shake.c
Go to the documentation of this file.
1 /**
2  * @file shake.c
3  * @brief SHAKE extendable-output function
4  *
5  * @section License
6  *
7  * SPDX-License-Identifier: GPL-2.0-or-later
8  *
9  * Copyright (C) 2010-2026 Oryx Embedded SARL. All rights reserved.
10  *
11  * This file is part of CycloneCRYPTO Open.
12  *
13  * This program is free software; you can redistribute it and/or
14  * modify it under the terms of the GNU General Public License
15  * as published by the Free Software Foundation; either version 2
16  * of the License, or (at your option) any later version.
17  *
18  * This program is distributed in the hope that it will be useful,
19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21  * GNU General Public License for more details.
22  *
23  * You should have received a copy of the GNU General Public License
24  * along with this program; if not, write to the Free Software Foundation,
25  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
26  *
27  * @section Description
28  *
29  * SHAKE is a function on binary data in which the output can be extended to any
30  * desired length. SHAKE128 supports 128 bits of security strength. SHAKE256
31  * supports 256 bits of security strength. Refer to FIPS 202 for more details
32  *
33  * @author Oryx Embedded SARL (www.oryx-embedded.com)
34  * @version 2.6.6
35  **/
36 
37 //Switch to the appropriate trace level
38 #define TRACE_LEVEL CRYPTO_TRACE_LEVEL
39 
40 //Dependencies
41 #include "core/crypto.h"
42 #include "xof/shake.h"
43 
44 //Check crypto library configuration
45 #if (SHAKE_SUPPORT == ENABLED)
46 
47 //SHAKE128 object identifier (2.16.840.1.101.3.4.2.11)
48 const uint8_t SHAKE128_OID[9] = {0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0B};
49 //SHAKE256 object identifier (2.16.840.1.101.3.4.2.12)
50 const uint8_t SHAKE256_OID[9] = {0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0C};
51 
52 //Common interface for XOF algorithms (SHAKE128)
53 const XofAlgo shake128XofAlgo =
54 {
55  "SHAKE128",
56  SHAKE128_OID,
57  sizeof(SHAKE128_OID),
58  sizeof(ShakeContext),
59  (XofAlgoCompute) shake128Compute,
60  (XofAlgoComputeEx) NULL,
61  (XofAlgoInit) shake128Init,
62  (XofAlgoInitEx) NULL,
63  (XofAlgoAbsorb) shakeAbsorb,
64  (XofAlgoFinal) shakeFinal,
65  (XofAlgoSqueeze) shakeSqueeze
66 };
67 
68 //Common interface for XOF algorithms (SHAKE256)
69 const XofAlgo shake256XofAlgo =
70 {
71  "SHAKE256",
72  SHAKE256_OID,
73  sizeof(SHAKE256_OID),
74  sizeof(ShakeContext),
75  (XofAlgoCompute) shake256Compute,
76  (XofAlgoComputeEx) NULL,
77  (XofAlgoInit) shake256Init,
78  (XofAlgoInitEx) NULL,
79  (XofAlgoAbsorb) shakeAbsorb,
80  (XofAlgoFinal) shakeFinal,
81  (XofAlgoSqueeze) shakeSqueeze
82 };
83 
84 
85 /**
86  * @brief Digest a message using SHAKE
87  * @param[in] strength Number of bits of security (128 for SHAKE128 and
88  * 256 for SHAKE256)
89  * @param[in] input Pointer to the input data
90  * @param[in] inputLen Length of the input data
91  * @param[out] output Pointer to the output data
92  * @param[in] outputLen Expected length of the output data
93  * @return Error code
94  **/
95 
96 error_t shakeCompute(uint_t strength, const void *input, size_t inputLen,
97  uint8_t *output, size_t outputLen)
98 {
99  error_t error;
100 #if (CRYPTO_STATIC_MEM_SUPPORT == DISABLED)
101  ShakeContext *context;
102 #else
103  ShakeContext context[1];
104 #endif
105 
106  //Check parameters
107  if(input == NULL && inputLen != 0)
108  return ERROR_INVALID_PARAMETER;
109 
110  if(output == NULL && outputLen != 0)
111  return ERROR_INVALID_PARAMETER;
112 
113 #if (CRYPTO_STATIC_MEM_SUPPORT == DISABLED)
114  //Allocate a memory buffer to hold the SHAKE context
115  context = cryptoAllocMem(sizeof(ShakeContext));
116  //Failed to allocate memory?
117  if(context == NULL)
118  return ERROR_OUT_OF_MEMORY;
119 #endif
120 
121  //Initialize the SHAKE context
122  error = shakeInit(context, strength);
123 
124  //Check status code
125  if(!error)
126  {
127  //Absorb input data
128  shakeAbsorb(context, input, inputLen);
129  //Finish absorbing phase
130  shakeFinal(context);
131  //Extract data from the squeezing phase
132  shakeSqueeze(context, output, outputLen);
133  }
134 
135 #if (CRYPTO_STATIC_MEM_SUPPORT == DISABLED)
136  //Free previously allocated memory
137  cryptoFreeMem(context);
138 #endif
139 
140  //Return status code
141  return error;
142 }
143 
144 
145 /**
146  * @brief Digest a message using SHAKE128
147  * @param[in] input Pointer to the input data
148  * @param[in] inputLen Length of the input data
149  * @param[out] output Pointer to the output data
150  * @param[in] outputLen Expected length of the output data
151  * @return Error code
152  **/
153 
154 error_t shake128Compute(const void *input, size_t inputLen, uint8_t *output,
155  size_t outputLen)
156 {
157  //Digest the message using SHAKE128
158  return shakeCompute(128, input, inputLen, output, outputLen);
159 }
160 
161 
162 /**
163  * @brief Digest a message using SHAKE256
164  * @param[in] input Pointer to the input data
165  * @param[in] inputLen Length of the input data
166  * @param[out] output Pointer to the output data
167  * @param[in] outputLen Expected length of the output data
168  * @return Error code
169  **/
170 
171 error_t shake256Compute(const void *input, size_t inputLen, uint8_t *output,
172  size_t outputLen)
173 {
174  //Digest the message using SHAKE256
175  return shakeCompute(256, input, inputLen, output, outputLen);
176 }
177 
178 
179 /**
180  * @brief Initialize SHAKE context
181  * @param[in] context Pointer to the SHAKE context to initialize
182  * @param[in] strength Number of bits of security (128 for SHAKE128 and
183  * 256 for SHAKE256)
184  * @return Error code
185  **/
186 
187 error_t shakeInit(ShakeContext *context, uint_t strength)
188 {
189  error_t error;
190 
191  //SHAKE128 and SHAKE256 provides respectively 128 and 256 bits of security
192  if(strength == 128 || strength == 256)
193  {
194  //Initialize Keccak context
195  error = keccakInit(&context->keccakContext, 2 * strength);
196  }
197  else
198  {
199  //Report an error
200  error = ERROR_INVALID_PARAMETER;
201  }
202 
203  //Return status code
204  return error;
205 }
206 
207 
208 /**
209  * @brief Initialize SHAKE128 context
210  * @param[in] context Pointer to the SHAKE context to initialize
211  * @return Error code
212  **/
213 
214 error_t shake128Init(ShakeContext *context)
215 {
216  //Initialize SHAKE128 context
217  return shakeInit(context, 128);
218 }
219 
220 
221 /**
222  * @brief Initialize SHAKE256 context
223  * @param[in] context Pointer to the SHAKE context to initialize
224  * @return Error code
225  **/
226 
227 error_t shake256Init(ShakeContext *context)
228 {
229  //Initialize SHAKE256 context
230  return shakeInit(context, 256);
231 }
232 
233 
234 /**
235  * @brief Absorb data
236  * @param[in] context Pointer to the SHAKE context
237  * @param[in] input Pointer to the buffer being hashed
238  * @param[in] length Length of the buffer
239  **/
240 
241 void shakeAbsorb(ShakeContext *context, const void *input, size_t length)
242 {
243  //Absorb the input data
244  keccakAbsorb(&context->keccakContext, input, length);
245 }
246 
247 
248 /**
249  * @brief Finish absorbing phase
250  * @param[in] context Pointer to the SHAKE context
251  **/
252 
253 void shakeFinal(ShakeContext *context)
254 {
255  //Finish absorbing phase (padding byte is 0x1F for XOFs)
256  keccakFinal(&context->keccakContext, KECCAK_SHAKE_PAD);
257 }
258 
259 
260 /**
261  * @brief Extract data from the squeezing phase
262  * @param[in] context Pointer to the SHAKE context
263  * @param[out] output Output string
264  * @param[in] length Desired output length, in bytes
265  **/
266 
267 void shakeSqueeze(ShakeContext *context, uint8_t *output, size_t length)
268 {
269  //Extract data from the squeezing phase
270  keccakSqueeze(&context->keccakContext, output, length);
271 }
272 
273 #endif
KECCAK_SHAKE_PAD
#define KECCAK_SHAKE_PAD
Definition: keccak.h:101
shake.h
SHAKE extendable-output function.
XofAlgoAbsorb
void(* XofAlgoAbsorb)(void *context, const void *input, size_t length)
Definition: crypto.h:1191
XofAlgoInit
error_t(* XofAlgoInit)(void *context)
Definition: crypto.h:1186
ERROR_OUT_OF_MEMORY
@ ERROR_OUT_OF_MEMORY
Definition: error.h:63
keccakFinal
void keccakFinal(KeccakContext *context, uint8_t pad)
Finish absorbing phase.
Definition: keccak.c:373
XofAlgoInitEx
error_t(* XofAlgoInitEx)(void *context, const char_t *custom, size_t customLen)
Definition: crypto.h:1188
shake256XofAlgo
const XofAlgo shake256XofAlgo
Definition: shake.c:69
ERROR_INVALID_PARAMETER
@ ERROR_INVALID_PARAMETER
Invalid parameter.
Definition: error.h:47
error_t
error_t
Error codes.
Definition: error.h:43
shakeInit
error_t shakeInit(ShakeContext *context, uint_t strength)
Initialize SHAKE context.
Definition: shake.c:187
SHAKE256_OID
const uint8_t SHAKE256_OID[9]
Definition: shake.c:50
shakeAbsorb
void shakeAbsorb(ShakeContext *context, const void *input, size_t length)
Absorb data.
Definition: shake.c:241
crypto.h
General definitions for cryptographic algorithms.
shakeSqueeze
void shakeSqueeze(ShakeContext *context, uint8_t *output, size_t length)
Extract data from the squeezing phase.
Definition: shake.c:267
ShakeContext
SHAKE algorithm context.
Definition: shake.h:53
shake256Init
error_t shake256Init(ShakeContext *context)
Initialize SHAKE256 context.
Definition: shake.c:227
length
uint8_t length
Definition: tcp.h:375
ShakeContext::keccakContext
KeccakContext keccakContext
Definition: shake.h:54
keccakSqueeze
void keccakSqueeze(KeccakContext *context, uint8_t *output, size_t length)
Extract data from the squeezing phase.
Definition: keccak.c:417
shake128XofAlgo
const XofAlgo shake128XofAlgo
Definition: shake.c:53
XofAlgoCompute
error_t(* XofAlgoCompute)(const void *input, size_t inputLen, uint8_t *output, size_t outputLen)
Definition: crypto.h:1180
XofAlgo
Common interface for XOF algorithms.
Definition: crypto.h:1265
keccakAbsorb
void keccakAbsorb(KeccakContext *context, const void *input, size_t length)
Absorb data.
Definition: m460_crypto_hash.c:491
cryptoFreeMem
#define cryptoFreeMem(p)
Definition: crypto.h:966
shake128Compute
error_t shake128Compute(const void *input, size_t inputLen, uint8_t *output, size_t outputLen)
Digest a message using SHAKE128.
Definition: shake.c:154
cryptoAllocMem
#define cryptoAllocMem(size)
Definition: crypto.h:961
keccakInit
error_t keccakInit(KeccakContext *context, uint_t capacity)
Initialize Keccak context.
Definition: keccak.c:285
shakeFinal
void shakeFinal(ShakeContext *context)
Finish absorbing phase.
Definition: shake.c:253
shake256Compute
error_t shake256Compute(const void *input, size_t inputLen, uint8_t *output, size_t outputLen)
Digest a message using SHAKE256.
Definition: shake.c:171
XofAlgoSqueeze
void(* XofAlgoSqueeze)(void *context, uint8_t *output, size_t length)
Definition: crypto.h:1193
uint_t
unsigned int uint_t
Definition: compiler_port.h:57
XofAlgoComputeEx
error_t(* XofAlgoComputeEx)(const void *input, size_t inputLen, const char_t *custom, size_t customLen, uint8_t *output, size_t outputLen)
Definition: crypto.h:1183
shake128Init
error_t shake128Init(ShakeContext *context)
Initialize SHAKE128 context.
Definition: shake.c:214
shakeCompute
error_t shakeCompute(uint_t strength, const void *input, size_t inputLen, uint8_t *output, size_t outputLen)
Digest a message using SHAKE.
Definition: shake.c:96
XofAlgoFinal
void(* XofAlgoFinal)(void *context)
Definition: crypto.h:1192
SHAKE128_OID
const uint8_t SHAKE128_OID[9]
Definition: shake.c:48