Feat: Core AEAD Cipher Split - #120
Open
officialfrancismendoza wants to merge 28 commits into
Open
officialfrancismendoza wants to merge 28 commits into
officialfrancismendoza wants to merge 28 commits into
Conversation
officialfrancismendoza
changed the base branch from
main
to
release/0.1.3alpha
September 8, 2026 11:59
ounsworth
self-requested a review
September 8, 2026 17:03
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ounsworth
requested changes
Sep 8, 2026
Contributor
There was a problem hiding this comment.
Holy crap. This is a 13,000 line PR. That's an insane amount of code to review.
It looks like this PR is bringing (at least) to other PRs with it? What is the actual change here?
I suggest that you either change the merge target to point to another currently-open PR so that the diff to review is smaller (and we can merge this into the other PR), or maybe hold off on this for now and we should focus out effort on reviewing and merging the other PRs first?
officialfrancismendoza
changed the base branch from
release/0.1.3alpha
to
feature/symmetric-cipher
September 8, 2026 17:07
officialfrancismendoza
changed the base branch from
feature/symmetric-cipher
to
feature/officialfrancismendoza/ascon
September 8, 2026 17:07
officialfrancismendoza
force-pushed
the
feature/officialfrancismendoza/119-core-aead-cipher
branch
from
September 9, 2026 08:35
7471ef2 to
01c3e6f
Compare
dghgit
changed the base branch from
feature/officialfrancismendoza/ascon
to
feature/symmetric-cipher
September 9, 2026 11:14
officialfrancismendoza
force-pushed
the
feature/officialfrancismendoza/119-core-aead-cipher
branch
from
September 9, 2026 17:24
01c3e6f to
aa209a9
Compare
Contributor
This was referenced Sep 10, 2026
ounsworth
marked this pull request as draft
September 16, 2026 02:54
…a parameter set can derive MAX_SECURITY_STRENGTH from a const generic instead of naming a variant by hand; no behaviour change, and the following commit is the first caller that needs it Assisted-by: Claude:claude-opus-5 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…a hash for, not just the two approved truncations, so the IV Generation Function regains the one- and two-digit decimal branches that b11f8f6 dropped as unreachable -- writing a fixed three digits gives the "0256" spelling the section forbids, and hence the wrong IV, for every t below 100; t is checked against the section's own rule (positive, below 512, not 384) plus this crate's multiple-of-8 requirement, which BC Java's SHA512tDigest also imposes, and the unapproved truncations carry SHA512tParams::FIPS_APPROVED = false which SHA512Internal::new asserts in an inline const, so reaching one takes new_allow_unapproved_t() the way an encrypting mode takes ENCRYPTION_APPROVED; ALG_NAME, OUTPUT_LEN and MAX_SECURITY_STRENGTH are now derived from t and pinned to their old values for t = 224 and t = 256; new sha512t_tests.rs cross-checks eight truncations spanning all three digit branches against BC Java, and of the file's 259 mutants 180 are caught, 5 die on timeout and the 5 missed are the XOR/OR equivalences already documented at their sites Assisted-by: Claude:claude-opus-5 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ueezing becomes its own type
…oFinal after doOutput
… encodings and cshake CLI subcommands
…tions and the commit message style in CLAUDE.md
…tory registration and kmac CLI subcommands
…r requires Default
…yed XOFs can use it
…pdate appends one tuple element
…ting the Recommendation
…5 on the command line
… KMAC against the sample values, plus KMAC's key-type and buffer-length checks; kills the 88 mutants the SP 800-185 suites had missed
…al suite against the SHAKE types; of 29 missed mutants only the equivalent default_128_bit one survives
…orked and finished several ways from one absorbed prefix; the SP 800-185 types and the factory enums derive it, the sha2 and sha3 params traits require it, and the framework hash and XOF suites check a clone finishes like its original and diverges on different input
…E overrides them, XofOutput is renamed XOFOutput to match the spec capitalisation used everywhere else, Hash::output_len documents that a XOF's length is nominal rather than part of the function, and the BC Java asides come out of the Hash and XOF docs
…sh suite covering short, exact and over-long output buffers, for the implementors that take constructor arguments and so cannot reach test_hash
… than output_len instead of truncating, and neither they nor KMAC zeroized past the digest as the Hash and MAC contracts require; the two suites that had pinned the old behaviour are corrected and all three types now run the framework's buffer-length checks
… overrode and nothing outside their own tests called; a squeeze has nothing to finalize, so ending the stream is dropping the value, and the XOF suite now checks do_output_out zeroizes the buffer where it had checked the alias agreed with do_final
…he XOF squeezing vocabulary, so XOFOutput becomes XOFSqueezer with SHAKEOutput and XOFFactoryOutput following it, XOF::Output becomes XOF::Squeezer, into_output and into_output_partial_bits become into_squeezer and into_squeezer_partial_bits, and the one-shots hash_xof and hash_xof_out become xof and xof_out; mechanical throughout, with no behaviour change
…ut length, so XOFSqueezer gains do_final and do_final_out, KMACXOF, TupleHashXOF and ParallelHashXOF defer their right_encode(L) to the first read through a new LengthBoundSqueezer and compute the fixed-length function of SP 800-185 s. 4.3, 5.3 and 6.3 whenever do_final or a one-shot is that read, and the Hash view of every XOF, SHAKE and cSHAKE included, becomes a final read at output_len that zeroes the rest of the caller's buffer
…a bare run examines only the root package and finds nothing, the checked-in config's examine_globs silently overrides -f, crates whose mutants die in another crate's tests need --test-workspace, and without the /tmp/bc-test-data symlink the vector suites pass vacuously and their mutants all read as missed
…in update_out_len and a FINAL_LEN final buffer so a buffering cipher or an inline ciphertext||tag layout can be expressed; TaggedEncryptor/TaggedDecryptor adapt any FINAL_LEN=0 pair to the SimpleCipherEncryptor/SimpleCipherDecryptor ciphertext||tag shape; the block, simple-cipher and AEAD strength sweeps assert they are not vacuous, and the AEAD streaming suite gains a genuinely-buffering toy plus undersized-buffer and std-one-shot coverage
…XOF128/CXOF128) implementing AEADCipherEncryptor/AEADCipherDecryptor via AsconAead128Encryptor/AsconAead128Decryptor, with HashFactory/XOFFactory registration and CLI wiring including a TaggedDecryptor-based decrypt stream
officialfrancismendoza
force-pushed
the
feature/officialfrancismendoza/119-core-aead-cipher
branch
from
September 17, 2026 13:38
5ba4350 to
2c479f4
Compare
Contributor
Author
officialfrancismendoza
marked this pull request as ready for review
September 17, 2026 13:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements core AEAD cipher split (#119), built off of bcgit/feature/symmetric-cipher. Implements AEADCipherEncryptor and AEADCipherDecryptor, as well as cherry-picks commits from ASCON (#22) so that ASCON is compatible.