sleeping_kangaroo12 0.0.1

data/ext/xkcp/lib/high/Kravatte/KravatteModes.h

@@ -0,0 +1,247 @@
+/*
+The eXtended Keccak Code Package (XKCP)
+https://github.com/XKCP/XKCP
+
+Kravatte, designed by Guido Bertoni, Joan Daemen, Seth Hoffert, Michaël Peeters, Gilles Van Assche and Ronny Van Keer.
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+For more information, feedback or questions, please refer to the Keccak Team website:
+https://keccak.team/
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#ifndef _KravatteModes_h_
+#define _KravatteModes_h_
+
+#include "config.h"
+#ifdef XKCP_has_KeccakP1600
+
+#include <stddef.h>
+#include <stdint.h>
+#include "align.h"
+#include "Kravatte.h"
+
+/**
+  * Kravatte-SANE Tag Length in bytes.
+  */
+#define Kravatte_SANE_TagLength      16
+
+/**
+  * Definition of the constant l.
+  */
+#define Kravatte_SANE_l              8
+
+typedef struct {
+    Kravatte_Instance   kravatte;
+    unsigned int        e;
+} Kravatte_SANE_Instance;
+
+
+/**
+  * Function to initialize a Kravatte SANE instance with given key and nonce.
+  * @param  kvInstance      Pointer to the instance to be initialized.
+  * @param  Key             Pointer to the key (K).
+  * @param  KeyBitLen       The length of the key in bits.
+  * @param  Nonce           Pointer to the nonce (N).
+  * @param  NonceBitLen     The length of the nonce in bits.
+  * @param  tag             The buffer where to store the tag.
+  *                         This buffer must be minimum Kravatte_SANE_TagLength bytes long.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANE_Initialize(Kravatte_SANE_Instance *kvInstance, const BitSequence *Key, BitLength KeyBitLen, 
+                            const BitSequence *Nonce, BitLength NonceBitLen, unsigned char *tag);
+
+/**
+  * Function to wrap plaintext into ciphertext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_SANE_Initialize().
+  * @param  plaintext       Pointer to plaintext data to wrap.
+  * @param  ciphertext      Pointer to buffer where the full wrapped data will be stored.
+  *                         The ciphertext buffer must not overlap plaintext.
+  * @param  dataBitLen      The size of the plaintext/ciphertext data.
+  * @param  AD              Pointer to the Associated Data.
+  * @param  ADBitLen        The number of bytes provided in the Associated Data.
+  * @param  tag             The buffer where to store the tag.
+  *                         This buffer must be minimum Kravatte_SANE_TagLength bytes long.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANE_Wrap(Kravatte_SANE_Instance *kvInstance, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen, unsigned char *tag);
+
+/**
+  * Function to unwrap ciphertext into plaintext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_SANE_Initialize().
+  * @param  ciphertext      Pointer to ciphertext data to unwrap.
+  * @param  plaintext       Pointer to buffer where the full unwrapped data will be stored.
+  *                         The plaintext buffer must not overlap ciphertext.
+  * @param  dataBitLen      The size of the ciphertext/plaintext data.
+  * @param  AD              Pointer to the Associated Data.
+  * @param  ADBitLen        The number of bytes provided in the Associated Data.
+  * @param  tag             The buffer where to read the tag to check (when lastFlag is set).
+  *                         This buffer must be minimum Kravatte_SANE_TagLength bytes long.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANE_Unwrap(Kravatte_SANE_Instance *kvInstance, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                            const BitSequence *AD, BitLength ADBitLen, const unsigned char *tag);
+
+/* ------------------------------------------------------------------------- */
+
+/**
+  * Kravatte-SANSE Tag Length in bytes.
+  */
+#define Kravatte_SANSE_TagLength      32
+
+typedef struct {
+    Kravatte_Instance   kravatte;
+    unsigned int        e;
+} Kravatte_SANSE_Instance;
+
+
+/**
+  * Function to initialize a Kravatte SANSE instance with given key and nonce.
+  * @param  kvInstance      Pointer to the instance to be initialized.
+  * @param  Key             Pointer to the key (K).
+  * @param  KeyBitLen       The length of the key in bits.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANSE_Initialize(Kravatte_SANSE_Instance *kvInstance, const BitSequence *Key, BitLength KeyBitLen);
+
+/**
+  * Function to wrap plaintext into ciphertext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_SANSE_Initialize().
+  * @param  plaintext       Pointer to plaintext data to wrap.
+  * @param  ciphertext      Pointer to buffer where the full wrapped data will be stored.
+  *                         The ciphertext buffer must not overlap plaintext.
+  * @param  dataBitLen      The size of the plaintext/ciphertext data.
+  * @param  AD              Pointer to the Associated Data.
+  * @param  ADBitLen        The number of bytes provided in the Associated Data.
+  * @param  tag             The buffer where to store the tag.
+  *                         This buffer must be minimum Kravatte_SANSE_TagLength bytes long.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANSE_Wrap(Kravatte_SANSE_Instance *kvInstance, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen, unsigned char *tag);
+
+/**
+  * Function to unwrap ciphertext into plaintext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_SANSE_Initialize().
+  * @param  ciphertext      Pointer to ciphertext data to unwrap.
+  * @param  plaintext       Pointer to buffer where the full unwrapped data will be stored.
+  *                         The plaintext buffer must not overlap ciphertext.
+  * @param  dataBitLen      The size of the ciphertext/plaintext data.
+  * @param  AD              Pointer to the Associated Data.
+  * @param  ADBitLen        The number of bytes provided in the Associated Data.
+  * @param  tag             The buffer where to read the tag to check (when lastFlag is set).
+  *                         This buffer must be minimum Kravatte_SANSE_TagLength bytes long.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_SANSE_Unwrap(Kravatte_SANSE_Instance *kvInstance, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                            const BitSequence *AD, BitLength ADBitLen, const unsigned char *tag);
+
+/* ------------------------------------------------------------------------- */
+
+/**
+  * Definition of the constant l, used to split the input into two parts.
+  * The left part of the input will be a multiple of l bits.
+  */
+#define Kravatte_WBC_l      8
+
+/**
+  * Definition of the constant b block length.
+  */
+#define Kravatte_WBC_b      (SnP_widthInBytes*8)
+
+/**
+  * Macro to initialize a Kravatte_WBC instance with given key.
+  * @param  kvw             Pointer to the instance to be initialized.
+  * @param  Key             Pointer to the key (K).
+  * @param  KeyBitLen       The length of the key in bits.
+  * @return 0 if successful, 1 otherwise.
+  */
+#define Kravatte_WBC_Initialize(kvw, Key, KeyBitLen)        Kravatte_MaskDerivation(kvw, Key, KeyBitLen)
+
+/**
+  * Function to encipher plaintext into ciphertext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_WBC_Initialize().
+  * @param  plaintext       Pointer to plaintext data to encipher.
+  * @param  ciphertext      Pointer to buffer where the enciphered data will be stored.
+  *                         The ciphertext buffer must not overlap plaintext.
+  * @param  dataBitLen      The size in bits of the plaintext/ciphertext data.
+  * @param  W               Pointer to the tweak W.
+  * @param  WBitLen         The number of bits provided in the tweak.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_WBC_Encipher(Kravatte_Instance *kvwInstance, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *W, BitLength WBitLen);
+
+/**
+  * Function to decipher ciphertext into plaintext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_WBC_Initialize().
+  * @param  ciphertext      Pointer to ciphertext data to decipher.
+  * @param  plaintext       Pointer to buffer where the deciphered data will be stored.
+  *                         The plaintext buffer must not overlap ciphertext.
+  * @param  dataBitLen      The size in bits of the plaintext/ciphertext data.
+  * @param  W               Pointer to the tweak W.
+  * @param  WBitLen         The number of bits provided in the tweak.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_WBC_Decipher(Kravatte_Instance *kvwInstance, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                        const BitSequence *W, BitLength WBitLen);
+
+/* ------------------------------------------------------------------------- */
+
+/**
+  * Definition of the constant t, expansion length (in bits).
+  */
+#define Kravatte_WBCAE_t      128
+
+/**
+  * Macro to initialize a Kravatte_WBC instance with given key.
+  * @param  kvw             Pointer to the instance to be initialized.
+  * @param  Key             Pointer to the key (K).
+  * @param  KeyBitLen       The length of the key in bits.
+  * @return 0 if successful, 1 otherwise.
+  */
+#define Kravatte_WBCAE_Initialize(kvw, Key, KeyBitLen)      Kravatte_MaskDerivation(kvw, Key, KeyBitLen)
+
+/**
+  * Function to encipher plaintext into ciphertext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_WBC_Initialize().
+  * @param  plaintext       Pointer to plaintext data to encipher.
+  *                         The last ::Kravatte_WBCAE_t bits of the buffer will be overwritten with zeros.
+  * @param  ciphertext      Pointer to buffer where the enciphered data will be stored.
+  *                         The ciphertext buffer must not overlap plaintext.
+  *                         Ciphertext will be ::Kravatte_WBCAE_t bits longer than plaintext.
+  * @param  dataBitLen      The size in bits of the plaintext data.
+  *                         Plaintext and ciphertext buffers must be ::Kravatte_WBCAE_t bits longer than dataBitLen.
+  * @param  AD              Pointer to the metadata AD.
+  * @param  ADBitLen        The number of bits provided in the metadata.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_WBCAE_Encipher(Kravatte_Instance *kvwInstance, BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen);
+
+/**
+  * Function to decipher ciphertext into plaintext.
+  * @param  kvInstance      Pointer to the instance initialized by Kravatte_WBC_Initialize().
+  * @param  ciphertext      Pointer to ciphertext data to decipher.
+  *                         Ciphertext is ::Kravatte_WBCAE_t bits longer than plaintext.
+  * @param  plaintext       Pointer to buffer where the deciphered data will be stored.
+  *                         The plaintext buffer must not overlap ciphertext.
+  * @param  dataBitLen      The size in bits of the plaintext data.
+  *                         Ciphertext and plaintext buffers must be ::Kravatte_WBCAE_t bits longer than dataBitLen.
+  * @param  AD              Pointer to the metadata AD.
+  * @param  ADBitLen        The number of bits provided in the metadata.
+  * @return 0 if successful, 1 otherwise.
+  */
+int Kravatte_WBCAE_Decipher(Kravatte_Instance *kvwInstance, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen);
+
+#else
+#error This requires an implementation of Keccak-p[1600]
+#endif
+
+#endif

data/ext/xkcp/lib/high/Xoodyak/Cyclist.h

@@ -0,0 +1,66 @@
+/*
+The eXtended Keccak Code Package (XKCP)
+https://github.com/XKCP/XKCP
+
+Xoodyak, designed by Joan Daemen, Seth Hoffert, Michaël Peeters, Gilles Van Assche and Ronny Van Keer.
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+For more information, feedback or questions, please refer to the Keccak Team website:
+https://keccak.team/
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#ifndef _Cyclist_h_
+#define _Cyclist_h_
+
+#include <stdint.h>
+#include "align.h"
+
+#define Cyclist_ModeHash    1
+#define Cyclist_ModeKeyed   2
+
+#define Cyclist_PhaseDown   1
+#define Cyclist_PhaseUp     2
+
+#ifdef OUTPUT
+
+#include    <stdio.h>
+
+#define KCP_DeclareCyclistStructure(prefix, size, alignment)                    \
+            ALIGN(alignment) typedef struct prefix##_CyclistInstanceStruct {    \
+            uint8_t         state[size];                                        \
+            uint8_t         stateShadow[size];                                  \
+            FILE            *file;                                              \
+            unsigned int    phase;                                              \
+            unsigned int    mode;                                               \
+            unsigned int    Rabsorb;                                            \
+            unsigned int    Rsqueeze;                                           \
+        } prefix##_Instance;
+
+#else
+
+#define KCP_DeclareCyclistStructure(prefix, size, alignment)                    \
+            ALIGN(alignment) typedef struct prefix##_CyclistInstanceStruct {    \
+            uint8_t         state[size];                                        \
+            unsigned int    phase;                                              \
+            unsigned int    mode;                                               \
+            unsigned int    Rabsorb;                                            \
+            unsigned int    Rsqueeze;                                           \
+        } prefix##_Instance;
+
+#endif
+
+#define KCP_DeclareCyclistFunctions(prefix) \
+    void prefix##_Initialize(prefix##_Instance *instance, const uint8_t *K, size_t KLen, const uint8_t *ID, size_t IDLen, const uint8_t *counter, size_t counterLen); \
+    void prefix##_Absorb(prefix##_Instance *instance, const uint8_t *X, size_t XLen); \
+    void prefix##_Encrypt(prefix##_Instance *instance, const uint8_t *P, uint8_t *C, size_t PLen); \
+    void prefix##_Decrypt(prefix##_Instance *instance, const uint8_t *C, uint8_t *P, size_t CLen); \
+    void prefix##_Squeeze(prefix##_Instance *instance, uint8_t *Y, size_t YLen); \
+    void prefix##_SqueezeKey(prefix##_Instance *instance, uint8_t *K, size_t KLen); \
+    void prefix##_Ratchet(prefix##_Instance *instance);
+
+#endif

data/ext/xkcp/lib/high/Xoodyak/Cyclist.inc

@@ -0,0 +1,336 @@
+/*
+The eXtended Keccak Code Package (XKCP)
+https://github.com/XKCP/XKCP
+
+Xoodyak, designed by Joan Daemen, Seth Hoffert, Michaël Peeters, Gilles Van Assche and Ronny Van Keer.
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+For more information, feedback or questions, please refer to the Keccak Team website:
+https://keccak.team/
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#define JOIN0(a, b)                     a ## b
+#define JOIN(a, b)                      JOIN0(a, b)
+
+#define SnP_StaticInitialize            JOIN(SnP, _StaticInitialize)
+#define SnP_Initialize                  JOIN(SnP, _Initialize)
+#define SnP_AddBytes                    JOIN(SnP, _AddBytes)
+#define SnP_AddByte                     JOIN(SnP, _AddByte)
+#define SnP_OverwriteBytes              JOIN(SnP, _OverwriteBytes)
+#define SnP_ExtractBytes                JOIN(SnP, _ExtractBytes)
+#define SnP_ExtractAndAddBytes          JOIN(SnP, _ExtractAndAddBytes)
+
+#define Cyclist_Instance                JOIN(prefix, _Instance)
+#define Cyclist_Initialize              JOIN(prefix, _Initialize)
+#define Cyclist_Absorb                  JOIN(prefix, _Absorb)
+#define Cyclist_Encrypt                 JOIN(prefix, _Encrypt)
+#define Cyclist_Decrypt                 JOIN(prefix, _Decrypt)
+#define Cyclist_Squeeze                 JOIN(prefix, _Squeeze)
+#define Cyclist_SqueezeKey              JOIN(prefix, _SqueezeKey)
+#define Cyclist_Ratchet                 JOIN(prefix, _Ratchet)
+
+#define Cyclist_AbsorbAny               JOIN(prefix, _AbsorbAny)
+#define Cyclist_AbsorbKey               JOIN(prefix, _AbsorbKey)
+#define Cyclist_SqueezeAny              JOIN(prefix, _SqueezeAny)
+#define Cyclist_Down                    JOIN(prefix, _Down)
+#define Cyclist_Up                      JOIN(prefix, _Up)
+#define Cyclist_Crypt                   JOIN(prefix, _Crypt)
+
+#define Cyclist_f_bPrime                JOIN(prefix, _f_bPrime)
+#define Cyclist_Rhash                   JOIN(prefix, _Rhash)
+#define Cyclist_Rkin                    JOIN(prefix, _Rkin)
+#define Cyclist_Rkout                   JOIN(prefix, _Rkout)
+#define Cyclist_lRatchet                JOIN(prefix, _lRatchet)
+
+#if defined(CyclistFullBlocks_supported)
+#define Cyclist_AbsorbKeyedFullBlocks   JOIN(prefix, _AbsorbKeyedFullBlocks)
+#define Cyclist_AbsorbHashFullBlocks    JOIN(prefix, _AbsorbHashFullBlocks)
+#define Cyclist_SqueezeKeyedFullBlocks  JOIN(prefix, _SqueezeKeyedFullBlocks)
+#define Cyclist_SqueezeHashFullBlocks   JOIN(prefix, _SqueezeHashFullBlocks)
+#define Cyclist_EncryptFullBlocks       JOIN(prefix, _EncryptFullBlocks)
+#define Cyclist_DecryptFullBlocks       JOIN(prefix, _DecryptFullBlocks)
+#endif
+
+/* ------- Cyclist internal interfaces ------- */
+
+static void Cyclist_Down(Cyclist_Instance *instance, const uint8_t *Xi, unsigned int XiLen, uint8_t Cd)
+{
+    SnP_AddBytes(instance->state, Xi, 0, XiLen);
+    SnP_AddByte(instance->state, 0x01, XiLen);
+    SnP_AddByte(instance->state, (instance->mode == Cyclist_ModeHash) ? (Cd & 0x01) : Cd, Cyclist_f_bPrime - 1);
+    instance->phase = Cyclist_PhaseDown;
+
+}
+
+static void Cyclist_Up(Cyclist_Instance *instance, uint8_t *Yi, unsigned int YiLen, uint8_t Cu)
+{
+    #if defined(OUTPUT)
+    uint8_t   s[Cyclist_f_bPrime];
+    #endif
+
+    if (instance->mode != Cyclist_ModeHash) {
+        SnP_AddByte(instance->state, Cu, Cyclist_f_bPrime - 1);
+    }
+    #if defined(OUTPUT)
+    if (instance->file != NULL) {
+        SnP_ExtractBytes( instance->stateShadow, s, 0, Cyclist_f_bPrime );
+        SnP_ExtractAndAddBytes( instance->state, s, s, 0, Cyclist_f_bPrime );
+    }
+    #endif
+    SnP_Permute( instance->state );
+    #if defined(OUTPUT)
+    if (instance->file != NULL) {
+        memcpy( instance->stateShadow, instance->state, sizeof(instance->state) );
+        fprintf( instance->file, "Data XORed" );
+        displayByteString( instance->file, "", s, Cyclist_f_bPrime );
+        SnP_ExtractBytes( instance->stateShadow, s, 0, Cyclist_f_bPrime );
+        fprintf( instance->file, "After f() ");
+        displayByteString( instance->file, "", s, Cyclist_f_bPrime );
+    }
+    #endif
+    instance->phase = Cyclist_PhaseUp;
+    SnP_ExtractBytes( instance->state, Yi, 0, YiLen );
+}
+
+static void Cyclist_AbsorbAny(Cyclist_Instance *instance, const uint8_t *X, size_t XLen, unsigned int r, uint8_t Cd)
+{
+    unsigned int    splitLen;
+
+    do {
+        if (instance->phase != Cyclist_PhaseUp) {
+            Cyclist_Up(instance, NULL, 0, 0);
+        }
+        splitLen = (unsigned int)MyMin(XLen, r);
+        Cyclist_Down(instance, X, splitLen, Cd);
+        Cd = 0;
+        X       += splitLen;
+        XLen    -= splitLen;
+        #if defined(CyclistFullBlocks_supported)
+        if ((r == Cyclist_Rkin) && (XLen >= Cyclist_Rkin)) {
+            size_t  lenProcessed = Cyclist_AbsorbKeyedFullBlocks(instance->state, X, XLen);
+            X       += lenProcessed;
+            XLen    -= lenProcessed;
+        }
+        else if ((r == Cyclist_Rhash) && (XLen >= Cyclist_Rhash)) {
+            size_t  lenProcessed = Cyclist_AbsorbHashFullBlocks(instance->state, X, XLen);
+            X       += lenProcessed;
+            XLen    -= lenProcessed;
+        }
+        #endif
+    } while ( XLen != 0 );
+}
+
+static void Cyclist_AbsorbKey(Cyclist_Instance *instance, const uint8_t *K, size_t KLen, const uint8_t *ID, size_t IDLen, const uint8_t *counter, size_t counterLen)
+{
+    uint8_t KID[Cyclist_Rkin];
+
+    #if DEBUG
+    assert(instance->mode == Cyclist_ModeHash);
+    assert((KLen + IDLen) <= (Cyclist_Rkin - 1));
+    #endif
+    instance->mode      = Cyclist_ModeKeyed;
+    instance->Rabsorb   = Cyclist_Rkin;
+    instance->Rsqueeze  = Cyclist_Rkout;
+    if (KLen != 0) {
+        memcpy(KID, K, KLen);
+        memcpy(KID + KLen, ID, IDLen);
+        KID[KLen + IDLen] = (uint8_t)IDLen;
+        Cyclist_AbsorbAny(instance, KID, KLen + IDLen + 1, instance->Rabsorb, 0x02);
+        if (counterLen != 0) {
+            Cyclist_AbsorbAny(instance, counter, counterLen, 1, 0x00);
+        }
+    }
+}
+
+static void Cyclist_SqueezeAny(Cyclist_Instance *instance, uint8_t *Y, size_t YLen, uint8_t Cu)
+{
+    unsigned int    len;
+
+    len = (unsigned int)MyMin(YLen, instance->Rsqueeze );
+    Cyclist_Up(instance, Y, len, Cu);
+    Y += len;
+    YLen -= len;
+    while (YLen != 0) {
+        #if defined(CyclistFullBlocks_supported)
+        if ((instance->mode == Cyclist_ModeKeyed) && (YLen >= Cyclist_Rkin)) {
+            size_t  lenProcessed = Cyclist_SqueezeKeyedFullBlocks(instance->state, Y, YLen);
+            Y       += lenProcessed;
+            YLen    -= lenProcessed;
+        }
+        else if ((instance->mode == Cyclist_ModeHash) && (YLen >= Cyclist_Rhash)) {
+            size_t  lenProcessed = Cyclist_SqueezeHashFullBlocks(instance->state, Y, YLen);
+            Y       += lenProcessed;
+            YLen    -= lenProcessed;
+        }
+        else
+        #endif
+        {
+            Cyclist_Down(instance, NULL, 0, 0);
+            len = (unsigned int)MyMin(YLen, instance->Rsqueeze );
+            Cyclist_Up(instance, Y, len, 0);
+            Y += len;
+            YLen -= len;
+        }
+    }
+}
+
+static void Cyclist_Crypt(Cyclist_Instance *instance, const uint8_t *I, uint8_t *O, size_t IOLen, int decrypt)
+{
+    unsigned int    splitLen;
+    uint8_t         P[Cyclist_Rkout];
+    uint8_t         Cu = 0x80;
+
+    do {
+        if (decrypt != 0) {
+            #if defined(CyclistFullBlocks_supported)
+            if ((Cu == 0) && (IOLen >= Cyclist_Rkout)) {
+                size_t  lenProcessed = Cyclist_DecryptFullBlocks(instance->state, I, O, IOLen);
+                I       += lenProcessed;
+                O       += lenProcessed;
+                IOLen   -= lenProcessed;
+            }
+            else
+            #endif
+            {
+                splitLen = (unsigned int)MyMin(IOLen, Cyclist_Rkout); /* use Rkout instead of Rsqueeze, this function is only called in keyed mode */
+                Cyclist_Up(instance, NULL, 0, Cu); /* Up without extract */
+                SnP_ExtractAndAddBytes(instance->state, I, O, 0, splitLen); /* Extract from Up and Add */
+                Cyclist_Down(instance, O, splitLen, 0x00);
+                I       += splitLen;
+                O       += splitLen;
+                IOLen   -= splitLen;
+            }
+        }
+        else {
+            #if defined(CyclistFullBlocks_supported)
+            if ((Cu == 0) && (IOLen >= Cyclist_Rkout)) {
+                size_t  lenProcessed = Cyclist_EncryptFullBlocks(instance->state, I, O, IOLen);
+                I       += lenProcessed;
+                O       += lenProcessed;
+                IOLen   -= lenProcessed;
+            }
+            else
+            #endif
+            {
+                splitLen = (unsigned int)MyMin(IOLen, Cyclist_Rkout); /* use Rkout instead of Rsqueeze, this function is only called in keyed mode */
+                memcpy(P, I, splitLen);
+                Cyclist_Up(instance, NULL, 0, Cu); /* Up without extract */
+                SnP_ExtractAndAddBytes(instance->state, I, O, 0, splitLen); /* Extract from Up and Add */
+                Cyclist_Down(instance, P, splitLen, 0x00);
+                I       += splitLen;
+                O       += splitLen;
+                IOLen   -= splitLen;
+            }
+        }
+        Cu = 0x00;
+    } while ( IOLen != 0 );
+}
+
+/* ------- Cyclist interfaces ------- */
+
+void Cyclist_Initialize(Cyclist_Instance *instance, const uint8_t *K, size_t KLen, const uint8_t *ID, size_t IDLen, const uint8_t *counter, size_t counterLen)
+{
+    SnP_StaticInitialize();
+    SnP_Initialize(instance->state);
+    instance->phase     = Cyclist_PhaseUp;
+    instance->mode      = Cyclist_ModeHash;
+    instance->Rabsorb   = Cyclist_Rhash;
+    instance->Rsqueeze  = Cyclist_Rhash;
+    #ifdef OUTPUT
+    instance->file = 0;
+    SnP_Initialize( instance->stateShadow );
+    #endif
+    if (KLen != 0) {
+        Cyclist_AbsorbKey(instance, K, KLen, ID, IDLen, counter, counterLen);
+    }
+}
+
+void Cyclist_Absorb(Cyclist_Instance *instance, const uint8_t *X, size_t XLen)
+{
+    Cyclist_AbsorbAny(instance, X, XLen, instance->Rabsorb, 0x03);
+}
+
+void Cyclist_Encrypt(Cyclist_Instance *instance, const uint8_t *P, uint8_t *C, size_t PLen)
+{
+    #if DEBUG
+    assert(instance->mode == Cyclist_ModeKeyed);
+    #endif
+    Cyclist_Crypt(instance, P, C, PLen, 0);
+}
+
+void Cyclist_Decrypt(Cyclist_Instance *instance, const uint8_t *C, uint8_t *P, size_t CLen)
+{
+    #if DEBUG
+    assert(instance->mode == Cyclist_ModeKeyed);
+    #endif
+    Cyclist_Crypt(instance, C, P, CLen, 1);
+}
+
+void Cyclist_Squeeze(Cyclist_Instance *instance, uint8_t *Y, size_t YLen)
+{
+    Cyclist_SqueezeAny(instance, Y, YLen, 0x40);
+}
+
+void Cyclist_SqueezeKey(Cyclist_Instance *instance, uint8_t *K, size_t KLen)
+{
+    #if DEBUG
+    assert(instance->mode == Cyclist_ModeKeyed);
+    #endif
+    Cyclist_SqueezeAny(instance, K, KLen, 0x20);
+}
+
+void Cyclist_Ratchet(Cyclist_Instance *instance)
+{
+    uint8_t buffer[Cyclist_lRatchet];
+
+    #if DEBUG
+    assert(instance->mode == Cyclist_ModeKeyed);
+    #endif
+    /* Squeeze then absorb is the same as overwriting with zeros */
+    Cyclist_SqueezeAny(instance, buffer, sizeof(buffer), 0x10);
+    Cyclist_AbsorbAny(instance, buffer, sizeof(buffer), instance->Rabsorb, 0x00);
+}
+
+#undef SnP_StaticInitialize
+#undef SnP_Initialize
+#undef SnP_AddBytes
+#undef SnP_AddByte
+#undef SnP_OverwriteBytes
+#undef SnP_ExtractBytes
+#undef SnP_ExtractAndAddBytes
+
+#undef Cyclist_Instance
+#undef Cyclist_Initialize
+#undef Cyclist_Absorb
+#undef Cyclist_Encrypt
+#undef Cyclist_Decrypt
+#undef Cyclist_Squeeze
+#undef Cyclist_SqueezeKey
+#undef Cyclist_Ratchet
+
+#undef Cyclist_AbsorbAny
+#undef Cyclist_AbsorbKey
+#undef Cyclist_SqueezeAny
+#undef Cyclist_Down
+#undef Cyclist_Up
+#undef Cyclist_Crypt
+
+#undef Cyclist_f_bPrime
+#undef Cyclist_Rhash
+#undef Cyclist_Rkin
+#undef Cyclist_Rkout
+#undef Cyclist_lRatchet
+
+#if defined(CyclistFullBlocks_supported)
+#undef Cyclist_AbsorbKeyedFullBlocks
+#undef Cyclist_AbsorbHashFullBlocks
+#undef Cyclist_SqueezeKeyedFullBlocks
+#undef Cyclist_SqueezeHashFullBlocks
+#undef Cyclist_EncryptFullBlocks
+#undef Cyclist_DecryptFullBlocks
+#endif

data/ext/xkcp/lib/high/Xoodyak/Xoodyak-parameters.h

@@ -0,0 +1,26 @@
+/*
+The eXtended Keccak Code Package (XKCP)
+https://github.com/XKCP/XKCP
+
+Xoodyak, designed by Joan Daemen, Seth Hoffert, Michaël Peeters, Gilles Van Assche and Ronny Van Keer.
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+For more information, feedback or questions, please refer to the Keccak Team website:
+https://keccak.team/
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#ifndef _Xoodyak_parameters_h_
+#define _Xoodyak_parameters_h_
+
+#define Xoodyak_f_bPrime    48
+#define Xoodyak_Rhash       16
+#define Xoodyak_Rkin        44
+#define Xoodyak_Rkout       24
+#define Xoodyak_lRatchet    16
+
+#endif