Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SHA3 and SHAKE - New API Design #2084

Closed
wants to merge 18 commits into from
+337 −237
Closed

SHA3 and SHAKE - New API Design #2084

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
c6ed451
Introduce SHA3/SHAKE layered API design; Only SHA3/SHAKE files updates
manastasova Dec 30, 2024
a05d255
Add changes to ML-KEM based on SHA3/SHAKE new API Design
manastasova Dec 30, 2024
50cf7fa
Add changes to ML-DSA based on SHA3/SHAKE new API Design
manastasova Dec 30, 2024
4b0b92e
Update build files in generated-src
manastasova Dec 30, 2024
eb992ea
Update service indicator in SHA3_Final
manastasova Dec 30, 2024
d40fbec
Initialize |ctx->padded| to 0 for SHAKE inside SHAKE_Init
manastasova Dec 31, 2024
adb910d
Update service indicator at the end of SHAKE_Finalize; The XOF functi…
manastasova Dec 31, 2024
02b8085
Fix conflicts with MLDSA parameters renaming
manastasova Dec 31, 2024
e61be0d
Merge branch 'main' into sha3_absorb_squeeze
manastasova Dec 31, 2024
3008821
Merge branch 'aws:main' into sha3_absorb_squeeze
manastasova Jan 3, 2025
2a1622f
Update SHAKE single-shot and streaming APIs
manastasova Jan 3, 2025
c5d0afd
Update incremental block-wise SHAKE squeezes in MLKEM
manastasova Jan 3, 2025
b6a5590
Update incremental block-wise SHAKE squeezes in MLDSA
manastasova Jan 3, 2025
7ccaeba
Replace |keccak_st->padded| flag with |keccak_st->state| flag
manastasova Jan 3, 2025
7edb6c7
Update MLKEM and MLDSA
manastasova Jan 3, 2025
7386c1b
Update Keccak state flag in SHA3 functions
manastasova Jan 3, 2025
e424771
Address code review comments
manastasova Jan 4, 2025
6597af1
Add export macro to functions in the tests
manastasova Jan 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion crypto/dilithium/pqcrystals_dilithium_ref_common/params.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ typedef struct {
#define ML_DSA_L_MAX (7)
#define ML_DSA_C_TILDE_BYTES_MAX (64)
#define ML_DSA_POLYW1_PACKEDBYTES_MAX (192)
#define ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX ((227 + SHAKE256_RATE - 1)/SHAKE256_RATE)
#define ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX ((227 + SHAKE256_BLOCKSIZE - 1)/SHAKE256_BLOCKSIZE)
#define ML_DSA_POLYZ_PACKEDBYTES_MAX (576)

void ml_dsa_44_params_init(ml_dsa_params *params);
Expand Down
50 changes: 25 additions & 25 deletions crypto/dilithium/pqcrystals_dilithium_ref_common/poly.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -301,24 +301,24 @@ static unsigned int ml_dsa_rej_uniform(int32_t *a,
* - const uint8_t seed[]: byte array with seed of length SEEDBYTES
* - uint16_t nonce: 2-byte nonce
**************************************************/
#define POLY_UNIFORM_NBLOCKS ((768 + SHAKE128_RATE - 1)/ SHAKE128_RATE)
#define POLY_UNIFORM_NBLOCKS ((768 + SHAKE128_BLOCKSIZE - 1)/ SHAKE128_BLOCKSIZE)
void ml_dsa_poly_uniform(ml_dsa_poly *a,
const uint8_t seed[ML_DSA_SEEDBYTES],
uint16_t nonce)
{
unsigned int i, ctr, off;
unsigned int buflen = POLY_UNIFORM_NBLOCKS*SHAKE128_RATE;
uint8_t buf[POLY_UNIFORM_NBLOCKS*SHAKE128_RATE + 2];
unsigned int buflen = POLY_UNIFORM_NBLOCKS*SHAKE128_BLOCKSIZE;
uint8_t buf[POLY_UNIFORM_NBLOCKS*SHAKE128_BLOCKSIZE + 2];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the + 2? Should that be reflected in buflen?

KECCAK1600_CTX state;

uint8_t t[2];
t[0] = nonce & 0xff;
t[1] = nonce >> 8;

SHAKE_Init(&state, SHAKE128_BLOCKSIZE);
SHA3_Update(&state, seed, ML_DSA_SEEDBYTES);
SHA3_Update(&state, t, 2);
SHAKE_Final(buf, &state, POLY_UNIFORM_NBLOCKS * SHAKE128_BLOCKSIZE);
SHAKE_Absorb(&state, seed, ML_DSA_SEEDBYTES);
SHAKE_Absorb(&state, t, 2);
SHAKE_Squeeze(buf, &state, POLY_UNIFORM_NBLOCKS * SHAKE128_BLOCKSIZE);

ctr = ml_dsa_rej_uniform(a->coeffs, ML_DSA_N, buf, buflen);

Expand All @@ -327,8 +327,8 @@ void ml_dsa_poly_uniform(ml_dsa_poly *a,
for(i = 0; i < off; ++i)
buf[i] = buf[buflen - off + i];

SHAKE_Final(buf + off, &state, POLY_UNIFORM_NBLOCKS * SHAKE128_BLOCKSIZE);
buflen = SHAKE128_RATE + off;
SHAKE_Squeeze(buf + off, &state, POLY_UNIFORM_NBLOCKS * SHAKE128_BLOCKSIZE);
buflen = SHAKE128_BLOCKSIZE + off;
ctr += ml_dsa_rej_uniform(a->coeffs + ctr, ML_DSA_N - ctr, buf, buflen);
}
/* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
Expand Down Expand Up @@ -409,25 +409,26 @@ void ml_dsa_poly_uniform_eta(ml_dsa_params *params,
uint16_t nonce)
{
unsigned int ctr;
unsigned int buflen = ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_RATE;
uint8_t buf[ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_RATE];
unsigned int buflen = ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_BLOCKSIZE;
uint8_t buf[ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_BLOCKSIZE];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming this buf and buflen are related:

Suggested change
uint8_t buf[ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_BLOCKSIZE];
uint8_t buf[buflen];

KECCAK1600_CTX state;

uint8_t t[2];
t[0] = nonce & 0xff;
t[1] = nonce >> 8;

SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, seed, ML_DSA_CRHBYTES);
SHA3_Update(&state, t, 2);
SHAKE_Final(buf, &state, ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_BLOCKSIZE);
SHAKE_Absorb(&state, seed, ML_DSA_CRHBYTES);
SHAKE_Absorb(&state, t, 2);
SHAKE_Squeeze(buf, &state, ML_DSA_POLY_UNIFORM_ETA_NBLOCKS_MAX * SHAKE256_BLOCKSIZE);

ctr = rej_eta(params, a->coeffs, ML_DSA_N, buf, buflen);

while(ctr < ML_DSA_N) {
SHAKE_Final(buf, &state, SHAKE256_BLOCKSIZE);
ctr += rej_eta(params, a->coeffs + ctr, ML_DSA_N - ctr, buf, SHAKE256_RATE);
SHAKE_Squeeze(buf, &state, SHAKE256_BLOCKSIZE);
ctr += rej_eta(params, a->coeffs + ctr, ML_DSA_N - ctr, buf, SHAKE256_BLOCKSIZE);
}

/* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
OPENSSL_cleanse(buf, sizeof(buf));
OPENSSL_cleanse(&state, sizeof(state));
Expand All @@ -445,23 +446,22 @@ void ml_dsa_poly_uniform_eta(ml_dsa_params *params,
* - const uint8_t seed[]: byte array with seed of length CRHBYTES
* - uint16_t nonce: 16-bit nonce
**************************************************/
#define POLY_UNIFORM_GAMMA1_NBLOCKS ((ML_DSA_POLYZ_PACKEDBYTES_MAX + SHAKE256_RATE - 1) / SHAKE256_RATE)
#define POLY_UNIFORM_GAMMA1_NBLOCKS ((ML_DSA_POLYZ_PACKEDBYTES_MAX + SHAKE256_BLOCKSIZE - 1) / SHAKE256_BLOCKSIZE)
void ml_dsa_poly_uniform_gamma1(ml_dsa_params *params,
ml_dsa_poly *a,
const uint8_t seed[ML_DSA_CRHBYTES],
uint16_t nonce)
{
uint8_t buf[POLY_UNIFORM_GAMMA1_NBLOCKS * SHAKE256_RATE];
uint8_t buf[POLY_UNIFORM_GAMMA1_NBLOCKS * SHAKE256_BLOCKSIZE];
KECCAK1600_CTX state;

uint8_t t[2];
t[0] = nonce & 0xff;
t[1] = nonce >> 8;

SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, seed, ML_DSA_CRHBYTES);
SHA3_Update(&state, t, 2);

SHAKE_Absorb(&state, seed, ML_DSA_CRHBYTES);
SHAKE_Absorb(&state, t, 2);
SHAKE_Final(buf, &state, POLY_UNIFORM_GAMMA1_NBLOCKS * SHAKE256_BLOCKSIZE);
ml_dsa_polyz_unpack(params, a, buf);
/* FIPS 204. Section 3.6.3 Destruction of intermediate values. */
Expand All @@ -483,12 +483,12 @@ void ml_dsa_poly_uniform_gamma1(ml_dsa_params *params,
void ml_dsa_poly_challenge(ml_dsa_params *params, ml_dsa_poly *c, const uint8_t *seed) {
unsigned int i, b, pos;
uint64_t signs;
uint8_t buf[SHAKE256_RATE];
uint8_t buf[SHAKE256_BLOCKSIZE];
KECCAK1600_CTX state;

SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, seed, params->c_tilde_bytes);
SHAKE_Final(buf, &state, SHAKE256_BLOCKSIZE);
SHAKE_Absorb(&state, seed, params->c_tilde_bytes);
SHAKE_Squeeze(buf, &state, SHAKE256_BLOCKSIZE);

signs = 0;
for(i = 0; i < 8; ++i) {
Expand All @@ -501,8 +501,8 @@ void ml_dsa_poly_challenge(ml_dsa_params *params, ml_dsa_poly *c, const uint8_t
}
for(i = ML_DSA_N-params->tau; i < ML_DSA_N; ++i) {
do {
if(pos >= SHAKE256_RATE) {
SHAKE_Final(buf, &state, SHAKE256_BLOCKSIZE);
if(pos >= SHAKE256_BLOCKSIZE) {
SHAKE_Squeeze(buf, &state, SHAKE256_BLOCKSIZE);
pos = 0;
}

Expand Down
27 changes: 14 additions & 13 deletions crypto/dilithium/pqcrystals_dilithium_ref_common/sign.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,16 +156,16 @@ int ml_dsa_sign_internal(ml_dsa_params *params,
// processing of M' in the external function. However, as M' = (pre, msg),
// mu = CRH(tr, M') = CRH(tr, pre, msg).
SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, tr, ML_DSA_TRBYTES);
SHA3_Update(&state, pre, prelen);
SHA3_Update(&state, m, mlen);
SHAKE_Absorb(&state, tr, ML_DSA_TRBYTES);
SHAKE_Absorb(&state, pre, prelen);
SHAKE_Absorb(&state, m, mlen);
SHAKE_Final(mu, &state, ML_DSA_CRHBYTES);

/* FIPS 204: line 7 Compute rhoprime = CRH(key, rnd, mu) */
SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, key, ML_DSA_SEEDBYTES);
SHA3_Update(&state, rnd, ML_DSA_RNDBYTES);
SHA3_Update(&state, mu, ML_DSA_CRHBYTES);
SHAKE_Absorb(&state, key, ML_DSA_SEEDBYTES);
SHAKE_Absorb(&state, rnd, ML_DSA_RNDBYTES);
SHAKE_Absorb(&state, mu, ML_DSA_CRHBYTES);
SHAKE_Final(rhoprime, &state, ML_DSA_CRHBYTES);

/* FIPS 204: line 5 Expand matrix and transform vectors */
Expand All @@ -191,8 +191,8 @@ int ml_dsa_sign_internal(ml_dsa_params *params,
ml_dsa_polyveck_pack_w1(params, sig, &w1);

SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, mu, ML_DSA_CRHBYTES);
SHA3_Update(&state, sig, params->k * params->poly_w1_packed_bytes);
SHAKE_Absorb(&state, mu, ML_DSA_CRHBYTES);
SHAKE_Absorb(&state, sig, params->k * params->poly_w1_packed_bytes);
SHAKE_Final(sig, &state, params->c_tilde_bytes);
ml_dsa_poly_challenge(params, &cp, sig);
ml_dsa_poly_ntt(&cp);
Expand Down Expand Up @@ -395,9 +395,9 @@ int ml_dsa_verify_internal(ml_dsa_params *params,
// Like crypto_sign_signature_internal, the processing of M' is performed
// here, as opposed to within the external function.
SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, tr, ML_DSA_TRBYTES);
SHA3_Update(&state, pre, prelen);
SHA3_Update(&state, m, mlen);
SHAKE_Absorb(&state, tr, ML_DSA_TRBYTES);
SHAKE_Absorb(&state, pre, prelen);
SHAKE_Absorb(&state, m, mlen);
SHAKE_Final(mu, &state, ML_DSA_CRHBYTES);

/* FIPS 204: line 9 Matrix-vector multiplication; compute Az - c2^dt1 */
Expand All @@ -423,9 +423,10 @@ int ml_dsa_verify_internal(ml_dsa_params *params,

/* FIPS 204: line 12 Call random oracle and verify challenge */
SHAKE_Init(&state, SHAKE256_BLOCKSIZE);
SHA3_Update(&state, mu, ML_DSA_CRHBYTES);
SHA3_Update(&state, buf, params->k * params->poly_w1_packed_bytes);
SHAKE_Absorb(&state, mu, ML_DSA_CRHBYTES);
SHAKE_Absorb(&state, buf, params->k * params->poly_w1_packed_bytes);
SHAKE_Final(c2, &state, params->c_tilde_bytes);

for(i = 0; i < params->c_tilde_bytes; ++i) {
if(c[i] != c2[i]) {
return -1;
Expand Down
12 changes: 6 additions & 6 deletions crypto/fipsmodule/digest/digests.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,7 +326,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512_256) {


static void sha3_224_init(EVP_MD_CTX *ctx) {
CHECK(SHA3_Init(ctx->md_data, SHA3_PAD_CHAR, SHA3_224_DIGEST_BITLENGTH));
CHECK(SHA3_Init(ctx->md_data, SHA3_224_DIGEST_BITLENGTH));
}

static void sha3_224_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
Expand All @@ -351,7 +351,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_224) {


static void sha3_256_init(EVP_MD_CTX *ctx) {
CHECK(SHA3_Init(ctx->md_data, SHA3_PAD_CHAR, SHA3_256_DIGEST_BITLENGTH));
CHECK(SHA3_Init(ctx->md_data, SHA3_256_DIGEST_BITLENGTH));
}

static void sha3_256_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
Expand All @@ -376,7 +376,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_256) {


static void sha3_384_init(EVP_MD_CTX *ctx) {
CHECK(SHA3_Init(ctx->md_data, SHA3_PAD_CHAR, SHA3_384_DIGEST_BITLENGTH));
CHECK(SHA3_Init(ctx->md_data, SHA3_384_DIGEST_BITLENGTH));
}

static void sha3_384_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
Expand All @@ -401,7 +401,7 @@ DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha3_384) {


static void sha3_512_init(EVP_MD_CTX *ctx) {
CHECK(SHA3_Init(ctx->md_data, SHA3_PAD_CHAR, SHA3_512_DIGEST_BITLENGTH));
CHECK(SHA3_Init(ctx->md_data, SHA3_512_DIGEST_BITLENGTH));
}

static void sha3_512_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
Expand Down Expand Up @@ -430,7 +430,7 @@ static void shake128_init(EVP_MD_CTX *ctx) {
}

static void shake128_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
CHECK(SHA3_Update(ctx->md_data, data, count));
CHECK(SHAKE_Absorb(ctx->md_data, data, count));
}

static void shake128_final(EVP_MD_CTX *ctx, uint8_t *md, size_t len) {
Expand All @@ -455,7 +455,7 @@ static void shake256_init(EVP_MD_CTX *ctx) {
}

static void shake256_update(EVP_MD_CTX *ctx, const void *data, size_t count) {
CHECK(SHA3_Update(ctx->md_data, data, count));
CHECK(SHAKE_Absorb(ctx->md_data, data, count));
}

static void shake256_finalXOF(EVP_MD_CTX *ctx, uint8_t *md, size_t len) {
Expand Down
18 changes: 9 additions & 9 deletions crypto/fipsmodule/ml_kem/ml_kem_ref/symmetric-shake.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@ void kyber_shake128_absorb(KECCAK1600_CTX *ctx,
// SHAKE_Init always returns 1 when called with correct block size value
SHAKE_Init(ctx, SHAKE128_BLOCKSIZE);

// SHA3_Update always returns 1 on first call of sizeof(extseed) (34 bytes)
SHA3_Update(ctx, extseed, sizeof(extseed));
// SHAKE_Absorb always returns 1 on first call of sizeof(extseed) (34 bytes)
SHAKE_Absorb(ctx, extseed, sizeof(extseed));
}

/*************************************************
Expand All @@ -48,8 +48,8 @@ void kyber_shake128_absorb(KECCAK1600_CTX *ctx,
void kyber_shake128_squeeze(KECCAK1600_CTX *ctx, uint8_t *out, int nblocks)
{
// Return code checks can be omitted
// SHAKE_Final always returns 1
SHAKE_Final(out, ctx, nblocks * SHAKE128_BLOCKSIZE);
// SHAKE_Squeeze always returns 1 when |ctx->padded| flag is cleared
SHAKE_Squeeze(out, ctx, nblocks * SHAKE128_BLOCKSIZE);
}

/*************************************************
Expand Down Expand Up @@ -94,12 +94,12 @@ void kyber_shake256_rkprf(ml_kem_params *params, uint8_t out[KYBER_SSBYTES], con
// SHAKE_Init always returns 1 when called with correct block size value
SHAKE_Init(&ctx, SHAKE256_BLOCKSIZE);

// SHA3_Update always returns 1 on first call of KYBER_SYMBYTES (32 bytes)
SHA3_Update(&ctx, key, KYBER_SYMBYTES);
// SHAKE_Absorb always returns 1 on first call of KYBER_SYMBYTES (32 bytes)
SHAKE_Absorb(&ctx, key, KYBER_SYMBYTES);

// SHA3_Update always returns 1 processing all data blocks that don't need pad
SHA3_Update(&ctx, input, params->ciphertext_bytes);
// SHAKE_Absorb always returns 1 processing all data blocks that don't need pad
SHAKE_Absorb(&ctx, input, params->ciphertext_bytes);

// SHAKE_Final always returns 1
// SHAKE_Final always returns 1 when |ctx->padded| flag is cleared (no previous calls to SHAKE_Final)
SHAKE_Final(out, &ctx, KYBER_SSBYTES);
}
32 changes: 16 additions & 16 deletions crypto/fipsmodule/sha/asm/keccak1600-armv8.pl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,10 +343,10 @@
AARCH64_VALIDATE_LINK_REGISTER
ret
.size KeccakF1600,.-KeccakF1600
.globl SHA3_Absorb_hw
.type SHA3_Absorb_hw,%function
.globl Keccak1600_Absorb_hw
.type Keccak1600_Absorb_hw,%function
.align 5
SHA3_Absorb_hw:
Keccak1600_Absorb_hw:
AARCH64_SIGN_LINK_REGISTER
stp x29,x30,[sp,#-128]!
add x29,sp,#0
Expand Down Expand Up @@ -438,15 +438,15 @@
ldp x29,x30,[sp],#128
AARCH64_VALIDATE_LINK_REGISTER
ret
.size SHA3_Absorb_hw,.-SHA3_Absorb_hw
.size Keccak1600_Absorb_hw,.-Keccak1600_Absorb_hw
___
{
my ($A_flat,$out,$len,$bsz) = map("x$_",(19..22));
$code.=<<___;
.globl SHA3_Squeeze_hw
.type SHA3_Squeeze_hw,%function
.globl Keccak1600_Squeeze_hw
.type Keccak1600_Squeeze_hw,%function
.align 5
SHA3_Squeeze_hw:
Keccak1600_Squeeze_hw:
AARCH64_SIGN_LINK_REGISTER
stp x29,x30,[sp,#-48]!
add x29,sp,#0
Expand Down Expand Up @@ -512,7 +512,7 @@
ldp x29,x30,[sp],#48
AARCH64_VALIDATE_LINK_REGISTER
ret
.size SHA3_Squeeze_hw,.-SHA3_Squeeze_hw
.size Keccak1600_Squeeze_hw,.-Keccak1600_Squeeze_hw
___
} }}}
{{{
Expand Down Expand Up @@ -650,10 +650,10 @@
my ($ctx,$inp,$len,$bsz) = map("x$_",(0..3));

$code.=<<___;
.globl SHA3_Absorb_cext
.type SHA3_Absorb_cext,%function
.globl Keccak1600_Absorb_cext
.type Keccak1600_Absorb_cext,%function
.align 5
SHA3_Absorb_cext:
Keccak1600_Absorb_cext:
AARCH64_SIGN_LINK_REGISTER
stp x29,x30,[sp,#-80]!
add x29,sp,#0
Expand Down Expand Up @@ -722,16 +722,16 @@
ldp x29,x30,[sp],#80
AARCH64_VALIDATE_LINK_REGISTER
ret
.size SHA3_Absorb_cext,.-SHA3_Absorb_cext
.size Keccak1600_Absorb_cext,.-Keccak1600_Absorb_cext
___
}
{
my ($ctx,$out,$len,$bsz) = map("x$_",(0..3));
$code.=<<___;
.globl SHA3_Squeeze_cext
.type SHA3_Squeeze_cext,%function
.globl Keccak1600_Squeeze_cext
.type Keccak1600_Squeeze_cext,%function
.align 5
SHA3_Squeeze_cext:
Keccak1600_Squeeze_cext:
AARCH64_SIGN_LINK_REGISTER
stp x29,x30,[sp,#-16]!
add x29,sp,#0
Expand Down Expand Up @@ -787,7 +787,7 @@
ldr x29,[sp],#16
AARCH64_VALIDATE_LINK_REGISTER
ret
.size SHA3_Squeeze_cext,.-SHA3_Squeeze_cext
.size Keccak1600_Squeeze_cext,.-Keccak1600_Squeeze_cext
___
} }}}
$code.=<<___;
Expand Down
Loading
Loading