/*	$OpenBSD: sha3.c,v 1.21 2026/07/22 14:34:38 jsing Exp $	*/
/*
 * The MIT License (MIT)
 *
 * Copyright (c) 2015 Markku-Juhani O. Saarinen
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

#include <endian.h>
#include <string.h>

#include "crypto_internal.h"
#include "sha3_internal.h"

#define KECCAKF_ROUNDS 24

static const uint64_t sha3_keccakf_rndc[24] = {
	0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
	0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
	0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
	0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
	0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
	0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
	0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
	0x8000000000008080, 0x0000000080000001, 0x8000000080008008
};

static void
sha3_keccakf(uint64_t st[25])
{
	uint64_t bc0, bc1, bc2, bc3, bc4;
	uint64_t d0, d1, d2, d3, d4;
	int i, r;

	for (i = 0; i < 25; i++)
		st[i] = le64toh(st[i]);

	/*
	 * Optimized Keccak algorithm from
	 * KeccakReferenceAndOptimized/Sources/Keccak-inplace.c contained in
	 * https://keccak.team/obsolete/KeccakReferenceAndOptimized-3.2.zip
	 */

	for (r = 0; r < KECCAKF_ROUNDS; r += 4) {
		/*
		 * Round 1
		 */
		bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
		bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
		bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
		bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
		bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
		d0 = bc4 ^ crypto_rol_u64(bc1, 1);
		d1 = bc0 ^ crypto_rol_u64(bc2, 1);
		d2 = bc1 ^ crypto_rol_u64(bc3, 1);
		d3 = bc2 ^ crypto_rol_u64(bc4, 1);
		d4 = bc3 ^ crypto_rol_u64(bc0, 1);

		bc0 = st[0] ^ d0;
		bc1 = crypto_rol_u64(st[6] ^ d1, 44);
		bc2 = crypto_rol_u64(st[12] ^ d2, 43);
		bc3 = crypto_rol_u64(st[18] ^ d3, 21);
		bc4 = crypto_rol_u64(st[24] ^ d4, 14);
		st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 0];
		st[6] = bc1 ^ (~bc2 & bc3);
		st[12] = bc2 ^ (~bc3 & bc4);
		st[18] = bc3 ^ (~bc4 & bc0);
		st[24] = bc4 ^ (~bc0 & bc1);

		bc2 = crypto_rol_u64(st[10] ^ d0, 3);
		bc3 = crypto_rol_u64(st[16] ^ d1, 45);
		bc4 = crypto_rol_u64(st[22] ^ d2, 61);
		bc0 = crypto_rol_u64(st[3] ^ d3, 28);
		bc1 = crypto_rol_u64(st[9] ^ d4, 20);
		st[10] = bc0 ^ (~bc1 & bc2);
		st[16] = bc1 ^ (~bc2 & bc3);
		st[22] = bc2 ^ (~bc3 & bc4);
		st[3] = bc3 ^ (~bc4 & bc0);
		st[9] = bc4 ^ (~bc0 & bc1);

		bc4 = crypto_rol_u64(st[20] ^ d0, 18);
		bc0 = crypto_rol_u64(st[1] ^ d1, 1);
		bc1 = crypto_rol_u64(st[7] ^ d2, 6);
		bc2 = crypto_rol_u64(st[13] ^ d3, 25);
		bc3 = crypto_rol_u64(st[19] ^ d4, 8);
		st[20] = bc0 ^ (~bc1 & bc2);
		st[1] = bc1 ^ (~bc2 & bc3);
		st[7] = bc2 ^ (~bc3 & bc4);
		st[13] = bc3 ^ (~bc4 & bc0);
		st[19] = bc4 ^ (~bc0 & bc1);

		bc1 = crypto_rol_u64(st[5] ^ d0, 36);
		bc2 = crypto_rol_u64(st[11] ^ d1, 10);
		bc3 = crypto_rol_u64(st[17] ^ d2, 15);
		bc4 = crypto_rol_u64(st[23] ^ d3, 56);
		bc0 = crypto_rol_u64(st[4] ^ d4, 27);
		st[5] = bc0 ^ (~bc1 & bc2);
		st[11] = bc1 ^ (~bc2 & bc3);
		st[17] = bc2 ^ (~bc3 & bc4);
		st[23] = bc3 ^ (~bc4 & bc0);
		st[4] = bc4 ^ (~bc0 & bc1);

		bc3 = crypto_rol_u64(st[15] ^ d0, 41);
		bc4 = crypto_rol_u64(st[21] ^ d1, 2);
		bc0 = crypto_rol_u64(st[2] ^ d2, 62);
		bc1 = crypto_rol_u64(st[8] ^ d3, 55);
		bc2 = crypto_rol_u64(st[14] ^ d4, 39);
		st[15] = bc0 ^ (~bc1 & bc2);
		st[21] = bc1 ^ (~bc2 & bc3);
		st[2] = bc2 ^ (~bc3 & bc4);
		st[8] = bc3 ^ (~bc4 & bc0);
		st[14] = bc4 ^ (~bc0 & bc1);

		/*
		 * Round 2
		 */
		bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
		bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
		bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
		bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
		bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
		d0 = bc4 ^ crypto_rol_u64(bc1, 1);
		d1 = bc0 ^ crypto_rol_u64(bc2, 1);
		d2 = bc1 ^ crypto_rol_u64(bc3, 1);
		d3 = bc2 ^ crypto_rol_u64(bc4, 1);
		d4 = bc3 ^ crypto_rol_u64(bc0, 1);

		bc0 = st[0] ^ d0;
		bc1 = crypto_rol_u64(st[16] ^ d1, 44);
		bc2 = crypto_rol_u64(st[7] ^ d2, 43);
		bc3 = crypto_rol_u64(st[23] ^ d3, 21);
		bc4 = crypto_rol_u64(st[14] ^ d4, 14);
		st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 1];
		st[16] = bc1 ^ (~bc2 & bc3);
		st[7] = bc2 ^ (~bc3 & bc4);
		st[23] = bc3 ^ (~bc4 & bc0);
		st[14] = bc4 ^ (~bc0 & bc1);

		bc2 = crypto_rol_u64(st[20] ^ d0, 3);
		bc3 = crypto_rol_u64(st[11] ^ d1, 45);
		bc4 = crypto_rol_u64(st[2] ^ d2, 61);
		bc0 = crypto_rol_u64(st[18] ^ d3, 28);
		bc1 = crypto_rol_u64(st[9] ^ d4, 20);
		st[20] = bc0 ^ (~bc1 & bc2);
		st[11] = bc1 ^ (~bc2 & bc3);
		st[2] = bc2 ^ (~bc3 & bc4);
		st[18] = bc3 ^ (~bc4 & bc0);
		st[9] = bc4 ^ (~bc0 & bc1);

		bc4 = crypto_rol_u64(st[15] ^ d0, 18);
		bc0 = crypto_rol_u64(st[6] ^ d1, 1);
		bc1 = crypto_rol_u64(st[22] ^ d2, 6);
		bc2 = crypto_rol_u64(st[13] ^ d3, 25);
		bc3 = crypto_rol_u64(st[4] ^ d4, 8);
		st[15] = bc0 ^ (~bc1 & bc2);
		st[6] = bc1 ^ (~bc2 & bc3);
		st[22] = bc2 ^ (~bc3 & bc4);
		st[13] = bc3 ^ (~bc4 & bc0);
		st[4] = bc4 ^ (~bc0 & bc1);

		bc1 = crypto_rol_u64(st[10] ^ d0, 36);
		bc2 = crypto_rol_u64(st[1] ^ d1, 10);
		bc3 = crypto_rol_u64(st[17] ^ d2, 15);
		bc4 = crypto_rol_u64(st[8] ^ d3, 56);
		bc0 = crypto_rol_u64(st[24] ^ d4, 27);
		st[10] = bc0 ^ (~bc1 & bc2);
		st[1] = bc1 ^ (~bc2 & bc3);
		st[17] = bc2 ^ (~bc3 & bc4);
		st[8] = bc3 ^ (~bc4 & bc0);
		st[24] = bc4 ^ (~bc0 & bc1);

		bc3 = crypto_rol_u64(st[5] ^ d0, 41);
		bc4 = crypto_rol_u64(st[21] ^ d1, 2);
		bc0 = crypto_rol_u64(st[12] ^ d2, 62);
		bc1 = crypto_rol_u64(st[3] ^ d3, 55);
		bc2 = crypto_rol_u64(st[19] ^ d4, 39);
		st[5] = bc0 ^ (~bc1 & bc2);
		st[21] = bc1 ^ (~bc2 & bc3);
		st[12] = bc2 ^ (~bc3 & bc4);
		st[3] = bc3 ^ (~bc4 & bc0);
		st[19] = bc4 ^ (~bc0 & bc1);

		/*
		 * Round 3
		 */
		bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
		bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
		bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
		bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
		bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
		d0 = bc4 ^ crypto_rol_u64(bc1, 1);
		d1 = bc0 ^ crypto_rol_u64(bc2, 1);
		d2 = bc1 ^ crypto_rol_u64(bc3, 1);
		d3 = bc2 ^ crypto_rol_u64(bc4, 1);
		d4 = bc3 ^ crypto_rol_u64(bc0, 1);

		bc0 = st[0] ^ d0;
		bc1 = crypto_rol_u64(st[11] ^ d1, 44);
		bc2 = crypto_rol_u64(st[22] ^ d2, 43);
		bc3 = crypto_rol_u64(st[8] ^ d3, 21);
		bc4 = crypto_rol_u64(st[19] ^ d4, 14);
		st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 2];
		st[11] = bc1 ^ (~bc2 & bc3);
		st[22] = bc2 ^ (~bc3 & bc4);
		st[8] = bc3 ^ (~bc4 & bc0);
		st[19] = bc4 ^ (~bc0 & bc1);

		bc2 = crypto_rol_u64(st[15] ^ d0, 3);
		bc3 = crypto_rol_u64(st[1] ^ d1, 45);
		bc4 = crypto_rol_u64(st[12] ^ d2, 61);
		bc0 = crypto_rol_u64(st[23] ^ d3, 28);
		bc1 = crypto_rol_u64(st[9] ^ d4, 20);
		st[15] = bc0 ^ (~bc1 & bc2);
		st[1] = bc1 ^ (~bc2 & bc3);
		st[12] = bc2 ^ (~bc3 & bc4);
		st[23] = bc3 ^ (~bc4 & bc0);
		st[9] = bc4 ^ (~bc0 & bc1);

		bc4 = crypto_rol_u64(st[5] ^ d0, 18);
		bc0 = crypto_rol_u64(st[16] ^ d1, 1);
		bc1 = crypto_rol_u64(st[2] ^ d2, 6);
		bc2 = crypto_rol_u64(st[13] ^ d3, 25);
		bc3 = crypto_rol_u64(st[24] ^ d4, 8);
		st[5] = bc0 ^ (~bc1 & bc2);
		st[16] = bc1 ^ (~bc2 & bc3);
		st[2] = bc2 ^ (~bc3 & bc4);
		st[13] = bc3 ^ (~bc4 & bc0);
		st[24] = bc4 ^ (~bc0 & bc1);

		bc1 = crypto_rol_u64(st[20] ^ d0, 36);
		bc2 = crypto_rol_u64(st[6] ^ d1, 10);
		bc3 = crypto_rol_u64(st[17] ^ d2, 15);
		bc4 = crypto_rol_u64(st[3] ^ d3, 56);
		bc0 = crypto_rol_u64(st[14] ^ d4, 27);
		st[20] = bc0 ^ (~bc1 & bc2);
		st[6] = bc1 ^ (~bc2 & bc3);
		st[17] = bc2 ^ (~bc3 & bc4);
		st[3] = bc3 ^ (~bc4 & bc0);
		st[14] = bc4 ^ (~bc0 & bc1);

		bc3 = crypto_rol_u64(st[10] ^ d0, 41);
		bc4 = crypto_rol_u64(st[21] ^ d1, 2);
		bc0 = crypto_rol_u64(st[7] ^ d2, 62);
		bc1 = crypto_rol_u64(st[18] ^ d3, 55);
		bc2 = crypto_rol_u64(st[4] ^ d4, 39);
		st[10] = bc0 ^ (~bc1 & bc2);
		st[21] = bc1 ^ (~bc2 & bc3);
		st[7] = bc2 ^ (~bc3 & bc4);
		st[18] = bc3 ^ (~bc4 & bc0);
		st[4] = bc4 ^ (~bc0 & bc1);

		/*
		 * Round 4
		 */
		bc0 = st[0] ^ st[5] ^ st[10] ^ st[15] ^ st[20];
		bc1 = st[1] ^ st[6] ^ st[11] ^ st[16] ^ st[21];
		bc2 = st[2] ^ st[7] ^ st[12] ^ st[17] ^ st[22];
		bc3 = st[3] ^ st[8] ^ st[13] ^ st[18] ^ st[23];
		bc4 = st[4] ^ st[9] ^ st[14] ^ st[19] ^ st[24];
		d0 = bc4 ^ crypto_rol_u64(bc1, 1);
		d1 = bc0 ^ crypto_rol_u64(bc2, 1);
		d2 = bc1 ^ crypto_rol_u64(bc3, 1);
		d3 = bc2 ^ crypto_rol_u64(bc4, 1);
		d4 = bc3 ^ crypto_rol_u64(bc0, 1);

		bc0 = st[0] ^ d0;
		bc1 = crypto_rol_u64(st[1] ^ d1, 44);
		bc2 = crypto_rol_u64(st[2] ^ d2, 43);
		bc3 = crypto_rol_u64(st[3] ^ d3, 21);
		bc4 = crypto_rol_u64(st[4] ^ d4, 14);
		st[0] = bc0 ^ (~bc1 & bc2) ^ sha3_keccakf_rndc[r + 3];
		st[1] = bc1 ^ (~bc2 & bc3);
		st[2] = bc2 ^ (~bc3 & bc4);
		st[3] = bc3 ^ (~bc4 & bc0);
		st[4] = bc4 ^ (~bc0 & bc1);

		bc2 = crypto_rol_u64(st[5] ^ d0, 3);
		bc3 = crypto_rol_u64(st[6] ^ d1, 45);
		bc4 = crypto_rol_u64(st[7] ^ d2, 61);
		bc0 = crypto_rol_u64(st[8] ^ d3, 28);
		bc1 = crypto_rol_u64(st[9] ^ d4, 20);
		st[5] = bc0 ^ (~bc1 & bc2);
		st[6] = bc1 ^ (~bc2 & bc3);
		st[7] = bc2 ^ (~bc3 & bc4);
		st[8] = bc3 ^ (~bc4 & bc0);
		st[9] = bc4 ^ (~bc0 & bc1);

		bc4 = crypto_rol_u64(st[10] ^ d0, 18);
		bc0 = crypto_rol_u64(st[11] ^ d1, 1);
		bc1 = crypto_rol_u64(st[12] ^ d2, 6);
		bc2 = crypto_rol_u64(st[13] ^ d3, 25);
		bc3 = crypto_rol_u64(st[14] ^ d4, 8);
		st[10] = bc0 ^ (~bc1 & bc2);
		st[11] = bc1 ^ (~bc2 & bc3);
		st[12] = bc2 ^ (~bc3 & bc4);
		st[13] = bc3 ^ (~bc4 & bc0);
		st[14] = bc4 ^ (~bc0 & bc1);

		bc1 = crypto_rol_u64(st[15] ^ d0, 36);
		bc2 = crypto_rol_u64(st[16] ^ d1, 10);
		bc3 = crypto_rol_u64(st[17] ^ d2, 15);
		bc4 = crypto_rol_u64(st[18] ^ d3, 56);
		bc0 = crypto_rol_u64(st[19] ^ d4, 27);
		st[15] = bc0 ^ (~bc1 & bc2);
		st[16] = bc1 ^ (~bc2 & bc3);
		st[17] = bc2 ^ (~bc3 & bc4);
		st[18] = bc3 ^ (~bc4 & bc0);
		st[19] = bc4 ^ (~bc0 & bc1);

		bc3 = crypto_rol_u64(st[20] ^ d0, 41);
		bc4 = crypto_rol_u64(st[21] ^ d1, 2);
		bc0 = crypto_rol_u64(st[22] ^ d2, 62);
		bc1 = crypto_rol_u64(st[23] ^ d3, 55);
		bc2 = crypto_rol_u64(st[24] ^ d4, 39);
		st[20] = bc0 ^ (~bc1 & bc2);
		st[21] = bc1 ^ (~bc2 & bc3);
		st[22] = bc2 ^ (~bc3 & bc4);
		st[23] = bc3 ^ (~bc4 & bc0);
		st[24] = bc4 ^ (~bc0 & bc1);
	}

	for (i = 0; i < 25; i++)
		st[i] = htole64(st[i]);
}

int
sha3_init(sha3_ctx *ctx, int mdlen)
{
	if (mdlen < 0 || mdlen >= KECCAK_BYTE_WIDTH / 2)
		return 0;

	memset(ctx, 0, sizeof(*ctx));

	ctx->mdlen = mdlen;
	ctx->rsize = KECCAK_BYTE_WIDTH - 2 * mdlen;

	return 1;
}

int
sha3_update(sha3_ctx *ctx, const void *_data, size_t len)
{
	const uint8_t *data = _data;
	size_t i, j;

	j = ctx->pt;
	for (i = 0; i < len; i++) {
		ctx->state.b[j++] ^= data[i];
		if (j >= ctx->rsize) {
			sha3_keccakf(ctx->state.q);
			j = 0;
		}
	}
	ctx->pt = j;

	return 1;
}

int
sha3_final(void *_md, sha3_ctx *ctx)
{
	uint8_t *md = _md;
	int i;

	ctx->state.b[ctx->pt] ^= 0x06;
	ctx->state.b[ctx->rsize - 1] ^= 0x80;
	sha3_keccakf(ctx->state.q);

	for (i = 0; i < ctx->mdlen; i++)
		md[i] = ctx->state.b[i];

	return 1;
}

/* SHAKE128 and SHAKE256 extensible-output functionality. */
void
shake_xof(sha3_ctx *ctx)
{
	ctx->state.b[ctx->pt] ^= 0x1f;
	ctx->state.b[ctx->rsize - 1] ^= 0x80;
	sha3_keccakf(ctx->state.q);
	ctx->pt = 0;
}

void
shake_out(sha3_ctx *ctx, void *_out, size_t len)
{
	uint8_t *out = _out;
	size_t i, j;

	j = ctx->pt;
	for (i = 0; i < len; i++) {
		if (j >= ctx->rsize) {
			sha3_keccakf(ctx->state.q);
			j = 0;
		}
		out[i] = ctx->state.b[j++];
	}
	ctx->pt = j;
}