Move Keccak code to its own folder and add an absorb API.

This is to prepare a Dilithium implementation.

Change-Id: I20581690c72837177823213fd2d3ad311614a660
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63586
Reviewed-by: Bob Beck <bbe@google.com>

crypto/CMakeLists.txt

@@ -175,7 +175,7 @@ add_library(
   ex_data.c
   hpke/hpke.c
   hrss/hrss.c
-  kyber/keccak.c
+  keccak/keccak.c
   kyber/kyber.c
   lhash/lhash.c
   mem.c

crypto/keccak/internal.h

@@ -0,0 +1,70 @@
+/* Copyright (c) 2023, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+enum boringssl_keccak_config_t {
+  boringssl_sha3_256,
+  boringssl_sha3_512,
+  boringssl_shake128,
+  boringssl_shake256,
+};
+
+enum boringssl_keccak_phase_t {
+  boringssl_keccak_phase_absorb,
+  boringssl_keccak_phase_squeeze,
+};
+
+struct BORINGSSL_keccak_st {
+  enum boringssl_keccak_config_t config;
+  enum boringssl_keccak_phase_t phase;
+  uint64_t state[25];
+  size_t rate_bytes;
+  size_t absorb_offset;
+  size_t squeeze_offset;
+};
+
+// BORINGSSL_keccak hashes |in_len| bytes from |in| and writes |out_len| bytes
+// of output to |out|. If the |config| specifies a fixed-output function, like
+// SHA3-256, then |out_len| must be the correct length for that function.
+OPENSSL_EXPORT void BORINGSSL_keccak(uint8_t *out, size_t out_len,
+                                     const uint8_t *in, size_t in_len,
+                                     enum boringssl_keccak_config_t config);
+
+// BORINGSSL_keccak_init prepares |ctx| for absorbing. The |config| must specify
+// a SHAKE variant, otherwise callers should use |BORINGSSL_keccak|.
+OPENSSL_EXPORT void BORINGSSL_keccak_init(
+    struct BORINGSSL_keccak_st *ctx, enum boringssl_keccak_config_t config);
+
+// BORINGSSL_keccak_absorb absorbs |in_len| bytes from |in|.
+OPENSSL_EXPORT void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx,
+                                            const uint8_t *in, size_t in_len);
+
+// BORINGSSL_keccak_squeeze writes |out_len| bytes to |out| from |ctx|.
+OPENSSL_EXPORT void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx,
+                                             uint8_t *out, size_t out_len);
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H

crypto/kyber/keccak.c → crypto/keccak/keccak.c

@@ -105,40 +105,90 @@ static void keccak_f(uint64_t state[25]) {
 }
 
 static void keccak_init(struct BORINGSSL_keccak_st *ctx,
-                        size_t *out_required_out_len, const uint8_t *in,
-                        size_t in_len, enum boringssl_keccak_config_t config) {
+                        size_t *out_required_out_len,
+                        enum boringssl_keccak_config_t config) {
   size_t capacity_bytes;
-  uint8_t terminator;
   switch (config) {
     case boringssl_sha3_256:
       capacity_bytes = 512 / 8;
       *out_required_out_len = 32;
-      terminator = 0x06;
       break;
     case boringssl_sha3_512:
       capacity_bytes = 1024 / 8;
       *out_required_out_len = 64;
-      terminator = 0x06;
       break;
     case boringssl_shake128:
       capacity_bytes = 256 / 8;
       *out_required_out_len = 0;
-      terminator = 0x1f;
       break;
     case boringssl_shake256:
       capacity_bytes = 512 / 8;
       *out_required_out_len = 0;
-      terminator = 0x1f;
       break;
     default:
       abort();
   }
 
   OPENSSL_memset(ctx, 0, sizeof(*ctx));
+  ctx->config = config;
+  ctx->phase = boringssl_keccak_phase_absorb;
   ctx->rate_bytes = 200 - capacity_bytes;
   assert(ctx->rate_bytes % 8 == 0);
+}
+
+void BORINGSSL_keccak(uint8_t *out, size_t out_len, const uint8_t *in,
+                      size_t in_len, enum boringssl_keccak_config_t config) {
+  struct BORINGSSL_keccak_st ctx;
+  size_t required_out_len;
+  keccak_init(&ctx, &required_out_len, config);
+  if (required_out_len != 0 && out_len != required_out_len) {
+    abort();
+  }
+  BORINGSSL_keccak_absorb(&ctx, in, in_len);
+  BORINGSSL_keccak_squeeze(&ctx, out, out_len);
+}
+
+void BORINGSSL_keccak_init(struct BORINGSSL_keccak_st *ctx,
+                           enum boringssl_keccak_config_t config) {
+  size_t required_out_len;
+  keccak_init(ctx, &required_out_len, config);
+  if (required_out_len != 0) {
+    abort();
+  }
+}
+
+void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx, const uint8_t *in,
+                             size_t in_len) {
+  if (ctx->phase == boringssl_keccak_phase_squeeze) {
+    // It's illegal to call absorb() again after calling squeeze().
+    abort();
+  }
+
   const size_t rate_words = ctx->rate_bytes / 8;
+  // XOR the input. Accessing |ctx->state| as a |uint8_t*| is allowed by strict
+  // aliasing because we require |uint8_t| to be a character type.
+  uint8_t *state_bytes = (uint8_t *)ctx->state;
+
+  // Absorb partial block.
+  if (ctx->absorb_offset != 0) {
+    assert(ctx->absorb_offset < ctx->rate_bytes);
+    size_t first_block_len = ctx->rate_bytes - ctx->absorb_offset;
+    for (size_t i = 0; i < first_block_len && i < in_len; i++) {
+      state_bytes[ctx->absorb_offset + i] ^= in[i];
+    }
+
+    // This input didn't fill the block.
+    if (first_block_len > in_len) {
+      ctx->absorb_offset += in_len;
+      return;
+    }
+
+    keccak_f(ctx->state);
+    in += first_block_len;
+    in_len -= first_block_len;
+  }
 
+  // Absorb full blocks.
   while (in_len >= ctx->rate_bytes) {
     for (size_t i = 0; i < rate_words; i++) {
       ctx->state[i] ^= CRYPTO_load_u64_le(in + 8 * i);
@@ -148,57 +198,60 @@ static void keccak_init(struct BORINGSSL_keccak_st *ctx,
     in_len -= ctx->rate_bytes;
   }
 
-  // XOR the final block. Accessing |ctx->state| as a |uint8_t*| is allowed by
-  // strict aliasing because we require |uint8_t| to be a character type.
-  uint8_t *state_bytes = (uint8_t *)ctx->state;
+  // Absorb partial block.
   assert(in_len < ctx->rate_bytes);
   for (size_t i = 0; i < in_len; i++) {
     state_bytes[i] ^= in[i];
   }
-  state_bytes[in_len] ^= terminator;
-  state_bytes[ctx->rate_bytes - 1] ^= 0x80;
-  keccak_f(ctx->state);
+  ctx->absorb_offset = in_len;
 }
 
-void BORINGSSL_keccak(uint8_t *out, size_t out_len, const uint8_t *in,
-                      size_t in_len, enum boringssl_keccak_config_t config) {
-  struct BORINGSSL_keccak_st ctx;
-  size_t required_out_len;
-  keccak_init(&ctx, &required_out_len, in, in_len, config);
-  if (required_out_len != 0 && out_len != required_out_len) {
-    abort();
+static void keccak_finalize(struct BORINGSSL_keccak_st *ctx) {
+  uint8_t terminator;
+  switch (ctx->config) {
+    case boringssl_sha3_256:
+    case boringssl_sha3_512:
+      terminator = 0x06;
+      break;
+    case boringssl_shake128:
+    case boringssl_shake256:
+      terminator = 0x1f;
+      break;
+    default:
+      abort();
   }
-  BORINGSSL_keccak_squeeze(&ctx, out, out_len);
-}
 
-void BORINGSSL_keccak_init(struct BORINGSSL_keccak_st *ctx, const uint8_t *in,
-                           size_t in_len,
-                           enum boringssl_keccak_config_t config) {
-  size_t required_out_len;
-  keccak_init(ctx, &required_out_len, in, in_len, config);
-  if (required_out_len != 0) {
-    abort();
-  }
+  // XOR the terminator. Accessing |ctx->state| as a |uint8_t*| is allowed by
+  // strict aliasing because we require |uint8_t| to be a character type.
+  uint8_t *state_bytes = (uint8_t *)ctx->state;
+  state_bytes[ctx->absorb_offset] ^= terminator;
+  state_bytes[ctx->rate_bytes - 1] ^= 0x80;
+  keccak_f(ctx->state);
 }
 
 void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx, uint8_t *out,
                               size_t out_len) {
+  if (ctx->phase == boringssl_keccak_phase_absorb) {
+    keccak_finalize(ctx);
+    ctx->phase = boringssl_keccak_phase_squeeze;
+  }
+
   // Accessing |ctx->state| as a |uint8_t*| is allowed by strict aliasing
   // because we require |uint8_t| to be a character type.
   const uint8_t *state_bytes = (const uint8_t *)ctx->state;
   while (out_len) {
-    size_t remaining = ctx->rate_bytes - ctx->offset;
+    size_t remaining = ctx->rate_bytes - ctx->squeeze_offset;
     size_t todo = out_len;
     if (todo > remaining) {
       todo = remaining;
     }
-    OPENSSL_memcpy(out, &state_bytes[ctx->offset], todo);
+    OPENSSL_memcpy(out, &state_bytes[ctx->squeeze_offset], todo);
     out += todo;
     out_len -= todo;
-    ctx->offset += todo;
-    if (ctx->offset == ctx->rate_bytes) {
+    ctx->squeeze_offset += todo;
+    if (ctx->squeeze_offset == ctx->rate_bytes) {
       keccak_f(ctx->state);
-      ctx->offset = 0;
+      ctx->squeeze_offset = 0;
     }
   }
 }