// Copyright 2023 The BoringSSL Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_KECCAK_INTERNAL_H
#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_KECCAK_INTERNAL_H

#include <openssl/base.h>

#include "../../internal.h"


BSSL_NAMESPACE_BEGIN

enum boringssl_keccak_config_t : int32_t {
  boringssl_sha3_256,
  boringssl_sha3_512,
  boringssl_shake128,
  boringssl_shake256,
  boringssl_turboshake128,
  boringssl_turboshake256,
  boringssl_cshake128,
  boringssl_cshake256,
};

enum boringssl_keccak_phase_t : int32_t {
  boringssl_keccak_phase_absorb,
  boringssl_keccak_phase_squeeze,
};

struct BORINGSSL_keccak_st {
  // Note: the state with 64-bit integers comes first so that the size of this
  // struct is easy to compute on all architectures without padding surprises
  // due to alignment.
  uint64_t state[25];
  enum boringssl_keccak_config_t config;
  enum boringssl_keccak_phase_t phase;
  size_t required_out_len;
  size_t rate_bytes;
  size_t absorb_offset;
  size_t squeeze_offset;
};

// BORINGSSL_keccak hashes `in_len` bytes from `in` and writes `out_len` bytes
// of output to `out`. If the `config` specifies a fixed-output function, like
// SHA3-256, then `out_len` must be the correct length for that function. The
// cSHAKE configurations are only valid with the BORINGSSL_cshake functions.
OPENSSL_EXPORT void BORINGSSL_keccak(uint8_t *out, size_t out_len,
                                     const uint8_t *in, size_t in_len,
                                     enum boringssl_keccak_config_t config);

// BORINGSSL_keccak_init prepares `ctx` for absorbing. If the `config` specifies
// a fixed-output function, like SHA3-256, then the output must be squeezed in a
// single call to `BORINGSSL_keccak_squeeze`. In that case, it is recommended to
// use `BORINGSSL_keccak` if the input can be absorbed in a single call.
OPENSSL_EXPORT void BORINGSSL_keccak_init(
    struct BORINGSSL_keccak_st *ctx, enum boringssl_keccak_config_t config);

// BORINGSSL_cshake_init prepares `ctx` for cSHAKE, including absorbing the
// function-name and customization strings. `config` must be
// `boringssl_cshake128` or `boringssl_cshake256`. The message may then be
// absorbed and output squeezed with the usual Keccak functions.
OPENSSL_EXPORT void BORINGSSL_cshake_init(struct BORINGSSL_keccak_st *ctx,
                                          enum boringssl_keccak_config_t config,
                                          const uint8_t *function_name,
                                          size_t function_name_len,
                                          const uint8_t *customization,
                                          size_t customization_len);

// BORINGSSL_cshake is the one-shot form of BORINGSSL_cshake_init.
OPENSSL_EXPORT void BORINGSSL_cshake(uint8_t *out, size_t out_len,
                                     const uint8_t *in, size_t in_len,
                                     enum boringssl_keccak_config_t config,
                                     const uint8_t *function_name,
                                     size_t function_name_len,
                                     const uint8_t *customization,
                                     size_t customization_len);

// BORINGSSL_keccak_absorb absorbs `in_len` bytes from `in`.
OPENSSL_EXPORT void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx,
                                            const uint8_t *in, size_t in_len);

// BORINGSSL_keccak_squeeze writes `out_len` bytes to `out` from `ctx`. If the
// configuration previously passed in `BORINGSSL_keccak_init` specifies a
// fixed-output function, then a single call to `BORINGSSL_keccak_squeeze` is
// allowed, where `out_len` must be the correct length for that function.
OPENSSL_EXPORT void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx,
                                             uint8_t *out, size_t out_len);

#if defined(__has_attribute)
#if __has_attribute(vector_size)

#define HAVE_KECCAK_X2

#if defined(OPENSSL_AARCH64)
#define HAVE_KECCAK_X4
#define KECCAK_X4_TARGET
#endif

#if defined(OPENSSL_X86_64)
#define HAVE_KECCAK_X4
#define KECCAK_X4_TARGET __attribute__((target("avx2")))
#endif

#endif  // vector_size
#endif  // __has_attribute

#if defined(HAVE_KECCAK_X2)
// BORINGSSL_keccak_squeeze_x2 performs BORINGSSL_keccak_squeeze in parallel
// with two same-length outputs. The contexts must be in equivalent state (i.e.
// same config, same amount of bytes absorbed and squeezed).
// This function is not compatible with cSHAKE nor TurboSHAKE.
OPENSSL_EXPORT void BORINGSSL_keccak_squeeze_x2(
    struct BORINGSSL_keccak_st ctx[2], uint8_t *outs[2], size_t out_len);

// BORINGSSL_keccak_short_x2 performs BORINGSSL_keccak in parallel on two
// same-length strings with same-length outputs. `in_len` must be less than 72
// (or actually `rate_bytes`).
// This function is not compatible with cSHAKE nor TurboSHAKE.
OPENSSL_EXPORT void BORINGSSL_keccak_short_x2(
    uint8_t *outs[2], size_t out_len, const uint8_t *ins[2], size_t in_len,
    enum boringssl_keccak_config_t config);
#endif

#if defined(HAVE_KECCAK_X4)
// BORINGSSL_have_keccak_x4 needs to return true before using any of the _x4
// variants here, as they may require additional CPU features.
// This function is not compatible with cSHAKE nor TurboSHAKE.
inline bool BORINGSSL_have_keccak_x4() {
#if defined(OPENSSL_X86_64)
  return CRYPTO_is_AVX2_capable();
#else
  return true;
#endif
}

// BORINGSSL_keccak_squeeze_x4 performs BORINGSSL_keccak_squeeze in parallel
// with four same-length outputs. The contexts must be in equivalent state (i.e.
// same config, same amount of bytes absorbed and squeezed).
// This function is not compatible with cSHAKE nor TurboSHAKE.
OPENSSL_EXPORT void BORINGSSL_keccak_squeeze_x4(
    struct BORINGSSL_keccak_st ctx[4], uint8_t *outs[4], size_t out_len);

// BORINGSSL_keccak_short_x4 performs BORINGSSL_keccak in parallel on four
// same-length strings with same-length outputs. in_len must be less than 72
// (or actually `rate_bytes`).
// This function is not compatible with cSHAKE nor TurboSHAKE.
OPENSSL_EXPORT void BORINGSSL_keccak_short_x4(
    uint8_t *outs[4], size_t out_len, const uint8_t *ins[4], size_t in_len,
    enum boringssl_keccak_config_t config);
#endif

BSSL_NAMESPACE_END

#endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_KECCAK_INTERNAL_H