blob, sizeof(blob)); // wipe to avoid any data leakage
 
    blob.header.magic = SYMCRYPT_BLOB_MAGIC;
    blob.header.size = SYMCRYPT_KECCAK_STATE_EXPORT_SIZE;
    blob.header.type = type;
 
    //
    // Copy the relevant data. Buffer will be 0-padded.
    //
 
    SymCryptUint64ToLsbFirst(&pState->state[0], &blob.state[0], 25);
    blob.stateIndex = pState->stateIndex;
    blob.paddingValue = pState->paddingValue;
    blob.squeezeMode = pState->squeezeMode;
 
    SYMCRYPT_ASSERT((PCBYTE)&blob + sizeof(blob) - sizeof(SYMCRYPT_BLOB_TRAILER) == (PCBYTE)&blob.trailer);
    SymCryptMarvin32(SymCryptMarvin32DefaultSeed, (PCBYTE)&blob, sizeof(blob) - sizeof(SYMCRYPT_BLOB_TRAILER), &blob.trailer.checksum[0]);
 
    memcpy(pbBlob, &blob, sizeof(blob));
 
    SymCryptWipeKnownSize(&blob, sizeof(blob));
    return;
}

Referenced by SymCryptSha3_224StateExport(), SymCryptSha3_256StateExport(), SymCryptSha3_384StateExport(), and SymCryptSha3_512StateExport().

SymCryptKeccakStateImport()

SYMCRYPT_ERROR SYMCRYPT_CALL SymCryptKeccakStateImport	(	SYMCRYPT_BLOB_TYPE	type,
		_Out_ PSYMCRYPT_KECCAK_STATE	pState,
		_In_reads_bytes_(SYMCRYPT_KECCAK_STATE_EXPORT_SIZE) PCBYTE	pbBlob
	)

Definition at line 518 of file sha3.c.

{
    SYMCRYPT_ERROR                  scError = SYMCRYPT_NO_ERROR;
 
    SYMCRYPT_ALIGN SYMCRYPT_KECCAK_STATE_EXPORT_BLOB blob;                       // local copy to have proper alignment.
    BYTE checksum[8];
 
    C_ASSERT(sizeof(blob) == SYMCRYPT_KECCAK_STATE_EXPORT_SIZE);
    memcpy(&blob, pbBlob, sizeof(blob));
 
    if (blob.header.magic != SYMCRYPT_BLOB_MAGIC ||
        blob.header.size != SYMCRYPT_KECCAK_STATE_EXPORT_SIZE ||
        blob.header.type != (UINT32)type)
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptMarvin32(SymCryptMarvin32DefaultSeed, (PCBYTE)&blob, sizeof(blob) - sizeof(SYMCRYPT_BLOB_TRAILER), checksum);
    if (memcmp(checksum, &blob.trailer.checksum[0], 8) != 0)
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    SymCryptLsbFirstToUint64(&blob.state[0], &pState->state[0], 25);
    pState->stateIndex = blob.stateIndex;
    pState->paddingValue = blob.paddingValue;
    pState->squeezeMode = blob.squeezeMode;
 
    //
    // Set state fields based on the blob type and do validation
    //
 
    // default values indicate error
    pState->inputBlockSize = 0;
    pState->paddingValue = 0;
 
    switch (blob.header.type)
    {
        case SymCryptBlobTypeSha3_224State:
            pState->inputBlockSize = SYMCRYPT_SHA3_224_INPUT_BLOCK_SIZE;
            if (blob.paddingValue == SYMCRYPT_SHA3_PADDING_VALUE)
            {
                pState->paddingValue = blob.paddingValue;
            }
            break;
        case SymCryptBlobTypeSha3_256State:
            pState->inputBlockSize = SYMCRYPT_SHA3_256_INPUT_BLOCK_SIZE;
            if (blob.paddingValue == SYMCRYPT_SHA3_PADDING_VALUE)
            {
                pState->paddingValue = blob.paddingValue;
            }
            break;
 
        case SymCryptBlobTypeSha3_384State:
            pState->inputBlockSize = SYMCRYPT_SHA3_384_INPUT_BLOCK_SIZE;
            if (blob.paddingValue == SYMCRYPT_SHA3_PADDING_VALUE)
            {
                pState->paddingValue = blob.paddingValue;
            }
            break;
 
        case SymCryptBlobTypeSha3_512State:
            pState->inputBlockSize = SYMCRYPT_SHA3_512_INPUT_BLOCK_SIZE;
            if (blob.paddingValue == SYMCRYPT_SHA3_PADDING_VALUE)
            {
                pState->paddingValue = blob.paddingValue;
            }
            break;
        default:
            scError = SYMCRYPT_INVALID_BLOB;
            goto cleanup;
    }
 
    if (pState->inputBlockSize == 0 || pState->paddingValue == 0)
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    if (pState->stateIndex > pState->inputBlockSize)
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
    // Allow stateIndex = inputBlockSize only in squeeze mode
    if ((pState->stateIndex == pState->inputBlockSize) && !pState->squeezeMode)
    {
        scError = SYMCRYPT_INVALID_BLOB;
        goto cleanup;
    }
 
cleanup:
    SymCryptWipeKnownSize(&blob, sizeof(blob));
 
    return scError;
}

Referenced by SymCryptSha3_224StateImport(), SymCryptSha3_256StateImport(), SymCryptSha3_384StateImport(), and SymCryptSha3_512StateImport().

SymCryptKeccakZeroAppendBlock()

VOID SYMCRYPT_CALL SymCryptKeccakZeroAppendBlock

(

_Inout_ PSYMCRYPT_KECCAK_STATE

pState

)

Definition at line 273 of file sha3.c.

{
    SYMCRYPT_ASSERT(!pState->squeezeMode);
    SymCryptKeccakPermute(pState->state);
    pState->stateIndex = 0;
}

Referenced by SYMCRYPT_XxxExpandKeyEx(), and SymCryptCShakeEncodeInputStrings().

Variable Documentation

KeccakIotaK

UINT64 KeccakIotaK[24]

static

Initial value:

= {
    0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL, 0x8000000080008000ULL,
    0x000000000000808bULL, 0x0000000080000001ULL, 0x8000000080008081ULL, 0x8000000000008009ULL,
    0x000000000000008aULL, 0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
    0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL, 0x8000000000008003ULL,
    0x8000000000008002ULL, 0x8000000000000080ULL, 0x000000000000800aULL, 0x800000008000000aULL,
    0x8000000080008081ULL, 0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL
}

Definition at line 44 of file sha3.c.

KeccakRhoK

const UINT8 KeccakRhoK[25]

static

Initial value:

= {
     0,  1, 62, 28, 27,     
    36, 44,  6, 55, 20,     
     3, 10, 43, 25, 39,     
    41, 45, 15, 21,  8,     
    18,  2, 61, 56, 14,     
}

Definition at line 35 of file sha3.c.