3 This file is part of the AVR-Crypto-Lib.
4 Copyright (C) 2012 Daniel Otte (daniel.otte@rub.de)
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 * \email daniel.otte@rub.de
24 * \license GPLv3 or later
29 #include "avr-asm-macros.S"
34 .global rho_pi_idx_table
38 .byte (((2 * \j + 3 * \i) % 5) * 5 + \i) * 8
44 .global rotate64_1bit_left
58 .global rotate64_1bit_right
72 .global rotate64_nbit_autodir
73 rotate64_nbit_autodir:
75 brcc rotate64_nbit_left
76 .global rotate64_nbit_right
78 ldi r30, pm_lo8(rotate64_1bit_right)
79 ldi r31, pm_hi8(rotate64_1bit_right)
81 .global rotate64_nbit_left
83 ldi r30, pm_lo8(rotate64_1bit_left)
84 ldi r31, pm_hi8(rotate64_1bit_left)
169 rjmp rotate64_1byte_left
170 rjmp rotate64_2byte_left
171 rjmp rotate64_3byte_left
172 rjmp rotate64_4byte_left
173 rjmp rotate64_5byte_left
174 rjmp rotate64_6byte_left
175 rjmp rotate64_7byte_left
177 .global rotate64left_code
179 ldi r30, pm_lo8(byte_rot_jmp_table)
180 ldi r31, pm_hi8(byte_rot_jmp_table)
190 rjmp rotate64_nbit_autodir
194 void keccak_theta (uint64_t *a, uint64_t *b){
196 for(i = 0; i < 5; ++i){
197 b[i][0] = a[0][i] ^ a[1][i] ^ a[2][i] ^ a[3][i] ^ a[4][i];
202 /*********************************************
204 *********************************************
206 r24:r25 = a ; uint64_t a[5][5]
215 Z = r24:r25 + 7 + 4 * 40
222 .irp r, 0, 1, 2, 3, 4
235 /*********************************************
237 *********************************************
239 r24:r25 = a+1 ; uint64_t a[5][5]
242 a[0..4][0] ^= rol(b,1)
249 Z = r24:r25 + 7 + 4 * 40
262 .irp r, 0, 1, 2, 3, 4
273 add r19, __zero_reg__
276 .irp r, 0, 1, 2, 3, 4
288 ; a[i][j] = b[i][j] ^ ((~(b[i][(j + 1) % 5])) & (b[i][(j + 2) % 5]));
290 /*********************************************
292 *********************************************
298 a[0..7] ^= ~b[0..7] & c[0..7]
325 stack_alloc_large 200, r26, r27
330 movw r30, r24 ; Z = a
359 for(i = 0; i < 5; ++i){
360 for(j = 0; j < 5; ++j){
361 a[j][i] ^= b[(4 + i) % 5][0];
366 /* a[0..4][0]{0..7} ^= b[4][0]{0..7} */
370 /* a[0..4][1]{0..7} ^= b[0][0]{0..7} */
371 subi XL, lo8(4 * 5 * 8 + 8)
372 sbci XH, hi8(4 * 5 * 8 + 8)
374 /* a[0..4][2]{0..7} ^= b[1][0]{0..7} */
377 /* a[0..4][3]{0..7} ^= b[2][0]{0..7} */
380 /* a[0..4][4]{0..7} ^= b[3][0]{0..7} */
384 for(i = 0; i < 5; ++i){
385 for(j = 0; j < 5; ++j){
386 a[j][i] ^= rotate64_1bit_left(b[(i + 1) % 5][0]);
390 /* a[0..4][0]{0..7} ^= rol(b[1][0]{0..7}) */
391 subi r24, lo8(5 * 8 - 1)
392 sbci r25, hi8(5 * 8 - 1)
393 subi XL, lo8(2 * 5 * 8 + 8)
394 sbci XH, hi8(2 * 5 * 8 + 8)
396 /* a[0..4][1]{0..7} ^= rol(b[2][0]{0..7}) */
399 /* a[0..4][21]{0..7} ^= rol(b[3][0]{0..7}) */
402 /* a[0..4][3]{0..7} ^= rol(b[4][0]{0..7}) */
405 /* a[0..4][4]{0..7} ^= rol(b[0][0]{0..7}) */
406 subi XL, lo8(4 * 5 * 8 + 8)
407 sbci XH, hi8(4 * 5 * 8 + 8)
413 for(i = 0; i < 5; ++i){
414 for(j = 0; j < 5; ++j){
415 b[(2 * i + 3 * j) % 5][j] =
416 rotate64left_code(a[j][i], pgm_read_byte(&(keccak_rotate_codes[i][j])));
422 const uint8_t* rot_code = (const uint8_t*)keccak_rotate_codes;
423 const uint8_t* idx_idx = (const uint8_t*)rho_pi_idx_table;
424 uint64_t *a_tmp = (uint64_t*)a;
425 for(i = 0; i < 25; ++i){
426 *((uint64_t*)(((uint8_t*)b) + pgm_read_byte(idx_idx++))) =
427 rotate64left_code(*a_tmp++, pgm_read_byte(rot_code++));
436 ldi r18, lo8(keccak_rotate_codes)
437 ldi r19, hi8(keccak_rotate_codes)
439 ldi r18, lo8(rho_pi_idx_table)
440 ldi r19, hi8(rho_pi_idx_table)
462 rcall rotate64left_code
482 for(i = 0; i < 5; ++i){
483 a[i][0] ^= ((~(b[i][1])) & (b[i][2]));
484 a[i][1] ^= ((~(b[i][2])) & (b[i][3]));
485 a[i][2] ^= ((~(b[i][3])) & (b[i][4]));
486 a[i][3] ^= ((~(b[i][4])) & (b[i][0]));
487 a[i][4] ^= ((~(b[i][0])) & (b[i][1]));
492 ; X points at b + 32 + 8 = b + 40 = b[1][0] has to point to b[0][0]
496 subi YL, lo8(5 * 5 * 8)
497 sbci YH, hi8(5 * 5 * 8)
526 ldi r30, lo8(keccak_rc_comp)
527 ldi r31, hi8(keccak_rc_comp)
529 adc r31, __zero_reg__
565 stack_free_large3 200