[cpuminer-multi.git] / scryptjane / scrypt-jane-hash_keccak.h

#if defined(SCRYPT_KECCAK256)
	#define SCRYPT_HASH "Keccak-256"
	#define SCRYPT_HASH_DIGEST_SIZE 32
#else
	#define SCRYPT_HASH "Keccak-512"
	#define SCRYPT_HASH_DIGEST_SIZE 64
#endif
#define SCRYPT_KECCAK_F 1600
#define SCRYPT_KECCAK_C (SCRYPT_HASH_DIGEST_SIZE * 8 * 2) /* 256=512, 512=1024 */
#define SCRYPT_KECCAK_R (SCRYPT_KECCAK_F - SCRYPT_KECCAK_C) /* 256=1088, 512=576 */
#define SCRYPT_HASH_BLOCK_SIZE (SCRYPT_KECCAK_R / 8)

typedef uint8_t scrypt_hash_digest[SCRYPT_HASH_DIGEST_SIZE];

typedef struct scrypt_hash_state_t {
	uint64_t state[SCRYPT_KECCAK_F / 64];
	uint32_t leftover;
	uint8_t buffer[SCRYPT_HASH_BLOCK_SIZE];
} scrypt_hash_state;

static const uint64_t keccak_round_constants[24] = {
	0x0000000000000001ull, 0x0000000000008082ull,
	0x800000000000808aull, 0x8000000080008000ull,
	0x000000000000808bull, 0x0000000080000001ull,
	0x8000000080008081ull, 0x8000000000008009ull,
	0x000000000000008aull, 0x0000000000000088ull,
	0x0000000080008009ull, 0x000000008000000aull,
	0x000000008000808bull, 0x800000000000008bull,
	0x8000000000008089ull, 0x8000000000008003ull,
	0x8000000000008002ull, 0x8000000000000080ull,
	0x000000000000800aull, 0x800000008000000aull,
	0x8000000080008081ull, 0x8000000000008080ull,
	0x0000000080000001ull, 0x8000000080008008ull
};

static void
keccak_block(scrypt_hash_state *S, const uint8_t *in) {
	size_t i;
	uint64_t *s = S->state, t[5], u[5], v, w;

	/* absorb input */
	for (i = 0; i < SCRYPT_HASH_BLOCK_SIZE / 8; i++, in += 8)
		s[i] ^= U8TO64_LE(in);
	
	for (i = 0; i < 24; i++) {
		/* theta: c = a[0,i] ^ a[1,i] ^ .. a[4,i] */
		t[0] = s[0] ^ s[5] ^ s[10] ^ s[15] ^ s[20];
		t[1] = s[1] ^ s[6] ^ s[11] ^ s[16] ^ s[21];
		t[2] = s[2] ^ s[7] ^ s[12] ^ s[17] ^ s[22];
		t[3] = s[3] ^ s[8] ^ s[13] ^ s[18] ^ s[23];
		t[4] = s[4] ^ s[9] ^ s[14] ^ s[19] ^ s[24];

		/* theta: d[i] = c[i+4] ^ rotl(c[i+1],1) */
		u[0] = t[4] ^ ROTL64(t[1], 1);
		u[1] = t[0] ^ ROTL64(t[2], 1);
		u[2] = t[1] ^ ROTL64(t[3], 1);
		u[3] = t[2] ^ ROTL64(t[4], 1);
		u[4] = t[3] ^ ROTL64(t[0], 1);

		/* theta: a[0,i], a[1,i], .. a[4,i] ^= d[i] */
		s[0] ^= u[0]; s[5] ^= u[0]; s[10] ^= u[0]; s[15] ^= u[0]; s[20] ^= u[0];
		s[1] ^= u[1]; s[6] ^= u[1]; s[11] ^= u[1]; s[16] ^= u[1]; s[21] ^= u[1];
		s[2] ^= u[2]; s[7] ^= u[2]; s[12] ^= u[2]; s[17] ^= u[2]; s[22] ^= u[2];
		s[3] ^= u[3]; s[8] ^= u[3]; s[13] ^= u[3]; s[18] ^= u[3]; s[23] ^= u[3];
		s[4] ^= u[4]; s[9] ^= u[4]; s[14] ^= u[4]; s[19] ^= u[4]; s[24] ^= u[4];

		/* rho pi: b[..] = rotl(a[..], ..) */
		v = s[ 1];
		s[ 1] = ROTL64(s[ 6], 44);
		s[ 6] = ROTL64(s[ 9], 20);
		s[ 9] = ROTL64(s[22], 61);
		s[22] = ROTL64(s[14], 39);
		s[14] = ROTL64(s[20], 18);
		s[20] = ROTL64(s[ 2], 62);
		s[ 2] = ROTL64(s[12], 43);
		s[12] = ROTL64(s[13], 25);
		s[13] = ROTL64(s[19],  8);
		s[19] = ROTL64(s[23], 56);
		s[23] = ROTL64(s[15], 41);
		s[15] = ROTL64(s[ 4], 27);
		s[ 4] = ROTL64(s[24], 14);
		s[24] = ROTL64(s[21],  2);
		s[21] = ROTL64(s[ 8], 55);
		s[ 8] = ROTL64(s[16], 45);
		s[16] = ROTL64(s[ 5], 36);
		s[ 5] = ROTL64(s[ 3], 28);
		s[ 3] = ROTL64(s[18], 21);
		s[18] = ROTL64(s[17], 15);
		s[17] = ROTL64(s[11], 10);
		s[11] = ROTL64(s[ 7],  6);
		s[ 7] = ROTL64(s[10],  3);
		s[10] = ROTL64(    v,  1);

		/* chi: a[i,j] ^= ~b[i,j+1] & b[i,j+2] */
		v = s[ 0]; w = s[ 1]; s[ 0] ^= (~w) & s[ 2]; s[ 1] ^= (~s[ 2]) & s[ 3]; s[ 2] ^= (~s[ 3]) & s[ 4]; s[ 3] ^= (~s[ 4]) & v; s[ 4] ^= (~v) & w;
		v = s[ 5]; w = s[ 6]; s[ 5] ^= (~w) & s[ 7]; s[ 6] ^= (~s[ 7]) & s[ 8]; s[ 7] ^= (~s[ 8]) & s[ 9]; s[ 8] ^= (~s[ 9]) & v; s[ 9] ^= (~v) & w;
		v = s[10]; w = s[11]; s[10] ^= (~w) & s[12]; s[11] ^= (~s[12]) & s[13]; s[12] ^= (~s[13]) & s[14]; s[13] ^= (~s[14]) & v; s[14] ^= (~v) & w;
		v = s[15]; w = s[16]; s[15] ^= (~w) & s[17]; s[16] ^= (~s[17]) & s[18]; s[17] ^= (~s[18]) & s[19]; s[18] ^= (~s[19]) & v; s[19] ^= (~v) & w;
		v = s[20]; w = s[21]; s[20] ^= (~w) & s[22]; s[21] ^= (~s[22]) & s[23]; s[22] ^= (~s[23]) & s[24]; s[23] ^= (~s[24]) & v; s[24] ^= (~v) & w;

		/* iota: a[0,0] ^= round constant */
		s[0] ^= keccak_round_constants[i];
	}
}

static void
scrypt_hash_init(scrypt_hash_state *S) {
	memset(S, 0, sizeof(*S));
}

static void
scrypt_hash_update(scrypt_hash_state *S, const uint8_t *in, size_t inlen) {
	size_t want;

	/* handle the previous data */
	if (S->leftover) {
		want = (SCRYPT_HASH_BLOCK_SIZE - S->leftover);
		want = (want < inlen) ? want : inlen;
		memcpy(S->buffer + S->leftover, in, want);
		S->leftover += (uint32_t)want;
		if (S->leftover < SCRYPT_HASH_BLOCK_SIZE)
			return;
		in += want;
		inlen -= want;
		keccak_block(S, S->buffer);
	}

	/* handle the current data */
	while (inlen >= SCRYPT_HASH_BLOCK_SIZE) {
		keccak_block(S, in);
		in += SCRYPT_HASH_BLOCK_SIZE;
		inlen -= SCRYPT_HASH_BLOCK_SIZE;
	}

	/* handle leftover data */
	S->leftover = (uint32_t)inlen;
	if (S->leftover)
		memcpy(S->buffer, in, S->leftover);
}

static void
scrypt_hash_finish(scrypt_hash_state *S, uint8_t *hash) {
	size_t i;

	S->buffer[S->leftover] = 0x01;
	memset(S->buffer + (S->leftover + 1), 0, SCRYPT_HASH_BLOCK_SIZE - (S->leftover + 1));
	S->buffer[SCRYPT_HASH_BLOCK_SIZE - 1] |= 0x80;
	keccak_block(S, S->buffer);

	for (i = 0; i < SCRYPT_HASH_DIGEST_SIZE; i += 8) {
		U64TO8_LE(&hash[i], S->state[i / 8]);
	}
}

#if defined(SCRYPT_KECCAK256)
static const uint8_t scrypt_test_hash_expected[SCRYPT_HASH_DIGEST_SIZE] = {
	0x26,0xb7,0x10,0xb3,0x66,0xb1,0xd1,0xb1,0x25,0xfc,0x3e,0xe3,0x1e,0x33,0x1d,0x19,
	0x94,0xaa,0x63,0x7a,0xd5,0x77,0x29,0xb4,0x27,0xe9,0xe0,0xf4,0x19,0xba,0x68,0xea,
};
#else
static const uint8_t scrypt_test_hash_expected[SCRYPT_HASH_DIGEST_SIZE] = {
	0x17,0xc7,0x8c,0xa0,0xd9,0x08,0x1d,0xba,0x8a,0xc8,0x3e,0x07,0x90,0xda,0x91,0x88,
	0x25,0xbd,0xd3,0xf8,0x78,0x4a,0x8d,0x5e,0xe4,0x96,0x9c,0x01,0xf3,0xeb,0xdc,0x12,
	0xea,0x35,0x57,0xba,0x94,0xb8,0xe9,0xb9,0x27,0x45,0x0a,0x48,0x5c,0x3d,0x69,0xf0,
	0xdb,0x22,0x38,0xb5,0x52,0x22,0x29,0xea,0x7a,0xb2,0xe6,0x07,0xaa,0x37,0x4d,0xe6,
};
#endif
Commit	Line	Data
b089cc9f LJ	1	#if defined(SCRYPT_KECCAK256)
	2	#define SCRYPT_HASH "Keccak-256"
	3	#define SCRYPT_HASH_DIGEST_SIZE 32
	4	#else
	5	#define SCRYPT_HASH "Keccak-512"
	6	#define SCRYPT_HASH_DIGEST_SIZE 64
	7	#endif
	8	#define SCRYPT_KECCAK_F 1600
	9	#define SCRYPT_KECCAK_C (SCRYPT_HASH_DIGEST_SIZE * 8 * 2) /* 256=512, 512=1024 */
	10	#define SCRYPT_KECCAK_R (SCRYPT_KECCAK_F - SCRYPT_KECCAK_C) /* 256=1088, 512=576 */
	11	#define SCRYPT_HASH_BLOCK_SIZE (SCRYPT_KECCAK_R / 8)
	12
	13	typedef uint8_t scrypt_hash_digest[SCRYPT_HASH_DIGEST_SIZE];
	14
	15	typedef struct scrypt_hash_state_t {
	16	uint64_t state[SCRYPT_KECCAK_F / 64];
	17	uint32_t leftover;
	18	uint8_t buffer[SCRYPT_HASH_BLOCK_SIZE];
	19	} scrypt_hash_state;
	20
	21	static const uint64_t keccak_round_constants[24] = {
	22	0x0000000000000001ull, 0x0000000000008082ull,
	23	0x800000000000808aull, 0x8000000080008000ull,
	24	0x000000000000808bull, 0x0000000080000001ull,
	25	0x8000000080008081ull, 0x8000000000008009ull,
	26	0x000000000000008aull, 0x0000000000000088ull,
	27	0x0000000080008009ull, 0x000000008000000aull,
	28	0x000000008000808bull, 0x800000000000008bull,
	29	0x8000000000008089ull, 0x8000000000008003ull,
	30	0x8000000000008002ull, 0x8000000000000080ull,
	31	0x000000000000800aull, 0x800000008000000aull,
	32	0x8000000080008081ull, 0x8000000000008080ull,
	33	0x0000000080000001ull, 0x8000000080008008ull
	34	};
	35
	36	static void
	37	keccak_block(scrypt_hash_state S, const uint8_t in) {
	38	size_t i;
	39	uint64_t *s = S->state, t[5], u[5], v, w;
	40
	41	/* absorb input */
	42	for (i = 0; i < SCRYPT_HASH_BLOCK_SIZE / 8; i++, in += 8)
	43	s[i] ^= U8TO64_LE(in);
	44
	45	for (i = 0; i < 24; i++) {
	46	/* theta: c = a[0,i] ^ a[1,i] ^ .. a[4,i] */
	47	t[0] = s[0] ^ s[5] ^ s[10] ^ s[15] ^ s[20];
	48	t[1] = s[1] ^ s[6] ^ s[11] ^ s[16] ^ s[21];
	49	t[2] = s[2] ^ s[7] ^ s[12] ^ s[17] ^ s[22];
	50	t[3] = s[3] ^ s[8] ^ s[13] ^ s[18] ^ s[23];
	51	t[4] = s[4] ^ s[9] ^ s[14] ^ s[19] ^ s[24];
	52
	53	/* theta: d[i] = c[i+4] ^ rotl(c[i+1],1) */
	54	u[0] = t[4] ^ ROTL64(t[1], 1);
	55	u[1] = t[0] ^ ROTL64(t[2], 1);
	56	u[2] = t[1] ^ ROTL64(t[3], 1);
	57	u[3] = t[2] ^ ROTL64(t[4], 1);
	58	u[4] = t[3] ^ ROTL64(t[0], 1);
	59
	60	/* theta: a[0,i], a[1,i], .. a[4,i] ^= d[i] */
	61	s[0] ^= u[0]; s[5] ^= u[0]; s[10] ^= u[0]; s[15] ^= u[0]; s[20] ^= u[0];
	62	s[1] ^= u[1]; s[6] ^= u[1]; s[11] ^= u[1]; s[16] ^= u[1]; s[21] ^= u[1];
	63	s[2] ^= u[2]; s[7] ^= u[2]; s[12] ^= u[2]; s[17] ^= u[2]; s[22] ^= u[2];
	64	s[3] ^= u[3]; s[8] ^= u[3]; s[13] ^= u[3]; s[18] ^= u[3]; s[23] ^= u[3];
65	s[4] ^= u[4]; s[9] ^= u[4]; s[14] ^= u[4]; s[19] ^= u[4]; s[24] ^= u[4];
66
67	/* rho pi: b[..] = rotl(a[..], ..) */
68	v = s[ 1];
69	s[ 1] = ROTL64(s[ 6], 44);
70	s[ 6] = ROTL64(s[ 9], 20);
71	s[ 9] = ROTL64(s[22], 61);
72	s[22] = ROTL64(s[14], 39);
73	s[14] = ROTL64(s[20], 18);
74	s[20] = ROTL64(s[ 2], 62);
75	s[ 2] = ROTL64(s[12], 43);
76	s[12] = ROTL64(s[13], 25);
77	s[13] = ROTL64(s[19], 8);
78	s[19] = ROTL64(s[23], 56);
79	s[23] = ROTL64(s[15], 41);
80	s[15] = ROTL64(s[ 4], 27);
81	s[ 4] = ROTL64(s[24], 14);
82	s[24] = ROTL64(s[21], 2);
83	s[21] = ROTL64(s[ 8], 55);
84	s[ 8] = ROTL64(s[16], 45);
85	s[16] = ROTL64(s[ 5], 36);
86	s[ 5] = ROTL64(s[ 3], 28);
87	s[ 3] = ROTL64(s[18], 21);
88	s[18] = ROTL64(s[17], 15);
89	s[17] = ROTL64(s[11], 10);
90	s[11] = ROTL64(s[ 7], 6);
91	s[ 7] = ROTL64(s[10], 3);
92	s[10] = ROTL64( v, 1);
93
94	/* chi: a[i,j] ^= ~b[i,j+1] & b[i,j+2] */
95	v = s[ 0]; w = s[ 1]; s[ 0] ^= (~w) & s[ 2]; s[ 1] ^= (~s[ 2]) & s[ 3]; s[ 2] ^= (~s[ 3]) & s[ 4]; s[ 3] ^= (~s[ 4]) & v; s[ 4] ^= (~v) & w;
96	v = s[ 5]; w = s[ 6]; s[ 5] ^= (~w) & s[ 7]; s[ 6] ^= (~s[ 7]) & s[ 8]; s[ 7] ^= (~s[ 8]) & s[ 9]; s[ 8] ^= (~s[ 9]) & v; s[ 9] ^= (~v) & w;
97	v = s[10]; w = s[11]; s[10] ^= (~w) & s[12]; s[11] ^= (~s[12]) & s[13]; s[12] ^= (~s[13]) & s[14]; s[13] ^= (~s[14]) & v; s[14] ^= (~v) & w;
98	v = s[15]; w = s[16]; s[15] ^= (~w) & s[17]; s[16] ^= (~s[17]) & s[18]; s[17] ^= (~s[18]) & s[19]; s[18] ^= (~s[19]) & v; s[19] ^= (~v) & w;
99	v = s[20]; w = s[21]; s[20] ^= (~w) & s[22]; s[21] ^= (~s[22]) & s[23]; s[22] ^= (~s[23]) & s[24]; s[23] ^= (~s[24]) & v; s[24] ^= (~v) & w;
100
101	/* iota: a[0,0] ^= round constant */
102	s[0] ^= keccak_round_constants[i];
103	}
104	}
105
106	static void
107	scrypt_hash_init(scrypt_hash_state *S) {
108	memset(S, 0, sizeof(*S));
109	}
110
111	static void
112	scrypt_hash_update(scrypt_hash_state S, const uint8_t in, size_t inlen) {
113	size_t want;
114
115	/* handle the previous data */
116	if (S->leftover) {
117	want = (SCRYPT_HASH_BLOCK_SIZE - S->leftover);
118	want = (want < inlen) ? want : inlen;
119	memcpy(S->buffer + S->leftover, in, want);
120	S->leftover += (uint32_t)want;
121	if (S->leftover < SCRYPT_HASH_BLOCK_SIZE)
122	return;
123	in += want;
124	inlen -= want;
125	keccak_block(S, S->buffer);
126	}
127
128	/* handle the current data */
129	while (inlen >= SCRYPT_HASH_BLOCK_SIZE) {
130	keccak_block(S, in);
131	in += SCRYPT_HASH_BLOCK_SIZE;
132	inlen -= SCRYPT_HASH_BLOCK_SIZE;
133	}
134
135	/* handle leftover data */
136	S->leftover = (uint32_t)inlen;
137	if (S->leftover)
138	memcpy(S->buffer, in, S->leftover);
139	}
140
141	static void
142	scrypt_hash_finish(scrypt_hash_state S, uint8_t hash) {
143	size_t i;
144
145	S->buffer[S->leftover] = 0x01;
146	memset(S->buffer + (S->leftover + 1), 0, SCRYPT_HASH_BLOCK_SIZE - (S->leftover + 1));
147	S->buffer[SCRYPT_HASH_BLOCK_SIZE - 1] \|= 0x80;
148	keccak_block(S, S->buffer);
149
150	for (i = 0; i < SCRYPT_HASH_DIGEST_SIZE; i += 8) {
151	U64TO8_LE(&hash[i], S->state[i / 8]);
152	}
153	}
154
155	#if defined(SCRYPT_KECCAK256)
156	static const uint8_t scrypt_test_hash_expected[SCRYPT_HASH_DIGEST_SIZE] = {
157	0x26,0xb7,0x10,0xb3,0x66,0xb1,0xd1,0xb1,0x25,0xfc,0x3e,0xe3,0x1e,0x33,0x1d,0x19,
158	0x94,0xaa,0x63,0x7a,0xd5,0x77,0x29,0xb4,0x27,0xe9,0xe0,0xf4,0x19,0xba,0x68,0xea,
159	};
160	#else
161	static const uint8_t scrypt_test_hash_expected[SCRYPT_HASH_DIGEST_SIZE] = {
162	0x17,0xc7,0x8c,0xa0,0xd9,0x08,0x1d,0xba,0x8a,0xc8,0x3e,0x07,0x90,0xda,0x91,0x88,
163	0x25,0xbd,0xd3,0xf8,0x78,0x4a,0x8d,0x5e,0xe4,0x96,0x9c,0x01,0xf3,0xeb,0xdc,0x12,
164	0xea,0x35,0x57,0xba,0x94,0xb8,0xe9,0xb9,0x27,0x45,0x0a,0x48,0x5c,0x3d,0x69,0xf0,
165	0xdb,0x22,0x38,0xb5,0x52,0x22,0x29,0xea,0x7a,0xb2,0xe6,0x07,0xaa,0x37,0x4d,0xe6,
166	};
167	#endif
168