update turboshake

Author: newpavlov

Cargo.lock

@@ -36,3 +36,4 @@ opt-level = 2
 [patch.crates-io]
 sha1 = { path = "sha1" }
 whirlpool = { path = "whirlpool" }
+sponge-cursor = { git = "https://github.com/RustCrypto/utils", branch = "add-sponge-cursor" }

Cargo.toml

@@ -15,10 +15,10 @@ description = "Implementation of the cSHAKE family of extendable-output function
 [dependencies]
 digest = { version = "0.11", default-features = false }
 keccak = "0.2"
-sponge-cursor = { git = "https://github.com/RustCrypto/utils", branch = "add-sponge-cursor" }
+sponge-cursor = "0.1"
 
 [dev-dependencies]
-digest = { version = "0.11", features = ["dev"] }
+digest = { version = "0.11", default-features = false, features = ["dev"] }
 hex-literal = "1"
 
 [features]

cshake/Cargo.toml

@@ -13,17 +13,18 @@ categories = ["cryptography", "no-std"]
 description = "Implementation of the TurboSHAKE family of extendable-output functions (XOFs)"
 
 [dependencies]
-digest = "0.11"
+digest = { version = "0.11", default-features = false }
 keccak = "0.2"
+sponge-cursor = "0.1"
 
 [dev-dependencies]
-digest = { version = "0.11", features = ["dev"] }
+digest = { version = "0.11", default-features = false, features = ["dev"] }
 hex-literal = "1"
 
 [features]
 default = ["alloc"]
 alloc = ["digest/alloc"]
-zeroize = ["digest/zeroize"]
+zeroize = ["digest/zeroize", "sponge-cursor/zeroize"]
 
 [package.metadata.docs.rs]
 all-features = true

turboshake/Cargo.toml

@@ -11,12 +11,14 @@
 
 pub use digest;
 use keccak::{Keccak, State1600};
+use sponge_cursor::SpongeCursor;
 
 use core::fmt;
 use digest::{
-    CollisionResistance, ExtendableOutput, ExtendableOutputReset, HashMarker, Update, XofReader,
-    block_api::{AlgorithmName, BlockSizeUser, Reset},
-    block_buffer::{BlockSizes, EagerBuffer, ReadBuffer},
+    CollisionResistance, ExtendableOutput, ExtendableOutputReset, HashMarker, Reset, Update,
+    XofReader,
+    array::ArraySize,
+    common::{AlgorithmName, BlockSizeUser},
     consts::{U16, U32, U136, U168},
 };
 
@@ -33,13 +35,13 @@ pub const DEFAULT_DS: u8 = 0x1F;
 ///
 /// Rate MUST be either [`U168`] or [`U136`] for TurboSHAKE128 and TurboSHAKE256 respectively.
 #[derive(Clone)]
-pub struct TurboShake<Rate: BlockSizes, const DS: u8> {
+pub struct TurboShake<Rate: ArraySize, const DS: u8> {
     state: State1600,
+    cursor: SpongeCursor<Rate>,
     keccak: Keccak,
-    buffer: EagerBuffer<Rate>,
 }
 
-impl<Rate: BlockSizes, const DS: u8> Default for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> Default for TurboShake<Rate, DS> {
     #[inline]
     fn default() -> Self {
         const {
@@ -48,96 +50,76 @@ impl<Rate: BlockSizes, const DS: u8> Default for TurboShake<Rate, DS> {
         }
         Self {
             state: Default::default(),
+            cursor: Default::default(),
             keccak: Keccak::new(),
-            buffer: Default::default(),
         }
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> HashMarker for TurboShake<Rate, DS> {}
+impl<Rate: ArraySize, const DS: u8> HashMarker for TurboShake<Rate, DS> {}
 
-impl<Rate: BlockSizes, const DS: u8> BlockSizeUser for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> BlockSizeUser for TurboShake<Rate, DS> {
     type BlockSize = Rate;
 }
 
-impl<Rate: BlockSizes, const DS: u8> Update for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> Update for TurboShake<Rate, DS> {
     #[inline]
     fn update(&mut self, data: &[u8]) {
-        let Self {
-            state,
-            keccak,
-            buffer,
-        } = self;
-
-        keccak.with_p1600::<ROUNDS>(|p1600| {
-            buffer.digest_blocks(data, |blocks| {
-                for block in blocks {
-                    xor_block(state, block);
-                    p1600(state);
-                }
-            });
+        self.keccak.with_p1600::<ROUNDS>(|p1600| {
+            self.cursor.absorb_u64_le(&mut self.state, p1600, data);
         });
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> TurboShake<Rate, DS> {
-    fn finalize_dirty(&mut self) {
-        let Self {
-            state,
-            keccak,
-            buffer,
-        } = self;
-
-        let pos = buffer.get_pos();
-        let mut block = buffer.pad_with_zeros();
-        block[pos] = DS;
-        let n = block.len();
-        block[n - 1] |= 0x80;
+impl<Rate: ArraySize, const DS: u8> TurboShake<Rate, DS> {
+    fn pad(&mut self) {
+        let pos = self.cursor.pos();
+        let word_offset = pos / 8;
+        let byte_offset = pos % 8;
 
-        keccak.with_p1600::<ROUNDS>(|p1600| {
-            xor_block(state, &block);
-            p1600(state);
-        });
+        let pad = u64::from(DS) << (8 * byte_offset);
+        self.state[word_offset] ^= pad;
+        self.state[Rate::USIZE / 8 - 1] ^= 1 << 63;
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> ExtendableOutput for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> ExtendableOutput for TurboShake<Rate, DS> {
     type Reader = TurboShakeReader<Rate>;
 
     #[inline]
     fn finalize_xof(mut self) -> Self::Reader {
-        self.finalize_dirty();
+        self.pad();
         Self::Reader {
             state: self.state,
+            cursor: Default::default(),
             keccak: self.keccak,
-            buffer: Default::default(),
         }
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> ExtendableOutputReset for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> ExtendableOutputReset for TurboShake<Rate, DS> {
     #[inline]
     fn finalize_xof_reset(&mut self) -> Self::Reader {
-        self.finalize_dirty();
+        self.pad();
         let reader = Self::Reader {
             state: self.state,
+            cursor: Default::default(),
             keccak: self.keccak,
-            buffer: Default::default(),
         };
         self.reset();
         reader
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> Reset for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> Reset for TurboShake<Rate, DS> {
     #[inline]
     fn reset(&mut self) {
         self.state = Default::default();
-        self.buffer.reset();
+        self.cursor = Default::default();
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> AlgorithmName for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> AlgorithmName for TurboShake<Rate, DS> {
     fn write_alg_name(f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let alg_name = match Rate::USIZE {
             168 => "TurboSHAKE128",
@@ -148,7 +130,7 @@ impl<Rate: BlockSizes, const DS: u8> AlgorithmName for TurboShake<Rate, DS> {
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> fmt::Debug for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> fmt::Debug for TurboShake<Rate, DS> {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let debug_str = match Rate::USIZE {
             168 => "TurboShake128 { ... }",
@@ -159,7 +141,7 @@ impl<Rate: BlockSizes, const DS: u8> fmt::Debug for TurboShake<Rate, DS> {
     }
 }
 
-impl<Rate: BlockSizes, const DS: u8> Drop for TurboShake<Rate, DS> {
+impl<Rate: ArraySize, const DS: u8> Drop for TurboShake<Rate, DS> {
     fn drop(&mut self) {
         #[cfg(feature = "zeroize")]
         {
@@ -171,40 +153,26 @@ impl<Rate: BlockSizes, const DS: u8> Drop for TurboShake<Rate, DS> {
 }
 
 #[cfg(feature = "zeroize")]
-impl<Rate: BlockSizes, const DS: u8> digest::zeroize::ZeroizeOnDrop for TurboShake<Rate, DS> {}
+impl<Rate: ArraySize, const DS: u8> digest::zeroize::ZeroizeOnDrop for TurboShake<Rate, DS> {}
 
 /// Generic TurboSHAKE XOF reader
 #[derive(Clone)]
-pub struct TurboShakeReader<Rate: BlockSizes> {
+pub struct TurboShakeReader<Rate: ArraySize> {
     state: State1600,
+    cursor: SpongeCursor<Rate>,
     keccak: Keccak,
-    buffer: ReadBuffer<Rate>,
 }
 
-impl<Rate: BlockSizes> XofReader for TurboShakeReader<Rate> {
+impl<Rate: ArraySize> XofReader for TurboShakeReader<Rate> {
     #[inline]
     fn read(&mut self, buf: &mut [u8]) {
-        let Self {
-            state,
-            keccak,
-            buffer,
-        } = self;
-
-        buffer.read(buf, |block| {
-            let mut chunks = block.chunks_exact_mut(8);
-            for (src, dst) in state.iter().zip(&mut chunks) {
-                dst.copy_from_slice(&src.to_le_bytes());
-            }
-            assert!(
-                chunks.into_remainder().is_empty(),
-                "rate is either 136 or 168",
-            );
-            keccak.with_p1600::<ROUNDS>(|p1600| p1600(state));
+        self.keccak.with_p1600::<ROUNDS>(|p1600| {
+            self.cursor.squeeze_u64_le(&mut self.state, p1600, buf);
         });
     }
 }
 
-impl<Rate: BlockSizes> fmt::Debug for TurboShakeReader<Rate> {
+impl<Rate: ArraySize> fmt::Debug for TurboShakeReader<Rate> {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let debug_str = match Rate::USIZE {
             168 => "TurboShakeReader128 { ... }",
@@ -215,19 +183,19 @@ impl<Rate: BlockSizes> fmt::Debug for TurboShakeReader<Rate> {
     }
 }
 
-impl<Rate: BlockSizes> Drop for TurboShakeReader<Rate> {
+impl<Rate: ArraySize> Drop for TurboShakeReader<Rate> {
     fn drop(&mut self) {
         #[cfg(feature = "zeroize")]
         {
             use digest::zeroize::Zeroize;
             self.state.zeroize();
-            // self.buffer is zeroized by its `Drop`
+            self.cursor.zeroize();
         }
     }
 }
 
 #[cfg(feature = "zeroize")]
-impl<Rate: BlockSizes> digest::zeroize::ZeroizeOnDrop for TurboShakeReader<Rate> {}
+impl<Rate: ArraySize> digest::zeroize::ZeroizeOnDrop for TurboShakeReader<Rate> {}
 
 /// TurboSHAKE128 hasher with domain separator.
 pub type TurboShake128<const DS: u8 = DEFAULT_DS> = TurboShake<U168, DS>;
@@ -248,15 +216,3 @@ impl<const DS: u8> CollisionResistance for TurboShake256<DS> {
     // https://www.ietf.org/archive/id/draft-irtf-cfrg-kangarootwelve-17.html#section-7-8
     type CollisionResistance = U32;
 }
-
-fn xor_block(state: &mut State1600, block: &[u8]) {
-    assert!(size_of_val(block) < size_of_val(state));
-
-    let mut chunks = block.chunks_exact(8);
-    for (s, chunk) in state.iter_mut().zip(&mut chunks) {
-        *s ^= u64::from_le_bytes(chunk.try_into().unwrap());
-    }
-
-    let rem = chunks.remainder();
-    assert!(rem.is_empty(), "block size is equal to 136 or 168");
-}