Fix 1362 xof streaming squeeze#1389
Conversation
The XOF squeeze previously required all chunks except the last to be
exactly RATE bytes long. Calling squeeze with a sub-RATE chunk would
permute on the next call and discard the unread bytes from the current
block, producing output inconsistent with a single one-shot squeeze.
Add `squeeze_buf: [u8; RATE]` and `squeeze_pos: usize` to
`KeccakXofState`. On each squeeze:
1. Drain leftover bytes from `squeeze_buf[squeeze_pos..]` first.
2. If more output is needed, permute (skipping on the very first
squeeze) and extract full blocks directly into the caller's buffer.
3. For a trailing sub-RATE remainder, extract a full RATE-byte block
into `squeeze_buf` and copy the requested prefix to the caller;
the rest stays buffered for the next call.
Add four regression tests covering partial-chunk streaming for SHAKE128
and SHAKE256, byte-at-a-time squeezing, and a partial-then-multi-block
squeeze that crosses a block boundary inside one call.
…62-xof-streaming-squeeze
|
Thank you! I don't have capacity for a full review right now. |
jschneider-bensch
added
the
waiting-on-review
Sorry for the delay . . . I was behind on my Github email notifications. I installed hax at the workspace's pinned
The |
2 participants
No description provided.