-
Notifications
You must be signed in to change notification settings - Fork 1
/
shake128.hpp
85 lines (72 loc) · 2.6 KB
/
shake128.hpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
#pragma once
#include "sponge.hpp"
// SHAKE128 Extendable Output Function : Keccak[256](M || 1111, d)
namespace shake128 {
// Width of capacity portion of the sponge, in bits.
constexpr size_t CAPACITY = 256;
// Width of rate portion of the sponge, in bits.
constexpr size_t RATE = 1600 - CAPACITY;
// Domain separator bits, used for finalization.
constexpr uint8_t DOM_SEP = 0b00001111;
// Bit-width of domain separator, starting from least significant bit.
constexpr size_t DOM_SEP_BW = 4;
// SHAKE128 Extendable Output Function (Xof)
//
// See SHA3 extendable output function definition in section 6.2 of SHA3
// specification https://dx.doi.org/10.6028/NIST.FIPS.202
struct shake128_t
{
private:
uint64_t state[keccak::LANE_CNT]{};
size_t offset = 0;
alignas(4) bool finalized = false; // all message bytes absorbed ?
size_t squeezable = 0;
public:
inline constexpr shake128_t() = default;
// Given N -many bytes input message, this routine consumes those into
// keccak[256] sponge state.
//
// Note, this routine can be called arbitrary number of times, each time with
// arbitrary bytes of input message, until keccak[256] state is finalized ( by
// calling routine with similar name ). Once the sponge is finalized, it can't
// absorb any more message bytes.
inline constexpr void absorb(std::span<const uint8_t> msg)
{
if (!finalized) {
sponge::absorb<RATE>(state, offset, msg);
}
}
// After consuming arbitrary many input bytes, this routine is invoked when
// no more input bytes remaining to be consumed by keccak[256] state.
//
// Note, once this routine is called, calling absorb() or finalize() again, on
// same SHAKE128 object, doesn't do anything. After finalization, one might
// intend to read arbitrary many bytes by squeezing sponge, which is done by
// calling read() function, as many times required.
inline constexpr void finalize()
{
if (!finalized) {
sponge::finalize<DOM_SEP, DOM_SEP_BW, RATE>(state, offset);
finalized = true;
squeezable = RATE / 8;
}
}
// After sponge state is finalized, arbitrary many output bytes can be
// squeezed by calling this function any number of times required.
inline constexpr void squeeze(std::span<uint8_t> dig)
{
if (finalized) {
sponge::squeeze<RATE>(state, squeezable, dig);
}
}
// Reset the internal state of the Shake128-Xof hasher, now it can again be
// used for another absorb->finalize->squeeze cycle.
inline constexpr void reset()
{
std::fill(std::begin(state), std::end(state), 0);
offset = 0;
finalized = false;
squeezable = 0;
}
};
}