From 6bebd054b1d506574c1ff1f44e139d70a1231d6e Mon Sep 17 00:00:00 2001 From: Andrew Ekstedt Date: Sat, 5 Oct 2024 23:30:02 -0700 Subject: [PATCH] add (c)SHAKE-128 and 256 --- shake.go | 147 ++++++++++++++++++++++++++++++++++++++++++++++++++ shake_test.go | 124 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 271 insertions(+) create mode 100644 shake.go create mode 100644 shake_test.go diff --git a/shake.go b/shake.go new file mode 100644 index 0000000..95f9601 --- /dev/null +++ b/shake.go @@ -0,0 +1,147 @@ +package keccak + +import "math/bits" + +type Shake struct { + digest + initialState *[25]uint64 // todo: unique.Handle? + + running uint8 +} + +func NewShake128(N, S []byte) *Shake { return newShake(N, S, 128/8) } +func NewShake256(N, S []byte) *Shake { return newShake(N, S, 256/8) } + +func newShake(N, S []byte, sizeBytes int) *Shake { + s := new(Shake) + s.digest.size = sizeBytes + if len(N) == 0 && len(S) == 0 { + s.digest.dsbyte = 0x1f // 1111 10... + } else { + // cSHAKE + s.digest.dsbyte = 0x04 // 00 10... + rate := s.digest.BlockSize() + s.digest.Write(leftEncode(uint64(rate))) // rate in bytes + s.digest.Write(leftEncode(uint64(len(N)) * 8)) // length of N in bits + s.digest.Write(N) + s.digest.Write(leftEncode(uint64(len(S)) * 8)) // length of S in bits + s.digest.Write(S) + if s.len > 0 { + s.pad(rate) + s.flush() + } + } + //s.Reset() + return s +} + +func (s *Shake) pad8() { + n := -s.len & 7 + for i := 0; i < n; i++ { + s.buf[s.len+i] = 0 + } + s.len += n +} + +func (s *Shake) pad(rate int) { + for i := s.len; i < rate && i < len(s.buf); i++ { + s.buf[i] = 0 + } + s.len = rate +} + +// Shake is only resettable if Reset is called before the first Write or Read. +// (The first call to Reset makes a copy of the initial state which is restored +// on subsequent calls.) +func (s *Shake) Reset() { + if s.running == 0 { + if s.initialState == nil { + s.initialState = new([25]uint64) + *s.initialState = s.a + } + } else { + if s.initialState == nil { + panic("keccak: Reset called after Read or Write") + } + s.a = *s.initialState + s.buf = [200]byte{} + s.len = 0 + s.running = 0 + } +} + +func (s *Shake) Write(p []byte) (int, error) { + s.running = 1 + return s.digest.Write(p) +} + +func (s *Shake) Read(p []byte) (int, error) { + if s.running < 2 && len(p) > 0 { + s.running = 2 + + s.buf[s.len] = s.dsbyte + bs := s.BlockSize() + for i := s.len + 1; i < bs; i++ { + s.buf[i] = 0 + } + s.buf[bs-1] |= 0x80 + + for i := range s.a { + if i*8 > bs { + break + } + s.a[i] ^= le64dec(s.buf[i*8:]) + } + + s.len = bs + } + return s.digest.read(p) +} + +func (d *digest) read(p []byte) (int, error) { + bs := d.BlockSize() + size := len(p) + for len(p) > 0 { + if d.len == bs { + d.squeeze(bs) + } + n := copy(p, d.buf[:bs]) + d.len += n + p = p[n:] + } + return size, nil +} + +func (d *digest) squeeze(bs int) { + //fmt.Printf("Squeezing\n", d.len) + keccakf(&d.a) + b := d.buf[:bs] + for i := range d.a { + if len(b) == 0 { + break + } + le64enc(b[:0], d.a[i]) // append + b = b[8:] + } + d.len = 0 +} + +func leftEncode(x uint64) []byte { + var out [9]byte + be64enc(out[1:], x) + i := bits.LeadingZeros64(x|1) / 8 // 0..7 + out[i] = byte(8 - i) + return out[i:] +} + +func be64enc(b []byte, x uint64) { + _ = b[7] + b[0] = byte(x >> 56) + b[1] = byte(x >> 48) + b[2] = byte(x >> 40) + b[3] = byte(x >> 32) + b[4] = byte(x >> 24) + b[5] = byte(x >> 16) + b[6] = byte(x >> 8) + b[7] = byte(x) +} diff --git a/shake_test.go b/shake_test.go new file mode 100644 index 0000000..af1788c --- /dev/null +++ b/shake_test.go @@ -0,0 +1,124 @@ +package keccak + +import ( + "bytes" + "fmt" + "testing" +) + +func TestShake(t *testing.T) { + tests := []struct { + function string + F, S []byte + input string + digest string + }{ + { + function: "shake128", + digest: "027cfb9e61ea1419dfce3b48e6bcb0b6b692fa2904751e5391c9ed468e010d5946f6f7c2be344c3ac2d722d96cf2a9a115681e22fcb43fd162a830b2079b527b", + }, + { + function: "shake256", + digest: "f08a3125f880d9a58e0603ed5ae3778d33b8ccc795e0c18c9b9d735caa079440c6ab577eca4e0d898d966c4b730aee69307af26e459a0332367129476c381817", + }, + + { + function: "shake256", + input: "odd output", + digest: "678cc171bbc31a40c50d5e", + }, + + { + function: "cshake256", + F: []byte("FunctionName"), + S: []byte("CustomizationString"), + digest: "e80473cc7466ed4de29611752502ab9c5597818d", + }, + } + for _, tt := range tests { + want := tt.digest + var sh *Shake + switch tt.function { + case "shake128": + sh = NewShake128(nil, nil) + case "shake256": + sh = NewShake256(nil, nil) + case "cshake256": + sh = NewShake256(tt.F, tt.S) + } + if tt.input == "" { + sh.Write([]byte("hello keccak")) + } else { + sh.Write([]byte(tt.input)) + } + out := make([]byte, len(want)/2) + sh.Read(out) + got := fmt.Sprintf("%x", out) + if want != got { + t.Errorf("%s: got %s want %s", tt.function, got, want) + } + } +} + +func TestShakeNIST(t *testing.T) { + sh := NewShake256(nil, nil) + want := shake256_digest_m0[:] + out := make([]byte, len(want)) + n, err := sh.Read(out) + if n != len(out) || err != nil { + t.Errorf("unexpected return value: want (0, nil) got (%v,%v)", n, err) + } + if !bytes.Equal(want, out) { + t.Errorf("hash output:\nwant %x\ngot %x", want, out) + for i := range want { + if want[i] != out[i] { + t.Logf("note: first difference is at index %d", i) + break + } + } + } +} + +// NIST test vector +var shake256_digest_m0 = [...]byte{ + 0x46, 0xB9, 0xDD, 0x2B, 0x0B, 0xA8, 0x8D, 0x13, 0x23, 0x3B, 0x3F, 0xEB, 0x74, + 0x3E, 0xEB, 0x24, 0x3F, 0xCD, 0x52, 0xEA, 0x62, 0xB8, 0x1B, 0x82, 0xB5, 0x0C, + 0x27, 0x64, 0x6E, 0xD5, 0x76, 0x2F, 0xD7, 0x5D, 0xC4, 0xDD, 0xD8, 0xC0, 0xF2, + 0x00, 0xCB, 0x05, 0x01, 0x9D, 0x67, 0xB5, 0x92, 0xF6, 0xFC, 0x82, 0x1C, 0x49, + 0x47, 0x9A, 0xB4, 0x86, 0x40, 0x29, 0x2E, 0xAC, 0xB3, 0xB7, 0xC4, 0xBE, 0x14, + 0x1E, 0x96, 0x61, 0x6F, 0xB1, 0x39, 0x57, 0x69, 0x2C, 0xC7, 0xED, 0xD0, 0xB4, + 0x5A, 0xE3, 0xDC, 0x07, 0x22, 0x3C, 0x8E, 0x92, 0x93, 0x7B, 0xEF, 0x84, 0xBC, + 0x0E, 0xAB, 0x86, 0x28, 0x53, 0x34, 0x9E, 0xC7, 0x55, 0x46, 0xF5, 0x8F, 0xB7, + 0xC2, 0x77, 0x5C, 0x38, 0x46, 0x2C, 0x50, 0x10, 0xD8, 0x46, 0xC1, 0x85, 0xC1, + 0x51, 0x11, 0xE5, 0x95, 0x52, 0x2A, 0x6B, 0xCD, 0x16, 0xCF, 0x86, 0xF3, 0xD1, + 0x22, 0x10, 0x9E, 0x3B, 0x1F, 0xDD, 0x94, 0x3B, 0x6A, 0xEC, 0x46, 0x8A, 0x2D, + 0x62, 0x1A, 0x7C, 0x06, 0xC6, 0xA9, 0x57, 0xC6, 0x2B, 0x54, 0xDA, 0xFC, 0x3B, + 0xE8, 0x75, 0x67, 0xD6, 0x77, 0x23, 0x13, 0x95, 0xF6, 0x14, 0x72, 0x93, 0xB6, + 0x8C, 0xEA, 0xB7, 0xA9, 0xE0, 0xC5, 0x8D, 0x86, 0x4E, 0x8E, 0xFD, 0xE4, 0xE1, + 0xB9, 0xA4, 0x6C, 0xBE, 0x85, 0x47, 0x13, 0x67, 0x2F, 0x5C, 0xAA, 0xAE, 0x31, + 0x4E, 0xD9, 0x08, 0x3D, 0xAB, 0x4B, 0x09, 0x9F, 0x8E, 0x30, 0x0F, 0x01, 0xB8, + 0x65, 0x0F, 0x1F, 0x4B, 0x1D, 0x8F, 0xCF, 0x3F, 0x3C, 0xB5, 0x3F, 0xB8, 0xE9, + 0xEB, 0x2E, 0xA2, 0x03, 0xBD, 0xC9, 0x70, 0xF5, 0x0A, 0xE5, 0x54, 0x28, 0xA9, + 0x1F, 0x7F, 0x53, 0xAC, 0x26, 0x6B, 0x28, 0x41, 0x9C, 0x37, 0x78, 0xA1, 0x5F, + 0xD2, 0x48, 0xD3, 0x39, 0xED, 0xE7, 0x85, 0xFB, 0x7F, 0x5A, 0x1A, 0xAA, 0x96, + 0xD3, 0x13, 0xEA, 0xCC, 0x89, 0x09, 0x36, 0xC1, 0x73, 0xCD, 0xCD, 0x0F, 0xAB, + 0x88, 0x2C, 0x45, 0x75, 0x5F, 0xEB, 0x3A, 0xED, 0x96, 0xD4, 0x77, 0xFF, 0x96, + 0x39, 0x0B, 0xF9, 0xA6, 0x6D, 0x13, 0x68, 0xB2, 0x08, 0xE2, 0x1F, 0x7C, 0x10, + 0xD0, 0x4A, 0x3D, 0xBD, 0x4E, 0x36, 0x06, 0x33, 0xE5, 0xDB, 0x4B, 0x60, 0x26, + 0x01, 0xC1, 0x4C, 0xEA, 0x73, 0x7D, 0xB3, 0xDC, 0xF7, 0x22, 0x63, 0x2C, 0xC7, + 0x78, 0x51, 0xCB, 0xDD, 0xE2, 0xAA, 0xF0, 0xA3, 0x3A, 0x07, 0xB3, 0x73, 0x44, + 0x5D, 0xF4, 0x90, 0xCC, 0x8F, 0xC1, 0xE4, 0x16, 0x0F, 0xF1, 0x18, 0x37, 0x8F, + 0x11, 0xF0, 0x47, 0x7D, 0xE0, 0x55, 0xA8, 0x1A, 0x9E, 0xDA, 0x57, 0xA4, 0xA2, + 0xCF, 0xB0, 0xC8, 0x39, 0x29, 0xD3, 0x10, 0x91, 0x2F, 0x72, 0x9E, 0xC6, 0xCF, + 0xA3, 0x6C, 0x6A, 0xC6, 0xA7, 0x58, 0x37, 0x14, 0x30, 0x45, 0xD7, 0x91, 0xCC, + 0x85, 0xEF, 0xF5, 0xB2, 0x19, 0x32, 0xF2, 0x38, 0x61, 0xBC, 0xF2, 0x3A, 0x52, + 0xB5, 0xDA, 0x67, 0xEA, 0xF7, 0xBA, 0xAE, 0x0F, 0x5F, 0xB1, 0x36, 0x9D, 0xB7, + 0x8F, 0x3A, 0xC4, 0x5F, 0x8C, 0x4A, 0xC5, 0x67, 0x1D, 0x85, 0x73, 0x5C, 0xDD, + 0xDB, 0x09, 0xD2, 0xB1, 0xE3, 0x4A, 0x1F, 0xC0, 0x66, 0xFF, 0x4A, 0x16, 0x2C, + 0xB2, 0x63, 0xD6, 0x54, 0x12, 0x74, 0xAE, 0x2F, 0xCC, 0x86, 0x5F, 0x61, 0x8A, + 0xBE, 0x27, 0xC1, 0x24, 0xCD, 0x8B, 0x07, 0x4C, 0xCD, 0x51, 0x63, 0x01, 0xB9, + 0x18, 0x75, 0x82, 0x4D, 0x09, 0x95, 0x8F, 0x34, 0x1E, 0xF2, 0x74, 0xBD, 0xAB, + 0x0B, 0xAE, 0x31, 0x63, 0x39, 0x89, 0x43, 0x04, 0xE3, 0x58, 0x77, 0xB0, 0xC2, + 0x8A, 0x9B, 0x1F, 0xD1, 0x66, 0xC7, 0x96, 0xB9, 0xCC, 0x25, 0x8A, 0x06, 0x4A, + 0x8F, 0x57, 0xE2, 0x7F, 0x2A, +}