/* File:    md6.h 
** Author:  Ronald L. Rivest
** Address: Room 32G-692 Stata Center 
**          32 Vassar Street 
**          Cambridge, MA 02139
** Email:   rivest@mit.edu
** Date:    10/24/2008
**
** (The following license is known as "The MIT License")
** 
** Copyright (c) 2008 Ronald L. Rivest
** 
** Permission is hereby granted, free of charge, to any person obtaining a copy
** of this software and associated documentation files (the "Software"), to deal
** in the Software without restriction, including without limitation the rights
** to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
** copies of the Software, and to permit persons to whom the Software is
** furnished to do so, subject to the following conditions:
** 
** The above copyright notice and this permission notice shall be included in
** all copies or substantial portions of the Software.
** 
** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
** THE SOFTWARE.
**
** (end of license)
**
** This file is part of the definition of the MD6 hash function.
** The files defining the MD6 hash function are:
**    md6.h
**    md6_compress.c
**    md6_mode.
** (Note that md6.h includes inttypes.h, which includes stdint.h; 
** versions of these header files compatible with MS Visual Studio
** are available, as noted below.)
**
** The files defining the interface between MD6 and the NIST SHA-3
** API are:
**    md6_nist.h
**    md6_nist.c
** The NIST SHA-3 API is defined in:
**    http://www.csrc.nist.gov/groups/ST/hash/documents/SHA3-C-API.pdf
**
** See  http://groups.csail.mit.edu/cis/md6  for more information.
**
** These files define the ``standard'' version of MD6.  However,
** they are written in such a way that one may relatively easily
** define and experiment with ``variant'' versions.
*/

/* Prevent multiple includes
** Matching endif is at end of md6.h
*/
#ifndef MD6_H_INCLUDED
#define MD6_H_INCLUDED


/* inttypes.h (which includes stdint.h)
** inttypes.h and stdint.h  are part of the normal environment 
** for gcc, but not for MS Visual Studio.  Fortunately,
** compatible implementations are available from Google at:
**   http://msinttypes.googlecode.com/svn/trunk/stdint.h
**   http://msinttypes.googlecode.com/svn/trunk/inttypes.h
** If these two files are in the same directory as md6.h, then
** MD6 will compile OK with MS Visual Studio.
*/
#if defined  _MSC_VER
#include "inttypes.h"
#else
#include <inttypes.h>
#endif

/* MD6 wordsize.
**
** Define md6 wordsize md6_w, in bits.
** Note that this is the "word size" relevant to the
** definition of md6 (it defines how many bits in an
** "md6_word");  it does *not* refer to the word size
** on the platform for which this is being compiled.
*/

#define   md6_w    64

/* Define "md6_word" appropriately for given value of md6_w.
** Also define PR_MD6_WORD to be the appropriate hex format string,
** using the format strings from inttypes.h .
** The term `word' in comments means an `md6_word'.
*/

#if (md6_w==64)                    /* standard md6 */
typedef uint64_t md6_word;
#define PR_MD6_WORD "%.16" PRIx64

#elif (md6_w==32)                  /* nonstandard variant */
typedef uint32_t md6_word;
#define PR_MD6_WORD "%.8" PRIx32

#elif (md6_w==16)                  /* nonstandard variant */
typedef uint16_t md6_word;
#define PR_MD6_WORD "%.4" PRIx16

#elif (md6_w==8)                   /* nonstandard variant */
typedef uint8_t md6_word;
#define PR_MD6_WORD "%.2" PRIx8

#endif

/* MD6 compression function.
**
** MD6 compression function is defined in file md6_compress.c 
*/

/* MD6 compression function constants                                  */

#define md6_n      89    /* size of compression input block, in words  */
#define md6_c      16    /* size of compression output, in words       */
                         /* a c-word block is also called a "chunk"    */
#define md6_max_r 255    /* max allowable value for number r of rounds */

/* Compression function routines                                
** These are ``internal'' routines that need not be called for  
** ordinary md6 usage.
*/

extern int md6_default_r( int d,      /* returns default r for given d */ 
			  int keylen  /* and keylen                    */
			  );    

void md6_main_compression_loop( md6_word *A,          /* working array */
				int r              /* number of rounds */
				);

int md6_compress( md6_word *C,                               /* output */  
		  md6_word *N,                                /* input */
		  int r,                              /* number rounds */
		  md6_word *A /* (optional) working array, may be NULL */
                );


typedef uint64_t md6_control_word;                      /* (r,L,z,p,d) */
md6_control_word md6_make_control_word( int r,        /* number rounds */
					int L,      /* parallel passes */
					int z,      /* final node flag */
					int p,         /* padding bits */
					int keylen,    /* bytes in key */
					int d           /* digest size */
					);

typedef uint64_t md6_nodeID;                                /* (ell,i) */
md6_nodeID md6_make_nodeID( int ell,                   /* level number */
			    int i    /* index (0,1,2,...) within level */
			    );

void md6_pack( md6_word* N,                                  /* output */
	       const md6_word* Q,           /* fractional part sqrt(6) */
	       md6_word* K,                                     /* key */
	       int ell, int i,                                /* for U */
	       int r, int L, int z, int p, int keylen, int d, /* for V */
	       md6_word* B                               /* data input */
	       );

int md6_standard_compress( 
        md6_word *C,                                     /* output */
	const md6_word *Q,              /* fractional part sqrt(6) */
	md6_word *K,                                        /* key */
	int ell, int i,                                   /* for U */
	int r, int L, int z, int p, int keylen, int d,    /* for V */
	md6_word* B                                  /* data input */
			   );

/* MD6 mode of operation.
**
** MD6 mode of operation is defined in file md6_mode.c 
*/

/* MD6 constants related to standard mode of operation                 */

/* These five values give lengths of the components of compression     */
/* input block; they should sum to md6_n.                              */
#define md6_q 15         /* # Q words in compression block (>=0)       */
#define md6_k  8         /* # key words per compression block (>=0)    */
#define md6_u (64/md6_w) /* # words for unique node ID (0 or 64/w)     */
#define md6_v (64/md6_w) /* # words for control word (0 or 64/w)       */
#define md6_b 64         /* # data words per compression block (>0)    */

#define md6_default_L 64    /* large so that MD6 is fully hierarchical */

#define md6_max_stack_height 29
    /* max_stack_height determines the maximum number of bits that
    ** can be processed by this implementation (with default L) to be:
    **    (b*w) * ((b/c) ** (max_stack_height-3)
    **    = 2 ** 64  for b = 64, w = 64, c = 16, and  max_stack_height = 29
    ** (We lose three off the height since level 0 is unused,
    ** level 1 contains the input data, and C has 0-origin indexing.)
    ** The smallest workable value for md6_max_stack_height is 3.
    ** (To avoid stack overflow for non-default L values, 
    ** we should have max_stack_height >= L + 2.)
    ** (One level of storage could be saved by letting st->N[] use
    ** 1-origin indexing, since st->N[0] is now unused.)
    */

/* MD6 state.
** 
** md6_state is the main data structure for the MD6 hash function.
*/

typedef struct {

  int d;           /* desired hash bit length. 1 <= d <= 512.      */
  int hashbitlen;  /* hashbitlen is the same as d; for NIST API    */

  unsigned char hashval[ (md6_c/2)*(md6_w/8) ];    
      /* e.g. unsigned char hashval[64];  (Assumes d<=c/2.)        */
      /* contains hashval after call to md6_final                  */
      /* hashval appears in first floor(d/8) bytes, with           */