`bash-prg-hash`: Initial implementation by makavity · Pull Request #751 · RustCrypto/hashes

makavity · 2025-11-04T13:18:37Z

I am not sure to assert in block_api
I am not sure in new and new_with_empty_header functions.

makavity · 2025-11-04T13:50:43Z

I am also not sure, it should be implemented as prg-hash.
Because AEAD algorithm uses start, squeeze, absorb and encrypt functions. But it is correct to implement encrypt here and make block_api methods - pub?

newpavlov

Sorry for the late review!

Some preliminary comments without looking deep at the implementation and the spec.

makavity · 2026-04-28T09:58:18Z

Thanks for review, @newpavlov.
As I see, all fixed

makavity · 2026-04-28T10:18:18Z

Looks like the sha1 is failed because timeout, not because PR changes.

…tation

newpavlov · 2026-05-03T12:55:57Z

I added TryCustomizedInit trait in digest v0.11.3. Also, take a look at #849 (the change was inspired by this PR), it should help to simplify the implementation.

makavity · 2026-05-04T13:10:35Z

I added TryCustomizedInit trait in digest v0.11.3. Also, take a look at #849 (the change was inspired by this PR), it should help to simplify the implementation.

Cannot implement squeeze.
In SpongeCursor::squeeze_u64_le:

for block in &mut blocks {
    sponge(state);

    let mut dst_chunks = block.chunks_exact_mut(size_of::<u64>());
    for (src, dst_chunk) in state.iter_mut().zip(&mut dst_chunks) {
        dst_chunk.copy_from_slice(&src.to_le_bytes());
    }
    assert!(dst_chunks.into_remainder().is_empty());
}

This does permute then read, while bash-prg-hash needs read then permute for the first block after commit(OUT) (and then permutation between full-rate blocks).
So the first output block must come from the current committed state, without an extra permutation. With current API, that path cannot be expressed directly, so reader squeeze still needs custom logic.

Should I left it as-is, or maybe another mode in SpongeCursor?

…artially use `SpongeCursor`

makavity · 2026-05-04T13:22:12Z

I've commited it without squeeze from SpongeCursor, have no idea how to use it in current approach.

newpavlov · 2026-05-04T14:40:39Z

Should I left it as-as, or maybe another mode in SpongeCursor?

Can not say right now, I will need to read the spec first.

newpavlov · 2026-05-06T13:17:01Z

+digest::new_test!(bashprg1282, BashPrgHash1282, xof_reset_test);
+digest::new_test!(bashprg1921, BashPrgHash1921, xof_reset_test);
+// Not in STB 34.101.77-2020, but included for completeness
+digest::new_test!(bashprg2562, BashPrgHash2562, xof_reset_test);


Are there any vectors for customized hashing? IIUC they are not part of the STB. It may be worth to generate synthetic tests for it.

I'll check the testing methodic and will extend the tests.

Found it in the methodics.
https://apmi.bsu.by/assets/files/std/met-v10.zip

I'll add it and tweak xof_test for the try_new_customized.

See the cshake test for an example. We probably will add a function for this into a future version of digest.

…of_reset_test` from `digest::dev`)

newpavlov · 2026-05-06T14:24:59Z

I refactored the code a fair bit. Feel free to comment on the changes if something is not clear or if you have suggestions on how we could improve it.

I think this PR is mostly ready for merge. We only need to release sponge-cursor and add tests for customized hashes.

newpavlov · 2026-05-06T14:29:31Z

+
+        // Step 2: S[r] <- S[r] ⊕ 1, where r = 1536 - 2 d ℓ (bit index).
+        const { assert!(RATE % 8 == 0) }
+        self.state[RATE / 8] ^= 1u64 << 7;


This looks a bit weird, but I guess it's a consequence of mixing little-endian byte order and big-endian bit order in the spec and commit acting on the state outside of the rate part. For comparison, in cshake and turboshake we use self.state[RATE / 8 - 1] ^= 1 << 63;.

makavity · 2026-05-06T14:46:59Z

I refactored the code a fair bit. Feel free to comment on the changes if something is not clear or if you have suggestions on how we could improve it.

Looks like the commit 1dc21053 broke the customization flow.
I'll commit the tests with announce, which worked before commit and continue to investigate.

makavity · 2026-05-06T14:52:42Z

Just misspell in the header length calculation.

makavity and others added 14 commits October 23, 2025 19:47

Implement bash-hash

24cb224

bash-hash: review fixes + add tests

ce3a2a9

bash-hash: use bash-f from crates

4eb3765

bash-hash: add Variant trait for possible hash variants

c34d490

bash-hash: fix/remove subtle

1126d5a

bash-hash: fix/split

b50e6f0

bash-hash: fix bash-f version, update PR link in changelog

f0a3d55

bash-hash: minor refactor (RustCrypto#746)

0cf1a43

Remove implementations of the VariableOutput trait (RustCrypto#744)

d1f4ff4

Fix bash-hash entry in the supported algorithms table (RustCrypto#748)

d101629

Merge branch 'RustCrypto:master' into master

549bc30

bash-prg-hash: initial implementation

7f2e420

bash-prg-hash: add github workflow

59c894a

bash-prg-hash: fix entry in CHANGELOG.md

864df08

newpavlov reviewed Apr 27, 2026

View reviewed changes

bash-prg-hash: fixes according to the review

0437021

makavity force-pushed the master branch from f0b4b1b to 0437021 Compare April 28, 2026 09:53

makavity added 4 commits April 28, 2026 12:53

bash-prg-hash: bump digest to 0.11

050b0e0

bash-prg-hash: bump digest to 0.11

bba618a

Merge branch 'RustCrypto:master' into master

8fdbb85

bash-prg-hash: bump digest to 0.11

e2578ef

bash-prg-hash: fix cargo.toml algo names

293e127

makavity requested a review from newpavlov April 28, 2026 10:20

makavity added 2 commits April 29, 2026 15:58

bash-prg-hash: fix/return example in README.md

533e036

bash-prg-hash: fix/get rid of vec! in tests

bacda34

newpavlov reviewed Apr 29, 2026

View reviewed changes

Comment thread bash-prg-hash/src/block_api.rs Outdated

Comment thread bash-prg-hash/src/block_api.rs Outdated

Comment thread bash-prg-hash/src/lib.rs Outdated

bash-prg-hash: cargo-fmt

57c51b2

newpavlov reviewed Apr 29, 2026

View reviewed changes

Comment thread bash-prg-hash/src/lib.rs Outdated

Comment thread bash-prg-hash/src/lib.rs Outdated

Comment thread bash-prg-hash/src/block_api.rs Outdated

Comment thread bash-prg-hash/src/block_api.rs Outdated

makavity added 4 commits April 29, 2026 17:07

bash-prg-hash: remove block_api, inline code in lib.rs, add documen…

8b5146d

…tation

bash-prg-hash: simplify CollisionResistance impl

5e7c5eb

bash-prg-hash: offset usize -> u8

85a62da

bash-prg-hash: change rate from bits to bytes calculation

ba7bc6b

bash-prg-hash: update digest to 0.11.3, use TryNewCustomized, p…

167bea9

…artially use `SpongeCursor`

migrate to the latest version of sponge-cursor

e1cfd53

newpavlov reviewed May 6, 2026

View reviewed changes

Comment thread bash-prg-hash/src/lib.rs Outdated

newpavlov added 2 commits May 6, 2026 15:56

tweak oid imls

b3653f8

add const assertion

987f092

newpavlov reviewed May 6, 2026

View reviewed changes

bash-prg-hash: remove Reset trait, add xof_test (copied from `x…

be4f186

…of_reset_test` from `digest::dev`)

makavity force-pushed the master branch from 365ef8e to be4f186 Compare May 6, 2026 13:21

newpavlov added 7 commits May 6, 2026 16:23

tweak xof_test

785f60b

simplify squeeze

83df568

zeroize cursor

75b594c

tweak rand tests

029dd50

remove hasher2 from xof_test

5607045

add const assert for RATE % 8 == 0

6bc8a11

refactor try_new_customized

1dc2105

newpavlov reviewed May 6, 2026

View reviewed changes

makavity added 2 commits May 6, 2026 17:47

bash-prg-hash: add generated tests

98e5ed5

bash-prg-hash: fix header length calculation multiplier

6e282c5

Conversation

makavity commented Nov 4, 2025

Uh oh!

makavity commented Nov 4, 2025

Uh oh!

newpavlov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

makavity commented Apr 28, 2026

Uh oh!

makavity commented Apr 28, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

newpavlov commented May 3, 2026

Uh oh!

makavity commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

makavity commented May 4, 2026

Uh oh!

newpavlov commented May 4, 2026

Uh oh!

Uh oh!

newpavlov May 6, 2026

Choose a reason for hiding this comment

Uh oh!

makavity May 6, 2026

Choose a reason for hiding this comment

Uh oh!

makavity May 6, 2026

Choose a reason for hiding this comment

Uh oh!

newpavlov May 6, 2026

Choose a reason for hiding this comment

Uh oh!

newpavlov commented May 6, 2026

Uh oh!

newpavlov May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

makavity commented May 6, 2026

Uh oh!

makavity commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

makavity commented May 4, 2026 •

edited

Loading

newpavlov May 6, 2026 •

edited

Loading