1 /* Copyright (c) 2023, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <vector>
16
17 #include <string.h>
18
19 #include <gtest/gtest.h>
20
21 #include <openssl/bytestring.h>
22
23 #include "../test/file_test.h"
24 #include "../test/test_util.h"
25 #include "./internal.h"
26
27
KeccakFileTest(FileTest * t)28 static void KeccakFileTest(FileTest *t) {
29 std::vector<uint8_t> input, sha3_256_expected, sha3_512_expected,
30 shake128_expected, shake256_expected;
31 ASSERT_TRUE(t->GetBytes(&input, "Input"));
32 ASSERT_TRUE(t->GetBytes(&sha3_256_expected, "SHA3-256"));
33 ASSERT_TRUE(t->GetBytes(&sha3_512_expected, "SHA3-512"));
34 ASSERT_TRUE(t->GetBytes(&shake128_expected, "SHAKE-128"));
35 ASSERT_TRUE(t->GetBytes(&shake256_expected, "SHAKE-256"));
36
37 uint8_t sha3_256_digest[32];
38 BORINGSSL_keccak(sha3_256_digest, sizeof(sha3_256_digest), input.data(),
39 input.size(), boringssl_sha3_256);
40 uint8_t sha3_512_digest[64];
41 BORINGSSL_keccak(sha3_512_digest, sizeof(sha3_512_digest), input.data(),
42 input.size(), boringssl_sha3_512);
43 uint8_t shake128_output[512];
44 BORINGSSL_keccak(shake128_output, sizeof(shake128_output), input.data(),
45 input.size(), boringssl_shake128);
46 uint8_t shake256_output[512];
47 BORINGSSL_keccak(shake256_output, sizeof(shake256_output), input.data(),
48 input.size(), boringssl_shake256);
49
50 EXPECT_EQ(Bytes(sha3_256_expected), Bytes(sha3_256_digest));
51 EXPECT_EQ(Bytes(sha3_512_expected), Bytes(sha3_512_digest));
52 EXPECT_EQ(Bytes(shake128_expected), Bytes(shake128_output));
53 EXPECT_EQ(Bytes(shake256_expected), Bytes(shake256_output));
54
55 struct BORINGSSL_keccak_st ctx;
56
57 // Single-pass absorb/squeeze.
58 OPENSSL_memset(shake128_output, 0, sizeof(shake128_output));
59 BORINGSSL_keccak_init(&ctx, boringssl_shake128);
60 BORINGSSL_keccak_absorb(&ctx, input.data(), input.size());
61 BORINGSSL_keccak_squeeze(&ctx, shake128_output, sizeof(shake128_output));
62 EXPECT_EQ(Bytes(shake128_expected), Bytes(shake128_output));
63
64 OPENSSL_memset(shake256_output, 0, sizeof(shake256_output));
65 BORINGSSL_keccak_init(&ctx, boringssl_shake256);
66 BORINGSSL_keccak_absorb(&ctx, input.data(), input.size());
67 BORINGSSL_keccak_squeeze(&ctx, shake256_output, sizeof(shake256_output));
68 EXPECT_EQ(Bytes(shake256_expected), Bytes(shake256_output));
69
70 // Byte-by-byte absorb/squeeze.
71 OPENSSL_memset(shake128_output, 0, sizeof(shake128_output));
72 BORINGSSL_keccak_init(&ctx, boringssl_shake128);
73 for (size_t i = 0; i < input.size(); i++) {
74 BORINGSSL_keccak_absorb(&ctx, &input[i], 1);
75 }
76 for (size_t i = 0; i < sizeof(shake128_output); i++) {
77 BORINGSSL_keccak_squeeze(&ctx, &shake128_output[i], 1);
78 }
79 EXPECT_EQ(Bytes(shake128_expected), Bytes(shake128_output));
80
81 OPENSSL_memset(shake256_output, 0, sizeof(shake256_output));
82 BORINGSSL_keccak_init(&ctx, boringssl_shake256);
83 for (size_t i = 0; i < input.size(); i++) {
84 BORINGSSL_keccak_absorb(&ctx, &input[i], 1);
85 }
86 for (size_t i = 0; i < sizeof(shake256_output); i++) {
87 BORINGSSL_keccak_squeeze(&ctx, &shake256_output[i], 1);
88 }
89 EXPECT_EQ(Bytes(shake256_expected), Bytes(shake256_output));
90 }
91
TEST(KeccakTest,KeccakTestVectors)92 TEST(KeccakTest, KeccakTestVectors) {
93 FileTestGTest("crypto/keccak/keccak_tests.txt", KeccakFileTest);
94 }
95
TEST(KeccakTest,MultiPass)96 TEST(KeccakTest, MultiPass) {
97 // Example from keccak_tests.txt with an input long enough to be interesting.
98 uint8_t input[500] = {
99 0xd0, 0xee, 0x72, 0x13, 0xea, 0x0c, 0xd3, 0x4f, 0x99, 0xe8, 0x27, 0x8c,
100 0x24, 0xb0, 0x06, 0x3d, 0x41, 0x6e, 0x64, 0xda, 0x5a, 0xee, 0x96, 0x39,
101 0xa1, 0x81, 0x94, 0xe3, 0x95, 0x6b, 0x5f, 0xc8, 0x4e, 0xbb, 0x17, 0xf5,
102 0x92, 0xc2, 0xef, 0x45, 0xf9, 0xec, 0x9b, 0x75, 0xc6, 0x48, 0xc8, 0x08,
103 0xdc, 0x43, 0x69, 0xa7, 0x42, 0x15, 0xba, 0x89, 0x40, 0xd6, 0x40, 0xb3,
104 0xd0, 0x02, 0xdf, 0xb5, 0xae, 0xd7, 0xc6, 0x38, 0x84, 0xba, 0x6e, 0x52,
105 0x27, 0x8b, 0x65, 0x7f, 0x70, 0xde, 0x05, 0x10, 0xce, 0x88, 0x65, 0xfa,
106 0xca, 0x55, 0x31, 0xd4, 0x22, 0xa8, 0x37, 0x49, 0x75, 0xad, 0xd8, 0xcf,
107 0xa7, 0x9c, 0x05, 0x8a, 0x94, 0x2d, 0x55, 0xf3, 0x2d, 0xd7, 0x61, 0xda,
108 0xec, 0xcf, 0xb8, 0xc5, 0x28, 0x61, 0x04, 0x5d, 0x4f, 0x69, 0xa9, 0x17,
109 0x6b, 0x09, 0x09, 0xd9, 0x28, 0xef, 0x71, 0xf9, 0x1e, 0xb1, 0x81, 0x86,
110 0x62, 0x00, 0xbf, 0x0f, 0xc3, 0x01, 0x7a, 0x98, 0x02, 0x44, 0x0a, 0x9b,
111 0xdf, 0x78, 0xa2, 0x3a, 0x8d, 0x08, 0x69, 0x63, 0xaa, 0x9f, 0x3f, 0x33,
112 0x11, 0x3b, 0xac, 0x5e, 0xcc, 0xd0, 0x8f, 0x4b, 0x2b, 0x34, 0xda, 0x4c,
113 0x7a, 0x64, 0x61, 0xbd, 0x5c, 0x1f, 0x1b, 0x4e, 0x29, 0x33, 0x8d, 0x21,
114 0x1b, 0x87, 0xfa, 0xda, 0x3f, 0x48, 0x6a, 0x13, 0x01, 0x74, 0x85, 0xdb,
115 0x83, 0x39, 0x5f, 0x22, 0xd4, 0xf9, 0x2a, 0xca, 0x95, 0x34, 0x53, 0xdf,
116 0x16, 0x5b, 0x0a, 0xbf, 0xef, 0x9b, 0xab, 0xad, 0xb1, 0x6e, 0xe7, 0x6a,
117 0xc4, 0x68, 0x43, 0xd9, 0xc9, 0x76, 0xf8, 0x60, 0xe6, 0xff, 0xa9, 0x60,
118 0xc3, 0x45, 0x11, 0x62, 0xf6, 0x48, 0x15, 0x47, 0x5b, 0x9c, 0x91, 0xf3,
119 0xc9, 0x8c, 0x60, 0xc3, 0x3c, 0x6f, 0x03, 0x06, 0xa8, 0xc2, 0xc2, 0x30,
120 0xaa, 0x69, 0x81, 0x20, 0x5d, 0x74, 0xfa, 0xcf, 0x69, 0xb2, 0x98, 0xb0,
121 0xb9, 0x6e, 0x29, 0xa0, 0x24, 0xa9, 0xb2, 0xa4, 0x8c, 0xd5, 0xf3, 0xda,
122 0x5a, 0x61, 0x71, 0x96, 0x9f, 0x9a, 0xdf, 0x4a, 0x79, 0x8f, 0x36, 0xeb,
123 0xf6, 0x1f, 0x3e, 0x40, 0x18, 0xf8, 0x1f, 0xf9, 0x0f, 0xfd, 0x9c, 0xe2,
124 0x6d, 0x63, 0x84, 0x28, 0xf7, 0xbe, 0x42, 0x49, 0xb6, 0xa2, 0x81, 0x48,
125 0xe4, 0xc6, 0xe9, 0xd3, 0xd6, 0x1f, 0x68, 0xbe, 0x10, 0x3e, 0x6d, 0x43,
126 0x0c, 0x15, 0x1a, 0x02, 0x50, 0xde, 0x13, 0x8b, 0x57, 0x70, 0x29, 0x3a,
127 0x97, 0x7f, 0xa9, 0xbf, 0x5f, 0x52, 0x08, 0xb3, 0x8a, 0x9f, 0xf9, 0x9d,
128 0x08, 0x36, 0x3b, 0x9d, 0xc9, 0xcc, 0x65, 0xf2, 0x66, 0xb9, 0x68, 0xcd,
129 0xf7, 0x08, 0xfc, 0x31, 0x59, 0x8b, 0xaa, 0x3c, 0x10, 0xf3, 0xce, 0x7a,
130 0x50, 0xb3, 0xb2, 0x0a, 0x35, 0xac, 0xb4, 0x24, 0xdc, 0xa4, 0x04, 0xcd,
131 0xf9, 0x9f, 0xde, 0xbb, 0xa6, 0x0e, 0xe1, 0x9b, 0x76, 0xac, 0xa1, 0x24,
132 0xbd, 0x90, 0xbe, 0xe9, 0xa4, 0xd5, 0x4e, 0xfa, 0x30, 0xb7, 0x14, 0x49,
133 0x13, 0xc5, 0x2e, 0x84, 0x83, 0x76, 0x37, 0x93, 0x8f, 0x2d, 0x27, 0x13,
134 0x51, 0x19, 0xef, 0x06, 0xd0, 0xdf, 0x74, 0x18, 0x0c, 0xa6, 0xd9, 0x9c,
135 0xc1, 0xaa, 0xa6, 0x65, 0x4e, 0x93, 0xf5, 0x4f, 0x9e, 0x92, 0xd1, 0x2e,
136 0x18, 0xa0, 0x47, 0xf3, 0x0f, 0xe5, 0x31, 0x9f, 0xfa, 0xcc, 0x1d, 0x46,
137 0xe5, 0xcb, 0xcc, 0x56, 0x53, 0xab, 0x24, 0xfa, 0xc1, 0xc2, 0x34, 0x2e,
138 0x89, 0x81, 0xf9, 0x7f, 0x44, 0x83, 0x5e, 0xda, 0x88, 0x01, 0x52, 0x6b,
139 0x2d, 0x7d, 0x1b, 0x9c, 0x15, 0x98, 0x40, 0x87, 0x46, 0x7b, 0x6c, 0x39,
140 0x1e, 0xb0, 0xac, 0xaf, 0x98, 0xda, 0x31, 0x1d,
141 };
142 uint8_t shake128_expected[512] = {
143 0x40, 0x2e, 0x49, 0x68, 0xee, 0x3f, 0x9a, 0x3e, 0xfc, 0x60, 0x02, 0x65,
144 0x2c, 0xee, 0x0f, 0xa9, 0x0e, 0xd2, 0x1f, 0x76, 0xce, 0xd9, 0xbb, 0x5f,
145 0xda, 0xa6, 0x9a, 0x65, 0x4b, 0xa0, 0x9f, 0x56, 0x4a, 0xb7, 0x92, 0x7c,
146 0xa7, 0x7b, 0x48, 0x88, 0xbe, 0xf3, 0x12, 0xbd, 0xb8, 0xf9, 0xa6, 0x89,
147 0x23, 0x50, 0xf5, 0x94, 0xc8, 0x1a, 0xde, 0x8d, 0x90, 0xd3, 0x00, 0x0a,
148 0x45, 0xe6, 0x60, 0x4e, 0x3b, 0xaf, 0xd7, 0x23, 0x2b, 0xdc, 0x48, 0x20,
149 0x3e, 0xe1, 0x31, 0xf8, 0x09, 0x22, 0xdf, 0xed, 0x86, 0x38, 0x80, 0xf7,
150 0x4d, 0x0d, 0x18, 0x0b, 0xb4, 0x1f, 0x3a, 0xb3, 0xd4, 0x92, 0x5a, 0x53,
151 0xc0, 0x2b, 0xbf, 0x11, 0x8b, 0x07, 0xb4, 0xe0, 0x3d, 0x88, 0x10, 0xff,
152 0x0f, 0x69, 0x5e, 0x7f, 0x0f, 0x27, 0x59, 0x5d, 0xf7, 0xb7, 0x9d, 0x4d,
153 0x7e, 0xca, 0x27, 0xda, 0x5d, 0xe3, 0xc2, 0x72, 0x3b, 0x95, 0xf3, 0x24,
154 0xbe, 0xac, 0x86, 0x3d, 0x0d, 0x65, 0x32, 0x44, 0x3a, 0x29, 0xc9, 0x77,
155 0xcd, 0x52, 0x9b, 0x57, 0xf9, 0xc2, 0xf9, 0x10, 0xbe, 0x6a, 0x60, 0x48,
156 0x93, 0x23, 0x7f, 0xd8, 0x3b, 0xed, 0x46, 0xdb, 0xbd, 0xa4, 0xcd, 0x72,
157 0x11, 0x2f, 0xab, 0xa1, 0x14, 0x41, 0xb0, 0x47, 0x01, 0x9d, 0x7d, 0x7a,
158 0xfe, 0x18, 0xac, 0x2a, 0x90, 0xc8, 0xb1, 0x5f, 0xe7, 0xf0, 0x7d, 0xb0,
159 0xff, 0xbe, 0xca, 0xdb, 0x06, 0x20, 0x76, 0xb4, 0xd9, 0x0b, 0x1f, 0x02,
160 0x5b, 0x9c, 0x2c, 0x45, 0x83, 0x5e, 0x64, 0x25, 0x29, 0xf2, 0x08, 0xd6,
161 0xd4, 0x4f, 0x04, 0xb7, 0xd6, 0x04, 0xdf, 0x49, 0x53, 0x0d, 0x9c, 0x80,
162 0xa5, 0xdf, 0x30, 0x6b, 0xfb, 0x55, 0x3d, 0x07, 0x89, 0xed, 0x83, 0x16,
163 0x12, 0x54, 0x46, 0x47, 0xcd, 0x47, 0x44, 0x56, 0x78, 0xd3, 0x91, 0xd5,
164 0x0a, 0xab, 0xce, 0x70, 0x0d, 0x18, 0xa1, 0x4c, 0xdf, 0x78, 0x42, 0x7d,
165 0x54, 0x58, 0x40, 0xe9, 0xad, 0x70, 0x45, 0x28, 0x6b, 0x62, 0xeb, 0x51,
166 0xec, 0x49, 0xe3, 0xb1, 0x00, 0x49, 0x9d, 0xa6, 0x50, 0xb0, 0x92, 0xe2,
167 0x9a, 0xaf, 0x5c, 0xfd, 0x6d, 0x62, 0x89, 0xda, 0x9d, 0x49, 0x14, 0xd5,
168 0x34, 0xaa, 0x41, 0x26, 0xaf, 0x72, 0x8d, 0xa9, 0xb6, 0xf5, 0x79, 0xa0,
169 0x36, 0x0e, 0x57, 0xf5, 0xb9, 0xe3, 0x7c, 0xdc, 0x9c, 0xfc, 0x8a, 0x69,
170 0x6a, 0x9c, 0x2a, 0xd9, 0xfd, 0xc3, 0x34, 0xe7, 0x99, 0x70, 0xaf, 0x8d,
171 0x65, 0x51, 0x19, 0xf9, 0xae, 0x86, 0xd4, 0x0a, 0x5f, 0x47, 0xe9, 0xbf,
172 0x1d, 0x05, 0x9e, 0xa3, 0x29, 0x97, 0x3a, 0x43, 0x14, 0x2e, 0xa3, 0x48,
173 0x1e, 0x40, 0xc6, 0xf6, 0x7f, 0x8a, 0x26, 0xed, 0x9b, 0x27, 0x98, 0x2d,
174 0x27, 0xa5, 0x61, 0xd9, 0xf6, 0xa6, 0x13, 0x55, 0xd8, 0xb4, 0x73, 0x5e,
175 0xcf, 0x7b, 0x08, 0x85, 0x74, 0x82, 0x42, 0x11, 0x0f, 0x01, 0xcc, 0xc3,
176 0x2a, 0xda, 0x45, 0x47, 0x84, 0x87, 0xa2, 0xa5, 0x41, 0xc0, 0xe1, 0x87,
177 0xc5, 0xee, 0x1d, 0xd2, 0x57, 0xbc, 0x7c, 0x81, 0x02, 0x42, 0xb7, 0xf6,
178 0x3a, 0x3a, 0xb1, 0x4e, 0xe7, 0xc4, 0x57, 0xd3, 0xbf, 0x6d, 0xef, 0x86,
179 0x90, 0x46, 0xbf, 0x4b, 0x82, 0xe9, 0x9f, 0x5b, 0x40, 0x62, 0xa9, 0x9c,
180 0x11, 0xfc, 0xd7, 0x79, 0x39, 0xf6, 0x2a, 0x44, 0xe8, 0x3d, 0x0b, 0x7a,
181 0x19, 0xeb, 0x92, 0x87, 0xd5, 0x5d, 0xcd, 0x35, 0xfe, 0x89, 0xb8, 0x25,
182 0x84, 0xf0, 0xfc, 0xfc, 0x47, 0x0e, 0xdc, 0xb7, 0x5f, 0xf8, 0xe8, 0x8b,
183 0x13, 0xa7, 0x14, 0x53, 0xcf, 0xd4, 0xeb, 0x25, 0x9f, 0x9e, 0x0d, 0x04,
184 0x61, 0xae, 0x9a, 0x44, 0x0e, 0x67, 0x85, 0x90, 0xed, 0x0e, 0x2a, 0x5f,
185 0x4c, 0xd9, 0xd7, 0xbe, 0x94, 0x61, 0x64, 0xdc,
186 };
187 uint8_t shake256_expected[512] = {
188 0x6b, 0x70, 0x1d, 0x95, 0xb4, 0x8d, 0xa5, 0x89, 0xea, 0xde, 0x36, 0xf6,
189 0x21, 0xfd, 0x24, 0x9b, 0x85, 0x9c, 0x71, 0x25, 0xd2, 0x63, 0x30, 0xbe,
190 0x02, 0xee, 0xab, 0xb5, 0x7e, 0x13, 0x92, 0x34, 0x27, 0x5f, 0x78, 0x05,
191 0x86, 0x5d, 0x1c, 0x74, 0xd3, 0xb5, 0x22, 0x79, 0x16, 0x80, 0xab, 0x29,
192 0x71, 0xa7, 0x28, 0x52, 0xc8, 0xf0, 0x24, 0x6e, 0xf2, 0xa4, 0x15, 0x7a,
193 0xee, 0x78, 0xba, 0x5d, 0x75, 0x58, 0x6c, 0x31, 0x49, 0xde, 0x32, 0x29,
194 0xbf, 0xb3, 0x21, 0xf6, 0xb8, 0xbd, 0x0a, 0xc7, 0x64, 0x1b, 0x15, 0x92,
195 0x21, 0x02, 0x7b, 0x51, 0xd3, 0xb3, 0x8a, 0x57, 0x3a, 0xfa, 0xa9, 0x0e,
196 0x79, 0xf4, 0xb7, 0xcc, 0x0a, 0xec, 0x99, 0x81, 0x6c, 0x78, 0x61, 0xa9,
197 0x7b, 0x6f, 0xb5, 0x45, 0xa2, 0xa6, 0xc0, 0x12, 0xce, 0x0b, 0x95, 0x58,
198 0x0f, 0x25, 0x0a, 0xb3, 0x39, 0x87, 0x14, 0xb8, 0x8c, 0x2a, 0xfb, 0x87,
199 0x91, 0x6a, 0x09, 0x6e, 0x6d, 0x1a, 0xd6, 0xc3, 0x99, 0xab, 0xd3, 0x2d,
200 0x4a, 0xb2, 0x2b, 0x22, 0xb9, 0x5a, 0x70, 0x1e, 0x93, 0xd7, 0x91, 0x7f,
201 0xbd, 0x16, 0xe9, 0x43, 0x1e, 0xd3, 0x68, 0x44, 0x60, 0x4f, 0xe0, 0xc3,
202 0x6a, 0xa9, 0xd1, 0x05, 0xd8, 0x1b, 0xfa, 0xb8, 0xea, 0x7b, 0xcf, 0x82,
203 0xb1, 0x2c, 0x42, 0x0c, 0x17, 0x6e, 0x96, 0xd6, 0xe5, 0xd0, 0xbd, 0x1d,
204 0x7f, 0x66, 0x36, 0x31, 0x48, 0x44, 0x60, 0x5d, 0x0d, 0x69, 0x00, 0x23,
205 0xe4, 0xcc, 0x72, 0x84, 0x09, 0xd2, 0xd3, 0x4f, 0x47, 0x63, 0xcb, 0xc3,
206 0x19, 0x50, 0xaa, 0x57, 0x69, 0xbf, 0x5a, 0x08, 0x65, 0xf8, 0xe1, 0xbd,
207 0xe0, 0xeb, 0xed, 0x59, 0x6e, 0xb9, 0xee, 0x8c, 0x58, 0xe4, 0x0a, 0x43,
208 0xcc, 0x38, 0x39, 0x1f, 0x28, 0xad, 0xab, 0x3a, 0x5c, 0xae, 0x5c, 0x6b,
209 0x23, 0xd0, 0x19, 0x49, 0x81, 0xa8, 0x97, 0x8c, 0x59, 0x17, 0xb3, 0x84,
210 0x11, 0x77, 0xff, 0x33, 0x19, 0xb6, 0xa9, 0xa9, 0xa4, 0x8c, 0x2f, 0x0f,
211 0xb9, 0xb3, 0x12, 0xa3, 0x0f, 0x89, 0x84, 0xd4, 0xc4, 0x9f, 0xeb, 0x27,
212 0xa6, 0x61, 0x34, 0x9a, 0x2a, 0x2c, 0xc5, 0x3f, 0x45, 0xcc, 0xe6, 0xad,
213 0x2f, 0xa3, 0x16, 0x7b, 0x42, 0xda, 0x34, 0xae, 0xa8, 0x58, 0xc1, 0xe3,
214 0xf9, 0xd5, 0xef, 0xfc, 0x64, 0xbc, 0xb6, 0xad, 0x6a, 0x71, 0x17, 0x09,
215 0x21, 0x06, 0x80, 0x6a, 0x19, 0xb6, 0x0a, 0x1b, 0xb9, 0xe0, 0xf5, 0x43,
216 0x87, 0xe4, 0x84, 0x7e, 0x5f, 0x09, 0xde, 0x97, 0x31, 0xdc, 0x9f, 0xe8,
217 0xd8, 0xdc, 0x1d, 0x6b, 0x01, 0xfa, 0x1e, 0xd0, 0x11, 0x1f, 0x8b, 0x28,
218 0x8e, 0xc1, 0x4d, 0x4f, 0x32, 0x27, 0x2d, 0x7c, 0x4a, 0xc2, 0x3c, 0x85,
219 0x98, 0xf2, 0xa4, 0x5a, 0x5a, 0xaa, 0x1f, 0xac, 0x35, 0xef, 0xca, 0x81,
220 0x6b, 0xf2, 0xcb, 0x83, 0x33, 0x97, 0xb7, 0x46, 0x8e, 0x99, 0x27, 0x48,
221 0xbc, 0x0f, 0x85, 0xac, 0xc2, 0xc7, 0x31, 0x58, 0x11, 0x1e, 0x88, 0xd6,
222 0xc6, 0x8e, 0xad, 0x22, 0xa8, 0x3f, 0xb6, 0x16, 0x28, 0xcc, 0x28, 0x4a,
223 0x05, 0x4f, 0x4e, 0x52, 0x6a, 0xb2, 0xe1, 0x4b, 0x57, 0xc7, 0x9a, 0xa4,
224 0x3a, 0x00, 0xb5, 0x5b, 0x1b, 0xe2, 0xdd, 0xf3, 0x2f, 0xf8, 0xe7, 0xf4,
225 0xc5, 0x0a, 0x8a, 0x7e, 0xc4, 0x90, 0xb1, 0xc6, 0x4a, 0xcd, 0x66, 0x9e,
226 0xe9, 0x8a, 0xde, 0x15, 0x07, 0x16, 0xe7, 0xdc, 0x23, 0x16, 0xb3, 0xb2,
227 0xe0, 0x4b, 0x94, 0x9d, 0xec, 0x9f, 0x50, 0x6b, 0x70, 0x50, 0xb2, 0xb0,
228 0x12, 0x11, 0x46, 0x16, 0x4e, 0xb6, 0x60, 0x22, 0x83, 0x27, 0x6c, 0x76,
229 0x62, 0xb3, 0xb7, 0x83, 0x91, 0xd7, 0x10, 0x3f, 0xbf, 0x7a, 0x3b, 0x39,
230 0x5d, 0xf9, 0x50, 0x1d, 0x05, 0x46, 0xa0, 0xe7,
231 };
232
233 uint8_t shake128_output[512];
234 uint8_t shake256_output[512];
235
236 struct BORINGSSL_keccak_st ctx;
237
238 // Multi-pass absorb.
239 for (size_t j = 0; j < sizeof(input); j++) {
240 for (size_t i = 0; i < j; i++) {
241 OPENSSL_memset(shake128_output, 0, sizeof(shake128_output));
242 BORINGSSL_keccak_init(&ctx, boringssl_shake128);
243 BORINGSSL_keccak_absorb(&ctx, input, i);
244 BORINGSSL_keccak_absorb(&ctx, &input[i], j - i);
245 BORINGSSL_keccak_absorb(&ctx, &input[j], sizeof(input) - j);
246 BORINGSSL_keccak_squeeze(&ctx, shake128_output, sizeof(shake128_output));
247 EXPECT_EQ(Bytes(shake128_expected), Bytes(shake128_output));
248 }
249 }
250
251 for (size_t j = 0; j < sizeof(input); j++) {
252 for (size_t i = 0; i < j; i++) {
253 OPENSSL_memset(shake256_output, 0, sizeof(shake256_output));
254 BORINGSSL_keccak_init(&ctx, boringssl_shake256);
255 BORINGSSL_keccak_absorb(&ctx, input, i);
256 BORINGSSL_keccak_absorb(&ctx, &input[i], j - i);
257 BORINGSSL_keccak_absorb(&ctx, &input[j], sizeof(input) - j);
258 BORINGSSL_keccak_squeeze(&ctx, shake256_output, sizeof(shake256_output));
259 EXPECT_EQ(Bytes(shake256_expected), Bytes(shake256_output));
260 }
261 }
262
263 // Multi-pass squeeze.
264 for (size_t j = 0; j < sizeof(shake128_output); j++) {
265 for (size_t i = 0; i < j; i++) {
266 OPENSSL_memset(shake128_output, 0, sizeof(shake128_output));
267 BORINGSSL_keccak_init(&ctx, boringssl_shake128);
268 BORINGSSL_keccak_absorb(&ctx, input, sizeof(input));
269 BORINGSSL_keccak_squeeze(&ctx, shake128_output, i);
270 BORINGSSL_keccak_squeeze(&ctx, &shake128_output[i], j - i);
271 BORINGSSL_keccak_squeeze(&ctx, &shake128_output[j],
272 sizeof(shake128_output) - j);
273 EXPECT_EQ(Bytes(shake128_expected), Bytes(shake128_output));
274 }
275 }
276
277 for (size_t j = 0; j < sizeof(shake256_output); j++) {
278 for (size_t i = 0; i < j; i++) {
279 OPENSSL_memset(shake256_output, 0, sizeof(shake256_output));
280 BORINGSSL_keccak_init(&ctx, boringssl_shake256);
281 BORINGSSL_keccak_absorb(&ctx, input, sizeof(input));
282 BORINGSSL_keccak_squeeze(&ctx, shake256_output, i);
283 BORINGSSL_keccak_squeeze(&ctx, &shake256_output[i], j - i);
284 BORINGSSL_keccak_squeeze(&ctx, &shake256_output[j],
285 sizeof(shake256_output) - j);
286 EXPECT_EQ(Bytes(shake256_expected), Bytes(shake256_output));
287 }
288 }
289 }
290