Feature/sha2 final patches - #88
Open
dghgit wants to merge 5 commits into
Open
Conversation
Contributor
|
We should probably port the bc-test-data and wycheproof test harnesses over from the mldsa crate as part of this PR. |
Contributor
Author
|
bc-test-data testing has been ported. Partial/Full-byte test vectors added to bc-test-data/crypto/sha2. |
dghgit
added a commit
that referenced
this pull request
Aug 27, 2026
Reads the SHAVS .rsp files from ../bc-test-data/crypto/sha2/{bit-oriented,
byte-oriented}/ using the same lookup/skip-with-warning convention as the
mldsa, mlkem and sha3 crates, and runs ShortMsg, LongMsg and Monte Carlo
(SHAVS s. 6.4) for SHA-224/256/384/512 — 24 tests, ~12k message cases of
which ~5.4k are bit-length messages exercising do_final_partial_bits().
CAVP left-justifies the trailing message bits in the final Msg byte while
the Hash API takes them in the least significant bits, so the harness shifts
the last byte right by (8 - n). SHA-512/224 and SHA-512/256 vectors are
present in bc-test-data but not implemented by this crate, so are skipped.
Adds bouncycastle-hex as a dev-dependency. Requested in PR #88 review.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dghgit
added a commit
that referenced
this pull request
Aug 27, 2026
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… cleanups
- do_final_partial_bits[_out] previously hit unimplemented!() (a panic behind
a Result-returning API). Bit-oriented messages remain unsupported, but the
methods now return errors: num_partial_bits in 1..=7 -> HashError::InvalidInput
("not supported"), > 7 -> HashError::InvalidLength, and 0 behaves exactly as
do_final_out. do_final_out and this path share a single spec-commented
finalize().
- Initial hash values moved to `const H0` on new Sha256Family / Sha512Family
param traits, removing the runtime match-on-OUTPUT_LEN and its panic! arm.
- Blanket `impl HashAlgParams for SHA256Internal<P>` / `SHA512Internal<P>`
forwarding to the params struct, replacing four hand-duplicated impls.
- std::marker::PhantomData -> core::marker::PhantomData (no_std goal).
- Crate docs: fixed SHA3/SHAKE copy-paste, documented the partial-bits
limitation, added Memory Usage and Security Considerations sections,
documented *_NAME consts.
- Resolved byte_count TODOs with a stated 2^64-byte message limit.
Tests: partial_bits_are_rejected covers the 0 / 1..=7 / >7 cases for all
four variants without panicking.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…80-4 s. 5.1 Replaces the InvalidInput error path with a real implementation, bringing SHA-2 to parity with SHA3 for non-byte-aligned input. - finalize(partial_byte, num_partial_bits, output): the num_partial_bits least significant bits of partial_byte are placed MSB-first in the final message byte (FIPS 180-4 s. 3.1 bit numbering), immediately followed by the "1" pad bit, and the 64/128-bit length field is (byte_count << 3) | num_partial_bits. do_final_out is the zero-bit case. - do_final_partial_bits_out validates num_partial_bits <= 7 (InvalidLength) and delegates; nothing panics. - Crate docs: partial-bits usage example replaces the "not supported" note. Tests: the core-test-framework partial-input tests are now enabled for all four variants; `partial_bits` checks 0-bit equivalence, range validation, low-bit-only influence and second-block spill; `partial_bits_known_answers` holds 10 SHA-256/SHA-512 bit-length digests generated from an independent pure-Python FIPS 180-4 reference (validated against hashlib on byte inputs). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reads the SHAVS .rsp files from ../bc-test-data/crypto/sha2/{bit-oriented,
byte-oriented}/ using the same lookup/skip-with-warning convention as the
mldsa, mlkem and sha3 crates, and runs ShortMsg, LongMsg and Monte Carlo
(SHAVS s. 6.4) for SHA-224/256/384/512 — 24 tests, ~12k message cases of
which ~5.4k are bit-length messages exercising do_final_partial_bits().
CAVP left-justifies the trailing message bits in the final Msg byte while
the Hash API takes them in the least significant bits, so the harness shifts
the last byte right by (8 - n). SHA-512/224 and SHA-512/256 vectors are
present in bc-test-data but not implemented by this crate, so are skipped.
Adds bouncycastle-hex as a dev-dependency. Requested in PR #88 review.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
hubot
force-pushed
the
feature/sha2-final-patches
branch
from
August 27, 2026 04:19
cbeb8ac to
df51778
Compare
hubot
force-pushed
the
feature/sha2-final-patches
branch
from
August 27, 2026 05:07
df51778 to
f94559c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the partial bit processing - note we'll need to specify this is possible for ACVP testing for this and SHA3.