keccakf.go 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412
  1. // Copyright 2014 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. // +build !amd64 appengine gccgo
  5. package sha3
  6. // rc stores the round constants for use in the ι step.
  7. var rc = [24]uint64{
  8. 0x0000000000000001,
  9. 0x0000000000008082,
  10. 0x800000000000808A,
  11. 0x8000000080008000,
  12. 0x000000000000808B,
  13. 0x0000000080000001,
  14. 0x8000000080008081,
  15. 0x8000000000008009,
  16. 0x000000000000008A,
  17. 0x0000000000000088,
  18. 0x0000000080008009,
  19. 0x000000008000000A,
  20. 0x000000008000808B,
  21. 0x800000000000008B,
  22. 0x8000000000008089,
  23. 0x8000000000008003,
  24. 0x8000000000008002,
  25. 0x8000000000000080,
  26. 0x000000000000800A,
  27. 0x800000008000000A,
  28. 0x8000000080008081,
  29. 0x8000000000008080,
  30. 0x0000000080000001,
  31. 0x8000000080008008,
  32. }
  33. // keccakF1600 applies the Keccak permutation to a 1600b-wide
  34. // state represented as a slice of 25 uint64s.
  35. func keccakF1600(a *[25]uint64) {
  36. // Implementation translated from Keccak-inplace.c
  37. // in the keccak reference code.
  38. var t, bc0, bc1, bc2, bc3, bc4, d0, d1, d2, d3, d4 uint64
  39. for i := 0; i < 24; i += 4 {
  40. // Combines the 5 steps in each round into 2 steps.
  41. // Unrolls 4 rounds per loop and spreads some steps across rounds.
  42. // Round 1
  43. bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
  44. bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
  45. bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
  46. bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
  47. bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
  48. d0 = bc4 ^ (bc1<<1 | bc1>>63)
  49. d1 = bc0 ^ (bc2<<1 | bc2>>63)
  50. d2 = bc1 ^ (bc3<<1 | bc3>>63)
  51. d3 = bc2 ^ (bc4<<1 | bc4>>63)
  52. d4 = bc3 ^ (bc0<<1 | bc0>>63)
  53. bc0 = a[0] ^ d0
  54. t = a[6] ^ d1
  55. bc1 = t<<44 | t>>(64-44)
  56. t = a[12] ^ d2
  57. bc2 = t<<43 | t>>(64-43)
  58. t = a[18] ^ d3
  59. bc3 = t<<21 | t>>(64-21)
  60. t = a[24] ^ d4
  61. bc4 = t<<14 | t>>(64-14)
  62. a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i]
  63. a[6] = bc1 ^ (bc3 &^ bc2)
  64. a[12] = bc2 ^ (bc4 &^ bc3)
  65. a[18] = bc3 ^ (bc0 &^ bc4)
  66. a[24] = bc4 ^ (bc1 &^ bc0)
  67. t = a[10] ^ d0
  68. bc2 = t<<3 | t>>(64-3)
  69. t = a[16] ^ d1
  70. bc3 = t<<45 | t>>(64-45)
  71. t = a[22] ^ d2
  72. bc4 = t<<61 | t>>(64-61)
  73. t = a[3] ^ d3
  74. bc0 = t<<28 | t>>(64-28)
  75. t = a[9] ^ d4
  76. bc1 = t<<20 | t>>(64-20)
  77. a[10] = bc0 ^ (bc2 &^ bc1)
  78. a[16] = bc1 ^ (bc3 &^ bc2)
  79. a[22] = bc2 ^ (bc4 &^ bc3)
  80. a[3] = bc3 ^ (bc0 &^ bc4)
  81. a[9] = bc4 ^ (bc1 &^ bc0)
  82. t = a[20] ^ d0
  83. bc4 = t<<18 | t>>(64-18)
  84. t = a[1] ^ d1
  85. bc0 = t<<1 | t>>(64-1)
  86. t = a[7] ^ d2
  87. bc1 = t<<6 | t>>(64-6)
  88. t = a[13] ^ d3
  89. bc2 = t<<25 | t>>(64-25)
  90. t = a[19] ^ d4
  91. bc3 = t<<8 | t>>(64-8)
  92. a[20] = bc0 ^ (bc2 &^ bc1)
  93. a[1] = bc1 ^ (bc3 &^ bc2)
  94. a[7] = bc2 ^ (bc4 &^ bc3)
  95. a[13] = bc3 ^ (bc0 &^ bc4)
  96. a[19] = bc4 ^ (bc1 &^ bc0)
  97. t = a[5] ^ d0
  98. bc1 = t<<36 | t>>(64-36)
  99. t = a[11] ^ d1
  100. bc2 = t<<10 | t>>(64-10)
  101. t = a[17] ^ d2
  102. bc3 = t<<15 | t>>(64-15)
  103. t = a[23] ^ d3
  104. bc4 = t<<56 | t>>(64-56)
  105. t = a[4] ^ d4
  106. bc0 = t<<27 | t>>(64-27)
  107. a[5] = bc0 ^ (bc2 &^ bc1)
  108. a[11] = bc1 ^ (bc3 &^ bc2)
  109. a[17] = bc2 ^ (bc4 &^ bc3)
  110. a[23] = bc3 ^ (bc0 &^ bc4)
  111. a[4] = bc4 ^ (bc1 &^ bc0)
  112. t = a[15] ^ d0
  113. bc3 = t<<41 | t>>(64-41)
  114. t = a[21] ^ d1
  115. bc4 = t<<2 | t>>(64-2)
  116. t = a[2] ^ d2
  117. bc0 = t<<62 | t>>(64-62)
  118. t = a[8] ^ d3
  119. bc1 = t<<55 | t>>(64-55)
  120. t = a[14] ^ d4
  121. bc2 = t<<39 | t>>(64-39)
  122. a[15] = bc0 ^ (bc2 &^ bc1)
  123. a[21] = bc1 ^ (bc3 &^ bc2)
  124. a[2] = bc2 ^ (bc4 &^ bc3)
  125. a[8] = bc3 ^ (bc0 &^ bc4)
  126. a[14] = bc4 ^ (bc1 &^ bc0)
  127. // Round 2
  128. bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
  129. bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
  130. bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
  131. bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
  132. bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
  133. d0 = bc4 ^ (bc1<<1 | bc1>>63)
  134. d1 = bc0 ^ (bc2<<1 | bc2>>63)
  135. d2 = bc1 ^ (bc3<<1 | bc3>>63)
  136. d3 = bc2 ^ (bc4<<1 | bc4>>63)
  137. d4 = bc3 ^ (bc0<<1 | bc0>>63)
  138. bc0 = a[0] ^ d0
  139. t = a[16] ^ d1
  140. bc1 = t<<44 | t>>(64-44)
  141. t = a[7] ^ d2
  142. bc2 = t<<43 | t>>(64-43)
  143. t = a[23] ^ d3
  144. bc3 = t<<21 | t>>(64-21)
  145. t = a[14] ^ d4
  146. bc4 = t<<14 | t>>(64-14)
  147. a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+1]
  148. a[16] = bc1 ^ (bc3 &^ bc2)
  149. a[7] = bc2 ^ (bc4 &^ bc3)
  150. a[23] = bc3 ^ (bc0 &^ bc4)
  151. a[14] = bc4 ^ (bc1 &^ bc0)
  152. t = a[20] ^ d0
  153. bc2 = t<<3 | t>>(64-3)
  154. t = a[11] ^ d1
  155. bc3 = t<<45 | t>>(64-45)
  156. t = a[2] ^ d2
  157. bc4 = t<<61 | t>>(64-61)
  158. t = a[18] ^ d3
  159. bc0 = t<<28 | t>>(64-28)
  160. t = a[9] ^ d4
  161. bc1 = t<<20 | t>>(64-20)
  162. a[20] = bc0 ^ (bc2 &^ bc1)
  163. a[11] = bc1 ^ (bc3 &^ bc2)
  164. a[2] = bc2 ^ (bc4 &^ bc3)
  165. a[18] = bc3 ^ (bc0 &^ bc4)
  166. a[9] = bc4 ^ (bc1 &^ bc0)
  167. t = a[15] ^ d0
  168. bc4 = t<<18 | t>>(64-18)
  169. t = a[6] ^ d1
  170. bc0 = t<<1 | t>>(64-1)
  171. t = a[22] ^ d2
  172. bc1 = t<<6 | t>>(64-6)
  173. t = a[13] ^ d3
  174. bc2 = t<<25 | t>>(64-25)
  175. t = a[4] ^ d4
  176. bc3 = t<<8 | t>>(64-8)
  177. a[15] = bc0 ^ (bc2 &^ bc1)
  178. a[6] = bc1 ^ (bc3 &^ bc2)
  179. a[22] = bc2 ^ (bc4 &^ bc3)
  180. a[13] = bc3 ^ (bc0 &^ bc4)
  181. a[4] = bc4 ^ (bc1 &^ bc0)
  182. t = a[10] ^ d0
  183. bc1 = t<<36 | t>>(64-36)
  184. t = a[1] ^ d1
  185. bc2 = t<<10 | t>>(64-10)
  186. t = a[17] ^ d2
  187. bc3 = t<<15 | t>>(64-15)
  188. t = a[8] ^ d3
  189. bc4 = t<<56 | t>>(64-56)
  190. t = a[24] ^ d4
  191. bc0 = t<<27 | t>>(64-27)
  192. a[10] = bc0 ^ (bc2 &^ bc1)
  193. a[1] = bc1 ^ (bc3 &^ bc2)
  194. a[17] = bc2 ^ (bc4 &^ bc3)
  195. a[8] = bc3 ^ (bc0 &^ bc4)
  196. a[24] = bc4 ^ (bc1 &^ bc0)
  197. t = a[5] ^ d0
  198. bc3 = t<<41 | t>>(64-41)
  199. t = a[21] ^ d1
  200. bc4 = t<<2 | t>>(64-2)
  201. t = a[12] ^ d2
  202. bc0 = t<<62 | t>>(64-62)
  203. t = a[3] ^ d3
  204. bc1 = t<<55 | t>>(64-55)
  205. t = a[19] ^ d4
  206. bc2 = t<<39 | t>>(64-39)
  207. a[5] = bc0 ^ (bc2 &^ bc1)
  208. a[21] = bc1 ^ (bc3 &^ bc2)
  209. a[12] = bc2 ^ (bc4 &^ bc3)
  210. a[3] = bc3 ^ (bc0 &^ bc4)
  211. a[19] = bc4 ^ (bc1 &^ bc0)
  212. // Round 3
  213. bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
  214. bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
  215. bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
  216. bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
  217. bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
  218. d0 = bc4 ^ (bc1<<1 | bc1>>63)
  219. d1 = bc0 ^ (bc2<<1 | bc2>>63)
  220. d2 = bc1 ^ (bc3<<1 | bc3>>63)
  221. d3 = bc2 ^ (bc4<<1 | bc4>>63)
  222. d4 = bc3 ^ (bc0<<1 | bc0>>63)
  223. bc0 = a[0] ^ d0
  224. t = a[11] ^ d1
  225. bc1 = t<<44 | t>>(64-44)
  226. t = a[22] ^ d2
  227. bc2 = t<<43 | t>>(64-43)
  228. t = a[8] ^ d3
  229. bc3 = t<<21 | t>>(64-21)
  230. t = a[19] ^ d4
  231. bc4 = t<<14 | t>>(64-14)
  232. a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+2]
  233. a[11] = bc1 ^ (bc3 &^ bc2)
  234. a[22] = bc2 ^ (bc4 &^ bc3)
  235. a[8] = bc3 ^ (bc0 &^ bc4)
  236. a[19] = bc4 ^ (bc1 &^ bc0)
  237. t = a[15] ^ d0
  238. bc2 = t<<3 | t>>(64-3)
  239. t = a[1] ^ d1
  240. bc3 = t<<45 | t>>(64-45)
  241. t = a[12] ^ d2
  242. bc4 = t<<61 | t>>(64-61)
  243. t = a[23] ^ d3
  244. bc0 = t<<28 | t>>(64-28)
  245. t = a[9] ^ d4
  246. bc1 = t<<20 | t>>(64-20)
  247. a[15] = bc0 ^ (bc2 &^ bc1)
  248. a[1] = bc1 ^ (bc3 &^ bc2)
  249. a[12] = bc2 ^ (bc4 &^ bc3)
  250. a[23] = bc3 ^ (bc0 &^ bc4)
  251. a[9] = bc4 ^ (bc1 &^ bc0)
  252. t = a[5] ^ d0
  253. bc4 = t<<18 | t>>(64-18)
  254. t = a[16] ^ d1
  255. bc0 = t<<1 | t>>(64-1)
  256. t = a[2] ^ d2
  257. bc1 = t<<6 | t>>(64-6)
  258. t = a[13] ^ d3
  259. bc2 = t<<25 | t>>(64-25)
  260. t = a[24] ^ d4
  261. bc3 = t<<8 | t>>(64-8)
  262. a[5] = bc0 ^ (bc2 &^ bc1)
  263. a[16] = bc1 ^ (bc3 &^ bc2)
  264. a[2] = bc2 ^ (bc4 &^ bc3)
  265. a[13] = bc3 ^ (bc0 &^ bc4)
  266. a[24] = bc4 ^ (bc1 &^ bc0)
  267. t = a[20] ^ d0
  268. bc1 = t<<36 | t>>(64-36)
  269. t = a[6] ^ d1
  270. bc2 = t<<10 | t>>(64-10)
  271. t = a[17] ^ d2
  272. bc3 = t<<15 | t>>(64-15)
  273. t = a[3] ^ d3
  274. bc4 = t<<56 | t>>(64-56)
  275. t = a[14] ^ d4
  276. bc0 = t<<27 | t>>(64-27)
  277. a[20] = bc0 ^ (bc2 &^ bc1)
  278. a[6] = bc1 ^ (bc3 &^ bc2)
  279. a[17] = bc2 ^ (bc4 &^ bc3)
  280. a[3] = bc3 ^ (bc0 &^ bc4)
  281. a[14] = bc4 ^ (bc1 &^ bc0)
  282. t = a[10] ^ d0
  283. bc3 = t<<41 | t>>(64-41)
  284. t = a[21] ^ d1
  285. bc4 = t<<2 | t>>(64-2)
  286. t = a[7] ^ d2
  287. bc0 = t<<62 | t>>(64-62)
  288. t = a[18] ^ d3
  289. bc1 = t<<55 | t>>(64-55)
  290. t = a[4] ^ d4
  291. bc2 = t<<39 | t>>(64-39)
  292. a[10] = bc0 ^ (bc2 &^ bc1)
  293. a[21] = bc1 ^ (bc3 &^ bc2)
  294. a[7] = bc2 ^ (bc4 &^ bc3)
  295. a[18] = bc3 ^ (bc0 &^ bc4)
  296. a[4] = bc4 ^ (bc1 &^ bc0)
  297. // Round 4
  298. bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20]
  299. bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21]
  300. bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22]
  301. bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23]
  302. bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24]
  303. d0 = bc4 ^ (bc1<<1 | bc1>>63)
  304. d1 = bc0 ^ (bc2<<1 | bc2>>63)
  305. d2 = bc1 ^ (bc3<<1 | bc3>>63)
  306. d3 = bc2 ^ (bc4<<1 | bc4>>63)
  307. d4 = bc3 ^ (bc0<<1 | bc0>>63)
  308. bc0 = a[0] ^ d0
  309. t = a[1] ^ d1
  310. bc1 = t<<44 | t>>(64-44)
  311. t = a[2] ^ d2
  312. bc2 = t<<43 | t>>(64-43)
  313. t = a[3] ^ d3
  314. bc3 = t<<21 | t>>(64-21)
  315. t = a[4] ^ d4
  316. bc4 = t<<14 | t>>(64-14)
  317. a[0] = bc0 ^ (bc2 &^ bc1) ^ rc[i+3]
  318. a[1] = bc1 ^ (bc3 &^ bc2)
  319. a[2] = bc2 ^ (bc4 &^ bc3)
  320. a[3] = bc3 ^ (bc0 &^ bc4)
  321. a[4] = bc4 ^ (bc1 &^ bc0)
  322. t = a[5] ^ d0
  323. bc2 = t<<3 | t>>(64-3)
  324. t = a[6] ^ d1
  325. bc3 = t<<45 | t>>(64-45)
  326. t = a[7] ^ d2
  327. bc4 = t<<61 | t>>(64-61)
  328. t = a[8] ^ d3
  329. bc0 = t<<28 | t>>(64-28)
  330. t = a[9] ^ d4
  331. bc1 = t<<20 | t>>(64-20)
  332. a[5] = bc0 ^ (bc2 &^ bc1)
  333. a[6] = bc1 ^ (bc3 &^ bc2)
  334. a[7] = bc2 ^ (bc4 &^ bc3)
  335. a[8] = bc3 ^ (bc0 &^ bc4)
  336. a[9] = bc4 ^ (bc1 &^ bc0)
  337. t = a[10] ^ d0
  338. bc4 = t<<18 | t>>(64-18)
  339. t = a[11] ^ d1
  340. bc0 = t<<1 | t>>(64-1)
  341. t = a[12] ^ d2
  342. bc1 = t<<6 | t>>(64-6)
  343. t = a[13] ^ d3
  344. bc2 = t<<25 | t>>(64-25)
  345. t = a[14] ^ d4
  346. bc3 = t<<8 | t>>(64-8)
  347. a[10] = bc0 ^ (bc2 &^ bc1)
  348. a[11] = bc1 ^ (bc3 &^ bc2)
  349. a[12] = bc2 ^ (bc4 &^ bc3)
  350. a[13] = bc3 ^ (bc0 &^ bc4)
  351. a[14] = bc4 ^ (bc1 &^ bc0)
  352. t = a[15] ^ d0
  353. bc1 = t<<36 | t>>(64-36)
  354. t = a[16] ^ d1
  355. bc2 = t<<10 | t>>(64-10)
  356. t = a[17] ^ d2
  357. bc3 = t<<15 | t>>(64-15)
  358. t = a[18] ^ d3
  359. bc4 = t<<56 | t>>(64-56)
  360. t = a[19] ^ d4
  361. bc0 = t<<27 | t>>(64-27)
  362. a[15] = bc0 ^ (bc2 &^ bc1)
  363. a[16] = bc1 ^ (bc3 &^ bc2)
  364. a[17] = bc2 ^ (bc4 &^ bc3)
  365. a[18] = bc3 ^ (bc0 &^ bc4)
  366. a[19] = bc4 ^ (bc1 &^ bc0)
  367. t = a[20] ^ d0
  368. bc3 = t<<41 | t>>(64-41)
  369. t = a[21] ^ d1
  370. bc4 = t<<2 | t>>(64-2)
  371. t = a[22] ^ d2
  372. bc0 = t<<62 | t>>(64-62)
  373. t = a[23] ^ d3
  374. bc1 = t<<55 | t>>(64-55)
  375. t = a[24] ^ d4
  376. bc2 = t<<39 | t>>(64-39)
  377. a[20] = bc0 ^ (bc2 &^ bc1)
  378. a[21] = bc1 ^ (bc3 &^ bc2)
  379. a[22] = bc2 ^ (bc4 &^ bc3)
  380. a[23] = bc3 ^ (bc0 &^ bc4)
  381. a[24] = bc4 ^ (bc1 &^ bc0)
  382. }
  383. }