kpqc 0.1.0 → 0.2.0

data/vendor/NTRUplus/NTRU+1152/fips202/fips202.c

@@ -5,6 +5,8 @@
  * from https://twitter.com/tweetfips202
  * by Gilles Van Assche, Daniel J. Bernstein, and Peter Schwabe */
 
+#include "util.h"
+
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
@@ -14,13 +16,6 @@
 #define NROUNDS 24
 #define ROL(a, offset) (((a) << (offset)) ^ ((a) >> (64 - (offset))))
 
-static void clear_state(uint64_t *state, size_t words) {
-    volatile uint64_t *p = state;
-    while (words-- > 0) {
-        *p++ = 0;
-    }
-}
-
 /*************************************************
  * Name:        load64
  *
@@ -346,7 +341,7 @@ static void KeccakF1600_StatePermute(uint64_t *state) {
  *              non-incremental, starts by zeroeing the state.
  *
  * Arguments:   - uint64_t *s: pointer to (uninitialized) output Keccak state
- *              - uint32_t r: rate in bytes (e.g., 168 for SHAKE128)
+ *              - uint32_t r: rate in bytes (e.g., 136 for SHAKE256)
  *              - const uint8_t *m: pointer to input to be absorbed into s
  *              - size_t mlen: length of input in bytes
  *              - uint8_t p: domain-separation byte for different
@@ -383,6 +378,7 @@ static void keccak_absorb(uint64_t *s, uint32_t r, const uint8_t *m,
     for (i = 0; i < r / 8; ++i) {
         s[i] ^= load64(t + 8 * i);
     }
+    secure_clear(t, sizeof t);
 }
 
 /*************************************************
@@ -396,7 +392,7 @@ static void keccak_absorb(uint64_t *s, uint32_t r, const uint8_t *m,
  *              - size_t nblocks: number of blocks to be
  *                                                squeezed (written to h)
  *              - uint64_t *s: pointer to input/output Keccak state
- *              - uint32_t r: rate in bytes (e.g., 168 for SHAKE128)
+ *              - uint32_t r: rate in bytes (e.g., 136 for SHAKE256)
  **************************************************/
 static void keccak_squeezeblocks(uint8_t *h, size_t nblocks,
                                  uint64_t *s, uint32_t r) {
@@ -439,7 +435,7 @@ static void keccak_inc_init(uint64_t *s_inc) {
  *                First 25 values represent Keccak state.
  *                26th value represents either the number of absorbed bytes
  *                that have not been permuted, or not-yet-squeezed bytes.
- *              - uint32_t r: rate in bytes (e.g., 168 for SHAKE128)
+ *              - uint32_t r: rate in bytes (e.g., 136 for SHAKE256)
  *              - const uint8_t *m: pointer to input to be absorbed into s
  *              - size_t mlen: length of input in bytes
  **************************************************/
@@ -476,7 +472,7 @@ static void keccak_inc_absorb(uint64_t *s_inc, uint32_t r, const uint8_t *m,
  *                First 25 values represent Keccak state.
  *                26th value represents either the number of absorbed bytes
  *                that have not been permuted, or not-yet-squeezed bytes.
- *              - uint32_t r: rate in bytes (e.g., 168 for SHAKE128)
+ *              - uint32_t r: rate in bytes (e.g., 136 for SHAKE256)
  *              - uint8_t p: domain-separation byte for different
  *                                 Keccak-derived functions
  **************************************************/
@@ -499,7 +495,7 @@ static void keccak_inc_finalize(uint64_t *s_inc, uint32_t r, uint8_t p) {
  *                First 25 values represent Keccak state.
  *                26th value represents either the number of absorbed bytes
  *                that have not been permuted, or not-yet-squeezed bytes.
- *              - uint32_t r: rate in bytes (e.g., 168 for SHAKE128)
+ *              - uint32_t r: rate in bytes (e.g., 136 for SHAKE256)
  **************************************************/
 static void keccak_inc_squeeze(uint8_t *h, size_t outlen,
                                uint64_t *s_inc, uint32_t r) {
@@ -528,30 +524,6 @@ static void keccak_inc_squeeze(uint8_t *h, size_t outlen,
     }
 }
 
-void shake128_inc_init(shake128incctx *state) {
-    keccak_inc_init(state->ctx);
-}
-
-void shake128_inc_absorb(shake128incctx *state, const uint8_t *input, size_t inlen) {
-    keccak_inc_absorb(state->ctx, SHAKE128_RATE, input, inlen);
-}
-
-void shake128_inc_finalize(shake128incctx *state) {
-    keccak_inc_finalize(state->ctx, SHAKE128_RATE, 0x1F);
-}
-
-void shake128_inc_squeeze(uint8_t *output, size_t outlen, shake128incctx *state) {
-    keccak_inc_squeeze(output, outlen, state->ctx, SHAKE128_RATE);
-}
-
-void shake128_inc_ctx_clone(shake128incctx *dest, const shake128incctx *src) {
-    memcpy(dest->ctx, src->ctx, PQC_SHAKEINCCTX_BYTES);
-}
-
-void shake128_inc_ctx_release(shake128incctx *state) {
-    clear_state(state->ctx, 26);
-}
-
 void shake256_inc_init(shake256incctx *state) {
     keccak_inc_init(state->ctx);
 }
@@ -573,47 +545,7 @@ void shake256_inc_ctx_clone(shake256incctx *dest, const shake256incctx *src) {
 }
 
 void shake256_inc_ctx_release(shake256incctx *state) {
-    clear_state(state->ctx, 26);
-}
-
-/*************************************************
- * Name:        shake128_absorb
- *
- * Description: Absorb step of the SHAKE128 XOF.
- *              non-incremental, starts by zeroeing the state.
- *
- * Arguments:   - uint64_t *s: pointer to (uninitialized) output Keccak state
- *              - const uint8_t *input: pointer to input to be absorbed
- *                                            into s
- *              - size_t inlen: length of input in bytes
- **************************************************/
-void shake128_absorb(shake128ctx *state, const uint8_t *input, size_t inlen) {
-    keccak_absorb(state->ctx, SHAKE128_RATE, input, inlen, 0x1F);
-}
-
-/*************************************************
- * Name:        shake128_squeezeblocks
- *
- * Description: Squeeze step of SHAKE128 XOF. Squeezes full blocks of
- *              SHAKE128_RATE bytes each. Modifies the state. Can be called
- *              multiple times to keep squeezing, i.e., is incremental.
- *
- * Arguments:   - uint8_t *output: pointer to output blocks
- *              - size_t nblocks: number of blocks to be squeezed
- *                                            (written to output)
- *              - shake128ctx *state: pointer to input/output Keccak state
- **************************************************/
-void shake128_squeezeblocks(uint8_t *output, size_t nblocks, shake128ctx *state) {
-    keccak_squeezeblocks(output, nblocks, state->ctx, SHAKE128_RATE);
-}
-
-void shake128_ctx_clone(shake128ctx *dest, const shake128ctx *src) {
-    memcpy(dest->ctx, src->ctx, PQC_SHAKECTX_BYTES);
-}
-
-/** Release the allocated state. Call only once. */
-void shake128_ctx_release(shake128ctx *state) {
-    clear_state(state->ctx, 25);
+    secure_clear(state->ctx, PQC_SHAKEINCCTX_BYTES);
 }
 
 /*************************************************
@@ -651,40 +583,9 @@ void shake256_ctx_clone(shake256ctx *dest, const shake256ctx *src) {
     memcpy(dest->ctx, src->ctx, PQC_SHAKECTX_BYTES);
 }
 
-/** Release the allocated state. Call only once. */
+/** Clear the state. */
 void shake256_ctx_release(shake256ctx *state) {
-    clear_state(state->ctx, 25);
-}
-
-/*************************************************
- * Name:        shake128
- *
- * Description: SHAKE128 XOF with non-incremental API
- *
- * Arguments:   - uint8_t *output: pointer to output
- *              - size_t outlen: requested output length in bytes
- *              - const uint8_t *input: pointer to input
- *              - size_t inlen: length of input in bytes
- **************************************************/
-void shake128(uint8_t *output, size_t outlen,
-              const uint8_t *input, size_t inlen) {
-    size_t nblocks = outlen / SHAKE128_RATE;
-    uint8_t t[SHAKE128_RATE];
-    shake128ctx s;
-
-    shake128_absorb(&s, input, inlen);
-    shake128_squeezeblocks(output, nblocks, &s);
-
-    output += nblocks * SHAKE128_RATE;
-    outlen -= nblocks * SHAKE128_RATE;
-
-    if (outlen) {
-        shake128_squeezeblocks(t, 1, &s);
-        for (size_t i = 0; i < outlen; ++i) {
-            output[i] = t[i];
-        }
-    }
-    shake128_ctx_release(&s);
+    secure_clear(state->ctx, PQC_SHAKECTX_BYTES);
 }
 
 /*************************************************
@@ -715,164 +616,6 @@ void shake256(uint8_t *output, size_t outlen,
             output[i] = t[i];
         }
     }
+    secure_clear(t, sizeof(t));
     shake256_ctx_release(&s);
 }
-
-void sha3_256_inc_init(sha3_256incctx *state) {
-    keccak_inc_init(state->ctx);
-}
-
-void sha3_256_inc_ctx_clone(sha3_256incctx *dest, const sha3_256incctx *src) {
-    memcpy(dest->ctx, src->ctx, PQC_SHAKEINCCTX_BYTES);
-}
-
-void sha3_256_inc_ctx_release(sha3_256incctx *state) {
-    clear_state(state->ctx, 26);
-}
-
-void sha3_256_inc_absorb(sha3_256incctx *state, const uint8_t *input, size_t inlen) {
-    keccak_inc_absorb(state->ctx, SHA3_256_RATE, input, inlen);
-}
-
-void sha3_256_inc_finalize(uint8_t *output, sha3_256incctx *state) {
-    uint8_t t[SHA3_256_RATE];
-    keccak_inc_finalize(state->ctx, SHA3_256_RATE, 0x06);
-
-    keccak_squeezeblocks(t, 1, state->ctx, SHA3_256_RATE);
-
-    sha3_256_inc_ctx_release(state);
-
-    for (size_t i = 0; i < 32; i++) {
-        output[i] = t[i];
-    }
-}
-
-/*************************************************
- * Name:        sha3_256
- *
- * Description: SHA3-256 with non-incremental API
- *
- * Arguments:   - uint8_t *output:      pointer to output
- *              - const uint8_t *input: pointer to input
- *              - size_t inlen:   length of input in bytes
- **************************************************/
-void sha3_256(uint8_t *output, const uint8_t *input, size_t inlen) {
-    uint64_t s[25];
-    uint8_t t[SHA3_256_RATE];
-
-    /* Absorb input */
-    keccak_absorb(s, SHA3_256_RATE, input, inlen, 0x06);
-
-    /* Squeeze output */
-    keccak_squeezeblocks(t, 1, s, SHA3_256_RATE);
-
-    for (size_t i = 0; i < 32; i++) {
-        output[i] = t[i];
-    }
-}
-
-void sha3_384_inc_init(sha3_384incctx *state) {
-    keccak_inc_init(state->ctx);
-}
-
-void sha3_384_inc_ctx_clone(sha3_384incctx *dest, const sha3_384incctx *src) {
-    memcpy(dest->ctx, src->ctx, PQC_SHAKEINCCTX_BYTES);
-}
-
-void sha3_384_inc_absorb(sha3_384incctx *state, const uint8_t *input, size_t inlen) {
-    keccak_inc_absorb(state->ctx, SHA3_384_RATE, input, inlen);
-}
-
-void sha3_384_inc_ctx_release(sha3_384incctx *state) {
-    clear_state(state->ctx, 26);
-}
-
-void sha3_384_inc_finalize(uint8_t *output, sha3_384incctx *state) {
-    uint8_t t[SHA3_384_RATE];
-    keccak_inc_finalize(state->ctx, SHA3_384_RATE, 0x06);
-
-    keccak_squeezeblocks(t, 1, state->ctx, SHA3_384_RATE);
-
-    sha3_384_inc_ctx_release(state);
-
-    for (size_t i = 0; i < 48; i++) {
-        output[i] = t[i];
-    }
-}
-
-/*************************************************
- * Name:        sha3_384
- *
- * Description: SHA3-256 with non-incremental API
- *
- * Arguments:   - uint8_t *output:      pointer to output
- *              - const uint8_t *input: pointer to input
- *              - size_t inlen:   length of input in bytes
- **************************************************/
-void sha3_384(uint8_t *output, const uint8_t *input, size_t inlen) {
-    uint64_t s[25];
-    uint8_t t[SHA3_384_RATE];
-
-    /* Absorb input */
-    keccak_absorb(s, SHA3_384_RATE, input, inlen, 0x06);
-
-    /* Squeeze output */
-    keccak_squeezeblocks(t, 1, s, SHA3_384_RATE);
-
-    for (size_t i = 0; i < 48; i++) {
-        output[i] = t[i];
-    }
-}
-
-void sha3_512_inc_init(sha3_512incctx *state) {
-    keccak_inc_init(state->ctx);
-}
-
-void sha3_512_inc_ctx_clone(sha3_512incctx *dest, const sha3_512incctx *src) {
-    memcpy(dest->ctx, src->ctx, PQC_SHAKEINCCTX_BYTES);
-}
-
-void sha3_512_inc_absorb(sha3_512incctx *state, const uint8_t *input, size_t inlen) {
-    keccak_inc_absorb(state->ctx, SHA3_512_RATE, input, inlen);
-}
-
-void sha3_512_inc_ctx_release(sha3_512incctx *state) {
-    clear_state(state->ctx, 26);
-}
-
-void sha3_512_inc_finalize(uint8_t *output, sha3_512incctx *state) {
-    uint8_t t[SHA3_512_RATE];
-    keccak_inc_finalize(state->ctx, SHA3_512_RATE, 0x06);
-
-    keccak_squeezeblocks(t, 1, state->ctx, SHA3_512_RATE);
-
-    sha3_512_inc_ctx_release(state);
-
-    for (size_t i = 0; i < 64; i++) {
-        output[i] = t[i];
-    }
-}
-
-/*************************************************
- * Name:        sha3_512
- *
- * Description: SHA3-512 with non-incremental API
- *
- * Arguments:   - uint8_t *output:      pointer to output
- *              - const uint8_t *input: pointer to input
- *              - size_t inlen:   length of input in bytes
- **************************************************/
-void sha3_512(uint8_t *output, const uint8_t *input, size_t inlen) {
-    uint64_t s[25];
-    uint8_t t[SHA3_512_RATE];
-
-    /* Absorb input */
-    keccak_absorb(s, SHA3_512_RATE, input, inlen, 0x06);
-
-    /* Squeeze output */
-    keccak_squeezeblocks(t, 1, s, SHA3_512_RATE);
-
-    for (size_t i = 0; i < 64; i++) {
-        output[i] = t[i];
-    }
-}

data/vendor/NTRUplus/NTRU+1152/fips202/fips202.h

@@ -4,24 +4,10 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#define SHAKE128_RATE 168
 #define SHAKE256_RATE 136
-#define SHA3_256_RATE 136
-#define SHA3_384_RATE 104
-#define SHA3_512_RATE 72
 
-#define PQC_SHAKEINCCTX_BYTES (sizeof(uint64_t)*26)
-#define PQC_SHAKECTX_BYTES (sizeof(uint64_t)*25)
-
-// Context for incremental API
-typedef struct {
-    uint64_t ctx[26];
-} shake128incctx;
-
-// Context for non-incremental API
-typedef struct {
-    uint64_t ctx[25];
-} shake128ctx;
+#define PQC_SHAKEINCCTX_BYTES (sizeof(uint64_t) * 26)
+#define PQC_SHAKECTX_BYTES (sizeof(uint64_t) * 25)
 
 // Context for incremental API
 typedef struct {
@@ -33,56 +19,6 @@ typedef struct {
     uint64_t ctx[25];
 } shake256ctx;
 
-// Context for incremental API
-typedef struct {
-    uint64_t ctx[26];
-} sha3_256incctx;
-
-// Context for incremental API
-typedef struct {
-    uint64_t ctx[26];
-} sha3_384incctx;
-
-// Context for incremental API
-typedef struct {
-    uint64_t ctx[26];
-} sha3_512incctx;
-
-/* Initialize the state and absorb the provided input.
- *
- * This function does not support being called multiple times
- * with the same state.
- */
-void shake128_absorb(shake128ctx *state, const uint8_t *input, size_t inlen);
-/* Squeeze output out of the sponge.
- *
- * Supports being called multiple times
- */
-void shake128_squeezeblocks(uint8_t *output, size_t nblocks, shake128ctx *state);
-/* Free the state */
-void shake128_ctx_release(shake128ctx *state);
-/* Copy the state. */
-void shake128_ctx_clone(shake128ctx *dest, const shake128ctx *src);
-
-/* Initialize incremental hashing API */
-void shake128_inc_init(shake128incctx *state);
-/* Absorb more information into the XOF.
- *
- * Can be called multiple times.
- */
-void shake128_inc_absorb(shake128incctx *state, const uint8_t *input, size_t inlen);
-/* Finalize the XOF for squeezing */
-void shake128_inc_finalize(shake128incctx *state);
-/* Squeeze output out of the sponge.
- *
- * Supports being called multiple times
- */
-void shake128_inc_squeeze(uint8_t *output, size_t outlen, shake128incctx *state);
-/* Copy the context of the SHAKE128 XOF */
-void shake128_inc_ctx_clone(shake128incctx *dest, const shake128incctx *src);
-/* Free the context of the SHAKE128 XOF */
-void shake128_inc_ctx_release(shake128incctx *state);
-
 /* Initialize the state and absorb the provided input.
  *
  * This function does not support being called multiple times
@@ -94,7 +30,7 @@ void shake256_absorb(shake256ctx *state, const uint8_t *input, size_t inlen);
  * Supports being called multiple times
  */
 void shake256_squeezeblocks(uint8_t *output, size_t nblocks, shake256ctx *state);
-/* Free the context held by this XOF */
+/* Clear the context held by this XOF */
 void shake256_ctx_release(shake256ctx *state);
 /* Copy the context held by this XOF */
 void shake256_ctx_clone(shake256ctx *dest, const shake256ctx *src);
@@ -111,56 +47,11 @@ void shake256_inc_finalize(shake256incctx *state);
 void shake256_inc_squeeze(uint8_t *output, size_t outlen, shake256incctx *state);
 /* Copy the state */
 void shake256_inc_ctx_clone(shake256incctx *dest, const shake256incctx *src);
-/* Free the state */
+/* Clear the state */
 void shake256_inc_ctx_release(shake256incctx *state);
 
-/* One-stop SHAKE128 call */
-void shake128(uint8_t *output, size_t outlen,
-              const uint8_t *input, size_t inlen);
-
 /* One-stop SHAKE256 call */
 void shake256(uint8_t *output, size_t outlen,
               const uint8_t *input, size_t inlen);
 
-/* Initialize the incremental hashing state */
-void sha3_256_inc_init(sha3_256incctx *state);
-/* Absorb blocks into SHA3 */
-void sha3_256_inc_absorb(sha3_256incctx *state, const uint8_t *input, size_t inlen);
-/* Obtain the output of the function and free `state` */
-void sha3_256_inc_finalize(uint8_t *output, sha3_256incctx *state);
-/* Copy the context */
-void sha3_256_inc_ctx_clone(sha3_256incctx *dest, const sha3_256incctx *src);
-/* Release the state, don't use if `_finalize` has been used */
-void sha3_256_inc_ctx_release(sha3_256incctx *state);
-
-void sha3_256(uint8_t *output, const uint8_t *input, size_t inlen);
-
-/* Initialize the incremental hashing state */
-void sha3_384_inc_init(sha3_384incctx *state);
-/* Absorb blocks into SHA3 */
-void sha3_384_inc_absorb(sha3_384incctx *state, const uint8_t *input, size_t inlen);
-/* Obtain the output of the function and free `state` */
-void sha3_384_inc_finalize(uint8_t *output, sha3_384incctx *state);
-/* Copy the context */
-void sha3_384_inc_ctx_clone(sha3_384incctx *dest, const sha3_384incctx *src);
-/* Release the state, don't use if `_finalize` has been used */
-void sha3_384_inc_ctx_release(sha3_384incctx *state);
-
-/* One-stop SHA3-384 shop */
-void sha3_384(uint8_t *output, const uint8_t *input, size_t inlen);
-
-/* Initialize the incremental hashing state */
-void sha3_512_inc_init(sha3_512incctx *state);
-/* Absorb blocks into SHA3 */
-void sha3_512_inc_absorb(sha3_512incctx *state, const uint8_t *input, size_t inlen);
-/* Obtain the output of the function and free `state` */
-void sha3_512_inc_finalize(uint8_t *output, sha3_512incctx *state);
-/* Copy the context */
-void sha3_512_inc_ctx_clone(sha3_512incctx *dest, const sha3_512incctx *src);
-/* Release the state, don't use if `_finalize` has been used */
-void sha3_512_inc_ctx_release(sha3_512incctx *state);
-
-/* One-stop SHA3-512 shop */
-void sha3_512(uint8_t *output, const uint8_t *input, size_t inlen);
-
 #endif