diff options
author | Andy Polyakov <appro@openssl.org> | 2017-05-30 15:57:37 +0200 |
---|---|---|
committer | Andy Polyakov <appro@openssl.org> | 2017-05-30 19:53:14 +0200 |
commit | 1f2aff257dc7f700edd5234f0530396be5f9c19b (patch) | |
tree | c22099c5cc55f8bb2c24468e66583e7dc5fa9716 /crypto/sha | |
parent | 0dd0be9408a4f20941c7ec23b4634cdf6402f573 (diff) |
sha/keccak1600.c: implement lane complementing transform
...as discussed in section 2.2 of "Keccak implementation overview".
[skip ci]
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'crypto/sha')
-rw-r--r-- | crypto/sha/keccak1600.c | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/crypto/sha/keccak1600.c b/crypto/sha/keccak1600.c index 2682fdb1db..c89188f076 100644 --- a/crypto/sha/keccak1600.c +++ b/crypto/sha/keccak1600.c @@ -355,11 +355,19 @@ static void Round(uint64_t R[5][5], uint64_t A[5][5], size_t i) C[3] = ROL64(A[3][3] ^ D[3], rhotates[3][3]); C[4] = ROL64(A[4][4] ^ D[4], rhotates[4][4]); +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + R[0][0] = C[0] ^ ( C[1] | C[2]) ^ iotas[i]; + R[0][1] = C[1] ^ (~C[2] | C[3]); + R[0][2] = C[2] ^ ( C[3] & C[4]); + R[0][3] = C[3] ^ ( C[4] | C[0]); + R[0][4] = C[4] ^ ( C[0] & C[1]); +#else R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i]; R[0][1] = C[1] ^ (~C[2] & C[3]); R[0][2] = C[2] ^ (~C[3] & C[4]); R[0][3] = C[3] ^ (~C[4] & C[0]); R[0][4] = C[4] ^ (~C[0] & C[1]); +#endif C[0] = ROL64(A[0][3] ^ D[3], rhotates[0][3]); C[1] = ROL64(A[1][4] ^ D[4], rhotates[1][4]); @@ -367,11 +375,19 @@ static void Round(uint64_t R[5][5], uint64_t A[5][5], size_t i) C[3] = ROL64(A[3][1] ^ D[1], rhotates[3][1]); C[4] = ROL64(A[4][2] ^ D[2], rhotates[4][2]); +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + R[1][0] = C[0] ^ (C[1] | C[2]); + R[1][1] = C[1] ^ (C[2] & C[3]); + R[1][2] = C[2] ^ (C[3] | ~C[4]); + R[1][3] = C[3] ^ (C[4] | C[0]); + R[1][4] = C[4] ^ (C[0] & C[1]); +#else R[1][0] = C[0] ^ (~C[1] & C[2]); R[1][1] = C[1] ^ (~C[2] & C[3]); R[1][2] = C[2] ^ (~C[3] & C[4]); R[1][3] = C[3] ^ (~C[4] & C[0]); R[1][4] = C[4] ^ (~C[0] & C[1]); +#endif C[0] = ROL64(A[0][1] ^ D[1], rhotates[0][1]); C[1] = ROL64(A[1][2] ^ D[2], rhotates[1][2]); @@ -379,11 +395,19 @@ static void Round(uint64_t R[5][5], uint64_t A[5][5], size_t i) C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]); C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]); +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + R[2][0] = C[0] ^ ( C[1] | C[2]); + R[2][1] = C[1] ^ ( C[2] & C[3]); + R[2][2] = C[2] ^ (~C[3] & C[4]); + R[2][3] = ~C[3] ^ ( C[4] | C[0]); + R[2][4] = C[4] ^ ( C[0] & C[1]); +#else R[2][0] = C[0] ^ (~C[1] & C[2]); R[2][1] = C[1] ^ (~C[2] & C[3]); R[2][2] = C[2] ^ (~C[3] & C[4]); R[2][3] = C[3] ^ (~C[4] & C[0]); R[2][4] = C[4] ^ (~C[0] & C[1]); +#endif C[0] = ROL64(A[0][4] ^ D[4], rhotates[0][4]); C[1] = ROL64(A[1][0] ^ D[0], rhotates[1][0]); @@ -391,11 +415,19 @@ static void Round(uint64_t R[5][5], uint64_t A[5][5], size_t i) C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]); C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]); +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + R[3][0] = C[0] ^ ( C[1] & C[2]); + R[3][1] = C[1] ^ ( C[2] | C[3]); + R[3][2] = C[2] ^ (~C[3] | C[4]); + R[3][3] = ~C[3] ^ ( C[4] & C[0]); + R[3][4] = C[4] ^ ( C[0] | C[1]); +#else R[3][0] = C[0] ^ (~C[1] & C[2]); R[3][1] = C[1] ^ (~C[2] & C[3]); R[3][2] = C[2] ^ (~C[3] & C[4]); R[3][3] = C[3] ^ (~C[4] & C[0]); R[3][4] = C[4] ^ (~C[0] & C[1]); +#endif C[0] = ROL64(A[0][2] ^ D[2], rhotates[0][2]); C[1] = ROL64(A[1][3] ^ D[3], rhotates[1][3]); @@ -403,11 +435,19 @@ static void Round(uint64_t R[5][5], uint64_t A[5][5], size_t i) C[3] = ROL64(A[3][0] ^ D[0], rhotates[3][0]); C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]); +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + R[4][0] = C[0] ^ (~C[1] & C[2]); + R[4][1] = ~C[1] ^ ( C[2] | C[3]); + R[4][2] = C[2] ^ ( C[3] & C[4]); + R[4][3] = C[3] ^ ( C[4] | C[0]); + R[4][4] = C[4] ^ ( C[0] & C[1]); +#else R[4][0] = C[0] ^ (~C[1] & C[2]); R[4][1] = C[1] ^ (~C[2] & C[3]); R[4][2] = C[2] ^ (~C[3] & C[4]); R[4][3] = C[3] ^ (~C[4] & C[0]); R[4][4] = C[4] ^ (~C[0] & C[1]); +#endif } void KeccakF1600(uint64_t A[5][5]) @@ -415,10 +455,28 @@ void KeccakF1600(uint64_t A[5][5]) uint64_t T[5][5]; size_t i; +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + A[0][1] = ~A[0][1]; + A[0][2] = ~A[0][2]; + A[1][3] = ~A[1][3]; + A[2][2] = ~A[2][2]; + A[3][2] = ~A[3][2]; + A[4][0] = ~A[4][0]; +#endif + for (i = 0; i < 24; i += 2) { Round(T, A, i); Round(A, T, i + 1); } + +#ifdef KECCAK_COMPLEMENTING_TRANSFORM + A[0][1] = ~A[0][1]; + A[0][2] = ~A[0][2]; + A[1][3] = ~A[1][3]; + A[2][2] = ~A[2][2]; + A[3][2] = ~A[3][2]; + A[4][0] = ~A[4][0]; +#endif } #else |