authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2020-10-26 13:23:16+01:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2020-10-29 15:18:37-04:00
log26793453a7cf2016ae6fa7ad3d649dca150b53f5
treecb174c663085e6908335350622e39de1bd4f181d
parent32e65c3f96b5418acf4d444714facbba98790a91

std/crypto/blake2b: allow the initial output length to be set

BLAKE2 includes the expected output length in the initial state. This length is actually distinct from the actual output length used at finalization. BLAKE2b-256/128 is thus not the same as BLAKE2b-128. This behavior can be a little bit surprising, and has been "fixed" in BLAKE3. In order to support this, we may want to provide an option to set the length used for domain separation. In Zig, there is another reason to allow this: we assume that the output length is defined at comptime. But BLAKE2 doesn't have a fixed output length. For an output length that is not known at comptime, we can't take the full block size and truncate it due to the reason above. What we can do now is set that length as an option to get the correct initial state, and truncate the output if necessary.

1 files changed, 4 insertions(+), 4 deletions(-)

lib/std/crypto/blake2.zig+4-4
......@@ -44,7 +44,7 @@ pub fn Blake2s(comptime out_bits: usize) type {
4444 pub const key_length_min = 0;
4545 pub const key_length_max = 32;
4646 pub const key_length = 32; // recommended key length
47 pub const Options = struct { key: ?[]const u8 = null, salt: ?[8]u8 = null, context: ?[8]u8 = null };
47 pub const Options = struct { key: ?[]const u8 = null, salt: ?[8]u8 = null, context: ?[8]u8 = null, expected_out_bits: usize = out_bits };
4848
4949 const iv = [8]u32{
5050 0x6A09E667,
......@@ -84,7 +84,7 @@ pub fn Blake2s(comptime out_bits: usize) type {
8484
8585 const key_len = if (options.key) |key| key.len else 0;
8686 // default parameters
87 d.h[0] ^= 0x01010000 ^ @truncate(u32, key_len << 8) ^ @intCast(u32, out_bits >> 3);
87 d.h[0] ^= 0x01010000 ^ @truncate(u32, key_len << 8) ^ @intCast(u32, options.expected_out_bits >> 3);
8888 d.t = 0;
8989 d.buf_len = 0;
9090
......@@ -385,7 +385,7 @@ pub fn Blake2b(comptime out_bits: usize) type {
385385 pub const key_length_min = 0;
386386 pub const key_length_max = 64;
387387 pub const key_length = 32; // recommended key length
388 pub const Options = struct { key: ?[]const u8 = null, salt: ?[16]u8 = null, context: ?[16]u8 = null };
388 pub const Options = struct { key: ?[]const u8 = null, salt: ?[16]u8 = null, context: ?[16]u8 = null, expected_out_bits: usize = out_bits };
389389
390390 const iv = [8]u64{
391391 0x6a09e667f3bcc908,
......@@ -427,7 +427,7 @@ pub fn Blake2b(comptime out_bits: usize) type {
427427
428428 const key_len = if (options.key) |key| key.len else 0;
429429 // default parameters
430 d.h[0] ^= 0x01010000 ^ (key_len << 8) ^ (out_bits >> 3);
430 d.h[0] ^= 0x01010000 ^ (key_len << 8) ^ (options.expected_out_bits >> 3);
431431 d.t = 0;
432432 d.buf_len = 0;
433433