providers/implementations/digests/sha3_prov.c

   1 /*
   2  * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <string.h>
  11 #include <openssl/core_names.h>
  12 #include <openssl/crypto.h>
  13 #include <openssl/evp.h>
  14 #include <openssl/params.h>
  15 #include <openssl/err.h>
  16 #include <openssl/proverr.h>
  17 #include "internal/sha3.h"
  18 #include "prov/digestcommon.h"
  19 #include "prov/implementations.h"
  20
  21 #define SHA3_FLAGS PROV_DIGEST_FLAG_ALGID_ABSENT
  22 #define SHAKE_FLAGS PROV_DIGEST_FLAG_XOF
  23 #define KMAC_FLAGS PROV_DIGEST_FLAG_XOF
  24
  25 /*
  26  * Forward declaration of any unique methods implemented here. This is not strictly
  27  * necessary for the compiler, but provides an assurance that the signatures
  28  * of the functions in the dispatch table are correct.
  29  */
  30 static OSSL_FUNC_digest_init_fn keccak_init;
  31 static OSSL_FUNC_digest_init_fn keccak_init_params;
  32 static OSSL_FUNC_digest_update_fn keccak_update;
  33 static OSSL_FUNC_digest_final_fn keccak_final;
  34 static OSSL_FUNC_digest_freectx_fn keccak_freectx;
  35 static OSSL_FUNC_digest_dupctx_fn keccak_dupctx;
  36 static OSSL_FUNC_digest_squeeze_fn shake_squeeze;
  37 static OSSL_FUNC_digest_set_ctx_params_fn shake_set_ctx_params;
  38 static OSSL_FUNC_digest_settable_ctx_params_fn shake_settable_ctx_params;
  39 static sha3_absorb_fn generic_sha3_absorb;
  40 static sha3_final_fn generic_sha3_final;
  41 static sha3_squeeze_fn generic_sha3_squeeze;
  42
  43 #if defined(OPENSSL_CPUID_OBJ) && defined(__s390__) && defined(KECCAK1600_ASM)
  44 /*
  45  * IBM S390X support
  46  */
  47 # include "s390x_arch.h"
  48 # define S390_SHA3 1
  49 # define S390_SHA3_CAPABLE(name) \
  50     ((OPENSSL_s390xcap_P.kimd[0] & S390X_CAPBIT(S390X_##name)) && \
  51      (OPENSSL_s390xcap_P.klmd[0] & S390X_CAPBIT(S390X_##name)))
  52
  53 #endif
  54
  55 static int keccak_init(void *vctx, ossl_unused const OSSL_PARAM params[])
  56 {
  57     if (!ossl_prov_is_running())
  58         return 0;
  59     /* The newctx() handles most of the ctx fixed setup. */
  60     ossl_sha3_reset((KECCAK1600_CTX *)vctx);
  61     return 1;
  62 }
  63
  64 static int keccak_init_params(void *vctx, const OSSL_PARAM params[])
  65 {
  66     return keccak_init(vctx, NULL)
  67             && shake_set_ctx_params(vctx, params);
  68 }
  69
  70 static int keccak_update(void *vctx, const unsigned char *inp, size_t len)
  71 {
  72     KECCAK1600_CTX *ctx = vctx;
  73     const size_t bsz = ctx->block_size;
  74     size_t num, rem;
  75
  76     if (len == 0)
  77         return 1;
  78
  79     /* Is there anything in the buffer already ? */
  80     if ((num = ctx->bufsz) != 0) {
  81         /* Calculate how much space is left in the buffer */
  82         rem = bsz - num;
  83         /* If the new input does not fill the buffer then just add it */
  84         if (len < rem) {
  85             memcpy(ctx->buf + num, inp, len);
  86             ctx->bufsz += len;
  87             return 1;
  88         }
  89         /* otherwise fill up the buffer and absorb the buffer */
  90         memcpy(ctx->buf + num, inp, rem);
  91         /* Update the input pointer */
  92         inp += rem;
  93         len -= rem;
  94         ctx->meth.absorb(ctx, ctx->buf, bsz);
  95         ctx->bufsz = 0;
  96     }
  97     /* Absorb the input - rem = leftover part of the input < blocksize) */
  98     rem = ctx->meth.absorb(ctx, inp, len);
  99     /* Copy the leftover bit of the input into the buffer */
 100     if (rem) {
 101         memcpy(ctx->buf, inp + len - rem, rem);
 102         ctx->bufsz = rem;
 103     }
 104     return 1;
 105 }
 106
 107 static int keccak_final(void *vctx, unsigned char *out, size_t *outl,
 108                         size_t outlen)
 109 {
 110     int ret = 1;
 111     KECCAK1600_CTX *ctx = vctx;
 112
 113     if (!ossl_prov_is_running())
 114         return 0;
 115     if (outlen > 0)
 116         ret = ctx->meth.final(ctx, out, ctx->md_size);
 117
 118     *outl = ctx->md_size;
 119     return ret;
 120 }
 121
 122 static int shake_squeeze(void *vctx, unsigned char *out, size_t *outl,
 123                          size_t outlen)
 124 {
 125     int ret = 1;
 126     KECCAK1600_CTX *ctx = vctx;
 127
 128     if (!ossl_prov_is_running())
 129         return 0;
 130     if (ctx->meth.squeeze == NULL)
 131         return 0;
 132     if (outlen > 0)
 133         ret = ctx->meth.squeeze(ctx, out, outlen);
 134
 135     *outl = outlen;
 136     return ret;
 137 }
 138
 139 /*-
 140  * Generic software version of the absorb() and final().
 141  */
 142 static size_t generic_sha3_absorb(void *vctx, const void *inp, size_t len)
 143 {
 144     KECCAK1600_CTX *ctx = vctx;
 145
 146     if (!(ctx->xof_state == XOF_STATE_INIT ||
 147           ctx->xof_state == XOF_STATE_ABSORB))
 148         return 0;
 149     ctx->xof_state = XOF_STATE_ABSORB;
 150     return SHA3_absorb(ctx->A, inp, len, ctx->block_size);
 151 }
 152
 153 static int generic_sha3_final(void *vctx, unsigned char *out, size_t outlen)
 154 {
 155     return ossl_sha3_final((KECCAK1600_CTX *)vctx, out, outlen);
 156 }
 157
 158 static int generic_sha3_squeeze(void *vctx, unsigned char *out, size_t outlen)
 159 {
 160     return ossl_sha3_squeeze((KECCAK1600_CTX *)vctx, out, outlen);
 161 }
 162
 163 static PROV_SHA3_METHOD sha3_generic_md =
 164 {
 165     generic_sha3_absorb,
 166     generic_sha3_final,
 167     NULL
 168 };
 169
 170 static PROV_SHA3_METHOD shake_generic_md =
 171 {
 172     generic_sha3_absorb,
 173     generic_sha3_final,
 174     generic_sha3_squeeze
 175 };
 176
 177 #if defined(S390_SHA3)
 178
 179 static sha3_absorb_fn s390x_sha3_absorb;
 180 static sha3_final_fn s390x_sha3_final;
 181 static sha3_final_fn s390x_shake_final;
 182
 183 /*-
 184  * The platform specific parts of the absorb() and final() for S390X.
 185  */
 186 static size_t s390x_sha3_absorb(void *vctx, const void *inp, size_t len)
 187 {
 188     KECCAK1600_CTX *ctx = vctx;
 189     size_t rem = len % ctx->block_size;
 190
 191     if (!(ctx->xof_state == XOF_STATE_INIT ||
 192           ctx->xof_state == XOF_STATE_ABSORB))
 193         return 0;
 194     ctx->xof_state = XOF_STATE_ABSORB;
 195     s390x_kimd(inp, len - rem, ctx->pad, ctx->A);
 196     return rem;
 197 }
 198
 199 static int s390x_sha3_final(void *vctx, unsigned char *out, size_t outlen)
 200 {
 201     KECCAK1600_CTX *ctx = vctx;
 202
 203     if (!ossl_prov_is_running())
 204         return 0;
 205     if (!(ctx->xof_state == XOF_STATE_INIT ||
 206           ctx->xof_state == XOF_STATE_ABSORB))
 207         return 0;
 208     ctx->xof_state = XOF_STATE_FINAL;
 209     s390x_klmd(ctx->buf, ctx->bufsz, NULL, 0, ctx->pad, ctx->A);
 210     memcpy(out, ctx->A, outlen);
 211     return 1;
 212 }
 213
 214 static int s390x_shake_final(void *vctx, unsigned char *out, size_t outlen)
 215 {
 216     KECCAK1600_CTX *ctx = vctx;
 217
 218     if (!ossl_prov_is_running())
 219         return 0;
 220     if (!(ctx->xof_state == XOF_STATE_INIT ||
 221           ctx->xof_state == XOF_STATE_ABSORB))
 222         return 0;
 223     ctx->xof_state = XOF_STATE_FINAL;
 224     s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, ctx->pad, ctx->A);
 225     return 1;
 226 }
 227
 228 static int s390x_shake_squeeze(void *vctx, unsigned char *out, size_t outlen)
 229 {
 230     KECCAK1600_CTX *ctx = vctx;
 231     size_t len;
 232
 233     if (!ossl_prov_is_running())
 234         return 0;
 235     if (ctx->xof_state == XOF_STATE_FINAL)
 236         return 0;
 237     /*
 238      * On the first squeeze call, finish the absorb process (incl. padding).
 239      */
 240     if (ctx->xof_state != XOF_STATE_SQUEEZE) {
 241         ctx->xof_state = XOF_STATE_SQUEEZE;
 242         s390x_klmd(ctx->buf, ctx->bufsz, out, outlen, ctx->pad, ctx->A);
 243         ctx->bufsz = outlen % ctx->block_size;
 244         /* reuse ctx->bufsz to count bytes squeezed from current sponge */
 245         return 1;
 246     }
 247     ctx->xof_state = XOF_STATE_SQUEEZE;
 248     if (ctx->bufsz != 0) {
 249         len = ctx->block_size - ctx->bufsz;
 250         if (outlen < len)
 251             len = outlen;
 252         memcpy(out, (char *)ctx->A + ctx->bufsz, len);
 253         out += len;
 254         outlen -= len;
 255         ctx->bufsz += len;
 256         if (ctx->bufsz == ctx->block_size)
 257             ctx->bufsz = 0;
 258     }
 259     if (outlen == 0)
 260         return 1;
 261     s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A);
 262     ctx->bufsz = outlen % ctx->block_size;
 263
 264     return 1;
 265 }
 266
 267 static int s390x_keccakc_final(void *vctx, unsigned char *out, size_t outlen,
 268                                int padding)
 269 {
 270     KECCAK1600_CTX *ctx = vctx;
 271     size_t bsz = ctx->block_size;
 272     size_t num = ctx->bufsz;
 273     size_t needed = outlen;
 274
 275     if (!ossl_prov_is_running())
 276         return 0;
 277     if (!(ctx->xof_state == XOF_STATE_INIT ||
 278           ctx->xof_state == XOF_STATE_ABSORB))
 279         return 0;
 280     ctx->xof_state = XOF_STATE_FINAL;
 281     if (outlen == 0)
 282         return 1;
 283     memset(ctx->buf + num, 0, bsz - num);
 284     ctx->buf[num] = padding;
 285     ctx->buf[bsz - 1] |= 0x80;
 286     s390x_kimd(ctx->buf, bsz, ctx->pad, ctx->A);
 287     num = needed > bsz ? bsz : needed;
 288     memcpy(out, ctx->A, num);
 289     needed -= num;
 290     if (needed > 0)
 291         s390x_klmd(NULL, 0, out + bsz, needed, ctx->pad | S390X_KLMD_PS, ctx->A);
 292
 293     return 1;
 294 }
 295
 296 static int s390x_keccak_final(void *vctx, unsigned char *out, size_t outlen)
 297 {
 298     return s390x_keccakc_final(vctx, out, outlen, 0x01);
 299 }
 300
 301 static int s390x_kmac_final(void *vctx, unsigned char *out, size_t outlen)
 302 {
 303     return s390x_keccakc_final(vctx, out, outlen, 0x04);
 304 }
 305
 306 static int s390x_keccakc_squeeze(void *vctx, unsigned char *out, size_t outlen,
 307                                  int padding)
 308 {
 309     KECCAK1600_CTX *ctx = vctx;
 310     size_t len;
 311
 312     if (!ossl_prov_is_running())
 313         return 0;
 314     if (ctx->xof_state == XOF_STATE_FINAL)
 315         return 0;
 316     /*
 317      * On the first squeeze call, finish the absorb process
 318      * by adding the trailing padding and then doing
 319      * a final absorb.
 320      */
 321     if (ctx->xof_state != XOF_STATE_SQUEEZE) {
 322         len = ctx->block_size - ctx->bufsz;
 323         memset(ctx->buf + ctx->bufsz, 0, len);
 324         ctx->buf[ctx->bufsz] = padding;
 325         ctx->buf[ctx->block_size - 1] |= 0x80;
 326         s390x_kimd(ctx->buf, ctx->block_size, ctx->pad, ctx->A);
 327         ctx->bufsz = 0;
 328         /* reuse ctx->bufsz to count bytes squeezed from current sponge */
 329     }
 330     if (ctx->bufsz != 0 || ctx->xof_state != XOF_STATE_SQUEEZE) {
 331         len = ctx->block_size - ctx->bufsz;
 332         if (outlen < len)
 333             len = outlen;
 334         memcpy(out, (char *)ctx->A + ctx->bufsz, len);
 335         out += len;
 336         outlen -= len;
 337         ctx->bufsz += len;
 338         if (ctx->bufsz == ctx->block_size)
 339             ctx->bufsz = 0;
 340     }
 341     ctx->xof_state = XOF_STATE_SQUEEZE;
 342     if (outlen == 0)
 343         return 1;
 344     s390x_klmd(NULL, 0, out, outlen, ctx->pad | S390X_KLMD_PS, ctx->A);
 345     ctx->bufsz = outlen % ctx->block_size;
 346
 347     return 1;
 348 }
 349
 350 static int s390x_keccak_squeeze(void *vctx, unsigned char *out, size_t outlen)
 351 {
 352      return s390x_keccakc_squeeze(vctx, out, outlen, 0x01);
 353 }
 354
 355 static int s390x_kmac_squeeze(void *vctx, unsigned char *out, size_t outlen)
 356 {
 357      return s390x_keccakc_squeeze(vctx, out, outlen, 0x04);
 358 }
 359
 360 static PROV_SHA3_METHOD sha3_s390x_md =
 361 {
 362     s390x_sha3_absorb,
 363     s390x_sha3_final,
 364     NULL,
 365 };
 366
 367 static PROV_SHA3_METHOD keccak_s390x_md =
 368 {
 369     s390x_sha3_absorb,
 370     s390x_keccak_final,
 371     s390x_keccak_squeeze,
 372 };
 373
 374 static PROV_SHA3_METHOD shake_s390x_md =
 375 {
 376     s390x_sha3_absorb,
 377     s390x_shake_final,
 378     s390x_shake_squeeze,
 379 };
 380
 381 static PROV_SHA3_METHOD kmac_s390x_md =
 382 {
 383     s390x_sha3_absorb,
 384     s390x_kmac_final,
 385     s390x_kmac_squeeze,
 386 };
 387
 388 # define SHAKE_SET_MD(uname, typ)                                              \
 389     if (S390_SHA3_CAPABLE(uname)) {                                            \
 390         ctx->pad = S390X_##uname;                                              \
 391         ctx->meth = typ##_s390x_md;                                            \
 392     } else {                                                                   \
 393         ctx->meth = shake_generic_md;                                          \
 394     }
 395
 396 # define SHA3_SET_MD(uname, typ)                                               \
 397     if (S390_SHA3_CAPABLE(uname)) {                                            \
 398         ctx->pad = S390X_##uname;                                              \
 399         ctx->meth = typ##_s390x_md;                                            \
 400     } else {                                                                   \
 401         ctx->meth = sha3_generic_md;                                           \
 402     }
 403 # define KMAC_SET_MD(bitlen)                                                   \
 404     if (S390_SHA3_CAPABLE(SHAKE_##bitlen)) {                                   \
 405         ctx->pad = S390X_SHAKE_##bitlen;                                       \
 406         ctx->meth = kmac_s390x_md;                                             \
 407     } else {                                                                   \
 408         ctx->meth = sha3_generic_md;                                           \
 409     }
 410 #elif defined(__aarch64__) && defined(KECCAK1600_ASM)
 411 # include "arm_arch.h"
 412
 413 static sha3_absorb_fn armsha3_sha3_absorb;
 414
 415 size_t SHA3_absorb_cext(uint64_t A[5][5], const unsigned char *inp, size_t len,
 416                         size_t r);
 417 /*-
 418  * Hardware-assisted ARMv8.2 SHA3 extension version of the absorb()
 419  */
 420 static size_t armsha3_sha3_absorb(void *vctx, const void *inp, size_t len)
 421 {
 422     KECCAK1600_CTX *ctx = vctx;
 423
 424     return SHA3_absorb_cext(ctx->A, inp, len, ctx->block_size);
 425 }
 426
 427 static PROV_SHA3_METHOD sha3_ARMSHA3_md =
 428 {
 429     armsha3_sha3_absorb,
 430     generic_sha3_final
 431 };
 432 static PROV_SHA3_METHOD shake_ARMSHA3_md =
 433 {
 434     armsha3_sha3_absorb,
 435     generic_sha3_final,
 436     generic_sha3_squeeze
 437 };
 438 # define SHAKE_SET_MD(uname, typ)                                              \
 439     if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
 440         ctx->meth = shake_ARMSHA3_md;                                          \
 441     } else {                                                                   \
 442         ctx->meth = shake_generic_md;                                          \
 443     }
 444
 445 # define SHA3_SET_MD(uname, typ)                                               \
 446     if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
 447         ctx->meth = sha3_ARMSHA3_md;                                           \
 448     } else {                                                                   \
 449         ctx->meth = sha3_generic_md;                                           \
 450     }
 451 # define KMAC_SET_MD(bitlen)                                                   \
 452     if (OPENSSL_armcap_P & ARMV8_HAVE_SHA3_AND_WORTH_USING) {                  \
 453         ctx->meth = sha3_ARMSHA3_md;                                           \
 454     } else {                                                                   \
 455         ctx->meth = sha3_generic_md;                                           \
 456     }
 457 #else
 458 # define SHA3_SET_MD(uname, typ) ctx->meth = sha3_generic_md;
 459 # define KMAC_SET_MD(bitlen) ctx->meth = sha3_generic_md;
 460 # define SHAKE_SET_MD(uname, typ) ctx->meth = shake_generic_md;
 461 #endif /* S390_SHA3 */
 462
 463 #define SHA3_newctx(typ, uname, name, bitlen, pad)                             \
 464 static OSSL_FUNC_digest_newctx_fn name##_newctx;                               \
 465 static void *name##_newctx(void *provctx)                                      \
 466 {                                                                              \
 467     KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \
 468                                                 : NULL;                        \
 469                                                                                \
 470     if (ctx == NULL)                                                           \
 471         return NULL;                                                           \
 472     ossl_sha3_init(ctx, pad, bitlen);                                          \
 473     SHA3_SET_MD(uname, typ)                                                    \
 474     return ctx;                                                                \
 475 }
 476
 477 #define SHAKE_newctx(typ, uname, name, bitlen, pad)                            \
 478 static OSSL_FUNC_digest_newctx_fn name##_newctx;                               \
 479 static void *name##_newctx(void *provctx)                                      \
 480 {                                                                              \
 481     KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx))\
 482                                                 : NULL;                        \
 483                                                                                \
 484     if (ctx == NULL)                                                           \
 485         return NULL;                                                           \
 486     ossl_sha3_init(ctx, pad, bitlen);                                          \
 487     SHAKE_SET_MD(uname, typ)                                                   \
 488     return ctx;                                                                \
 489 }
 490
 491 #define KMAC_newctx(uname, bitlen, pad)                                        \
 492 static OSSL_FUNC_digest_newctx_fn uname##_newctx;                              \
 493 static void *uname##_newctx(void *provctx)                                     \
 494 {                                                                              \
 495     KECCAK1600_CTX *ctx = ossl_prov_is_running() ? OPENSSL_zalloc(sizeof(*ctx)) \
 496                                                 : NULL;                        \
 497                                                                                \
 498     if (ctx == NULL)                                                           \
 499         return NULL;                                                           \
 500     ossl_keccak_kmac_init(ctx, pad, bitlen);                                   \
 501     KMAC_SET_MD(bitlen)                                                        \
 502     return ctx;                                                                \
 503 }
 504
 505 #define PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags)   \
 506 PROV_FUNC_DIGEST_GET_PARAM(name, blksize, dgstsize, flags)                     \
 507 const OSSL_DISPATCH ossl_##name##_functions[] = {                              \
 508     { OSSL_FUNC_DIGEST_NEWCTX, (void (*)(void))name##_newctx },                \
 509     { OSSL_FUNC_DIGEST_UPDATE, (void (*)(void))keccak_update },                \
 510     { OSSL_FUNC_DIGEST_FINAL, (void (*)(void))keccak_final },                  \
 511     { OSSL_FUNC_DIGEST_FREECTX, (void (*)(void))keccak_freectx },              \
 512     { OSSL_FUNC_DIGEST_DUPCTX, (void (*)(void))keccak_dupctx },                \
 513     PROV_DISPATCH_FUNC_DIGEST_GET_PARAMS(name)
 514
 515 #define PROV_FUNC_SHA3_DIGEST(name, bitlen, blksize, dgstsize, flags)          \
 516     PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags),      \
 517     { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init },                    \
 518     PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END
 519
 520 #define PROV_FUNC_SHAKE_DIGEST(name, bitlen, blksize, dgstsize, flags)         \
 521     PROV_FUNC_SHA3_DIGEST_COMMON(name, bitlen, blksize, dgstsize, flags),      \
 522     { OSSL_FUNC_DIGEST_SQUEEZE, (void (*)(void))shake_squeeze },               \
 523     { OSSL_FUNC_DIGEST_INIT, (void (*)(void))keccak_init_params },             \
 524     { OSSL_FUNC_DIGEST_SET_CTX_PARAMS, (void (*)(void))shake_set_ctx_params }, \
 525     { OSSL_FUNC_DIGEST_SETTABLE_CTX_PARAMS,                                    \
 526      (void (*)(void))shake_settable_ctx_params },                              \
 527     PROV_DISPATCH_FUNC_DIGEST_CONSTRUCT_END
 528
 529 static void keccak_freectx(void *vctx)
 530 {
 531     KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx;
 532
 533     OPENSSL_clear_free(ctx,  sizeof(*ctx));
 534 }
 535
 536 static void *keccak_dupctx(void *ctx)
 537 {
 538     KECCAK1600_CTX *in = (KECCAK1600_CTX *)ctx;
 539     KECCAK1600_CTX *ret = ossl_prov_is_running() ? OPENSSL_malloc(sizeof(*ret))
 540                                                  : NULL;
 541
 542     if (ret != NULL)
 543         *ret = *in;
 544     return ret;
 545 }
 546
 547 static const OSSL_PARAM known_shake_settable_ctx_params[] = {
 548     {OSSL_DIGEST_PARAM_XOFLEN, OSSL_PARAM_UNSIGNED_INTEGER, NULL, 0, 0},
 549     OSSL_PARAM_END
 550 };
 551 static const OSSL_PARAM *shake_settable_ctx_params(ossl_unused void *ctx,
 552                                                    ossl_unused void *provctx)
 553 {
 554     return known_shake_settable_ctx_params;
 555 }
 556
 557 static int shake_set_ctx_params(void *vctx, const OSSL_PARAM params[])
 558 {
 559     const OSSL_PARAM *p;
 560     KECCAK1600_CTX *ctx = (KECCAK1600_CTX *)vctx;
 561
 562     if (ctx == NULL)
 563         return 0;
 564     if (params == NULL)
 565         return 1;
 566
 567     p = OSSL_PARAM_locate_const(params, OSSL_DIGEST_PARAM_XOFLEN);
 568     if (p != NULL && !OSSL_PARAM_get_size_t(p, &ctx->md_size)) {
 569         ERR_raise(ERR_LIB_PROV, PROV_R_FAILED_TO_GET_PARAMETER);
 570         return 0;
 571     }
 572     return 1;
 573 }
 574
 575 #define IMPLEMENT_SHA3_functions(bitlen)                                       \
 576     SHA3_newctx(sha3, SHA3_##bitlen, sha3_##bitlen, bitlen, '\x06')            \
 577     PROV_FUNC_SHA3_DIGEST(sha3_##bitlen, bitlen,                               \
 578                           SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen),         \
 579                           SHA3_FLAGS)
 580
 581 #define IMPLEMENT_KECCAK_functions(bitlen)                                     \
 582     SHA3_newctx(keccak, KECCAK_##bitlen, keccak_##bitlen, bitlen, '\x01')      \
 583     PROV_FUNC_SHA3_DIGEST(keccak_##bitlen, bitlen,                             \
 584                           SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen),         \
 585                           SHA3_FLAGS)
 586
 587 #define IMPLEMENT_SHAKE_functions(bitlen)                                      \
 588     SHAKE_newctx(shake, SHAKE_##bitlen, shake_##bitlen, bitlen, '\x1f')        \
 589     PROV_FUNC_SHAKE_DIGEST(shake_##bitlen, bitlen,                             \
 590                           SHA3_BLOCKSIZE(bitlen), SHA3_MDSIZE(bitlen),         \
 591                           SHAKE_FLAGS)
 592 #define IMPLEMENT_KMAC_functions(bitlen)                                       \
 593     KMAC_newctx(keccak_kmac_##bitlen, bitlen, '\x04')                          \
 594     PROV_FUNC_SHAKE_DIGEST(keccak_kmac_##bitlen, bitlen,                       \
 595                            SHA3_BLOCKSIZE(bitlen), KMAC_MDSIZE(bitlen),        \
 596                            KMAC_FLAGS)
 597
 598 /* ossl_sha3_224_functions */
 599 IMPLEMENT_SHA3_functions(224)
 600 /* ossl_sha3_256_functions */
 601 IMPLEMENT_SHA3_functions(256)
 602 /* ossl_sha3_384_functions */
 603 IMPLEMENT_SHA3_functions(384)
 604 /* ossl_sha3_512_functions */
 605 IMPLEMENT_SHA3_functions(512)
 606 /* ossl_keccak_224_functions */
 607 IMPLEMENT_KECCAK_functions(224)
 608 /* ossl_keccak_256_functions */
 609 IMPLEMENT_KECCAK_functions(256)
 610 /* ossl_keccak_384_functions */
 611 IMPLEMENT_KECCAK_functions(384)
 612 /* ossl_keccak_512_functions */
 613 IMPLEMENT_KECCAK_functions(512)
 614 /* ossl_shake_128_functions */
 615 IMPLEMENT_SHAKE_functions(128)
 616 /* ossl_shake_256_functions */
 617 IMPLEMENT_SHAKE_functions(256)
 618 /* ossl_keccak_kmac_128_functions */
 619 IMPLEMENT_KMAC_functions(128)
 620 /* ossl_keccak_kmac_256_functions */
 621 IMPLEMENT_KMAC_functions(256)