From: David Howells Date: Sun, 26 Oct 2025 05:50:21 +0000 (-0700) Subject: lib/crypto: sha3: Move SHA3 Iota step mapping into round function X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c0db39e253ebca9dea57e8885450ff0a0a6d6155;p=thirdparty%2Flinux.git lib/crypto: sha3: Move SHA3 Iota step mapping into round function In crypto/sha3_generic.c, the keccakf() function calls keccakf_round() to do four of Keccak-f's five step mappings. However, it does not do the Iota step mapping - presumably because that is dependent on round number, whereas Theta, Rho, Pi and Chi are not. Note that the keccakf_round() function needs to be explicitly non-inlined on certain architectures as gcc's produced output will (or used to) use over 1KiB of stack space if inlined. Now, this code was copied more or less verbatim into lib/crypto/sha3.c, so that has the same aesthetic issue. Fix this there by passing the round number into sha3_keccakf_one_round_generic() and doing the Iota step mapping there. crypto/sha3_generic.c is left untouched as that will be converted to use lib/crypto/sha3.c at some point. Suggested-by: Eric Biggers Signed-off-by: David Howells Tested-by: Harald Freudenberger Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251026055032.1413733-5-ebiggers@kernel.org Signed-off-by: Eric Biggers --- diff --git a/lib/crypto/sha3.c b/lib/crypto/sha3.c index 56d8353f9c5bf..2102c2ecac969 100644 --- a/lib/crypto/sha3.c +++ b/lib/crypto/sha3.c @@ -48,7 +48,7 @@ static const u64 sha3_keccakf_rndc[SHA3_KECCAK_ROUNDS] = { /* * Perform a single round of Keccak mixing. */ -static SHA3_INLINE void sha3_keccakf_one_round_generic(u64 st[25]) +static SHA3_INLINE void sha3_keccakf_one_round_generic(u64 st[25], int round) { u64 t[5], tt, bc[5]; @@ -149,6 +149,9 @@ static SHA3_INLINE void sha3_keccakf_one_round_generic(u64 st[25]) st[22] ^= bc[ 2]; st[23] ^= bc[ 3]; st[24] ^= bc[ 4]; + + /* Iota */ + st[0] ^= sha3_keccakf_rndc[round]; } /* Generic implementation of the Keccak-f[1600] permutation */ @@ -163,11 +166,8 @@ static void sha3_keccakf_generic(struct sha3_state *state) for (int i = 0; i < ARRAY_SIZE(state->words); i++) state->native_words[i] = le64_to_cpu(state->words[i]); - for (int round = 0; round < SHA3_KECCAK_ROUNDS; round++) { - sha3_keccakf_one_round_generic(state->native_words); - /* Iota */ - state->native_words[0] ^= sha3_keccakf_rndc[round]; - } + for (int round = 0; round < SHA3_KECCAK_ROUNDS; round++) + sha3_keccakf_one_round_generic(state->native_words, round); for (int i = 0; i < ARRAY_SIZE(state->words); i++) state->words[i] = cpu_to_le64(state->native_words[i]);