XKCP internals Gilles Van Assche 1 1 STMicroelectronics SCA workshop - PowerPoint PPT Presentation

XKCP internals Gilles Van Assche 1 1 STMicroelectronics SCA workshop Šibenik, Croatia, June 2019 Based on joint work with Ronny Van Keer 1 / 19

Outline 1 Introduction 2 Inside the XKCP 3 Below SnP and PlSnP 4 Build system 2 / 19

Introduction Outline 1 Introduction 2 Inside the XKCP 3 Below SnP and PlSnP 4 Build system 3 / 19

Introduction What is the XKCP? Previously known as the Keccak Code Package… Repository of implementations of KangarooTwelve, Ketje, Keyak, Kravatte, … Xoodoo, Xoodyak, Xoofff, Xoofff-SANE, … 4 / 19 Keccak- p [ 200 to 1600 ] , SHA-3, (c)SHAKE, KMAC, … now eXtended KCP

Introduction What is the XKCP? Previously known as the Keccak Code Package… Repository of implementations of KangarooTwelve, Ketje, Keyak, Kravatte, … Xoodoo, Xoodyak, Xoofff, Xoofff-SANE, … 4 / 19 Keccak- p [ 200 to 1600 ] , SHA-3, (c)SHAKE, KMAC, … now eXtended KCP

Introduction What is the XKCP? Previously known as the Keccak Code Package… Repository of implementations of KangarooTwelve, Ketje, Keyak, Kravatte, … Xoodoo, Xoodyak, Xoofff, Xoofff-SANE, … … now eXtended KCP 4 / 19 Keccak- p [ 200 to 1600 ] , SHA-3, (c)SHAKE, KMAC,

Introduction What is the XKCP? Previously known as the Keccak Code Package… Repository of implementations of KangarooTwelve, Ketje, Keyak, Kravatte, … Xoodoo, Xoodyak, Xoofff, Xoofff-SANE, … 4 / 19 Keccak- p [ 200 to 1600 ] , SHA-3, (c)SHAKE, KMAC, … now eXtended KCP

Introduction Where to fjnd it https://github.com/XKCP/XKCP 5 / 19

Inside the XKCP Outline 1 Introduction 2 Inside the XKCP 3 Below SnP and PlSnP 4 Build system 6 / 19

Inside the XKCP focus on user bulk data processing permutation tailored implementations unit tests limited scope to optimize focus on developer Specifjc pointers and arithmetic one implementation e.g., message queue easy to use Generic A layered approach 7 / 19 Mode Hashing MAC PRNG Auth. Enc. Construction Sponge Duplex Primitive Keccak- p [200] Keccak- p [1600] Xoodoo

Inside the XKCP focus on user bulk data processing permutation tailored implementations unit tests limited scope to optimize focus on developer Specifjc pointers and arithmetic one implementation e.g., message queue easy to use Generic A layered approach 7 / 19 Mode Hashing MAC PRNG Auth. Enc. Construction Sponge Duplex Primitive Keccak- p [200] Keccak- p [1600] Xoodoo

Inside the XKCP focus on user bulk data processing permutation tailored implementations unit tests limited scope to optimize focus on developer Specifjc pointers and arithmetic one implementation e.g., message queue easy to use Generic A layered approach 7 / 19 Mode Hashing MAC PRNG Auth. Enc. Construction Sponge Duplex Primitive Keccak- p [200] Keccak- p [1600] Xoodoo

Inside the XKCP Generic bulk data processing permutation tailored implementations unit tests limited scope to optimize focus on developer Specifjc pointers and arithmetic one implementation e.g., message queue easy to use focus on user 7 / 19 A layered approach Mode Hashing MAC PRNG Auth. Enc. Construction Sponge Duplex SnP Primitive Keccak- p [200] Keccak- p [1600] Xoodoo

Inside the XKCP Parallel processing SnP = State and Permutation PlSnP = Parallel States and Permutations 8 / 19 Mode KangarooTwelve Deck-SANE Deck-WBC Construction Parallel Sponges Farfalle Primitive 4× Keccak- p [1600] 8× Keccak- p [1600] 16× Xoodoo

Inside the XKCP Parallel processing PlSnP = Parallel States and Permutations SnP = State and Permutation 8 / 19 Mode KangarooTwelve Deck-SANE Deck-WBC Construction Parallel Sponges Farfalle PlSnP Primitive 4× Keccak- p [1600] 8× Keccak- p [1600] 16× Xoodoo

Below SnP and PlSnP Outline 1 Introduction 2 Inside the XKCP 3 Below SnP and PlSnP 4 Build system 9 / 19

Below SnP and PlSnP Multiple implementations Assumption: the state representation is opaque! 10 / 19 SnP or PlSnP Keccak- p [1600] 2× Keccak- p [1600] Xoodoo 4× Xoodoo opt32 fallback opt32 fallback opt64 AVX2 ARMv6M AVX2 AVX2 AVX512 ARMv7M AVX512 AVX512 NEON ARMv7A NEON ARMv7M AVR8 ARMv8A

Below SnP and PlSnP Multiple implementations Assumption: the state representation is opaque! 10 / 19 SnP or PlSnP Keccak- p [1600] 2× Keccak- p [1600] Xoodoo 4× Xoodoo opt32 fallback opt32 fallback opt64 AVX2 ARMv6M AVX2 AVX2 AVX512 ARMv7M AVX512 AVX512 NEON ARMv7A NEON ARMv7M AVR8 ARMv8A

Below SnP and PlSnP Operations on the state initialize the state apply the permutation f XOR/overwrite bytes into the state extract bytes from the state and optionally XOR them 11 / 19

Below SnP and PlSnP Declarations in KeccakP-1600-SnP.h : #define KeccakP1600_implementation “generic 64-bit optimized implementation” #define KeccakP1600_stateSizeInBytes 200 #define KeccakP1600_stateAlignment 8 Typical functions to be implemented (or macro’ed): KeccakP1600_Initialize KeccakP1600_AddBytes KeccakP1600_OverwriteBytes KeccakP1600_Permute_Nrounds KeccakP1600_ExtractBytes KeccakP1600_ExtractAndAddBytes 12 / 19 Example for Keccak- p [ 1600 ]

Below SnP and PlSnP Declarations in KeccakP-1600-SnP.h : #define KeccakP1600_implementation “generic 64-bit optimized implementation” #define KeccakP1600_stateSizeInBytes 200 #define KeccakP1600_stateAlignment 8 Typical functions to be implemented (or macro’ed): KeccakP1600_Initialize KeccakP1600_AddBytes KeccakP1600_OverwriteBytes KeccakP1600_Permute_Nrounds KeccakP1600_ExtractBytes KeccakP1600_ExtractAndAddBytes 12 / 19 Example for Keccak- p [ 1600 ]

Below SnP and PlSnP Declarations in KeccakP-1600-SnP.h : #define KeccakP1600_implementation “generic 64-bit optimized implementation” #define KeccakP1600_stateSizeInBytes 200 #define KeccakP1600_stateAlignment 8 Typical functions to be implemented (or macro’ed): KeccakP1600_Initialize KeccakP1600_AddBytes KeccakP1600_OverwriteBytes KeccakP1600_Permute_Nrounds KeccakP1600_ExtractBytes KeccakP1600_ExtractAndAddBytes 12 / 19 Example for Keccak- p [ 1600 ]

Below SnP and PlSnP Declarations in KeccakP-1600-SnP.h : #define KeccakP1600_implementation “generic 64-bit optimized implementation” #define KeccakP1600_stateSizeInBytes 200 #define KeccakP1600_stateAlignment 8 Typical functions to be implemented (or macro’ed): KeccakP1600_Initialize KeccakP1600_AddBytes KeccakP1600_OverwriteBytes KeccakP1600_Permute_Nrounds KeccakP1600_ExtractBytes KeccakP1600_ExtractAndAddBytes 12 / 19 Example for Keccak- p [ 1600 ]

Below SnP and PlSnP Declarations in KeccakP-1600-SnP.h : #define KeccakP1600_implementation “generic 64-bit optimized implementation” #define KeccakP1600_stateSizeInBytes 200 #define KeccakP1600_stateAlignment 8 Typical functions to be implemented (or macro’ed): KeccakP1600_Initialize KeccakP1600_AddBytes KeccakP1600_OverwriteBytes KeccakP1600_Permute_Nrounds KeccakP1600_ExtractBytes KeccakP1600_ExtractAndAddBytes 12 / 19 Example for Keccak- p [ 1600 ]

Below SnP and PlSnP Fast loop optimization Specialized repeated application of some operations (optional) 13 / 19

Below SnP and PlSnP Parallel operations on the states Optional fast loop optimization XOR blocks into state Parallel application of f Functions on all instances Functions on individual instances 14 / 19 0 … f f f 0 … f f f 0 f f f …

Below SnP and PlSnP Parallel operations on the states Optional fast loop optimization XOR blocks into state Parallel application of f Functions on all instances Functions on individual instances 14 / 19 0 … f f f 0 … f f f 0 f f f …

Below SnP and PlSnP Parallel operations on the states Optional fast loop optimization XOR blocks into state Parallel application of f Functions on all instances Functions on individual instances 14 / 19 0 … f f f 0 … f f f 0 f f f …

Build system Outline 1 Introduction 2 Inside the XKCP 3 Below SnP and PlSnP 4 Build system 15 / 19

Build system Making targets Making a library ( .a or .so ) make generic64/libXKCP.a make generic32/libXKCP.a make Skylake/libXKCP.a make ARMv7A/libXKCP.a make compact/libXKCP.a Extracting the source fjles make generic64/libXKCP.a .pack Running the unit tests make generic64/UnitTests UnitTests --SnP --KangarooTwelve --Xoofff And more: benchmarks, KeccakSum utility 16 / 19

Build system Making targets Making a library ( .a or .so ) make generic64/libXKCP.a make generic32/libXKCP.a make Skylake/libXKCP.a make ARMv7A/libXKCP.a make compact/libXKCP.a Extracting the source fjles make generic64/libXKCP.a .pack Running the unit tests make generic64/UnitTests UnitTests --SnP --KangarooTwelve --Xoofff And more: benchmarks, KeccakSum utility 16 / 19

Build system Making targets Making a library ( .a or .so ) make generic64/libXKCP.a make generic32/libXKCP.a make Skylake/libXKCP.a make ARMv7A/libXKCP.a make compact/libXKCP.a Extracting the source fjles make generic64/libXKCP.a .pack Running the unit tests make generic64/UnitTests UnitTests --SnP --KangarooTwelve --Xoofff And more: benchmarks, KeccakSum utility 16 / 19