raw
smg_comms_rsa_oaep      1  -- S.MG implementation of Keccak-f permutations
smg_comms_rsa_oaep      2 
smg_comms_rsa_oaep      3  -- (Based on The Keccak Reference, Version 3.0, January 14, 2011, by
smg_comms_rsa_oaep      4  --   Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche)
smg_comms_rsa_oaep      5 
smg_comms_rsa_oaep      6  -- S.MG, 2018
smg_comms_rsa_oaep      7 
smg_comms_rsa_oaep      8 package Keccak is
smg_comms_rsa_oaep      9 	pragma Pure(Keccak);  --stateless, no side effects -> can cache calls
smg_comms_rsa_oaep     10 
smg_comms_rsa_oaep     11   --knobs (can change as per keccak design but fixed here for S.MG purposes)--
smg_comms_rsa_oaep     12   Keccak_L: constant := 6;  --gives keccak z (word) dimension of 2^6=64 and 
smg_comms_rsa_oaep     13                             --therefore keccak function 1600 with current 
smg_comms_rsa_oaep     14                             --constants (5*5*2^6)
smg_comms_rsa_oaep     15 
smg_comms_rsa_oaep     16   Default_Bitrate: constant := 1344; --max bits the sponge can eat/spit without
smg_comms_rsa_oaep     17                                      --needing to scramble the state
smg_comms_rsa_oaep     18 
smg_comms_rsa_oaep     19   --constants: dimensions of keccak state and number of rounds
smg_comms_rsa_oaep     20   XY_Length: constant := 5;
smg_comms_rsa_oaep     21   Z_Length: constant := 2**Keccak_L;
smg_comms_rsa_oaep     22   Width: constant := XY_Length * XY_Length * Z_Length;
smg_comms_rsa_oaep     23   N_Rounds: constant := 12 + 2*Keccak_L;
smg_comms_rsa_oaep     24 
smg_comms_rsa_oaep     25   --types
smg_comms_rsa_oaep     26   type XYCoord is mod XY_Length;
smg_comms_rsa_oaep     27   type ZCoord is mod Z_Length;
smg_comms_rsa_oaep     28   type Round_Index is mod N_Rounds;
smg_comms_rsa_oaep     29 
smg_comms_rsa_oaep     30   type ZWord is mod 2**Z_Length;	--"lane" in keccak ref
smg_comms_rsa_oaep     31   type Plane is array(XYCoord) of ZWord; --a "horizontal slice" of keccak state
smg_comms_rsa_oaep     32   type State is array(XYCoord, XYCoord) of ZWord; --the full keccak state
smg_comms_rsa_oaep     33 
smg_comms_rsa_oaep     34   type Round_Constants is array(Round_Index) of ZWord; --magic keccak constants
smg_comms_rsa_oaep     35 
smg_comms_rsa_oaep     36   -- rate can be chosen by caller at each call, between 1 and width of state
smg_comms_rsa_oaep     37   -- higher rate means sponge "eats" more bits at a time but has fewer bits in 
smg_comms_rsa_oaep     38   --   the "secret" part of the state (i.e. lower capacity)
smg_comms_rsa_oaep     39   subtype Keccak_Rate is Positive range 1..Width;  -- capacity = width - rate
smg_comms_rsa_oaep     40 
smg_comms_rsa_oaep     41   type Bit is mod 2;
smg_comms_rsa_oaep     42   type Bitstream is array( Natural range <> ) of Bit; -- any length; message
smg_comms_rsa_oaep     43   subtype Bitword is Bitstream( 0..Z_Length - 1 ); -- bits of one state "word"
smg_comms_rsa_oaep     44 
smg_comms_rsa_oaep     45   -- type conversions
smg_comms_rsa_oaep     46   function BitsToWord( BWord : in Bitword ) return ZWord;
smg_comms_rsa_oaep     47   function WordToBits( Word  : in ZWord ) return Bitword;
smg_comms_rsa_oaep     48 
smg_comms_rsa_oaep     49   -- flip input octets (i.e. groups of 8 bits)
smg_comms_rsa_oaep     50   function FlipOctets( BWord : in Bitword ) return Bitword;
smg_comms_rsa_oaep     51 
smg_comms_rsa_oaep     52   -- public function, the sponge itself
smg_comms_rsa_oaep     53   -- Keccak sponge structure using Keccak_Function, Pad and a given bitrate;
smg_comms_rsa_oaep     54   -- Input - the stream of bits to hash (the message)
smg_comms_rsa_oaep     55   -- Output - a bitstream of desired size for holding output
smg_comms_rsa_oaep     56   -- Block_Len - the bitrate to use; this is effectively the block length 
smg_comms_rsa_oaep     57   --             for splitting Input AND squeezing output between scrambles 
smg_comms_rsa_oaep     58   procedure Sponge(Input      : in Bitstream;
smg_comms_rsa_oaep     59                    Output     : out Bitstream;
smg_comms_rsa_oaep     60                    Block_Len  : in Keccak_Rate := Default_Bitrate );
smg_comms_rsa_oaep     61 
smg_comms_rsa_oaep     62 private
smg_comms_rsa_oaep     63   -- these are internals of the keccak implementation, not meant to be directly
smg_comms_rsa_oaep     64   --  accessed/used
smg_comms_rsa_oaep     65 
smg_comms_rsa_oaep     66   -- this will squeeze Block'Length bits out of state S
smg_comms_rsa_oaep     67   -- NO scramble of state in here!
smg_comms_rsa_oaep     68   -- NB: make SURE that Block'Length is the correct bitrate for this sponge
smg_comms_rsa_oaep     69   -- specifically: Block'Length should be a correct bitrate aka LESS than Width
smg_comms_rsa_oaep     70   procedure SqueezeBlock( Block: out Bitstream; S: in State);
smg_comms_rsa_oaep     71 
smg_comms_rsa_oaep     72   -- This absorbs into sponge the given block, modifying the state accordingly
smg_comms_rsa_oaep     73   -- NO scramble of state in here so make sure the whole Block fits in state!
smg_comms_rsa_oaep     74   -- NB: make SURE that Block'Length is *the correct bitrate* for this sponge
smg_comms_rsa_oaep     75   -- specifically: Block'Length should be a correct bitrate aka LESS than Width
smg_comms_rsa_oaep     76   procedure AbsorbBlock( Block: in Bitstream; S: in out State );
smg_comms_rsa_oaep     77 
smg_comms_rsa_oaep     78   --Keccak magic numbers
smg_comms_rsa_oaep     79   RC : constant Round_Constants :=
smg_comms_rsa_oaep     80     (
smg_comms_rsa_oaep     81      16#0000_0000_0000_0001#,
smg_comms_rsa_oaep     82      16#0000_0000_0000_8082#,
smg_comms_rsa_oaep     83      16#8000_0000_0000_808A#,
smg_comms_rsa_oaep     84      16#8000_0000_8000_8000#,
smg_comms_rsa_oaep     85      16#0000_0000_0000_808B#,
smg_comms_rsa_oaep     86      16#0000_0000_8000_0001#,
smg_comms_rsa_oaep     87      16#8000_0000_8000_8081#,
smg_comms_rsa_oaep     88      16#8000_0000_0000_8009#,
smg_comms_rsa_oaep     89      16#0000_0000_0000_008A#,
smg_comms_rsa_oaep     90      16#0000_0000_0000_0088#,
smg_comms_rsa_oaep     91      16#0000_0000_8000_8009#,
smg_comms_rsa_oaep     92      16#0000_0000_8000_000A#,
smg_comms_rsa_oaep     93      16#0000_0000_8000_808B#,
smg_comms_rsa_oaep     94      16#8000_0000_0000_008B#,
smg_comms_rsa_oaep     95      16#8000_0000_0000_8089#,
smg_comms_rsa_oaep     96      16#8000_0000_0000_8003#,
smg_comms_rsa_oaep     97      16#8000_0000_0000_8002#,
smg_comms_rsa_oaep     98      16#8000_0000_0000_0080#,
smg_comms_rsa_oaep     99      16#0000_0000_0000_800A#,
smg_comms_rsa_oaep    100      16#8000_0000_8000_000A#,
smg_comms_rsa_oaep    101      16#8000_0000_8000_8081#,
smg_comms_rsa_oaep    102      16#8000_0000_0000_8080#,
smg_comms_rsa_oaep    103      16#0000_0000_8000_0001#,
smg_comms_rsa_oaep    104      16#8000_0000_8000_8008#
smg_comms_rsa_oaep    105     );
smg_comms_rsa_oaep    106 
smg_comms_rsa_oaep    107   --gnat-specific methods to have bit-ops for modular types
smg_comms_rsa_oaep    108   function Rotate_Left( Value  : ZWord; 
smg_comms_rsa_oaep    109 	                      Amount : Natural) 
smg_comms_rsa_oaep    110 	                      return ZWord;
smg_comms_rsa_oaep    111 	pragma Import(Intrinsic, Rotate_Left); 
smg_comms_rsa_oaep    112 
smg_comms_rsa_oaep    113 	function Shift_Right( Value  : ZWord; 
smg_comms_rsa_oaep    114                         Amount : Natural) 
smg_comms_rsa_oaep    115                         return ZWord;
smg_comms_rsa_oaep    116   pragma Import(Intrinsic, Shift_Right); 
smg_comms_rsa_oaep    117 
smg_comms_rsa_oaep    118   function Shift_Left( Value  : ZWord;
smg_comms_rsa_oaep    119                        Amount : Natural)
smg_comms_rsa_oaep    120                        return ZWord;
smg_comms_rsa_oaep    121   pragma Import(Intrinsic, Shift_Left);
smg_comms_rsa_oaep    122 
smg_comms_rsa_oaep    123   --Keccak transformations of the internal state
smg_comms_rsa_oaep    124   function Theta ( Input       : in State) return State;
smg_comms_rsa_oaep    125   function Rho   ( Input       : in State) return State;
smg_comms_rsa_oaep    126   function Pi    ( Input       : in State) return State;
smg_comms_rsa_oaep    127   function Chi   ( Input       : in State) return State;
smg_comms_rsa_oaep    128   function Iota  ( Round_Const : in ZWord; Input : in State) return State;
smg_comms_rsa_oaep    129 
smg_comms_rsa_oaep    130   --Keccak function with block width currently 1600 (Width constant above)
smg_comms_rsa_oaep    131   --this simply applies *all* keccak transformations in the correct order,
smg_comms_rsa_oaep    132   -- using the keccak magic numbers (round constants) as per keccak reference
smg_comms_rsa_oaep    133   function Keccak_Function(Input: in State) return State;
smg_comms_rsa_oaep    134 
smg_comms_rsa_oaep    135 end Keccak;