Botan 2.19.2
Crypto and TLS for C&
sha3_round.h
Go to the documentation of this file.
1/*
2* (C) 2010,2016,2021 Jack Lloyd
3*
4* Botan is released under the Simplified BSD License (see license.txt)
5*/
6
7#ifndef BOTAN_SHA3_ROUND_H_
8#define BOTAN_SHA3_ROUND_H_
9
10#include <botan/types.h>
11#include <botan/rotate.h>
12
13/*
14A bug in Clang 12 and XCode 13 cause a miscompilation of SHA3_round
15with optimization levels -O2 and higher.
16
17For details
18 https://github.com/randombit/botan/issues/2802 and
19 https://bugs.llvm.org/show_bug.cgi?id=51957
20*/
21
22#if defined(__clang__) && \
23 (( defined(__apple_build_version__) && __clang_major__ == 13) || \
24 (!defined(__apple_build_version__) && __clang_major__ == 12))
25 #define BOTAN_HAS_BROKEN_CLANG_SHA3
26#endif
27
28#if defined(BOTAN_HAS_BROKEN_CLANG_SHA3)
29 #include <tuple>
30#endif
31
32namespace Botan {
33
34#if defined(BOTAN_HAS_BROKEN_CLANG_SHA3)
35
36namespace {
37
38__attribute__((noinline)) std::tuple<uint64_t, uint64_t, uint64_t, uint64_t, uint64_t>
39 xor_CNs(const uint64_t A[25])
40 {
41 return std::tuple<uint64_t, uint64_t, uint64_t, uint64_t, uint64_t>(
42 A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20],
43 A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21],
44 A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22],
45 A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23],
46 A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24]);
47 }
48
49}
50
51#endif
52
53inline void SHA3_round(uint64_t T[25], const uint64_t A[25], uint64_t RC)
54 {
55#if defined(BOTAN_HAS_BROKEN_CLANG_SHA3)
56 const auto C_tup = xor_CNs(A);
57 const uint64_t C0 = std::get<0>(C_tup);
58 const uint64_t C1 = std::get<1>(C_tup);
59 const uint64_t C2 = std::get<2>(C_tup);
60 const uint64_t C3 = std::get<3>(C_tup);
61 const uint64_t C4 = std::get<4>(C_tup);
62#else
63 const uint64_t C0 = A[0] ^ A[5] ^ A[10] ^ A[15] ^ A[20];
64 const uint64_t C1 = A[1] ^ A[6] ^ A[11] ^ A[16] ^ A[21];
65 const uint64_t C2 = A[2] ^ A[7] ^ A[12] ^ A[17] ^ A[22];
66 const uint64_t C3 = A[3] ^ A[8] ^ A[13] ^ A[18] ^ A[23];
67 const uint64_t C4 = A[4] ^ A[9] ^ A[14] ^ A[19] ^ A[24];
68#endif
69
70 const uint64_t D0 = rotl<1>(C0) ^ C3;
71 const uint64_t D1 = rotl<1>(C1) ^ C4;
72 const uint64_t D2 = rotl<1>(C2) ^ C0;
73 const uint64_t D3 = rotl<1>(C3) ^ C1;
74 const uint64_t D4 = rotl<1>(C4) ^ C2;
75
76 const uint64_t B00 = A[ 0] ^ D1;
77 const uint64_t B01 = rotl<44>(A[ 6] ^ D2);
78 const uint64_t B02 = rotl<43>(A[12] ^ D3);
79 const uint64_t B03 = rotl<21>(A[18] ^ D4);
80 const uint64_t B04 = rotl<14>(A[24] ^ D0);
81 T[ 0] = B00 ^ (~B01 & B02) ^ RC;
82 T[ 1] = B01 ^ (~B02 & B03);
83 T[ 2] = B02 ^ (~B03 & B04);
84 T[ 3] = B03 ^ (~B04 & B00);
85 T[ 4] = B04 ^ (~B00 & B01);
86
87 const uint64_t B05 = rotl<28>(A[ 3] ^ D4);
88 const uint64_t B06 = rotl<20>(A[ 9] ^ D0);
89 const uint64_t B07 = rotl< 3>(A[10] ^ D1);
90 const uint64_t B08 = rotl<45>(A[16] ^ D2);
91 const uint64_t B09 = rotl<61>(A[22] ^ D3);
92 T[ 5] = B05 ^ (~B06 & B07);
93 T[ 6] = B06 ^ (~B07 & B08);
94 T[ 7] = B07 ^ (~B08 & B09);
95 T[ 8] = B08 ^ (~B09 & B05);
96 T[ 9] = B09 ^ (~B05 & B06);
97
98 const uint64_t B10 = rotl< 1>(A[ 1] ^ D2);
99 const uint64_t B11 = rotl< 6>(A[ 7] ^ D3);
100 const uint64_t B12 = rotl<25>(A[13] ^ D4);
101 const uint64_t B13 = rotl< 8>(A[19] ^ D0);
102 const uint64_t B14 = rotl<18>(A[20] ^ D1);
103 T[10] = B10 ^ (~B11 & B12);
104 T[11] = B11 ^ (~B12 & B13);
105 T[12] = B12 ^ (~B13 & B14);
106 T[13] = B13 ^ (~B14 & B10);
107 T[14] = B14 ^ (~B10 & B11);
108
109 const uint64_t B15 = rotl<27>(A[ 4] ^ D0);
110 const uint64_t B16 = rotl<36>(A[ 5] ^ D1);
111 const uint64_t B17 = rotl<10>(A[11] ^ D2);
112 const uint64_t B18 = rotl<15>(A[17] ^ D3);
113 const uint64_t B19 = rotl<56>(A[23] ^ D4);
114 T[15] = B15 ^ (~B16 & B17);
115 T[16] = B16 ^ (~B17 & B18);
116 T[17] = B17 ^ (~B18 & B19);
117 T[18] = B18 ^ (~B19 & B15);
118 T[19] = B19 ^ (~B15 & B16);
119
120 const uint64_t B20 = rotl<62>(A[ 2] ^ D3);
121 const uint64_t B21 = rotl<55>(A[ 8] ^ D4);
122 const uint64_t B22 = rotl<39>(A[14] ^ D0);
123 const uint64_t B23 = rotl<41>(A[15] ^ D1);
124 const uint64_t B24 = rotl< 2>(A[21] ^ D2);
125 T[20] = B20 ^ (~B21 & B22);
126 T[21] = B21 ^ (~B22 & B23);
127 T[22] = B22 ^ (~B23 & B24);
128 T[23] = B23 ^ (~B24 & B20);
129 T[24] = B24 ^ (~B20 & B21);
130 }
131
132}
133
134#endif
fe T
Definition: ge.cpp:37
Definition: alg_id.cpp:13
void SHA3_round(uint64_t T[25], const uint64_t A[25], uint64_t RC)
Definition: sha3_round.h:53