diff options
author | Andy Polyakov <appro@openssl.org> | 2017-06-03 22:07:05 +0200 |
---|---|---|
committer | Andy Polyakov <appro@openssl.org> | 2017-06-05 19:35:07 +0200 |
commit | 1ded2dd3ee9389b412e2ef0cf8e0b40a4ed3179b (patch) | |
tree | 4cad9b63a3e7daeec45bf2f7146efc035ef8407c /crypto/sha | |
parent | c83a4db52123603fd6d2fe8535dd19ec9e5d848d (diff) |
sha/keccak1600.c: add another 1x variant.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'crypto/sha')
-rw-r--r-- | crypto/sha/keccak1600.c | 144 |
1 files changed, 144 insertions, 0 deletions
diff --git a/crypto/sha/keccak1600.c b/crypto/sha/keccak1600.c index f2fffe7c48..827affbad3 100644 --- a/crypto/sha/keccak1600.c +++ b/crypto/sha/keccak1600.c @@ -341,6 +341,150 @@ void KeccakF1600(uint64_t A[5][5]) } } +#elif defined(KECCAK_1X_ALT) +/* + * This is variant of above KECCAK_1X that presses temporary storage + * even further, but at cost of more write references to A[5][5]. + * It's less suitable if A[5][5] is memory bound, but better if it's + * register bound. + */ + +static void Round(uint64_t A[5][5], size_t i) +{ + uint64_t C[5], D[5]; + + assert(i < (sizeof(iotas) / sizeof(iotas[0]))); + + C[0] = A[0][0] ^ A[1][0] ^ A[2][0] ^ A[3][0] ^ A[4][0]; + C[1] = A[0][1] ^ A[1][1] ^ A[2][1] ^ A[3][1] ^ A[4][1]; + C[2] = A[0][2] ^ A[1][2] ^ A[2][2] ^ A[3][2] ^ A[4][2]; + C[3] = A[0][3] ^ A[1][3] ^ A[2][3] ^ A[3][3] ^ A[4][3]; + C[4] = A[0][4] ^ A[1][4] ^ A[2][4] ^ A[3][4] ^ A[4][4]; + + D[0] = ROL64(C[1], 1) ^ C[4]; + A[0][0] ^= D[0]; + A[1][0] ^= D[0]; + A[2][0] ^= D[0]; + A[3][0] ^= D[0]; + A[4][0] ^= D[0]; + + D[1] = ROL64(C[2], 1) ^ C[0]; + A[0][1] ^= D[1]; + A[1][1] ^= D[1]; + A[2][1] ^= D[1]; + A[3][1] ^= D[1]; + A[4][1] ^= D[1]; + + D[2] = ROL64(C[3], 1) ^ C[1]; + A[0][2] ^= D[2]; + A[1][2] ^= D[2]; + A[2][2] ^= D[2]; + A[3][2] ^= D[2]; + A[4][2] ^= D[2]; + + D[3] = ROL64(C[4], 1) ^ C[2]; + A[0][3] ^= D[3]; + A[1][3] ^= D[3]; + A[2][3] ^= D[3]; + A[3][3] ^= D[3]; + A[4][3] ^= D[3]; + + D[4] = ROL64(C[0], 1) ^ C[3]; + A[0][4] ^= D[4]; + A[1][4] ^= D[4]; + A[2][4] ^= D[4]; + A[3][4] ^= D[4]; + A[4][4] ^= D[4]; + + C[1] = A[0][1]; + C[2] = A[0][2]; + C[3] = A[0][3]; + C[4] = A[0][4]; + + A[0][1] = ROL64(A[1][1], rhotates[1][1]); + A[0][2] = ROL64(A[2][2], rhotates[2][2]); + A[0][3] = ROL64(A[3][3], rhotates[3][3]); + A[0][4] = ROL64(A[4][4], rhotates[4][4]); + + A[1][1] = ROL64(A[1][4], rhotates[1][4]); + A[2][2] = ROL64(A[2][3], rhotates[2][3]); + A[3][3] = ROL64(A[3][2], rhotates[3][2]); + A[4][4] = ROL64(A[4][1], rhotates[4][1]); + + A[1][4] = ROL64(A[4][2], rhotates[4][2]); + A[2][3] = ROL64(A[3][4], rhotates[3][4]); + A[3][2] = ROL64(A[2][1], rhotates[2][1]); + A[4][1] = ROL64(A[1][3], rhotates[1][3]); + + A[4][2] = ROL64(A[2][4], rhotates[2][4]); + A[3][4] = ROL64(A[4][3], rhotates[4][3]); + A[2][1] = ROL64(A[1][2], rhotates[1][2]); + A[1][3] = ROL64(A[3][1], rhotates[3][1]); + + A[2][4] = ROL64(A[4][0], rhotates[4][0]); + A[4][3] = ROL64(A[3][0], rhotates[3][0]); + A[1][2] = ROL64(A[2][0], rhotates[2][0]); + A[3][1] = ROL64(A[1][0], rhotates[1][0]); + + A[1][0] = ROL64(C[3], rhotates[0][3]); + A[2][0] = ROL64(C[1], rhotates[0][1]); + A[3][0] = ROL64(C[4], rhotates[0][4]); + A[4][0] = ROL64(C[2], rhotates[0][2]); + + C[0] = A[0][0]; + C[1] = A[1][0]; + C[2] = A[2][0]; + C[3] = A[3][0]; + C[4] = A[4][0]; + + D[0] = A[0][1]; + D[1] = A[1][1]; + D[2] = A[2][1]; + D[3] = A[3][1]; + D[4] = A[4][1]; + + A[0][0] ^= (~A[0][1] & A[0][2]); + A[1][0] ^= (~A[1][1] & A[1][2]); + A[2][0] ^= (~A[2][1] & A[2][2]); + A[3][0] ^= (~A[3][1] & A[3][2]); + A[4][0] ^= (~A[4][1] & A[4][2]); + + A[0][1] ^= (~A[0][2] & A[0][3]); + A[1][1] ^= (~A[1][2] & A[1][3]); + A[2][1] ^= (~A[2][2] & A[2][3]); + A[3][1] ^= (~A[3][2] & A[3][3]); + A[4][1] ^= (~A[4][2] & A[4][3]); + + A[0][2] ^= (~A[0][3] & A[0][4]); + A[1][2] ^= (~A[1][3] & A[1][4]); + A[2][2] ^= (~A[2][3] & A[2][4]); + A[3][2] ^= (~A[3][3] & A[3][4]); + A[4][2] ^= (~A[4][3] & A[4][4]); + + A[0][3] ^= (~A[0][4] & C[0]); + A[1][3] ^= (~A[1][4] & C[1]); + A[2][3] ^= (~A[2][4] & C[2]); + A[3][3] ^= (~A[3][4] & C[3]); + A[4][3] ^= (~A[4][4] & C[4]); + + A[0][4] ^= (~C[0] & D[0]); + A[1][4] ^= (~C[1] & D[1]); + A[2][4] ^= (~C[2] & D[2]); + A[3][4] ^= (~C[3] & D[3]); + A[4][4] ^= (~C[4] & D[4]); + + A[0][0] ^= iotas[i]; +} + +void KeccakF1600(uint64_t A[5][5]) +{ + size_t i; + + for (i = 0; i < 24; i++) { + Round(A, i); + } +} + #elif defined(KECCAK_2X) /* * This implementation is variant of KECCAK_1X above with outer-most |