authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2024-11-10 21:43:09+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2024-11-10 20:43:09+00:00
log05a3ac43e920e67dda850dcda9423935b4b540ac
tree6804a2327d065d89cd1c14e00f46784991ae6864
parent62f4a6b4d877ce03d1e6f59cf794b5ebc6ea41d0
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto.ascon: support up to 16 rounds, and update links (#21953)

Initial public draft NIST SP 800-232 specifies Ascon constants up to 16 rounds for future extensions. So, add these new constants.

1 files changed, 5 insertions(+), 4 deletions(-)

lib/std/crypto/ascon.zig+5-4
...@@ -1,6 +1,6 @@...@@ -1,6 +1,6 @@
1//! Ascon is a 320-bit permutation, selected as new standard for lightweight cryptography1//! Ascon is a 320-bit permutation, selected as new standard for lightweight cryptography
2//! in the NIST Lightweight Cryptography competition (2019–2023).2//! in the NIST Lightweight Cryptography competition (2019–2023).
3//! https://csrc.nist.gov/News/2023/lightweight-cryptography-nist-selects-ascon3//! https://csrc.nist.gov/pubs/sp/800/232/ipd
4//!4//!
5//! The permutation is compact, and optimized for timing and side channel resistance,5//! The permutation is compact, and optimized for timing and side channel resistance,
6//! making it a good choice for embedded applications.6//! making it a good choice for embedded applications.
...@@ -19,8 +19,9 @@ const native_endian = builtin.cpu.arch.endian();...@@ -19,8 +19,9 @@ const native_endian = builtin.cpu.arch.endian();
19///19///
20/// The state is represented as 5 64-bit words.20/// The state is represented as 5 64-bit words.
21///21///
22/// The NIST submission (v1.2) serializes these words as big-endian,22/// The original NIST submission (v1.2) serializes these words as big-endian,
23/// but software implementations are free to use native endianness.23/// but NIST SP 800-232 switched to a little-endian representation.
24/// Software implementations are free to use native endianness with no security degradation.
24pub fn State(comptime endian: std.builtin.Endian) type {25pub fn State(comptime endian: std.builtin.Endian) type {
25 return struct {26 return struct {
26 const Self = @This();27 const Self = @This();
...@@ -157,7 +158,7 @@ pub fn State(comptime endian: std.builtin.Endian) type {...@@ -157,7 +158,7 @@ pub fn State(comptime endian: std.builtin.Endian) type {
157158
158 /// Apply a reduced-round permutation to the state.159 /// Apply a reduced-round permutation to the state.
159 pub inline fn permuteR(state: *Self, comptime rounds: u4) void {160 pub inline fn permuteR(state: *Self, comptime rounds: u4) void {
160 const rks = [12]u64{ 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87, 0x78, 0x69, 0x5a, 0x4b };161 const rks = [16]u64{ 0x3c, 0x2d, 0x1e, 0x0f, 0xf0, 0xe1, 0xd2, 0xc3, 0xb4, 0xa5, 0x96, 0x87, 0x78, 0x69, 0x5a, 0x4b };
161 inline for (rks[rks.len - rounds ..]) |rk| {162 inline for (rks[rks.len - rounds ..]) |rk| {
162 state.round(rk);163 state.round(rk);
163 }164 }