diff options
| -rw-r--r-- | crypto/src/pqc/crypto/sphincsplus/HarakaSBase.cs | 359 |
1 files changed, 122 insertions, 237 deletions
diff --git a/crypto/src/pqc/crypto/sphincsplus/HarakaSBase.cs b/crypto/src/pqc/crypto/sphincsplus/HarakaSBase.cs index bad948a22..b7ee8e2aa 100644 --- a/crypto/src/pqc/crypto/sphincsplus/HarakaSBase.cs +++ b/crypto/src/pqc/crypto/sphincsplus/HarakaSBase.cs @@ -1,5 +1,7 @@ using System; +using Org.BouncyCastle.Crypto.Utilities; +using Org.BouncyCastle.Math.Raw; using Org.BouncyCastle.Utilities; namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus @@ -42,20 +44,10 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus Arrays.Clear(buffer); } - private void BrRangeDec32Le(byte[] input, uint[] output, int inputPos) - { - int tmp; - for (int i = 0; i < output.Length; ++i) - { - tmp = inputPos + (i << 2); - output[i] = (uint)(input[tmp] & 0xFF) | (uint)((input[tmp + 1] << 8) & 0xFF00) | (uint)((input[tmp + 2] << 16) & 0xFF0000) | (uint)(input[tmp + 3] << 24); - } - } - - protected void InterleaveConstant(ulong[] output, byte[] input, int startPos) + protected static void InterleaveConstant(ulong[] output, byte[] input, int startPos) { uint[] tmp_32_constant = new uint[16]; - BrRangeDec32Le(input, tmp_32_constant, startPos); + Pack.LE_To_UInt32(input, startPos, tmp_32_constant); for (int i = 0; i < 4; ++i) { BrAesCt64InterleaveIn(output, i, tmp_32_constant, i << 2); @@ -63,71 +55,63 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus BrAesCt64Ortho(output); } - protected void InterleaveConstant32(uint[] output, byte[] input, int startPos) + protected static void InterleaveConstant32(uint[] output, byte[] input, int startPos) { for (int i = 0; i < 4; ++i) { - output[i << 1] = BrDec32Le(input, startPos + (i << 2)); - output[(i << 1) + 1] = BrDec32Le(input, startPos + (i << 2) + 16); + output[i << 1] = Pack.LE_To_UInt32(input, startPos + (i << 2)); + output[(i << 1) + 1] = Pack.LE_To_UInt32(input, startPos + (i << 2) + 16); } BrAesCtOrtho(output); } - private uint BrDec32Le(byte[] input, int startPos) - { - return (uint)(input[startPos] & 0xFF) | (uint)((input[startPos + 1] << 8) & 0xFF00) - | (((uint)input[startPos + 2] << 16) & 0xFF0000) | ((uint)input[startPos + 3] << 24); - } - protected void Haraka512Perm(byte[] output) { uint[] w = new uint[16]; ulong[] q = new ulong[8]; - ulong tmp_q; - int i, j; - BrRangeDec32Le(buffer, w, 0); - for (i = 0; i < 4; ++i) + Pack.LE_To_UInt32(buffer, 0, w); + for (int i = 0; i < 4; ++i) { BrAesCt64InterleaveIn(q, i, w, i << 2); } BrAesCt64Ortho(q); - for (i = 0; i < 5; ++i) + for (int i = 0; i < 5; ++i) { - for (j = 0; j < 2; ++j) + for (int j = 0; j < 2; ++j) { BrAesCt64BitsliceSbox(q); ShiftRows(q); MixColumns(q); AddRoundKey(q, haraka512_rc[(i << 1) + j]); } - for (j = 0; j < 8; j++) + for (int j = 0; j < 8; j++) { - tmp_q = q[j]; - q[j] = (tmp_q & 0x0001000100010001L) << 5 | - (tmp_q & 0x0002000200020002L) << 12 | - (tmp_q & 0x0004000400040004L) >> 1 | - (tmp_q & 0x0008000800080008L) << 6 | - (tmp_q & 0x0020002000200020L) << 9 | - (tmp_q & 0x0040004000400040L) >> 4 | - (tmp_q & 0x0080008000800080L) << 3 | - (tmp_q & 0x2100210021002100L) >> 5 | - (tmp_q & 0x0210021002100210L) << 2 | - (tmp_q & 0x0800080008000800L) << 4 | - (tmp_q & 0x1000100010001000L) >> 12 | - (tmp_q & 0x4000400040004000L) >> 10 | - (tmp_q & 0x8400840084008400L) >> 3; + ulong t = q[j]; + q[j] = (t & 0x0001_0001_0001_0001L) << 5 | + (t & 0x0002_0002_0002_0002L) << 12 | + (t & 0x0004_0004_0004_0004L) >> 1 | + (t & 0x0008_0008_0008_0008L) << 6 | + (t & 0x0020_0020_0020_0020L) << 9 | + (t & 0x0040_0040_0040_0040L) >> 4 | + (t & 0x0080_0080_0080_0080L) << 3 | + (t & 0x2100_2100_2100_2100L) >> 5 | + (t & 0x0210_0210_0210_0210L) << 2 | + (t & 0x0800_0800_0800_0800L) << 4 | + (t & 0x1000_1000_1000_1000L) >> 12 | + (t & 0x4000_4000_4000_4000L) >> 10 | + (t & 0x8400_8400_8400_8400L) >> 3; } } BrAesCt64Ortho(q); - for (i = 0; i < 4; i++) + for (int i = 0; i < 4; i++) { BrAesCt64InterleaveOut(w, q, i); } - for (i = 0; i < 16; ++i) + for (int i = 0; i < 16; ++i) { - for (j = 0; j < 4; ++j) + for (int j = 0; j < 4; ++j) { - output[(i << 2) + j] = (byte)((w[i] >> (j << 3)) & 0xFF); + output[(i << 2) + j] = (byte)(w[i] >> (j << 3)); } } } @@ -135,52 +119,36 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus protected void Haraka256Perm(byte[] output) { uint[] q = new uint[8]; - int i, j; - uint tmp_q; InterleaveConstant32(q, buffer, 0); - for (i = 0; i < 5; ++i) + for (int i = 0; i < 5; ++i) { - for (j = 0; j < 2; ++j) + for (int j = 0; j < 2; ++j) { BrAesCtBitsliceSbox(q); ShiftRows32(q); MixColumns32(q); AddRoundKey32(q, haraka256_rc[(i << 1) + j]); } - for (j = 0; j < 8; j++) + for (int j = 0; j < 8; j++) { - tmp_q = q[j]; - q[j] = (tmp_q & 0x81818181) | - (tmp_q & 0x02020202) << 1 | - (tmp_q & 0x04040404) << 2 | - (tmp_q & 0x08080808) << 3 | - (tmp_q & 0x10101010) >> 3 | - (tmp_q & 0x20202020) >> 2 | - (tmp_q & 0x40404040) >> 1; + uint t = Bits.BitPermuteStep(q[j], 0x0C_0C_0C_0CU, 2); + q[j] = Bits.BitPermuteStep(t , 0x22_22_22_22U, 1); } } BrAesCtOrtho(q); - for (i = 0; i < 4; i++) + for (int i = 0; i < 4; i++) { - BrEnc32Le(output, q[i << 1], i << 2); - BrEnc32Le(output, q[(i << 1) + 1], (i << 2) + 16); + Pack.UInt32_To_LE(q[i << 1], output, i << 2); + Pack.UInt32_To_LE(q[(i << 1) + 1], output, (i << 2) + 16); } - for (i = 0; i < 32; i++) + for (int i = 0; i < 32; i++) { output[i] ^= buffer[i]; } } - private void BrEnc32Le(byte[] dst, uint x, int startPos) - { - for (int i = 0; i < 4; ++i) - { - dst[startPos + i] = (byte)(x >> (i << 3)); - } - } - - private void BrAesCt64InterleaveIn(ulong[] q, int qPos, uint[] w, int startPos) + private static void BrAesCt64InterleaveIn(ulong[] q, int qPos, uint[] w, int startPos) { ulong x0, x1, x2, x3; x0 = (ulong)w[startPos] & 0x00000000FFFFFFFFL; @@ -382,52 +350,37 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus q[0] = s7; } - private void ShiftRows32(uint[] q) + private static void ShiftRows32(uint[] q) { - uint x; for (int i = 0; i < 8; i++) { - x = q[i]; - q[i] = (x & 0x000000FF) - | ((x & 0x0000FC00) >> 2) | ((x & 0x00000300) << 6) - | ((x & 0x00F00000) >> 4) | ((x & 0x000F0000) << 4) - | ((x & 0xC0000000) >> 6) | ((x & 0x3F000000) << 2); + uint t = Bits.BitPermuteStep(q[i], 0x0C_0F_03_00U, 4); + q[i] = Bits.BitPermuteStep(t , 0x33_00_33_00U, 2); } } - private void MixColumns32(uint[] q) + private static void MixColumns32(uint[] q) { - uint q0, q1, q2, q3, q4, q5, q6, q7; - uint r0, r1, r2, r3, r4, r5, r6, r7; - - q0 = q[0]; - q1 = q[1]; - q2 = q[2]; - q3 = q[3]; - q4 = q[4]; - q5 = q[5]; - q6 = q[6]; - q7 = q[7]; - r0 = (q0 >> 8) | (q0 << 24); - r1 = (q1 >> 8) | (q1 << 24); - r2 = (q2 >> 8) | (q2 << 24); - r3 = (q3 >> 8) | (q3 << 24); - r4 = (q4 >> 8) | (q4 << 24); - r5 = (q5 >> 8) | (q5 << 24); - r6 = (q6 >> 8) | (q6 << 24); - r7 = (q7 >> 8) | (q7 << 24); - - q[0] = q7 ^ r7 ^ r0 ^ Rotr16(q0 ^ r0); - q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ Rotr16(q1 ^ r1); - q[2] = q1 ^ r1 ^ r2 ^ Rotr16(q2 ^ r2); - q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ Rotr16(q3 ^ r3); - q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ Rotr16(q4 ^ r4); - q[5] = q4 ^ r4 ^ r5 ^ Rotr16(q5 ^ r5); - q[6] = q5 ^ r5 ^ r6 ^ Rotr16(q6 ^ r6); - q[7] = q6 ^ r6 ^ r7 ^ Rotr16(q7 ^ r7); + uint q0 = q[0], r0 = Integers.RotateRight(q0, 8), s0 = q0 ^ r0; + uint q1 = q[1], r1 = Integers.RotateRight(q1, 8), s1 = q1 ^ r1; + uint q2 = q[2], r2 = Integers.RotateRight(q2, 8), s2 = q2 ^ r2; + uint q3 = q[3], r3 = Integers.RotateRight(q3, 8), s3 = q3 ^ r3; + uint q4 = q[4], r4 = Integers.RotateRight(q4, 8), s4 = q4 ^ r4; + uint q5 = q[5], r5 = Integers.RotateRight(q5, 8), s5 = q5 ^ r5; + uint q6 = q[6], r6 = Integers.RotateRight(q6, 8), s6 = q6 ^ r6; + uint q7 = q[7], r7 = Integers.RotateRight(q7, 8), s7 = q7 ^ r7; + + q[0] = r0 ^ s7 ^ Integers.RotateRight(s0, 16); + q[1] = r1 ^ s0 ^ s7 ^ Integers.RotateRight(s1, 16); + q[2] = r2 ^ s1 ^ Integers.RotateRight(s2, 16); + q[3] = r3 ^ s2 ^ s7 ^ Integers.RotateRight(s3, 16); + q[4] = r4 ^ s3 ^ s7 ^ Integers.RotateRight(s4, 16); + q[5] = r5 ^ s4 ^ Integers.RotateRight(s5, 16); + q[6] = r6 ^ s5 ^ Integers.RotateRight(s6, 16); + q[7] = r7 ^ s6 ^ Integers.RotateRight(s7, 16); } - private void AddRoundKey32(uint[] q, uint[] sk) + private static void AddRoundKey32(uint[] q, uint[] sk) { q[0] ^= sk[0]; q[1] ^= sk[1]; @@ -439,96 +392,51 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus q[7] ^= sk[7]; } - private uint Rotr16(uint x) + private static void BrAesCt64Ortho(ulong[] q) { - return (x << 16) | (x >> 16); - } + ulong q0 = q[0], q1 = q[1], q2 = q[2], q3 = q[3], q4 = q[4], q5 = q[5], q6 = q[6], q7 = q[7]; - private void BrAesCt64Ortho(ulong[] q) - { - Swapn(q, 1, 0, 1); - Swapn(q, 1, 2, 3); - Swapn(q, 1, 4, 5); - Swapn(q, 1, 6, 7); - - Swapn(q, 2, 0, 2); - Swapn(q, 2, 1, 3); - Swapn(q, 2, 4, 6); - Swapn(q, 2, 5, 7); - - Swapn(q, 4, 0, 4); - Swapn(q, 4, 1, 5); - Swapn(q, 4, 2, 6); - Swapn(q, 4, 3, 7); - } + Bits.BitPermuteStep2(ref q1, ref q0, 0x5555555555555555UL, 1); + Bits.BitPermuteStep2(ref q3, ref q2, 0x5555555555555555UL, 1); + Bits.BitPermuteStep2(ref q5, ref q4, 0x5555555555555555UL, 1); + Bits.BitPermuteStep2(ref q7, ref q6, 0x5555555555555555UL, 1); - private void BrAesCtOrtho(uint[] q) - { - Swapn32(q, 1, 0, 1); - Swapn32(q, 1, 2, 3); - Swapn32(q, 1, 4, 5); - Swapn32(q, 1, 6, 7); - - Swapn32(q, 2, 0, 2); - Swapn32(q, 2, 1, 3); - Swapn32(q, 2, 4, 6); - Swapn32(q, 2, 5, 7); - - Swapn32(q, 4, 0, 4); - Swapn32(q, 4, 1, 5); - Swapn32(q, 4, 2, 6); - Swapn32(q, 4, 3, 7); - } + Bits.BitPermuteStep2(ref q2, ref q0, 0x3333333333333333UL, 2); + Bits.BitPermuteStep2(ref q3, ref q1, 0x3333333333333333UL, 2); + Bits.BitPermuteStep2(ref q6, ref q4, 0x3333333333333333UL, 2); + Bits.BitPermuteStep2(ref q7, ref q5, 0x3333333333333333UL, 2); - private void Swapn32(uint[] q, int s, int pos1, int pos2) - { - uint cl = 0, ch = 0; - switch (s) - { - case 1: - cl = 0x55555555; - ch = 0xAAAAAAAA; - break; - case 2: - cl = 0x33333333; - ch = 0xCCCCCCCC; - break; - case 4: - cl = 0x0F0F0F0F; - ch = 0xF0F0F0F0; - break; - } - uint a = q[pos1], b = q[pos2]; - q[pos1] = (a & cl) | ((b & cl) << s); - q[pos2] = ((a & ch) >> s) | (b & ch); + Bits.BitPermuteStep2(ref q4, ref q0, 0x0F0F0F0F0F0F0F0FUL, 4); + Bits.BitPermuteStep2(ref q5, ref q1, 0x0F0F0F0F0F0F0F0FUL, 4); + Bits.BitPermuteStep2(ref q6, ref q2, 0x0F0F0F0F0F0F0F0FUL, 4); + Bits.BitPermuteStep2(ref q7, ref q3, 0x0F0F0F0F0F0F0F0FUL, 4); + + q[0] = q0; q[1] = q1; q[2] = q2; q[3] = q3; q[4] = q4; q[5] = q5; q[6] = q6; q[7] = q7; } - private void Swapn(ulong[] q, int s, int pos1, int pos2) + private static void BrAesCtOrtho(uint[] q) { - ulong cl = 0, ch = 0; - switch (s) - { - case 1: - cl = 0x5555555555555555L; - ch = 0xAAAAAAAAAAAAAAAAL; - break; - case 2: - cl = 0x3333333333333333L; - ch = 0xCCCCCCCCCCCCCCCCL; - break; - case 4: - cl = 0x0F0F0F0F0F0F0F0FL; - ch = 0xF0F0F0F0F0F0F0F0L; - break; - default: - return; - } - ulong a = q[pos1], b = q[pos2]; - q[pos1] = (a & cl) | ((b & cl) << s); - q[pos2] = ((a & ch) >> s) | (b & ch); + uint q0 = q[0], q1 = q[1], q2 = q[2], q3 = q[3], q4 = q[4], q5 = q[5], q6 = q[6], q7 = q[7]; + + Bits.BitPermuteStep2(ref q1, ref q0, 0x55555555U, 1); + Bits.BitPermuteStep2(ref q3, ref q2, 0x55555555U, 1); + Bits.BitPermuteStep2(ref q5, ref q4, 0x55555555U, 1); + Bits.BitPermuteStep2(ref q7, ref q6, 0x55555555U, 1); + + Bits.BitPermuteStep2(ref q2, ref q0, 0x33333333U, 2); + Bits.BitPermuteStep2(ref q3, ref q1, 0x33333333U, 2); + Bits.BitPermuteStep2(ref q6, ref q4, 0x33333333U, 2); + Bits.BitPermuteStep2(ref q7, ref q5, 0x33333333U, 2); + + Bits.BitPermuteStep2(ref q4, ref q0, 0x0F0F0F0FU, 4); + Bits.BitPermuteStep2(ref q5, ref q1, 0x0F0F0F0FU, 4); + Bits.BitPermuteStep2(ref q6, ref q2, 0x0F0F0F0FU, 4); + Bits.BitPermuteStep2(ref q7, ref q3, 0x0F0F0F0FU, 4); + + q[0] = q0; q[1] = q1; q[2] = q2; q[3] = q3; q[4] = q4; q[5] = q5; q[6] = q6; q[7] = q7; } - private void BrAesCt64BitsliceSbox(ulong[] q) + private static void BrAesCt64BitsliceSbox(ulong[] q) { /* * This S-box implementation is a straightforward translation of @@ -703,60 +611,37 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus q[0] = s7; } - private void ShiftRows(ulong[] q) + private static void ShiftRows(ulong[] q) { - ulong x; - for (int i = 0; i < q.Length; i++) + for (int i = 0; i < 8; i++) { - x = q[i]; - q[i] = (x & 0x000000000000FFFFL) - | ((x & 0x00000000FFF00000L) >> 4) - | ((x & 0x00000000000F0000L) << 12) - | ((x & 0x0000FF0000000000L) >> 8) - | ((x & 0x000000FF00000000L) << 8) - | ((x & 0xF000000000000000L) >> 12) - | ((x & 0x0FFF000000000000L) << 4); + ulong x = Bits.BitPermuteStep(q[i], 0x00F0_00FF_000F_0000UL, 8); + q[i] = Bits.BitPermuteStep(x , 0x0F0F_0000_0F0F_0000UL, 4); } } - private void MixColumns(ulong[] q) - { - ulong q0, q1, q2, q3, q4, q5, q6, q7; - ulong r0, r1, r2, r3, r4, r5, r6, r7; - - q0 = q[0]; - q1 = q[1]; - q2 = q[2]; - q3 = q[3]; - q4 = q[4]; - q5 = q[5]; - q6 = q[6]; - q7 = q[7]; - r0 = (q0 >> 16) | (q0 << 48); - r1 = (q1 >> 16) | (q1 << 48); - r2 = (q2 >> 16) | (q2 << 48); - r3 = (q3 >> 16) | (q3 << 48); - r4 = (q4 >> 16) | (q4 << 48); - r5 = (q5 >> 16) | (q5 << 48); - r6 = (q6 >> 16) | (q6 << 48); - r7 = (q7 >> 16) | (q7 << 48); - - q[0] = q7 ^ r7 ^ r0 ^ Rotr32(q0 ^ r0); - q[1] = q0 ^ r0 ^ q7 ^ r7 ^ r1 ^ Rotr32(q1 ^ r1); - q[2] = q1 ^ r1 ^ r2 ^ Rotr32(q2 ^ r2); - q[3] = q2 ^ r2 ^ q7 ^ r7 ^ r3 ^ Rotr32(q3 ^ r3); - q[4] = q3 ^ r3 ^ q7 ^ r7 ^ r4 ^ Rotr32(q4 ^ r4); - q[5] = q4 ^ r4 ^ r5 ^ Rotr32(q5 ^ r5); - q[6] = q5 ^ r5 ^ r6 ^ Rotr32(q6 ^ r6); - q[7] = q6 ^ r6 ^ r7 ^ Rotr32(q7 ^ r7); - } - - private ulong Rotr32(ulong x) + private static void MixColumns(ulong[] q) { - return (x << 32) | (x >> 32); + ulong q0 = q[0], r0 = Longs.RotateRight(q0, 16), s0 = q0 ^ r0; + ulong q1 = q[1], r1 = Longs.RotateRight(q1, 16), s1 = q1 ^ r1; + ulong q2 = q[2], r2 = Longs.RotateRight(q2, 16), s2 = q2 ^ r2; + ulong q3 = q[3], r3 = Longs.RotateRight(q3, 16), s3 = q3 ^ r3; + ulong q4 = q[4], r4 = Longs.RotateRight(q4, 16), s4 = q4 ^ r4; + ulong q5 = q[5], r5 = Longs.RotateRight(q5, 16), s5 = q5 ^ r5; + ulong q6 = q[6], r6 = Longs.RotateRight(q6, 16), s6 = q6 ^ r6; + ulong q7 = q[7], r7 = Longs.RotateRight(q7, 16), s7 = q7 ^ r7; + + q[0] = r0 ^ s7 ^ Longs.RotateRight(s0, 32); + q[1] = r1 ^ s0 ^ s7 ^ Longs.RotateRight(s1, 32); + q[2] = r2 ^ s1 ^ Longs.RotateRight(s2, 32); + q[3] = r3 ^ s2 ^ s7 ^ Longs.RotateRight(s3, 32); + q[4] = r4 ^ s3 ^ s7 ^ Longs.RotateRight(s4, 32); + q[5] = r5 ^ s4 ^ Longs.RotateRight(s5, 32); + q[6] = r6 ^ s5 ^ Longs.RotateRight(s6, 32); + q[7] = r7 ^ s6 ^ Longs.RotateRight(s7, 32); } - private void AddRoundKey(ulong[] q, ulong[] sk) + private static void AddRoundKey(ulong[] q, ulong[] sk) { q[0] ^= sk[0]; q[1] ^= sk[1]; @@ -768,7 +653,7 @@ namespace Org.BouncyCastle.Pqc.Crypto.SphincsPlus q[7] ^= sk[7]; } - private void BrAesCt64InterleaveOut(uint[] w, ulong[] q, int pos) + private static void BrAesCt64InterleaveOut(uint[] w, ulong[] q, int pos) { ulong x0, x1, x2, x3; |