jurischain.h

#ifndef H_JURISCHAIN
#define H_JURISCHAIN

#define JURISCHAIN_VERSION '1.0.0'

#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <strings.h>

#ifndef KECCAKF_ROUNDS
#define KECCAKF_ROUNDS 24
#endif

#ifndef ROTL64
#define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
#endif

#ifndef HASH_LEN
#define HASH_LEN 32
#endif
  

#define memcpy __builtin_memcpy

/* state context */
typedef struct {
  union {           /* state */
    uint8_t b[200]; /* 8-bit bytes */
    uint64_t q[25]; /* 64-bit words */
  } st;
  int pt, rsiz, mdlen; /* these don't overflow */
} sha3_ctx_t;

typedef struct {
  uint8_t payload[HASH_LEN + 1];
  uint8_t seed[HASH_LEN];
} jurischain_ctx_t;

/* Compression function */
void sha3_keccakf(uint64_t st[25]);

/* OpenSSL - like interface */
int sha3_init(sha3_ctx_t *c, int mdlen); /*  mdlen = hash output in bytes */
int sha3_update(sha3_ctx_t *c, const void *data, size_t len);
int sha3_final(void *md, sha3_ctx_t *c); /*  digest goes to md */

/* compute a sha3 hash (md) of given byte length from "in" */
void *sha3(const void *in, size_t inlen, void *md, int mdlen);

void sha3_keccakf(uint64_t st[25]) {
  /* constants */
  const uint64_t keccakf_rndc[24] = {
      0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
      0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
      0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
      0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
      0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
      0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
      0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
      0x8000000000008080, 0x0000000080000001, 0x8000000080008008};
  const int keccakf_rotc[24] = {1,  3,  6,  10, 15, 21, 28, 36, 45, 55, 2,  14,
                                27, 41, 56, 8,  25, 43, 62, 18, 39, 61, 20, 44};
  const int keccakf_piln[24] = {10, 7,  11, 17, 18, 3, 5,  16, 8,  21, 24, 4,
                                15, 23, 19, 13, 12, 2, 20, 14, 22, 9,  6,  1};

  /* variables */
  int i = 0, j = 0, r = 0;
  uint64_t t = 0, bc[5] = {
                      0,
                  };

#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
  uint8_t *v;

  /* endianess conversion. this is redundant on little-endian targets */
  for (i = 0; i < 25; i++) {
    v = (uint8_t *)&st[i];
    st[i] = ((uint64_t)v[0]) | (((uint64_t)v[1]) << 8) |
            (((uint64_t)v[2]) << 16) | (((uint64_t)v[3]) << 24) |
            (((uint64_t)v[4]) << 32) | (((uint64_t)v[5]) << 40) |
            (((uint64_t)v[6]) << 48) | (((uint64_t)v[7]) << 56);
  }
#endif

  /* actual iteration */
  for (r = 0; r < KECCAKF_ROUNDS; r++) {
    /*  Theta */
    for (i = 0; i < 5; i++)
      bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];

    for (i = 0; i < 5; i++) {
      t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
      for (j = 0; j < 25; j += 5) st[j + i] ^= t;
    }

    /*  Rho Pi */
    t = st[1];
    for (i = 0; i < 24; i++) {
      j = keccakf_piln[i];
      bc[0] = st[j];
      st[j] = ROTL64(t, keccakf_rotc[i]);
      t = bc[0];
    }

    /*   Chi */
    for (j = 0; j < 25; j += 5) {
      for (i = 0; i < 5; i++) bc[i] = st[j + i];
      for (i = 0; i < 5; i++) st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
    }

    /*   Iota */
    st[0] ^= keccakf_rndc[r];
  }

#if __BYTE_ORDER__ != __ORDER_LITTLE_ENDIAN__
#error WebAssembly should be little endian
  /*  endianess conversion. this is redundant on little-endian targets */
  for (i = 0; i < 25; i++) {
    v = (uint8_t *)&st[i];
    t = st[i];
    v[0] = t & 0xFF;
    v[1] = (t >> 8) & 0xFF;
    v[2] = (t >> 16) & 0xFF;
    v[3] = (t >> 24) & 0xFF;
    v[4] = (t >> 32) & 0xFF;
    v[5] = (t >> 40) & 0xFF;
    v[6] = (t >> 48) & 0xFF;
    v[7] = (t >> 56) & 0xFF;
  }
#endif
}

/*  Initialize the context for SHA3 */
int sha3_init(sha3_ctx_t *c, int mdlen) {
  int i = 0;

  for (i = 0; i < 25; i++) c->st.q[i] = 0;
  c->mdlen = mdlen;
  c->rsiz = 200 - 2 * mdlen;
  c->pt = 0;

  return 1;
}

/*  update state with more data */
int sha3_update(sha3_ctx_t *c, const void *data, size_t len) {
  size_t i = 0;
  int j = 0;

  j = c->pt;
  for (i = 0; i < len; i++) {
    c->st.b[j++] ^= ((const uint8_t *)data)[i];
    if (j >= c->rsiz) {
      sha3_keccakf(c->st.q);
      j = 0;
    }
  }
  c->pt = j;

  return 1;
}

/*  finalize and output a hash */
int sha3_final(void *md, sha3_ctx_t *c) {
  int i = 0;

  c->st.b[c->pt] ^= 0x06;
  c->st.b[c->rsiz - 1] ^= 0x80;
  sha3_keccakf(c->st.q);

  for (i = 0; i < c->mdlen; i++) {
    ((uint8_t *)md)[i] = c->st.b[i];
  }

  return 1;
}

/*  compute a SHA-3 hash (md) of given byte length from "in" */
void *sha3(const void *in, size_t inlen, void *md, int mdlen) {
  sha3_ctx_t sha3;

  bzero(&sha3, sizeof(sha3));

  sha3_init(&sha3, mdlen);
  sha3_update(&sha3, in, inlen);
  sha3_final(md, &sha3);

  return md;
}

void jurischain_gen(jurischain_ctx_t *challenge, uint8_t d, const void *seed, size_t inlen) {
  uint8_t rand_hash[HASH_LEN] = {
      0,
  };
  memset(challenge, 0, sizeof(jurischain_ctx_t));
  sha3(seed, inlen, rand_hash, HASH_LEN);
  memcpy(challenge->seed, rand_hash, sizeof(rand_hash));
  memcpy(challenge->payload, rand_hash, sizeof(rand_hash));
  challenge->payload[HASH_LEN] = d;
}

jurischain_ctx_t *jurischain_init() {
    jurischain_ctx_t *ptr = NULL;
    ptr = (jurischain_ctx_t *)malloc(sizeof(jurischain_ctx_t));
    return ptr;
}

void jurischain_destroy(jurischain_ctx_t **ptr) {
    free(*ptr);
    *ptr = NULL;
}

int jurischain_verify(jurischain_ctx_t *challenge) {
  uint8_t hash[HASH_LEN] = { 0, },
          d = 0,
          hash_concat[HASH_LEN * 2] = { 0, },
          response[HASH_LEN] = { 0, };
  uint64_t mask = 0, *res64 = NULL, valid = 0, i = 0;
  memcpy(hash, challenge->payload, HASH_LEN);
  memcpy(&hash_concat[HASH_LEN], challenge->payload, HASH_LEN);
  memcpy(hash_concat, challenge->seed, HASH_LEN);

  d = challenge->payload[HASH_LEN];

  sha3(hash_concat, HASH_LEN * 2, response, HASH_LEN);

  /*  checar se os primeiros bits estão corretos */
  mask = 0xFFFFFFFFFFFFFFFF >> (64 - (d % 64));
  res64 = (uint64_t *)response; /*  webassembly assumes little endian */
  valid = 1;

  for (i = 0; i < (d / 64); i++) valid = (res64[i] == 0) ? valid : 0;
  if ((d % 64) != 0) valid = ((res64[d / 64] & mask) == 0) ? valid : 0;

  return valid;
}

int jurischain_try(jurischain_ctx_t *challenge) {
  uint8_t rand_hash[HASH_LEN] = { 0, };
  sha3(challenge->seed, HASH_LEN, rand_hash, HASH_LEN);
  memcpy(challenge->seed, rand_hash, HASH_LEN);

  return jurischain_verify(challenge);
}

#endif