luna - wolfssl/wolfcrypt/src/sha3.c

   1/* sha3.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22/*
  23 * SHA-3 Build Options:
  24 *
  25 * Core:
  26 * WOLFSSL_SHA3:             Enable SHA-3 support                  default: off
  27 * WOLFSSL_SHA3_SMALL:       Use smaller SHA-3 implementation      default: off
  28 * WOLFSSL_SHAKE128:         Enable SHAKE128 XOF                   default: off
  29 * WOLFSSL_SHAKE256:         Enable SHAKE256 XOF                   default: off
  30 * SHA3_BY_SPEC:             Use specification Keccak-f order      default: off
  31 * WC_SHA3_NO_ASM:           Disable SHA-3 assembly optimizations  default: off
  32 * WC_SHA3_FAULT_HARDEN:     Harden SHA-3 against fault attacks    default: off
  33 *
  34 * Hardware Acceleration (SHA-3-specific):
  35 * WC_ASYNC_ENABLE_SHA3:     Enable async SHA-3 operations         default: off
  36 * WOLFSSL_ARMASM_CRYPTO_SHA3: ARM crypto SHA-3 instructions       default: off
  37 * STM32_HASH_SHA3:          STM32 hardware SHA-3                  default: off
  38 * PSOC6_HASH_SHA3:          PSoC6 hardware SHA-3                  default: off
  39 */
  40
  41#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
  42
  43#ifdef WC_SHA3_NO_ASM
  44    #undef USE_INTEL_SPEEDUP
  45    #undef WOLFSSL_ARMASM
  46    #undef WOLFSSL_RISCV_ASM
  47#endif
  48
  49#if defined(WOLFSSL_PSOC6_CRYPTO)
  50    #include <wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h>
  51#endif
  52
  53#if defined(WOLFSSL_SHA3) && !defined(WOLFSSL_XILINX_CRYPT) && \
  54   !defined(WOLFSSL_AFALG_XILINX_SHA3)
  55
  56#if FIPS_VERSION3_GE(2,0,0)
  57    /* set NO_WRAPPERS before headers, use direct internal f()s not wrappers */
  58    #define FIPS_NO_WRAPPERS
  59
  60    #ifdef USE_WINDOWS_API
  61        #pragma code_seg(".fipsA$n")
  62        #pragma const_seg(".fipsB$n")
  63    #endif
  64#endif
  65
  66#include <wolfssl/wolfcrypt/sha3.h>
  67#include <wolfssl/wolfcrypt/hash.h>
  68
  69#ifdef WOLF_CRYPTO_CB
  70    #include <wolfssl/wolfcrypt/cryptocb.h>
  71#endif
  72#ifdef NO_INLINE
  73    #include <wolfssl/wolfcrypt/misc.h>
  74#else
  75    #define WOLFSSL_MISC_INCLUDED
  76    #include <wolfcrypt/src/misc.c>
  77#endif
  78
  79#if FIPS_VERSION3_GE(6,0,0)
  80    const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2] =
  81                                                     { 0x1a2b3c4d, 0x00000016 };
  82    int wolfCrypt_FIPS_SHA3_sanity(void)
  83    {
  84        return 0;
  85    }
  86#endif
  87
  88
  89#if defined(USE_INTEL_SPEEDUP) || (defined(__aarch64__) && \
  90        defined(WOLFSSL_ARMASM))
  91    #include <wolfssl/wolfcrypt/cpuid.h>
  92
  93    static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;
  94#ifdef WC_C_DYNAMIC_FALLBACK
  95    #define SHA3_BLOCK (sha3->sha3_block)
  96    #define SHA3_BLOCK_N (sha3->sha3_block_n)
  97#else
  98    void (*sha3_block)(word64 *s) = NULL;
  99    void (*sha3_block_n)(word64 *s, const byte* data, word32 n,
 100        word64 c) = NULL;
 101    #define SHA3_BLOCK sha3_block
 102    #define SHA3_BLOCK_N sha3_block_n
 103#endif
 104#endif
 105
 106#if !defined(WOLFSSL_ARMASM) && !defined(WOLFSSL_RISCV_ASM)
 107
 108#ifdef WOLFSSL_SHA3_SMALL
 109/* Rotate a 64-bit value left.
 110 *
 111 * a  Number to rotate left.
 112 * r  Number od bits to rotate left.
 113 * returns the rotated number.
 114 */
 115#define ROTL64(a, n)    (((a)<<(n))|((a)>>(64-(n))))
 116
 117/* An array of values to XOR for block operation. */
 118static const word64 hash_keccak_r[24] =
 119{
 120    0x0000000000000001UL, 0x0000000000008082UL,
 121    0x800000000000808aUL, 0x8000000080008000UL,
 122    0x000000000000808bUL, 0x0000000080000001UL,
 123    0x8000000080008081UL, 0x8000000000008009UL,
 124    0x000000000000008aUL, 0x0000000000000088UL,
 125    0x0000000080008009UL, 0x000000008000000aUL,
 126    0x000000008000808bUL, 0x800000000000008bUL,
 127    0x8000000000008089UL, 0x8000000000008003UL,
 128    0x8000000000008002UL, 0x8000000000000080UL,
 129    0x000000000000800aUL, 0x800000008000000aUL,
 130    0x8000000080008081UL, 0x8000000000008080UL,
 131    0x0000000080000001UL, 0x8000000080008008UL
 132};
 133
 134/* Indices used in swap and rotate operation. */
 135#define K_I_0   10
 136#define K_I_1    7
 137#define K_I_2   11
 138#define K_I_3   17
 139#define K_I_4   18
 140#define K_I_5    3
 141#define K_I_6    5
 142#define K_I_7   16
 143#define K_I_8    8
 144#define K_I_9   21
 145#define K_I_10  24
 146#define K_I_11   4
 147#define K_I_12  15
 148#define K_I_13  23
 149#define K_I_14  19
 150#define K_I_15  13
 151#define K_I_16  12
 152#define K_I_17   2
 153#define K_I_18  20
 154#define K_I_19  14
 155#define K_I_20  22
 156#define K_I_21   9
 157#define K_I_22   6
 158#define K_I_23   1
 159
 160/* Number of bits to rotate in swap and rotate operation. */
 161#define K_R_0    1
 162#define K_R_1    3
 163#define K_R_2    6
 164#define K_R_3   10
 165#define K_R_4   15
 166#define K_R_5   21
 167#define K_R_6   28
 168#define K_R_7   36
 169#define K_R_8   45
 170#define K_R_9   55
 171#define K_R_10   2
 172#define K_R_11  14
 173#define K_R_12  27
 174#define K_R_13  41
 175#define K_R_14  56
 176#define K_R_15   8
 177#define K_R_16  25
 178#define K_R_17  43
 179#define K_R_18  62
 180#define K_R_19  18
 181#define K_R_20  39
 182#define K_R_21  61
 183#define K_R_22  20
 184#define K_R_23  44
 185
 186/* Swap and rotate left operation.
 187 *
 188 * s   The state.
 189 * t1  Temporary value.
 190 * t2  Second temporary value.
 191 * i   The index of the loop.
 192 */
 193#define SWAP_ROTL(s, t1, t2, i)                                         \
 194do {                                                                    \
 195    t2 = s[K_I_##i]; s[K_I_##i] = ROTL64(t1, K_R_##i);                  \
 196}                                                                       \
 197while (0)
 198
 199/* Mix the XOR of the column's values into each number by column.
 200 *
 201 * s  The state.
 202 * b  Temporary array of XORed column values.
 203 * x  The index of the column.
 204 * t  Temporary variable.
 205 */
 206#define COL_MIX(s, b, x, t)                                             \
 207do {                                                                    \
 208    for (x = 0; x < 5; x++)                                             \
 209        b[x] = s[x + 0] ^ s[x + 5] ^ s[x + 10] ^ s[x + 15] ^ s[x + 20]; \
 210    for (x = 0; x < 5; x++) {                                           \
 211        t = b[(x + 4) % 5] ^ ROTL64(b[(x + 1) % 5], 1);                 \
 212        s[x +  0] ^= t;                                                 \
 213        s[x +  5] ^= t;                                                 \
 214        s[x + 10] ^= t;                                                 \
 215        s[x + 15] ^= t;                                                 \
 216        s[x + 20] ^= t;                                                 \
 217    }                                                                   \
 218}                                                                       \
 219while (0)
 220
 221#ifdef SHA3_BY_SPEC
 222/* Mix the row values.
 223 * BMI1 has ANDN instruction ((~a) & b) - Haswell and above.
 224 *
 225 * s   The state.
 226 * b   Temporary array of XORed row values.
 227 * y   The index of the row to work on.
 228 * x   The index of the column.
 229 * t0  Temporary variable.
 230 * t1  Temporary variable.
 231 */
 232#define ROW_MIX(s, b, y, x, t0, t1)                                     \
 233do {                                                                    \
 234    for (y = 0; y < 5; y++) {                                           \
 235        for (x = 0; x < 5; x++)                                         \
 236            b[x] = s[y * 5 + x];                                        \
 237        for (x = 0; x < 5; x++)                                         \
 238            s[y * 5 + x] = b[x] ^ (~b[(x + 1) % 5] & b[(x + 2) % 5]);   \
 239    }                                                                   \
 240}                                                                       \
 241while (0)
 242#else
 243/* Mix the row values.
 244 * a ^ (~b & c) == a ^ (c & (b ^ c)) == (a ^ b) ^ (b | c)
 245 *
 246 * s   The state.
 247 * b   Temporary array of XORed row values.
 248 * y   The index of the row to work on.
 249 * x   The index of the column.
 250 * t0  Temporary variable.
 251 * t1  Temporary variable.
 252 */
 253#define ROW_MIX(s, b, y, x, t12, t34)                                   \
 254do {                                                                    \
 255    for (y = 0; y < 5; y++) {                                           \
 256        for (x = 0; x < 5; x++)                                         \
 257            b[x] = s[y * 5 + x];                                        \
 258        t12 = (b[1] ^ b[2]); t34 = (b[3] ^ b[4]);                       \
 259        s[y * 5 + 0] = b[0] ^ (b[2] &  t12);                            \
 260        s[y * 5 + 1] =  t12 ^ (b[2] | b[3]);                            \
 261        s[y * 5 + 2] = b[2] ^ (b[4] &  t34);                            \
 262        s[y * 5 + 3] =  t34 ^ (b[4] | b[0]);                            \
 263        s[y * 5 + 4] = b[4] ^ (b[1] & (b[0] ^ b[1]));                   \
 264    }                                                                   \
 265}                                                                       \
 266while (0)
 267#endif /* SHA3_BY_SPEC */
 268
 269/* The block operation performed on the state.
 270 *
 271 * s  The state.
 272 */
 273void BlockSha3(word64* s)
 274{
 275    byte i, x, y;
 276    word64 t0, t1;
 277    word64 b[5];
 278
 279    for (i = 0; i < 24; i++)
 280    {
 281        COL_MIX(s, b, x, t0);
 282
 283        t0 = s[1];
 284        SWAP_ROTL(s, t0, t1,  0);
 285        SWAP_ROTL(s, t1, t0,  1);
 286        SWAP_ROTL(s, t0, t1,  2);
 287        SWAP_ROTL(s, t1, t0,  3);
 288        SWAP_ROTL(s, t0, t1,  4);
 289        SWAP_ROTL(s, t1, t0,  5);
 290        SWAP_ROTL(s, t0, t1,  6);
 291        SWAP_ROTL(s, t1, t0,  7);
 292        SWAP_ROTL(s, t0, t1,  8);
 293        SWAP_ROTL(s, t1, t0,  9);
 294        SWAP_ROTL(s, t0, t1, 10);
 295        SWAP_ROTL(s, t1, t0, 11);
 296        SWAP_ROTL(s, t0, t1, 12);
 297        SWAP_ROTL(s, t1, t0, 13);
 298        SWAP_ROTL(s, t0, t1, 14);
 299        SWAP_ROTL(s, t1, t0, 15);
 300        SWAP_ROTL(s, t0, t1, 16);
 301        SWAP_ROTL(s, t1, t0, 17);
 302        SWAP_ROTL(s, t0, t1, 18);
 303        SWAP_ROTL(s, t1, t0, 19);
 304        SWAP_ROTL(s, t0, t1, 20);
 305        SWAP_ROTL(s, t1, t0, 21);
 306        SWAP_ROTL(s, t0, t1, 22);
 307        SWAP_ROTL(s, t1, t0, 23);
 308
 309        ROW_MIX(s, b, y, x, t0, t1);
 310
 311        s[0] ^= hash_keccak_r[i];
 312    }
 313}
 314#else
 315/* Rotate a 64-bit value left.
 316 *
 317 * a  Number to rotate left.
 318 * r  Number od bits to rotate left.
 319 * returns the rotated number.
 320 */
 321#define ROTL64(a, n)    (((a)<<(n))|((a)>>(64-(n))))
 322
 323#if !defined(STM32_HASH_SHA3) && !defined(PSOC6_HASH_SHA3)
 324/* An array of values to XOR for block operation. */
 325static const word64 hash_keccak_r[24] =
 326{
 327    W64LIT(0x0000000000000001), W64LIT(0x0000000000008082),
 328    W64LIT(0x800000000000808a), W64LIT(0x8000000080008000),
 329    W64LIT(0x000000000000808b), W64LIT(0x0000000080000001),
 330    W64LIT(0x8000000080008081), W64LIT(0x8000000000008009),
 331    W64LIT(0x000000000000008a), W64LIT(0x0000000000000088),
 332    W64LIT(0x0000000080008009), W64LIT(0x000000008000000a),
 333    W64LIT(0x000000008000808b), W64LIT(0x800000000000008b),
 334    W64LIT(0x8000000000008089), W64LIT(0x8000000000008003),
 335    W64LIT(0x8000000000008002), W64LIT(0x8000000000000080),
 336    W64LIT(0x000000000000800a), W64LIT(0x800000008000000a),
 337    W64LIT(0x8000000080008081), W64LIT(0x8000000000008080),
 338    W64LIT(0x0000000080000001), W64LIT(0x8000000080008008)
 339};
 340#endif
 341
 342/* Indices used in swap and rotate operation. */
 343#define KI_0     6
 344#define KI_1    12
 345#define KI_2    18
 346#define KI_3    24
 347#define KI_4     3
 348#define KI_5     9
 349#define KI_6    10
 350#define KI_7    16
 351#define KI_8    22
 352#define KI_9     1
 353#define KI_10    7
 354#define KI_11   13
 355#define KI_12   19
 356#define KI_13   20
 357#define KI_14    4
 358#define KI_15    5
 359#define KI_16   11
 360#define KI_17   17
 361#define KI_18   23
 362#define KI_19    2
 363#define KI_20    8
 364#define KI_21   14
 365#define KI_22   15
 366#define KI_23   21
 367
 368/* Number of bits to rotate in swap and rotate operation. */
 369#define KR_0    44
 370#define KR_1    43
 371#define KR_2    21
 372#define KR_3    14
 373#define KR_4    28
 374#define KR_5    20
 375#define KR_6     3
 376#define KR_7    45
 377#define KR_8    61
 378#define KR_9     1
 379#define KR_10    6
 380#define KR_11   25
 381#define KR_12    8
 382#define KR_13   18
 383#define KR_14   27
 384#define KR_15   36
 385#define KR_16   10
 386#define KR_17   15
 387#define KR_18   56
 388#define KR_19   62
 389#define KR_20   55
 390#define KR_21   39
 391#define KR_22   41
 392#define KR_23    2
 393
 394/* Mix the XOR of the column's values into each number by column.
 395 *
 396 * s  The state.
 397 * b  Temporary array of XORed column values.
 398 * x  The index of the column.
 399 * t  Temporary variable.
 400 */
 401#define COL_MIX(s, b, x, t)                                                         \
 402do {                                                                                \
 403    (b)[0] = (s)[0] ^ (s)[5] ^ (s)[10] ^ (s)[15] ^ (s)[20];                         \
 404    (b)[1] = (s)[1] ^ (s)[6] ^ (s)[11] ^ (s)[16] ^ (s)[21];                         \
 405    (b)[2] = (s)[2] ^ (s)[7] ^ (s)[12] ^ (s)[17] ^ (s)[22];                         \
 406    (b)[3] = (s)[3] ^ (s)[8] ^ (s)[13] ^ (s)[18] ^ (s)[23];                         \
 407    (b)[4] = (s)[4] ^ (s)[9] ^ (s)[14] ^ (s)[19] ^ (s)[24];                         \
 408    (t) = (b)[(0 + 4) % 5] ^ ROTL64((b)[(0 + 1) % 5], 1);                           \
 409    (s)[ 0] ^= (t); (s)[ 5] ^= (t); (s)[10] ^= (t); (s)[15] ^= (t); (s)[20] ^= (t); \
 410    (t) = (b)[(1 + 4) % 5] ^ ROTL64((b)[(1 + 1) % 5], 1);                           \
 411    (s)[ 1] ^= (t); (s)[ 6] ^= (t); (s)[11] ^= (t); (s)[16] ^= (t); (s)[21] ^= (t); \
 412    (t) = (b)[(2 + 4) % 5] ^ ROTL64((b)[(2 + 1) % 5], 1);                           \
 413    (s)[ 2] ^= (t); (s)[ 7] ^= (t); (s)[12] ^= (t); (s)[17] ^= (t); (s)[22] ^= (t); \
 414    (t) = (b)[(3 + 4) % 5] ^ ROTL64((b)[(3 + 1) % 5], 1);                           \
 415    (s)[ 3] ^= (t); (s)[ 8] ^= (t); (s)[13] ^= (t); (s)[18] ^= (t); (s)[23] ^= (t); \
 416    (t) = (b)[(4 + 4) % 5] ^ ROTL64((b)[(4 + 1) % 5], 1);                           \
 417    (s)[ 4] ^= (t); (s)[ 9] ^= (t); (s)[14] ^= (t); (s)[19] ^= (t); (s)[24] ^= (t); \
 418}                                                                                   \
 419while (0)
 420
 421#define S(s1, i) ROTL64((s1)[KI_##i], KR_##i)
 422
 423#ifdef SHA3_BY_SPEC
 424/* Mix the row values.
 425 * BMI1 has ANDN instruction ((~a) & b) - Haswell and above.
 426 *
 427 * s2  The new state.
 428 * s1  The current state.
 429 * b   Temporary array of XORed row values.
 430 * t0  Temporary variable. (Unused)
 431 * t1  Temporary variable. (Unused)
 432 */
 433#define ROW_MIX(s2, s1, b, t0, t1)                    \
 434do {                                                  \
 435    (b)[0] = (s1)[0];                                 \
 436    (b)[1] = S((s1), 0);                              \
 437    (b)[2] = S((s1), 1);                              \
 438    (b)[3] = S((s1), 2);                              \
 439    (b)[4] = S((s1), 3);                              \
 440    (s2)[0] = (b)[0] ^ (~(b)[1] & (b)[2]);            \
 441    (s2)[1] = (b)[1] ^ (~(b)[2] & (b)[3]);            \
 442    (s2)[2] = (b)[2] ^ (~(b)[3] & (b)[4]);            \
 443    (s2)[3] = (b)[3] ^ (~(b)[4] & (b)[0]);            \
 444    (s2)[4] = (b)[4] ^ (~(b)[0] & (b)[1]);            \
 445    (b)[0] = S((s1), 4);                              \
 446    (b)[1] = S((s1), 5);                              \
 447    (b)[2] = S((s1), 6);                              \
 448    (b)[3] = S((s1), 7);                              \
 449    (b)[4] = S((s1), 8);                              \
 450    (s2)[5] = (b)[0] ^ (~(b)[1] & (b)[2]);            \
 451    (s2)[6] = (b)[1] ^ (~(b)[2] & (b)[3]);            \
 452    (s2)[7] = (b)[2] ^ (~(b)[3] & (b)[4]);            \
 453    (s2)[8] = (b)[3] ^ (~(b)[4] & (b)[0]);            \
 454    (s2)[9] = (b)[4] ^ (~(b)[0] & (b)[1]);            \
 455    (b)[0] = S((s1), 9);                              \
 456    (b)[1] = S((s1), 10);                             \
 457    (b)[2] = S((s1), 11);                             \
 458    (b)[3] = S((s1), 12);                             \
 459    (b)[4] = S((s1), 13);                             \
 460    (s2)[10] = (b)[0] ^ (~(b)[1] & (b)[2]);           \
 461    (s2)[11] = (b)[1] ^ (~(b)[2] & (b)[3]);           \
 462    (s2)[12] = (b)[2] ^ (~(b)[3] & (b)[4]);           \
 463    (s2)[13] = (b)[3] ^ (~(b)[4] & (b)[0]);           \
 464    (s2)[14] = (b)[4] ^ (~(b)[0] & (b)[1]);           \
 465    (b)[0] = S((s1), 14);                             \
 466    (b)[1] = S((s1), 15);                             \
 467    (b)[2] = S((s1), 16);                             \
 468    (b)[3] = S((s1), 17);                             \
 469    (b)[4] = S((s1), 18);                             \
 470    (s2)[15] = (b)[0] ^ (~(b)[1] & (b)[2]);           \
 471    (s2)[16] = (b)[1] ^ (~(b)[2] & (b)[3]);           \
 472    (s2)[17] = (b)[2] ^ (~(b)[3] & (b)[4]);           \
 473    (s2)[18] = (b)[3] ^ (~(b)[4] & (b)[0]);           \
 474    (s2)[19] = (b)[4] ^ (~(b)[0] & (b)[1]);           \
 475    (b)[0] = S((s1), 19);                             \
 476    (b)[1] = S((s1), 20);                             \
 477    (b)[2] = S((s1), 21);                             \
 478    (b)[3] = S((s1), 22);                             \
 479    (b)[4] = S((s1), 23);                             \
 480    (s2)[20] = (b)[0] ^ (~(b)[1] & (b)[2]);           \
 481    (s2)[21] = (b)[1] ^ (~(b)[2] & (b)[3]);           \
 482    (s2)[22] = (b)[2] ^ (~(b)[3] & (b)[4]);           \
 483    (s2)[23] = (b)[3] ^ (~(b)[4] & (b)[0]);           \
 484    (s2)[24] = (b)[4] ^ (~(b)[0] & (b)[1]);           \
 485}                                                     \
 486while (0)
 487#else
 488/* Mix the row values.
 489 * a ^ (~b & c) == a ^ (c & (b ^ c)) == (a ^ b) ^ (b | c)
 490 *
 491 * s2  The new state.
 492 * s1  The current state.
 493 * b   Temporary array of XORed row values.
 494 * t12 Temporary variable.
 495 * t34 Temporary variable.
 496 */
 497#define ROW_MIX(s2, s1, b, t12, t34)                      \
 498do {                                                      \
 499    (b)[0] = (s1)[0];                                     \
 500    (b)[1] = S((s1), 0);                                  \
 501    (b)[2] = S((s1), 1);                                  \
 502    (b)[3] = S((s1), 2);                                  \
 503    (b)[4] = S((s1), 3);                                  \
 504    (t12) = ((b)[1] ^ (b)[2]); (t34) = ((b)[3] ^ (b)[4]); \
 505    (s2)[0] = (b)[0] ^ ((b)[2] &  (t12));                 \
 506    (s2)[1] =  (t12) ^ ((b)[2] | (b)[3]);                 \
 507    (s2)[2] = (b)[2] ^ ((b)[4] &  (t34));                 \
 508    (s2)[3] =  (t34) ^ ((b)[4] | (b)[0]);                 \
 509    (s2)[4] = (b)[4] ^ ((b)[1] & ((b)[0] ^ (b)[1]));      \
 510    (b)[0] = S((s1), 4);                                  \
 511    (b)[1] = S((s1), 5);                                  \
 512    (b)[2] = S((s1), 6);                                  \
 513    (b)[3] = S((s1), 7);                                  \
 514    (b)[4] = S((s1), 8);                                  \
 515    (t12) = ((b)[1] ^ (b)[2]); (t34) = ((b)[3] ^ (b)[4]); \
 516    (s2)[5] = (b)[0] ^ ((b)[2] &  (t12));                 \
 517    (s2)[6] =  (t12) ^ ((b)[2] | (b)[3]);                 \
 518    (s2)[7] = (b)[2] ^ ((b)[4] &  (t34));                 \
 519    (s2)[8] =  (t34) ^ ((b)[4] | (b)[0]);                 \
 520    (s2)[9] = (b)[4] ^ ((b)[1] & ((b)[0] ^ (b)[1]));      \
 521    (b)[0] = S((s1), 9);                                  \
 522    (b)[1] = S((s1), 10);                                 \
 523    (b)[2] = S((s1), 11);                                 \
 524    (b)[3] = S((s1), 12);                                 \
 525    (b)[4] = S((s1), 13);                                 \
 526    (t12) = ((b)[1] ^ (b)[2]); (t34) = ((b)[3] ^ (b)[4]); \
 527    (s2)[10] = (b)[0] ^ ((b)[2] &  (t12));                \
 528    (s2)[11] =  (t12) ^ ((b)[2] | (b)[3]);                \
 529    (s2)[12] = (b)[2] ^ ((b)[4] &  (t34));                \
 530    (s2)[13] =  (t34) ^ ((b)[4] | (b)[0]);                \
 531    (s2)[14] = (b)[4] ^ ((b)[1] & ((b)[0] ^ (b)[1]));     \
 532    (b)[0] = S((s1), 14);                                 \
 533    (b)[1] = S((s1), 15);                                 \
 534    (b)[2] = S((s1), 16);                                 \
 535    (b)[3] = S((s1), 17);                                 \
 536    (b)[4] = S((s1), 18);                                 \
 537    (t12) = ((b)[1] ^ (b)[2]); (t34) = ((b)[3] ^ (b)[4]); \
 538    (s2)[15] = (b)[0] ^ ((b)[2] &  (t12));                \
 539    (s2)[16] =  (t12) ^ ((b)[2] | (b)[3]);                \
 540    (s2)[17] = (b)[2] ^ ((b)[4] &  (t34));                \
 541    (s2)[18] =  (t34) ^ ((b)[4] | (b)[0]);                \
 542    (s2)[19] = (b)[4] ^ ((b)[1] & ((b)[0] ^ (b)[1]));     \
 543    (b)[0] = S((s1), 19);                                 \
 544    (b)[1] = S((s1), 20);                                 \
 545    (b)[2] = S((s1), 21);                                 \
 546    (b)[3] = S((s1), 22);                                 \
 547    (b)[4] = S((s1), 23);                                 \
 548    (t12) = ((b)[1] ^ (b)[2]); (t34) = ((b)[3] ^ (b)[4]); \
 549    (s2)[20] = (b)[0] ^ ((b)[2] &  (t12));                \
 550    (s2)[21] =  (t12) ^ ((b)[2] | (b)[3]);                \
 551    (s2)[22] = (b)[2] ^ ((b)[4] &  (t34));                \
 552    (s2)[23] =  (t34) ^ ((b)[4] | (b)[0]);                \
 553    (s2)[24] = (b)[4] ^ ((b)[1] & ((b)[0] ^ (b)[1]));     \
 554}                                                         \
 555while (0)
 556#endif /* SHA3_BY_SPEC */
 557
 558#if !defined(STM32_HASH_SHA3) && !defined(PSOC6_HASH_SHA3)
 559/* The block operation performed on the state.
 560 *
 561 * s  The state.
 562 */
 563void BlockSha3(word64* s)
 564{
 565    word64 n[25];
 566    word64 b[5];
 567    word64 t0;
 568#ifndef SHA3_BY_SPEC
 569    word64 t1;
 570#endif
 571    word32 i;
 572
 573    for (i = 0; i < 24; i += 2)
 574    {
 575        COL_MIX(s, b, x, t0);
 576        ROW_MIX(n, s, b, t0, t1);
 577        n[0] ^= hash_keccak_r[i];
 578
 579        COL_MIX(n, b, x, t0);
 580        ROW_MIX(s, n, b, t0, t1);
 581        s[0] ^= hash_keccak_r[i+1];
 582    }
 583}
 584#endif /* WOLFSSL_SHA3_SMALL */
 585#endif /* STM32_HASH_SHA3 */
 586#endif /* !WOLFSSL_ARMASM && !WOLFSSL_RISCV_ASM */
 587
 588#if !defined(STM32_HASH_SHA3) && !defined(PSOC6_HASH_SHA3)
 589#if defined(BIG_ENDIAN_ORDER)
 590static WC_INLINE word64 Load64Unaligned(const unsigned char *a)
 591{
 592    return ((word64)a[0] <<  0) |
 593           ((word64)a[1] <<  8) |
 594           ((word64)a[2] << 16) |
 595           ((word64)a[3] << 24) |
 596           ((word64)a[4] << 32) |
 597           ((word64)a[5] << 40) |
 598           ((word64)a[6] << 48) |
 599           ((word64)a[7] << 56);
 600}
 601
 602/* Convert the array of bytes, in little-endian order, to a 64-bit integer.
 603 *
 604 * a  Array of bytes.
 605 * returns a 64-bit integer.
 606 */
 607static word64 Load64BitLittleEndian(const byte* a)
 608{
 609    word64 n = 0;
 610    int i;
 611
 612    for (i = 0; i < 8; i++)
 613        n |= (word64)a[i] << (8 * i);
 614
 615    return n;
 616}
 617#elif defined(WC_SHA3_FAULT_HARDEN)
 618static WC_INLINE word64 Load64Unaligned(const unsigned char *a) {
 619    return readUnalignedWord64(a);
 620}
 621
 622/* Convert the array of bytes, in little-endian order, to a 64-bit integer.
 623 *
 624 * a  Array of bytes.
 625 * returns a 64-bit integer.
 626 */
 627static word64 Load64BitLittleEndian(const byte* a)
 628{
 629    return Load64Unaligned(a);
 630}
 631#endif
 632
 633/* Initialize the state for a SHA3-224 hash operation.
 634 *
 635 * sha3   wc_Sha3 object holding state.
 636 * returns 0 on success.
 637 */
 638
 639static int InitSha3(wc_Sha3* sha3)
 640{
 641    int i;
 642
 643    for (i = 0; i < 25; i++)
 644        sha3->s[i] = 0;
 645    XMEMSET(sha3->t, 0, sizeof(sha3->t));
 646    sha3->i = 0;
 647#ifdef WOLFSSL_HASH_FLAGS
 648    sha3->flags = 0;
 649#endif
 650#ifdef WOLF_CRYPTO_CB
 651    /* Cached hash variant is tied to sponge state; clear it whenever the
 652     * state is reset so reuse for a different SHA3 variant dispatches
 653     * correctly through the crypto callback. */
 654    sha3->hashType = WC_HASH_TYPE_NONE;
 655#endif
 656
 657#ifdef USE_INTEL_SPEEDUP
 658    {
 659        int cpuid_flags_were_updated = cpuid_get_flags_ex(&cpuid_flags);
 660#ifdef WC_C_DYNAMIC_FALLBACK
 661        (void)cpuid_flags_were_updated;
 662        if (! CAN_SAVE_VECTOR_REGISTERS()) {
 663            SHA3_BLOCK = BlockSha3;
 664            SHA3_BLOCK_N = NULL;
 665        }
 666        else
 667#else
 668        if ((! cpuid_flags_were_updated) && (SHA3_BLOCK != NULL)) {
 669        }
 670        else
 671#endif
 672        if (IS_INTEL_AVX2(cpuid_flags)) {
 673            SHA3_BLOCK = sha3_block_avx2;
 674            SHA3_BLOCK_N = sha3_block_n_avx2;
 675        }
 676        else if (IS_INTEL_BMI1(cpuid_flags) && IS_INTEL_BMI2(cpuid_flags)) {
 677            SHA3_BLOCK = sha3_block_bmi2;
 678            SHA3_BLOCK_N = sha3_block_n_bmi2;
 679        }
 680        else {
 681            SHA3_BLOCK = BlockSha3;
 682            SHA3_BLOCK_N = NULL;
 683        }
 684    }
 685#define SHA3_FUNC_PTR
 686#endif /* USE_INTEL_SPEEDUP */
 687#if defined(__aarch64__) && defined(WOLFSSL_ARMASM)
 688    {
 689        int cpuid_flags_were_updated = cpuid_get_flags_ex(&cpuid_flags);
 690        if ((! cpuid_flags_were_updated) && (SHA3_BLOCK != NULL)) {
 691        }
 692        else
 693    #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
 694        if (IS_AARCH64_SHA3(cpuid_flags)) {
 695            SHA3_BLOCK = BlockSha3_crypto;
 696            SHA3_BLOCK_N = NULL;
 697        }
 698        else
 699    #endif
 700        {
 701            SHA3_BLOCK = BlockSha3_base;
 702            SHA3_BLOCK_N = NULL;
 703        }
 704    }
 705#define SHA3_FUNC_PTR
 706#endif
 707
 708    return 0;
 709}
 710
 711#if defined(__aarch64__) && defined(WOLFSSL_ARMASM)
 712void BlockSha3(word64* s)
 713{
 714    (*SHA3_BLOCK)(s);
 715}
 716#endif
 717
 718/* Update the SHA-3 hash state with message data.
 719 *
 720 * sha3  wc_Sha3 object holding state.
 721 * data  Message data to be hashed.
 722 * len   Length of the message data.
 723 * p     Number of 64-bit numbers in a block of data to process.
 724 * returns 0 on success.
 725 */
 726static int Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
 727{
 728    word32 i;
 729    word32 blocks;
 730#ifdef WC_SHA3_FAULT_HARDEN
 731    word32 check = 0;
 732    word32 total_check = 0;
 733#endif
 734
 735#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
 736    if (SHA3_BLOCK == sha3_block_avx2) {
 737        SAVE_VECTOR_REGISTERS(return _svr_ret;);
 738    }
 739#endif
 740    if (sha3->i > 0) {
 741        byte *t;
 742        byte l = (byte)(p * 8 - sha3->i);
 743        if (l > len) {
 744            l = (byte)len;
 745        }
 746
 747        t = &sha3->t[sha3->i];
 748        for (i = 0; i < l; i++) {
 749            t[i] = data[i];
 750    #ifdef WC_SHA3_FAULT_HARDEN
 751            check++;
 752    #endif
 753        }
 754    #ifdef WC_SHA3_FAULT_HARDEN
 755        if (check != l) {
 756            return BAD_COND_E;
 757        }
 758        total_check += l;
 759    #endif
 760        data += i;
 761        len -= i;
 762        sha3->i = (byte)(sha3->i + i);
 763
 764        if (sha3->i == p * 8) {
 765    #if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
 766            xorbuf(sha3->s, sha3->t, (word32)(p * 8));
 767    #else
 768            for (i = 0; i < p; i++) {
 769                sha3->s[i] ^= Load64BitLittleEndian(sha3->t + 8 * i);
 770            #ifdef WC_SHA3_FAULT_HARDEN
 771                check++;
 772            #endif
 773            }
 774        #ifdef WC_SHA3_FAULT_HARDEN
 775            if (check != p + l) {
 776                return BAD_COND_E;
 777            }
 778            total_check += p;
 779        #endif
 780    #endif
 781        #ifdef SHA3_FUNC_PTR
 782            (*SHA3_BLOCK)(sha3->s);
 783        #else
 784            BlockSha3(sha3->s);
 785        #endif
 786            sha3->i = 0;
 787        }
 788    }
 789    blocks = len / (p * 8U);
 790    #ifdef SHA3_FUNC_PTR
 791    if ((SHA3_BLOCK_N != NULL) && (blocks > 0)) {
 792        (*SHA3_BLOCK_N)(sha3->s, data, blocks, p * 8U);
 793        len -= blocks * (p * 8U);
 794        data += blocks * (p * 8U);
 795        blocks = 0;
 796    }
 797    #endif
 798#ifdef WC_SHA3_FAULT_HARDEN
 799    total_check += blocks * p;
 800#endif
 801    for (; blocks > 0; blocks--) {
 802#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
 803        xorbuf(sha3->s, data, (word32)(p * 8));
 804#else
 805        for (i = 0; i < p; i++) {
 806            sha3->s[i] ^= Load64Unaligned(data + 8 * i);
 807        #ifdef WC_SHA3_FAULT_HARDEN
 808            check++;
 809        #endif
 810        }
 811    #ifdef WC_SHA3_FAULT_HARDEN
 812        if (check != total_check - ((blocks - 1) * p)) {
 813            return BAD_COND_E;
 814        }
 815    #endif
 816#endif
 817    #ifdef SHA3_FUNC_PTR
 818        (*SHA3_BLOCK)(sha3->s);
 819    #else
 820        BlockSha3(sha3->s);
 821    #endif
 822        len -= p * 8U;
 823        data += p * 8U;
 824    }
 825#ifdef WC_SHA3_FAULT_HARDEN
 826    if (check != total_check) {
 827        return BAD_COND_E;
 828    }
 829#endif
 830#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
 831    if (SHA3_BLOCK == sha3_block_avx2) {
 832        RESTORE_VECTOR_REGISTERS();
 833    }
 834#endif
 835    if (len > 0) {
 836        XMEMCPY(sha3->t, data, len);
 837    }
 838    sha3->i = (byte)(sha3->i + len);
 839
 840    return 0;
 841}
 842
 843/* Calculate the SHA-3 hash based on all the message data seen.
 844 *
 845 * sha3  wc_Sha3 object holding state.
 846 * hash  Buffer to hold the hash result.
 847 * p     Number of 64-bit numbers in a block of data to process.
 848 * len   Number of bytes in output.
 849 * returns 0 on success.
 850 */
 851static int Sha3Final(wc_Sha3* sha3, byte padChar, byte* hash, byte p, word32 l)
 852{
 853    word32 rate = p * 8U;
 854    word32 j;
 855#if defined(BIG_ENDIAN_ORDER) || defined(WC_SHA3_FAULT_HARDEN)
 856    word32 i;
 857#endif
 858#ifdef WC_SHA3_FAULT_HARDEN
 859    int check = 0;
 860#endif
 861
 862#if !defined(BIG_ENDIAN_ORDER) && !defined(WC_SHA3_FAULT_HARDEN)
 863    xorbuf(sha3->s, sha3->t, sha3->i);
 864#ifdef WOLFSSL_HASH_FLAGS
 865    if ((p == WC_SHA3_256_COUNT) && (sha3->flags & WC_HASH_SHA3_KECCAK256)) {
 866        padChar = 0x01;
 867    }
 868#endif
 869    ((byte*)sha3->s)[sha3->i ] ^= padChar;
 870    ((byte*)sha3->s)[rate - 1] ^= 0x80;
 871#else
 872    sha3->t[rate - 1]  = 0x00;
 873#ifdef WOLFSSL_HASH_FLAGS
 874    if ((p == WC_SHA3_256_COUNT) && (sha3->flags & WC_HASH_SHA3_KECCAK256)) {
 875        padChar = 0x01;
 876    }
 877#endif
 878    sha3->t[sha3->i ]  = padChar;
 879    sha3->t[rate - 1] |= 0x80;
 880    if (rate - 1 > (word32)sha3->i + 1) {
 881        XMEMSET(sha3->t + sha3->i + 1, 0, rate - 1U - (sha3->i + 1U));
 882    }
 883    for (i = 0; i < p; i++) {
 884        sha3->s[i] ^= Load64BitLittleEndian(sha3->t + 8 * i);
 885    #ifdef WC_SHA3_FAULT_HARDEN
 886        check++;
 887    #endif
 888    }
 889#ifdef WC_SHA3_FAULT_HARDEN
 890    if (check != p) {
 891        return BAD_COND_E;
 892    }
 893#endif
 894#endif
 895
 896#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
 897    if (SHA3_BLOCK == sha3_block_avx2)
 898        SAVE_VECTOR_REGISTERS(return _svr_ret;);
 899#endif
 900
 901    for (j = 0; l - j >= rate; j += rate) {
 902    #ifdef SHA3_FUNC_PTR
 903        (*SHA3_BLOCK)(sha3->s);
 904    #else
 905        BlockSha3(sha3->s);
 906    #endif
 907    #if defined(BIG_ENDIAN_ORDER)
 908        ByteReverseWords64((word64*)(hash + j), sha3->s, rate);
 909    #else
 910        XMEMCPY(hash + j, sha3->s, rate);
 911    #endif
 912    }
 913    if (j != l) {
 914    #ifdef SHA3_FUNC_PTR
 915        (*SHA3_BLOCK)(sha3->s);
 916    #else
 917        BlockSha3(sha3->s);
 918    #endif
 919    #if defined(BIG_ENDIAN_ORDER)
 920        ByteReverseWords64(sha3->s, sha3->s, rate);
 921    #endif
 922        XMEMCPY(hash + j, sha3->s, l - j);
 923    }
 924#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
 925    if (SHA3_BLOCK == sha3_block_avx2) {
 926        RESTORE_VECTOR_REGISTERS();
 927    }
 928#endif
 929
 930    return 0;
 931}
 932#endif
 933#if defined(STM32_HASH_SHA3)
 934
 935/* Supports CubeMX HAL or Standard Peripheral Library */
 936
 937static int wc_InitSha3(wc_Sha3* sha3, void* heap, int devId)
 938{
 939    if (sha3 == NULL)
 940        return BAD_FUNC_ARG;
 941
 942    (void)devId;
 943    (void)heap;
 944
 945    XMEMSET(sha3, 0, sizeof(wc_Sha3));
 946    wc_Stm32_Hash_Init(&sha3->stmCtx);
 947    return 0;
 948}
 949
 950static int Stm32GetAlgo(byte p)
 951{
 952    switch(p) {
 953        case WC_SHA3_224_COUNT:
 954            return HASH_ALGOSELECTION_SHA3_224;
 955        case WC_SHA3_256_COUNT:
 956            return HASH_ALGOSELECTION_SHA3_256;
 957        case WC_SHA3_384_COUNT:
 958            return HASH_ALGOSELECTION_SHA3_384;
 959        case WC_SHA3_512_COUNT:
 960            return HASH_ALGOSELECTION_SHA3_512;
 961    }
 962    /* Should never get here */
 963    return WC_SHA3_224_COUNT;
 964}
 965
 966static int wc_Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
 967{
 968    int ret = 0;
 969
 970    if (sha3 == NULL) {
 971        return BAD_FUNC_ARG;
 972    }
 973    if (data == NULL && len == 0) {
 974        /* valid, but do nothing */
 975        return 0;
 976    }
 977    if (data == NULL) {
 978        return BAD_FUNC_ARG;
 979    }
 980
 981    ret = wolfSSL_CryptHwMutexLock();
 982    if (ret == 0) {
 983        ret = wc_Stm32_Hash_Update(&sha3->stmCtx, Stm32GetAlgo(p), data, len,
 984            p * 8);
 985        wolfSSL_CryptHwMutexUnLock();
 986    }
 987    return ret;
 988}
 989
 990static int wc_Sha3Final(wc_Sha3* sha3, byte* hash, byte p, byte len)
 991{
 992    int ret = 0;
 993
 994    if (sha3 == NULL || hash == NULL) {
 995        return BAD_FUNC_ARG;
 996    }
 997
 998    ret = wolfSSL_CryptHwMutexLock();
 999    if (ret == 0) {
1000        ret = wc_Stm32_Hash_Final(&sha3->stmCtx, Stm32GetAlgo(p), hash, len);
1001        wolfSSL_CryptHwMutexUnLock();
1002    }
1003
1004    (void)wc_InitSha3(sha3, NULL, 0); /* reset state */
1005
1006    return ret;
1007}
1008#elif defined(PSOC6_HASH_SHA3)
1009
1010static int wc_InitSha3(wc_Sha3* sha3, void* heap, int devId)
1011{
1012    int ret;
1013    if (sha3 == NULL) {
1014        return BAD_FUNC_ARG;
1015    }
1016    (void)devId;
1017    (void)heap;
1018
1019    /* Lock the mutex to perform crypto operations */
1020    ret = wolfSSL_CryptHwMutexLock();
1021    if (ret == 0) {
1022        /* Initialize hash state for SHA-3 operation */
1023        ret = wc_Psoc6_Sha3_Init(sha3);
1024        /* Release the lock */
1025        wolfSSL_CryptHwMutexUnLock();
1026    }
1027
1028    return ret;
1029}
1030
1031static int wc_Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
1032{
1033    int ret;
1034
1035    if (sha3 == NULL || (data == NULL && len > 0)) {
1036        return BAD_FUNC_ARG;
1037    }
1038
1039    if (data == NULL && len == 0) {
1040        /* valid, but do nothing */
1041        return 0;
1042    }
1043
1044    /* Lock the mutex to perform crypto operations */
1045    ret = wolfSSL_CryptHwMutexLock();
1046    if (ret == 0) {
1047        /* Perform SHA3 on the input data and update the hash state */
1048        ret = wc_Psoc6_Sha3_Update(sha3, data, len, p);
1049        /* Release the lock */
1050        wolfSSL_CryptHwMutexUnLock();
1051    }
1052
1053    return ret;
1054}
1055
1056static int wc_Sha3Final(wc_Sha3* sha3, byte* hash, byte p, byte len)
1057{
1058    int ret;
1059
1060    if (sha3 == NULL || hash == NULL) {
1061        return BAD_FUNC_ARG;
1062    }
1063
1064    /* Lock the mutex to perform crypto operations */
1065    ret = wolfSSL_CryptHwMutexLock();
1066    if (ret == 0) {
1067        /* Finalize SHA3 operations and produce digest */
1068        ret = wc_Psoc6_Sha3_Final(sha3, 0x06, hash, p, len);
1069        if (ret == 0) {
1070            /* Initialize hash state for SHA-3 operation */
1071            ret = wc_Psoc6_Sha3_Init(sha3);
1072        }
1073        /* Release the lock */
1074        wolfSSL_CryptHwMutexUnLock();
1075    }
1076
1077    return ret;
1078}
1079
1080#else
1081
1082/* Initialize the state for a SHA-3 hash operation.
1083 *
1084 * sha3   wc_Sha3 object holding state.
1085 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1086 * devId  Device identifier for asynchronous operation.
1087 * returns 0 on success.
1088 */
1089static int wc_InitSha3(wc_Sha3* sha3, void* heap, int devId)
1090{
1091    int ret = 0;
1092
1093    if (sha3 == NULL)
1094        return BAD_FUNC_ARG;
1095
1096    sha3->heap = heap;
1097    ret = InitSha3(sha3);
1098    if (ret != 0)
1099        return ret;
1100
1101#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA3)
1102    ret = wolfAsync_DevCtxInit(&sha3->asyncDev,
1103                        WOLFSSL_ASYNC_MARKER_SHA3, sha3->heap, devId);
1104#endif
1105#if defined(WOLF_CRYPTO_CB)
1106    sha3->devId = devId;
1107    /* Set to none to determine the hash type later */
1108    /* in the update/final functions based on the p value */
1109    sha3->hashType = WC_HASH_TYPE_NONE;
1110#endif
1111    (void)devId;
1112
1113    return ret;
1114}
1115
1116#if !(defined(WOLFSSL_NOSHA3_224) && defined(WOLFSSL_NOSHA3_256) && \
1117      defined(WOLFSSL_NOSHA3_384) && defined(WOLFSSL_NOSHA3_512))
1118/* Update the SHA-3 hash state with message data.
1119 *
1120 * sha3  wc_Sha3 object holding state.
1121 * data  Message data to be hashed.
1122 * len   Length of the message data.
1123 * p     Number of 64-bit numbers in a block of data to process.
1124 * returns 0 on success.
1125 */
1126static int wc_Sha3Update(wc_Sha3* sha3, const byte* data, word32 len, byte p)
1127{
1128    int ret;
1129
1130    if (sha3 == NULL || (data == NULL && len > 0)) {
1131        return BAD_FUNC_ARG;
1132    }
1133
1134    if (data == NULL && len == 0) {
1135        /* valid, but do nothing */
1136        return 0;
1137    }
1138
1139#ifdef WOLF_CRYPTO_CB
1140    #ifndef WOLF_CRYPTO_CB_FIND
1141    if (sha3->devId != INVALID_DEVID)
1142    #endif
1143    {
1144        /* If the hash type is not set, determine it based on the p value */
1145        /* We can skip the switch statement if the hash type set already */
1146        if (sha3->hashType == WC_HASH_TYPE_NONE) {
1147            switch (p) {
1148                case WC_SHA3_224_COUNT:
1149                    sha3->hashType = WC_HASH_TYPE_SHA3_224; break;
1150                case WC_SHA3_256_COUNT:
1151                    sha3->hashType = WC_HASH_TYPE_SHA3_256; break;
1152                case WC_SHA3_384_COUNT:
1153                    sha3->hashType = WC_HASH_TYPE_SHA3_384; break;
1154                case WC_SHA3_512_COUNT:
1155                    sha3->hashType = WC_HASH_TYPE_SHA3_512; break;
1156                default: return BAD_FUNC_ARG;
1157            }
1158        }
1159        ret = wc_CryptoCb_Sha3Hash(sha3, sha3->hashType, data, len, NULL);
1160        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
1161            return ret;
1162        /* fall-through when unavailable */
1163    }
1164#endif
1165#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA3)
1166    if (sha3->asyncDev.marker == WOLFSSL_ASYNC_MARKER_SHA3) {
1167    #if defined(HAVE_INTEL_QA) && defined(QAT_V2)
1168        /* QAT only supports SHA3_256 */
1169        if (p == WC_SHA3_256_COUNT) {
1170            ret = IntelQaSymSha3(&sha3->asyncDev, NULL, data, len);
1171            if (ret != WC_NO_ERR_TRACE(NOT_COMPILED_IN))
1172                return ret;
1173            /* fall-through when unavailable */
1174        }
1175    #endif
1176    }
1177#endif /* WOLFSSL_ASYNC_CRYPT */
1178
1179    ret = Sha3Update(sha3, data, len, p);
1180
1181    return ret;
1182}
1183
1184/* Calculate the SHA-3 hash based on all the message data seen.
1185 *
1186 * sha3  wc_Sha3 object holding state.
1187 * hash  Buffer to hold the hash result.
1188 * p     Number of 64-bit numbers in a block of data to process.
1189 * len   Number of bytes in output.
1190 * returns 0 on success.
1191 */
1192static int wc_Sha3Final(wc_Sha3* sha3, byte* hash, byte p, byte len)
1193{
1194    int ret;
1195
1196    if (sha3 == NULL || hash == NULL) {
1197        return BAD_FUNC_ARG;
1198    }
1199
1200#ifdef WOLF_CRYPTO_CB
1201    #ifndef WOLF_CRYPTO_CB_FIND
1202    if (sha3->devId != INVALID_DEVID)
1203    #endif
1204    {
1205        /* If the hash type is not set, determine it based on the p value */
1206        /* We can skip the switch statement if the hash type is set already */
1207        if (sha3->hashType == WC_HASH_TYPE_NONE) {
1208            switch (p) {
1209                case WC_SHA3_224_COUNT:
1210                    sha3->hashType = WC_HASH_TYPE_SHA3_224; break;
1211                case WC_SHA3_256_COUNT:
1212                    sha3->hashType = WC_HASH_TYPE_SHA3_256; break;
1213                case WC_SHA3_384_COUNT:
1214                    sha3->hashType = WC_HASH_TYPE_SHA3_384; break;
1215                case WC_SHA3_512_COUNT:
1216                    sha3->hashType = WC_HASH_TYPE_SHA3_512; break;
1217                default: return BAD_FUNC_ARG;
1218            }
1219        }
1220        ret = wc_CryptoCb_Sha3Hash(sha3, sha3->hashType, NULL, 0, hash);
1221        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
1222            return ret;
1223        /* fall-through when unavailable */
1224    }
1225#endif
1226#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA3)
1227    if (sha3->asyncDev.marker == WOLFSSL_ASYNC_MARKER_SHA3) {
1228    #if defined(HAVE_INTEL_QA) && defined(QAT_V2)
1229        /* QAT only supports SHA3_256 */
1230        /* QAT SHA-3 only supported on v2 (8970 or later cards) */
1231        if (len == WC_SHA3_256_DIGEST_SIZE) {
1232            ret = IntelQaSymSha3(&sha3->asyncDev, hash, NULL, len);
1233            if (ret != WC_NO_ERR_TRACE(NOT_COMPILED_IN))
1234                return ret;
1235            /* fall-through when unavailable */
1236        }
1237    #endif
1238    }
1239#endif /* WOLFSSL_ASYNC_CRYPT */
1240
1241    ret = Sha3Final(sha3, 0x06, hash, p, (word32)len);
1242    if (ret != 0)
1243        return ret;
1244
1245    return InitSha3(sha3);  /* reset state */
1246}
1247#endif
1248#endif
1249
1250/* Dispose of any dynamically allocated data from the SHA3-384 operation.
1251 * (Required for async ops.)
1252 *
1253 * sha3  wc_Sha3 object holding state.
1254 * returns 0 on success.
1255 */
1256static void wc_Sha3Free(wc_Sha3* sha3)
1257{
1258#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
1259    int ret = 0;
1260#endif
1261
1262    (void)sha3;
1263
1264#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
1265    if (sha3 == NULL)
1266        return;
1267
1268    #ifndef WOLF_CRYPTO_CB_FIND
1269    if (sha3->devId != INVALID_DEVID)
1270    #endif
1271    {
1272        ret = wc_CryptoCb_Free(sha3->devId, WC_ALGO_TYPE_HASH,
1273                         sha3->hashType, 0, (void*)sha3);
1274        /* If they want the standard free, they can call it themselves */
1275        /* via their callback setting devId to INVALID_DEVID */
1276        /* otherwise assume the callback handled it */
1277        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
1278            return;
1279        /* fall-through when unavailable */
1280    }
1281
1282    /* silence compiler warning */
1283    (void)ret;
1284
1285#endif /* WOLF_CRYPTO_CB && WOLF_CRYPTO_CB_FREE */
1286
1287#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA3)
1288    if (sha3 == NULL)
1289        return;
1290
1291    wolfAsync_DevCtxFree(&sha3->asyncDev, WOLFSSL_ASYNC_MARKER_SHA3);
1292#endif /* WOLFSSL_ASYNC_CRYPT */
1293
1294#if defined(PSOC6_HASH_SHA3)
1295    wc_Psoc6_Sha_Free();
1296#endif
1297}
1298
1299/* Copy the state of the SHA3 operation.
1300 *
1301 * src  wc_Sha3 object holding state top copy.
1302 * dst  wc_Sha3 object to copy into.
1303 * returns 0 on success.
1304 */
1305static int wc_Sha3Copy(wc_Sha3* src, wc_Sha3* dst)
1306{
1307    int ret = 0;
1308
1309    if (src == NULL || dst == NULL)
1310        return BAD_FUNC_ARG;
1311
1312#if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_COPY)
1313    #ifndef WOLF_CRYPTO_CB_FIND
1314    if (src->devId != INVALID_DEVID)
1315    #endif
1316    {
1317        /* Cast the source and destination to be void to keep the abstraction */
1318        ret = wc_CryptoCb_Copy(src->devId, WC_ALGO_TYPE_HASH,
1319                               src->hashType, (void*)src, (void*)dst);
1320        if (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE))
1321            return ret;
1322        /* fall-through when unavailable */
1323    }
1324    ret = 0; /* Reset ret to 0 to avoid returning the callback error code */
1325#endif /* WOLF_CRYPTO_CB && WOLF_CRYPTO_CB_COPY */
1326
1327    /* Free dst resources before copy to prevent memory leaks (e.g.,
1328     * hardware contexts). XMEMCPY overwrites dst. */
1329    wc_Sha3Free(dst);
1330    XMEMCPY(dst, src, sizeof(wc_Sha3));
1331
1332#if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_SHA3)
1333    ret = wolfAsync_DevCopy(&src->asyncDev, &dst->asyncDev);
1334#endif
1335
1336#if defined(PSOC6_HASH_SHA3)
1337    /* Re-initialize internal pointers in hash_state that point inside sha_buffers */
1338    dst->hash_state.hash = (uint8_t*)((cy_stc_crypto_v2_sha3_buffers_t *)&dst->sha_buffers)->hash;
1339#endif
1340
1341#ifdef WOLFSSL_HASH_FLAGS
1342     dst->flags |= WC_HASH_FLAG_ISCOPY;
1343#endif
1344
1345    return ret;
1346}
1347
1348#if !(defined(WOLFSSL_NOSHA3_224) && defined(WOLFSSL_NOSHA3_256) && \
1349      defined(WOLFSSL_NOSHA3_384) && defined(WOLFSSL_NOSHA3_512))
1350/* Calculate the SHA3-224 hash based on all the message data so far.
1351 * More message data can be added, after this operation, using the current
1352 * state.
1353 *
1354 * sha3  wc_Sha3 object holding state.
1355 * hash  Buffer to hold the hash result. Must be at least 28 bytes.
1356 * p     Number of 64-bit numbers in a block of data to process.
1357 * len   Number of bytes in output.
1358 * returns 0 on success.
1359 */
1360static int wc_Sha3GetHash(wc_Sha3* sha3, byte* hash, byte p, byte len)
1361{
1362    int ret;
1363    WC_DECLARE_VAR(tmpSha3, wc_Sha3, 1, sha3 ? sha3->heap : NULL);
1364
1365    if (sha3 == NULL || hash == NULL)
1366        return BAD_FUNC_ARG;
1367
1368    WC_ALLOC_VAR_EX(tmpSha3, wc_Sha3, 1, sha3->heap, DYNAMIC_TYPE_TMP_BUFFER,
1369                    return MEMORY_E);
1370
1371    XMEMSET(tmpSha3, 0, sizeof(*tmpSha3));
1372    ret = wc_Sha3Copy(sha3, tmpSha3);
1373    if (ret == 0) {
1374        ret = wc_Sha3Final(tmpSha3, hash, p, len);
1375    }
1376
1377    WC_FREE_VAR_EX(tmpSha3, sha3->heap, DYNAMIC_TYPE_TMP_BUFFER);
1378    return ret;
1379}
1380#endif
1381
1382#ifndef WOLFSSL_NOSHA3_224
1383/* Initialize the state for a SHA3-224 hash operation.
1384 *
1385 * sha3   wc_Sha3 object holding state.
1386 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1387 * devId  Device identifier for asynchronous operation.
1388 * returns 0 on success.
1389 */
1390int wc_InitSha3_224(wc_Sha3* sha3, void* heap, int devId)
1391{
1392    return wc_InitSha3(sha3, heap, devId);
1393}
1394
1395/* Update the SHA3-224 hash state with message data.
1396 *
1397 * sha3  wc_Sha3 object holding state.
1398 * data  Message data to be hashed.
1399 * len   Length of the message data.
1400 * returns 0 on success.
1401 */
1402int wc_Sha3_224_Update(wc_Sha3* sha3, const byte* data, word32 len)
1403{
1404    return wc_Sha3Update(sha3, data, len, WC_SHA3_224_COUNT);
1405}
1406
1407/* Calculate the SHA3-224 hash based on all the message data seen.
1408 * The state is initialized ready for a new message to hash.
1409 *
1410 * sha3  wc_Sha3 object holding state.
1411 * hash  Buffer to hold the hash result. Must be at least 28 bytes.
1412 * returns 0 on success.
1413 */
1414int wc_Sha3_224_Final(wc_Sha3* sha3, byte* hash)
1415{
1416    return wc_Sha3Final(sha3, hash, WC_SHA3_224_COUNT, WC_SHA3_224_DIGEST_SIZE);
1417}
1418
1419/* Dispose of any dynamically allocated data from the SHA3-224 operation.
1420 * (Required for async ops.)
1421 *
1422 * sha3  wc_Sha3 object holding state.
1423 * returns 0 on success.
1424 */
1425void wc_Sha3_224_Free(wc_Sha3* sha3)
1426{
1427    wc_Sha3Free(sha3);
1428}
1429
1430/* Calculate the SHA3-224 hash based on all the message data so far.
1431 * More message data can be added, after this operation, using the current
1432 * state.
1433 *
1434 * sha3  wc_Sha3 object holding state.
1435 * hash  Buffer to hold the hash result. Must be at least 28 bytes.
1436 * returns 0 on success.
1437 */
1438int wc_Sha3_224_GetHash(wc_Sha3* sha3, byte* hash)
1439{
1440    return wc_Sha3GetHash(sha3, hash, WC_SHA3_224_COUNT, WC_SHA3_224_DIGEST_SIZE);
1441}
1442
1443/* Copy the state of the SHA3-224 operation.
1444 *
1445 * src  wc_Sha3 object holding state top copy.
1446 * dst  wc_Sha3 object to copy into.
1447 * returns 0 on success.
1448 */
1449int wc_Sha3_224_Copy(wc_Sha3* src, wc_Sha3* dst)
1450{
1451    return wc_Sha3Copy(src, dst);
1452}
1453#endif
1454
1455#ifndef WOLFSSL_NOSHA3_256
1456/* Initialize the state for a SHA3-256 hash operation.
1457 *
1458 * sha3   wc_Sha3 object holding state.
1459 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1460 * devId  Device identifier for asynchronous operation.
1461 * returns 0 on success.
1462 */
1463int wc_InitSha3_256(wc_Sha3* sha3, void* heap, int devId)
1464{
1465    return wc_InitSha3(sha3, heap, devId);
1466}
1467
1468/* Update the SHA3-256 hash state with message data.
1469 *
1470 * sha3  wc_Sha3 object holding state.
1471 * data  Message data to be hashed.
1472 * len   Length of the message data.
1473 * returns 0 on success.
1474 */
1475int wc_Sha3_256_Update(wc_Sha3* sha3, const byte* data, word32 len)
1476{
1477    return wc_Sha3Update(sha3, data, len, WC_SHA3_256_COUNT);
1478}
1479
1480/* Calculate the SHA3-256 hash based on all the message data seen.
1481 * The state is initialized ready for a new message to hash.
1482 *
1483 * sha3  wc_Sha3 object holding state.
1484 * hash  Buffer to hold the hash result. Must be at least 32 bytes.
1485 * returns 0 on success.
1486 */
1487int wc_Sha3_256_Final(wc_Sha3* sha3, byte* hash)
1488{
1489    return wc_Sha3Final(sha3, hash, WC_SHA3_256_COUNT, WC_SHA3_256_DIGEST_SIZE);
1490}
1491
1492/* Dispose of any dynamically allocated data from the SHA3-256 operation.
1493 * (Required for async ops.)
1494 *
1495 * sha3  wc_Sha3 object holding state.
1496 * returns 0 on success.
1497 */
1498void wc_Sha3_256_Free(wc_Sha3* sha3)
1499{
1500    wc_Sha3Free(sha3);
1501}
1502
1503/* Calculate the SHA3-256 hash based on all the message data so far.
1504 * More message data can be added, after this operation, using the current
1505 * state.
1506 *
1507 * sha3  wc_Sha3 object holding state.
1508 * hash  Buffer to hold the hash result. Must be at least 32 bytes.
1509 * returns 0 on success.
1510 */
1511int wc_Sha3_256_GetHash(wc_Sha3* sha3, byte* hash)
1512{
1513    return wc_Sha3GetHash(sha3, hash, WC_SHA3_256_COUNT, WC_SHA3_256_DIGEST_SIZE);
1514}
1515
1516/* Copy the state of the SHA3-256 operation.
1517 *
1518 * src  wc_Sha3 object holding state top copy.
1519 * dst  wc_Sha3 object to copy into.
1520 * returns 0 on success.
1521 */
1522int wc_Sha3_256_Copy(wc_Sha3* src, wc_Sha3* dst)
1523{
1524    return wc_Sha3Copy(src, dst);
1525}
1526#endif
1527
1528#ifndef WOLFSSL_NOSHA3_384
1529/* Initialize the state for a SHA3-384 hash operation.
1530 *
1531 * sha3   wc_Sha3 object holding state.
1532 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1533 * devId  Device identifier for asynchronous operation.
1534 * returns 0 on success.
1535 */
1536int wc_InitSha3_384(wc_Sha3* sha3, void* heap, int devId)
1537{
1538    return wc_InitSha3(sha3, heap, devId);
1539}
1540
1541/* Update the SHA3-384 hash state with message data.
1542 *
1543 * sha3  wc_Sha3 object holding state.
1544 * data  Message data to be hashed.
1545 * len   Length of the message data.
1546 * returns 0 on success.
1547 */
1548int wc_Sha3_384_Update(wc_Sha3* sha3, const byte* data, word32 len)
1549{
1550    return wc_Sha3Update(sha3, data, len, WC_SHA3_384_COUNT);
1551}
1552
1553/* Calculate the SHA3-384 hash based on all the message data seen.
1554 * The state is initialized ready for a new message to hash.
1555 *
1556 * sha3  wc_Sha3 object holding state.
1557 * hash  Buffer to hold the hash result. Must be at least 48 bytes.
1558 * returns 0 on success.
1559 */
1560int wc_Sha3_384_Final(wc_Sha3* sha3, byte* hash)
1561{
1562    return wc_Sha3Final(sha3, hash, WC_SHA3_384_COUNT, WC_SHA3_384_DIGEST_SIZE);
1563}
1564
1565/* Dispose of any dynamically allocated data from the SHA3-384 operation.
1566 * (Required for async ops.)
1567 *
1568 * sha3  wc_Sha3 object holding state.
1569 * returns 0 on success.
1570 */
1571void wc_Sha3_384_Free(wc_Sha3* sha3)
1572{
1573    wc_Sha3Free(sha3);
1574}
1575
1576/* Calculate the SHA3-384 hash based on all the message data so far.
1577 * More message data can be added, after this operation, using the current
1578 * state.
1579 *
1580 * sha3  wc_Sha3 object holding state.
1581 * hash  Buffer to hold the hash result. Must be at least 48 bytes.
1582 * returns 0 on success.
1583 */
1584int wc_Sha3_384_GetHash(wc_Sha3* sha3, byte* hash)
1585{
1586    return wc_Sha3GetHash(sha3, hash, WC_SHA3_384_COUNT, WC_SHA3_384_DIGEST_SIZE);
1587}
1588
1589/* Copy the state of the SHA3-384 operation.
1590 *
1591 * src  wc_Sha3 object holding state top copy.
1592 * dst  wc_Sha3 object to copy into.
1593 * returns 0 on success.
1594 */
1595int wc_Sha3_384_Copy(wc_Sha3* src, wc_Sha3* dst)
1596{
1597    return wc_Sha3Copy(src, dst);
1598}
1599#endif
1600
1601#ifndef WOLFSSL_NOSHA3_512
1602/* Initialize the state for a SHA3-512 hash operation.
1603 *
1604 * sha3   wc_Sha3 object holding state.
1605 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1606 * devId  Device identifier for asynchronous operation.
1607 * returns 0 on success.
1608 */
1609int wc_InitSha3_512(wc_Sha3* sha3, void* heap, int devId)
1610{
1611    return wc_InitSha3(sha3, heap, devId);
1612}
1613
1614/* Update the SHA3-512 hash state with message data.
1615 *
1616 * sha3  wc_Sha3 object holding state.
1617 * data  Message data to be hashed.
1618 * len   Length of the message data.
1619 * returns 0 on success.
1620 */
1621int wc_Sha3_512_Update(wc_Sha3* sha3, const byte* data, word32 len)
1622{
1623    return wc_Sha3Update(sha3, data, len, WC_SHA3_512_COUNT);
1624}
1625
1626/* Calculate the SHA3-512 hash based on all the message data seen.
1627 * The state is initialized ready for a new message to hash.
1628 *
1629 * sha3  wc_Sha3 object holding state.
1630 * hash  Buffer to hold the hash result. Must be at least 64 bytes.
1631 * returns 0 on success.
1632 */
1633int wc_Sha3_512_Final(wc_Sha3* sha3, byte* hash)
1634{
1635    return wc_Sha3Final(sha3, hash, WC_SHA3_512_COUNT, WC_SHA3_512_DIGEST_SIZE);
1636}
1637
1638/* Dispose of any dynamically allocated data from the SHA3-512 operation.
1639 * (Required for async ops.)
1640 *
1641 * sha3  wc_Sha3 object holding state.
1642 * returns 0 on success.
1643 */
1644void wc_Sha3_512_Free(wc_Sha3* sha3)
1645{
1646    wc_Sha3Free(sha3);
1647}
1648
1649/* Calculate the SHA3-512 hash based on all the message data so far.
1650 * More message data can be added, after this operation, using the current
1651 * state.
1652 *
1653 * sha3  wc_Sha3 object holding state.
1654 * hash  Buffer to hold the hash result. Must be at least 64 bytes.
1655 * returns 0 on success.
1656 */
1657int wc_Sha3_512_GetHash(wc_Sha3* sha3, byte* hash)
1658{
1659    return wc_Sha3GetHash(sha3, hash, WC_SHA3_512_COUNT, WC_SHA3_512_DIGEST_SIZE);
1660}
1661
1662/* Copy the state of the SHA3-512 operation.
1663 *
1664 * src  wc_Sha3 object holding state top copy.
1665 * dst  wc_Sha3 object to copy into.
1666 * returns 0 on success.
1667 */
1668int wc_Sha3_512_Copy(wc_Sha3* src, wc_Sha3* dst)
1669{
1670    return wc_Sha3Copy(src, dst);
1671}
1672#endif
1673
1674#ifdef WOLFSSL_HASH_FLAGS
1675int wc_Sha3_SetFlags(wc_Sha3* sha3, word32 flags)
1676{
1677    if (sha3) {
1678        sha3->flags = flags;
1679    }
1680    return 0;
1681}
1682int wc_Sha3_GetFlags(wc_Sha3* sha3, word32* flags)
1683{
1684    if (sha3 && flags) {
1685        *flags = sha3->flags;
1686    }
1687    return 0;
1688}
1689#endif
1690
1691#ifdef WOLFSSL_SHAKE128
1692/* Initialize the state for a Shake128 hash operation.
1693 *
1694 * shake  wc_Shake object holding state.
1695 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1696 * devId  Device identifier for asynchronous operation.
1697 * returns 0 on success.
1698 */
1699int wc_InitShake128(wc_Shake* shake, void* heap, int devId)
1700{
1701    return wc_InitSha3(shake, heap, devId);
1702}
1703
1704#if defined(PSOC6_HASH_SHA3)
1705
1706int wc_Shake128_Update(wc_Shake* shake, const byte* data, word32 len)
1707{
1708    int ret;
1709    if (shake == NULL || (data == NULL && len > 0)) {
1710         return BAD_FUNC_ARG;
1711    }
1712
1713    if (data == NULL && len == 0) {
1714        /* valid, but do nothing */
1715        return 0;
1716    }
1717
1718    /* Lock the mutex to perform crypto operations */
1719    ret = wolfSSL_CryptHwMutexLock();
1720    if (ret == 0) {
1721        /* Perform SHA3 on the input data and update the hash state */
1722        ret = wc_Psoc6_Sha3_Update(shake, data, len, WC_SHA3_128_COUNT);
1723        /* Release the lock */
1724        wolfSSL_CryptHwMutexUnLock();
1725    }
1726
1727    return ret;
1728}
1729
1730int wc_Shake128_Final(wc_Shake* shake, byte* hash, word32 hashLen)
1731{
1732    int ret;
1733
1734    if (shake == NULL || hash == NULL) {
1735        return BAD_FUNC_ARG;
1736    }
1737
1738    /* Lock the mutex to perform crypto operations */
1739    ret = wolfSSL_CryptHwMutexLock();
1740    if (ret == 0) {
1741        /* Finalize SHA3 operations and produce digest */
1742        ret = wc_Psoc6_Sha3_Final(shake, 0x1f, hash, WC_SHA3_128_COUNT, hashLen);
1743        if (ret == 0) {
1744            /* Initialize hash state for SHA-3 operation */
1745            ret = wc_Psoc6_Sha3_Init(shake);
1746        }
1747        /* Release the lock */
1748        wolfSSL_CryptHwMutexUnLock();
1749    }
1750
1751    return ret;
1752
1753}
1754
1755int wc_Shake128_Absorb(wc_Shake* shake, const byte* data, word32 len)
1756{
1757    int ret;
1758
1759    if ((shake == NULL) || (data == NULL && len != 0)) {
1760        return BAD_FUNC_ARG;
1761    }
1762
1763    /* Lock the mutex to perform crypto operations */
1764    ret = wolfSSL_CryptHwMutexLock();
1765    if (ret == 0) {
1766        /* Perform SHA3 on the input data and update the hash state */
1767        ret = wc_Psoc6_Sha3_Update(shake, data, len, WC_SHA3_128_COUNT);
1768        if (ret == 0) {
1769            /* Finalize SHA3 operations and produce digest */
1770            ret = wc_Psoc6_Sha3_Final(shake, 0x1f, NULL, WC_SHA3_128_COUNT, 0);
1771        }
1772        /* Release the lock */
1773        wolfSSL_CryptHwMutexUnLock();
1774    }
1775
1776    return ret;
1777}
1778
1779
1780int wc_Shake128_SqueezeBlocks(wc_Shake* shake, byte* out, word32 blockCnt)
1781{
1782    int ret;
1783    if ((shake == NULL) || (out == NULL && blockCnt != 0)) {
1784        return BAD_FUNC_ARG;
1785    }
1786
1787    /* Lock the mutex to perform crypto operations */
1788    ret = wolfSSL_CryptHwMutexLock();
1789    if (ret == 0) {
1790        /* Squeeze output blocks from current hash state */
1791        ret = wc_Psoc6_Shake_SqueezeBlocks(shake, out, blockCnt);
1792        /* Release the lock */
1793        wolfSSL_CryptHwMutexUnLock();
1794    }
1795
1796    return ret;
1797}
1798#else
1799/* Update the SHAKE128 hash state with message data.
1800 *
1801 * shake  wc_Shake object holding state.
1802 * data  Message data to be hashed.
1803 * len   Length of the message data.
1804 * returns 0 on success.
1805 */
1806int wc_Shake128_Update(wc_Shake* shake, const byte* data, word32 len)
1807{
1808    if (shake == NULL || (data == NULL && len > 0)) {
1809         return BAD_FUNC_ARG;
1810    }
1811
1812    if (data == NULL && len == 0) {
1813        /* valid, but do nothing */
1814        return 0;
1815    }
1816
1817    return Sha3Update(shake, data, len, WC_SHA3_128_COUNT);
1818}
1819
1820/* Calculate the SHAKE128 hash based on all the message data seen.
1821 * The state is initialized ready for a new message to hash.
1822 *
1823 * shake  wc_Shake object holding state.
1824 * hash  Buffer to hold the hash result. Must be at least 64 bytes.
1825 * returns 0 on success.
1826 */
1827int wc_Shake128_Final(wc_Shake* shake, byte* hash, word32 hashLen)
1828{
1829    int ret;
1830
1831    if (shake == NULL || hash == NULL) {
1832        return BAD_FUNC_ARG;
1833    }
1834
1835    ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_128_COUNT, hashLen);
1836    if (ret != 0)
1837        return ret;
1838
1839    return InitSha3(shake);  /* reset state */
1840}
1841
1842/* Absorb the data for squeezing.
1843 *
1844 * Update and final with data but no output and no reset
1845 *
1846 * shake  wc_Shake object holding state.
1847 * data  Data to absorb.
1848 * len  Length of d to absorb in bytes.
1849 * returns 0 on success.
1850 */
1851int wc_Shake128_Absorb(wc_Shake* shake, const byte* data, word32 len)
1852{
1853    int ret;
1854
1855    if ((shake == NULL) || (data == NULL && len != 0)) {
1856        return BAD_FUNC_ARG;
1857    }
1858
1859    ret = Sha3Update(shake, data, len, WC_SHA3_128_COUNT);
1860    if (ret == 0) {
1861        byte hash[1];
1862        ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_128_COUNT, 0);
1863    }
1864    /* No partial data. */
1865    shake->i = 0;
1866
1867    return ret;
1868}
1869
1870#ifdef WC_C_DYNAMIC_FALLBACK
1871    #undef SHA3_BLOCK
1872    #undef SHA3_BLOCK_N
1873    #define SHA3_BLOCK (shake->sha3_block)
1874    #define SHA3_BLOCK_N (shake->sha3_block_n)
1875#endif
1876
1877/* Squeeze the state to produce pseudo-random output.
1878 *
1879 * shake  wc_Shake object holding state.
1880 * out  Output buffer.
1881 * blockCnt  Number of blocks to write.
1882 * returns 0 on success.
1883 */
1884int wc_Shake128_SqueezeBlocks(wc_Shake* shake, byte* out, word32 blockCnt)
1885{
1886    if ((shake == NULL) || (out == NULL && blockCnt != 0)) {
1887        return BAD_FUNC_ARG;
1888    }
1889#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
1890    if (SHA3_BLOCK == sha3_block_avx2)
1891        SAVE_VECTOR_REGISTERS(return _svr_ret;);
1892#endif
1893    for (; (blockCnt > 0); blockCnt--) {
1894    #ifdef SHA3_FUNC_PTR
1895        (*SHA3_BLOCK)(shake->s);
1896    #else
1897        BlockSha3(shake->s);
1898    #endif
1899    #if defined(BIG_ENDIAN_ORDER)
1900        ByteReverseWords64((word64*)out, shake->s, WC_SHA3_128_COUNT * 8);
1901    #else
1902        XMEMCPY(out, shake->s, WC_SHA3_128_COUNT * 8);
1903    #endif
1904        out += WC_SHA3_128_COUNT * 8;
1905    }
1906#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
1907    if (SHA3_BLOCK == sha3_block_avx2)
1908        RESTORE_VECTOR_REGISTERS();
1909#endif
1910
1911    return 0;
1912}
1913#endif
1914
1915
1916/* Dispose of any dynamically allocated data from the SHAKE128 operation.
1917 * (Required for async ops.)
1918 *
1919 * shake  wc_Shake object holding state.
1920 * returns 0 on success.
1921 */
1922void wc_Shake128_Free(wc_Shake* shake)
1923{
1924    wc_Sha3Free(shake);
1925}
1926
1927/* Copy the state of the SHA3-512 operation.
1928 *
1929 * src  wc_Shake object holding state top copy.
1930 * dst  wc_Shake object to copy into.
1931 * returns 0 on success.
1932 */
1933int wc_Shake128_Copy(wc_Shake* src, wc_Shake* dst)
1934{
1935    return wc_Sha3Copy(src, dst);
1936}
1937#endif
1938
1939#ifdef WOLFSSL_SHAKE256
1940/* Initialize the state for a Shake256 hash operation.
1941 *
1942 * shake  wc_Shake object holding state.
1943 * heap   Heap reference for dynamic memory allocation. (Used in async ops.)
1944 * devId  Device identifier for asynchronous operation.
1945 * returns 0 on success.
1946 */
1947int wc_InitShake256(wc_Shake* shake, void* heap, int devId)
1948{
1949    return wc_InitSha3(shake, heap, devId);
1950}
1951
1952
1953#ifdef PSOC6_HASH_SHA3
1954
1955int wc_Shake256_Update(wc_Shake* shake, const byte* data, word32 len)
1956{
1957    int ret;
1958    if (shake == NULL || (data == NULL && len > 0)) {
1959         return BAD_FUNC_ARG;
1960    }
1961
1962    if (data == NULL && len == 0) {
1963        /* valid, but do nothing */
1964        return 0;
1965    }
1966
1967    /* Lock the mutex to perform crypto operations */
1968    ret = wolfSSL_CryptHwMutexLock();
1969    if (ret == 0) {
1970        /* Perform SHA3 on the input data and update the hash state */
1971        ret = wc_Psoc6_Sha3_Update(shake, data, len, WC_SHA3_256_COUNT);
1972        /* Release the lock */
1973        wolfSSL_CryptHwMutexUnLock();
1974    }
1975
1976    return ret;
1977}
1978
1979int wc_Shake256_Final(wc_Shake* shake, byte* hash, word32 hashLen)
1980{
1981    int ret;
1982    if (shake == NULL || hash == NULL) {
1983        return BAD_FUNC_ARG;
1984    }
1985
1986    /* Lock the mutex to perform crypto operations */
1987    ret = wolfSSL_CryptHwMutexLock();
1988    if (ret == 0) {
1989        /* Finalize SHA3 operations and produce digest */
1990        ret = wc_Psoc6_Sha3_Final(shake, 0x1f, hash, WC_SHA3_256_COUNT, hashLen);
1991        if (ret == 0) {
1992            /* Initialize hash state for SHA-3 operation */
1993            ret = wc_Psoc6_Sha3_Init(shake);
1994        }
1995        /* Release the lock */
1996        wolfSSL_CryptHwMutexUnLock();
1997    }
1998
1999    return ret;
2000}
2001
2002int wc_Shake256_Absorb(wc_Shake* shake, const byte* data, word32 len)
2003{
2004    int ret;
2005
2006    if ((shake == NULL) || (data == NULL && len != 0)) {
2007        return BAD_FUNC_ARG;
2008    }
2009
2010    /* Lock the mutex to perform crypto operations */
2011    ret = wolfSSL_CryptHwMutexLock();
2012    if (ret == 0) {
2013        /* Perform SHA3 on the input data and update the hash state */
2014        ret = wc_Psoc6_Sha3_Update(shake, data, len, WC_SHA3_256_COUNT);
2015        if (ret == 0) {
2016            /* Finalize SHA3 operations and produce digest */
2017            ret = wc_Psoc6_Sha3_Final(shake, 0x1f, NULL, WC_SHA3_256_COUNT, 0);
2018        }
2019        /* Release the lock */
2020        wolfSSL_CryptHwMutexUnLock();
2021    }
2022
2023    return ret;
2024}
2025
2026int wc_Shake256_SqueezeBlocks(wc_Shake* shake, byte* out, word32 blockCnt)
2027{
2028    int ret;
2029    if ((shake == NULL) || (out == NULL && blockCnt != 0)) {
2030        return BAD_FUNC_ARG;
2031    }
2032
2033    /* Lock the mutex to perform crypto operations */
2034    ret = wolfSSL_CryptHwMutexLock();
2035    if (ret == 0) {
2036        /* Squeeze output blocks from current hash state */
2037        ret = wc_Psoc6_Shake_SqueezeBlocks(shake, out, blockCnt);
2038        /* Release the lock */
2039        wolfSSL_CryptHwMutexUnLock();
2040    }
2041
2042    return ret;
2043}
2044
2045#else
2046/* Update the SHAKE256 hash state with message data.
2047 *
2048 * shake  wc_Shake object holding state.
2049 * data  Message data to be hashed.
2050 * len   Length of the message data.
2051 * returns 0 on success.
2052 */
2053int wc_Shake256_Update(wc_Shake* shake, const byte* data, word32 len)
2054{
2055    if (shake == NULL || (data == NULL && len > 0)) {
2056         return BAD_FUNC_ARG;
2057    }
2058
2059    if (data == NULL && len == 0) {
2060        /* valid, but do nothing */
2061        return 0;
2062    }
2063
2064    return Sha3Update(shake, data, len, WC_SHA3_256_COUNT);
2065}
2066
2067/* Calculate the SHAKE256 hash based on all the message data seen.
2068 * The state is initialized ready for a new message to hash.
2069 *
2070 * shake  wc_Shake object holding state.
2071 * hash  Buffer to hold the hash result. Must be at least 64 bytes.
2072 * hashLen Size of hash in bytes.
2073 * returns 0 on success.
2074 */
2075int wc_Shake256_Final(wc_Shake* shake, byte* hash, word32 hashLen)
2076{
2077    int ret;
2078
2079    if (shake == NULL || hash == NULL) {
2080        return BAD_FUNC_ARG;
2081    }
2082
2083    ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_256_COUNT, hashLen);
2084    if (ret != 0)
2085        return ret;
2086
2087    return InitSha3(shake);  /* reset state */
2088}
2089
2090/* Absorb the data for squeezing.
2091 *
2092 * Update and final with data but no output and no reset
2093 *
2094 * shake  wc_Shake object holding state.
2095 * data  Data to absorb.
2096 * len  Length of d to absorb in bytes.
2097 * returns 0 on success.
2098 */
2099int wc_Shake256_Absorb(wc_Shake* shake, const byte* data, word32 len)
2100{
2101    int ret;
2102
2103    if ((shake == NULL) || (data == NULL && len != 0)) {
2104        return BAD_FUNC_ARG;
2105    }
2106
2107    ret = Sha3Update(shake, data, len, WC_SHA3_256_COUNT);
2108    if (ret == 0) {
2109        byte hash[1];
2110        ret = Sha3Final(shake, 0x1f, hash, WC_SHA3_256_COUNT, 0);
2111    }
2112    /* No partial data. */
2113    shake->i = 0;
2114
2115    return ret;
2116}
2117
2118/* Squeeze the state to produce pseudo-random output.
2119 *
2120 * shake  wc_Shake object holding state.
2121 * out  Output buffer.
2122 * blockCnt  Number of blocks to write.
2123 * returns 0 on success.
2124 */
2125int wc_Shake256_SqueezeBlocks(wc_Shake* shake, byte* out, word32 blockCnt)
2126{
2127    if ((shake == NULL) || (out == NULL && blockCnt != 0)) {
2128        return BAD_FUNC_ARG;
2129    }
2130#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
2131    if (SHA3_BLOCK == sha3_block_avx2)
2132        SAVE_VECTOR_REGISTERS(return _svr_ret;);
2133#endif
2134    for (; (blockCnt > 0); blockCnt--) {
2135    #ifdef SHA3_FUNC_PTR
2136        (*SHA3_BLOCK)(shake->s);
2137    #else
2138        BlockSha3(shake->s);
2139    #endif
2140    #if defined(BIG_ENDIAN_ORDER)
2141        ByteReverseWords64((word64*)out, shake->s, WC_SHA3_256_COUNT * 8);
2142    #else
2143        XMEMCPY(out, shake->s, WC_SHA3_256_COUNT * 8);
2144    #endif
2145        out += WC_SHA3_256_COUNT * 8;
2146    }
2147#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(USE_INTEL_SPEEDUP)
2148    if (SHA3_BLOCK == sha3_block_avx2)
2149        RESTORE_VECTOR_REGISTERS();
2150#endif
2151
2152    return 0;
2153}
2154#endif
2155
2156/* Dispose of any dynamically allocated data from the SHAKE256 operation.
2157 * (Required for async ops.)
2158 *
2159 * shake  wc_Shake object holding state.
2160 * returns 0 on success.
2161 */
2162void wc_Shake256_Free(wc_Shake* shake)
2163{
2164    wc_Sha3Free(shake);
2165}
2166
2167/* Copy the state of the SHA3-512 operation.
2168 *
2169 * src  wc_Shake object holding state top copy.
2170 * dst  wc_Shake object to copy into.
2171 * returns 0 on success.
2172 */
2173int wc_Shake256_Copy(wc_Shake* src, wc_Shake* dst)
2174{
2175    return wc_Sha3Copy(src, dst);
2176}
2177#endif
2178
2179#endif /* WOLFSSL_SHA3 */