bash.h

/*
 *  Copyright (C) 2022 - This file is part of libecc project
 *
 *  Authors:
 *      Ryad BENADJILA <ryadbenadjila@gmail.com>
 *      Arnaud EBALARD <arnaud.ebalard@ssi.gouv.fr>
 *
 *  This software is licensed under a dual BSD and GPL v2 license.
 *  See LICENSE file at the root folder of the project.
 */
#ifndef __BASH_H__
#define __BASH_H__

#include "../words/words.h"

/*
 * This is an implementation of the BASH hash functions family (for sizes 224, 256, 384 and 512)
 * following the standard STB 34.101.77-2020 (http://apmi.bsu.by/assets/files/std/bash-spec24.pdf).
 * An english version of the specifications exist here: https://eprint.iacr.org/2016/587.pdf
 */

#define _BASH_ROTHI_(x, y) (((x) << (y)) | ((x) >> ((sizeof(u64) * 8) - (y))))

/* We handle the case where one of the shifts is more than 64-bit: in this
 * case, behaviour is undefined as per ANSI C definition. In this case, we
 * return the untouched input.
 */
#define BASH_ROTHI(x, y) ((((y) < (sizeof(u64) * 8)) && ((y) > 0)) ? (_BASH_ROTHI_(x, y)) : (x))

/*
 * Round transformation of the state. Notations are the
 * same as the ones used in:
 * https://eprint.iacr.org/2016/587.pdf
 */
#define BASH_SLICES_X   3
#define BASH_SLICES_Y   8
#define BASH_ROT_ROUNDS 8
#define BASH_ROT_IDX    4
#define BASH_ROUNDS     24

#define BASH_L3_S3(W0, W1, W2, m1, n1, m2, n2) do {				\
	u64 T0, T1, T2;								\
	T0 = BASH_ROTHI(W0, m1);						\
	W0 = (W0 ^ W1 ^ W2);							\
	T1 = (W1 ^ BASH_ROTHI(W0, n1));						\
	W1 = (T0 ^ T1);								\
	W2 = (W2 ^ BASH_ROTHI(W2, m2) ^ BASH_ROTHI(T1, n2));			\
	T0 = (~(W2));								\
	T1 = (W0 | W2);								\
	T2 = (W0 & W1);								\
	T0 = (T0 | W1);								\
	W1 = (W1 ^ T1);								\
	W2 = (W2 ^ T2);								\
	W0 = (W0 ^ T0);								\
} while(0)

#define BASH_PERMUTE(S) do {							\
	u64 S_[BASH_SLICES_X * BASH_SLICES_Y];					\
	IGNORE_RET_VAL(local_memcpy(S_, S, sizeof(S_)));			\
	S[ 0] = S_[15]; S[ 1] = S_[10]; S[ 2] = S_[ 9]; S[ 3] = S_[12];		\
	S[ 4] = S_[11]; S[ 5] = S_[14]; S[ 6] = S_[13]; S[ 7] = S_[ 8];		\
	S[ 8] = S_[17]; S[ 9] = S_[16]; S[10] = S_[19]; S[11] = S_[18];		\
	S[12] = S_[21]; S[13] = S_[20]; S[14] = S_[23]; S[15] = S_[22];		\
	S[16] = S_[ 6]; S[17] = S_[ 3]; S[18] = S_[ 0]; S[19] = S_[ 5];		\
	S[20] = S_[ 2]; S[21] = S_[ 7]; S[22] = S_[ 4]; S[23] = S_[ 1];		\
} while(0)

static const u64 bash_rc[BASH_ROUNDS] =
{
	0x3bf5080ac8ba94b1ULL,
	0xc1d1659c1bbd92f6ULL,
	0x60e8b2ce0ddec97bULL,
	0xec5fb8fe790fbc13ULL,
	0xaa043de6436706a7ULL,
	0x8929ff6a5e535bfdULL,
	0x98bf1e2c50c97550ULL,
	0x4c5f8f162864baa8ULL,
	0x262fc78b14325d54ULL,
	0x1317e3c58a192eaaULL,
	0x098bf1e2c50c9755ULL,
	0xd8ee19681d669304ULL,
	0x6c770cb40eb34982ULL,
	0x363b865a0759a4c1ULL,
	0xc73622b47c4c0aceULL,
	0x639b115a3e260567ULL,
	0xede6693460f3da1dULL,
	0xaad8d5034f9935a0ULL,
	0x556c6a81a7cc9ad0ULL,
	0x2ab63540d3e64d68ULL,
	0x155b1aa069f326b4ULL,
	0x0aad8d5034f9935aULL,
	0x0556c6a81a7cc9adULL,
	0xde8082cd72debc78ULL,
};

static const u8 bash_rot[BASH_ROT_ROUNDS][BASH_ROT_IDX] =
{
	{  8, 53, 14,  1 },
	{ 56, 51, 34,  7 },
	{  8, 37, 46, 49 },
	{ 56,  3,  2, 23 },
	{  8, 21, 14, 33 },
	{ 56, 19, 34, 39 },
	{  8,  5, 46, 17 },
	{ 56, 35,  2, 55 },
};

/* Macro to handle endianness conversion */
#define SWAP64(A) do {								\
	A = ((A) << 56 | ((A) & 0xff00) << 40 | ((A) & 0xff0000) << 24 |	\
	    ((A) & 0xff000000) << 8 | ((A) >> 8 & 0xff000000) |			\
	    ((A) >> 24 & 0xff0000) | ((A) >> 40 & 0xff00) | (A) >> 56);		\
} while(0)

/* The main Bash-f core as descibed in the specification. */
#define BASHF(S, end) do {									\
	unsigned int round, i;									\
	/* Swap endianness if necessary */							\
	if(end == BASH_BIG){									\
		for(i = 0; i < (BASH_SLICES_X * BASH_SLICES_Y); i++){				\
			SWAP64(S[i]);								\
		}										\
	}											\
	for(round = 0; round < BASH_ROUNDS; round++){						\
		unsigned int v;									\
		for(v = 0; v < 8; v++){								\
			BASH_L3_S3(S[v], S[v+8], S[v+16], bash_rot[v][0], bash_rot[v][1],	\
							bash_rot[v][2], bash_rot[v][3]);	\
		}										\
		BASH_PERMUTE(S);								\
		S[23] ^= bash_rc[round];							\
	}											\
	/* Swap back endianness if necessary */							\
	if(end == BASH_BIG){									\
		for(i = 0; i < (BASH_SLICES_X * BASH_SLICES_Y); i++){				\
			SWAP64(S[i]);								\
		}										\
	}											\
} while(0)

typedef enum {
	BASH_LITTLE = 0,
	BASH_BIG = 1,
} bash_endianness;

typedef struct bash_context_ {
	u8 bash_digest_size;
	u8 bash_block_size;
	bash_endianness bash_endian;
	/* Local counter */
	u64 bash_total;
	/* Bash state */
	u64 bash_state[BASH_SLICES_X * BASH_SLICES_Y];
	/* Initialization magic value */
	u64 magic;
} bash_context;

ATTRIBUTE_WARN_UNUSED_RET int _bash_init(bash_context *ctx, uint8_t digest_size);
ATTRIBUTE_WARN_UNUSED_RET int _bash_update(bash_context *ctx, const uint8_t *buf, uint32_t buflen);
ATTRIBUTE_WARN_UNUSED_RET int _bash_finalize(bash_context *ctx, uint8_t *output);

#endif /* __BASH_H__ */