PATCH: Padding bug in cSHAKE-128/256

[NIIBE Yutaka]

Hello,

Jonathan Plata wrote:
> cshake_input_s()'s padlen computation,
>
>     padlen = ctx->blocksize - (len_written % ctx->blocksize);

Thank you for your report.

> --- a/cipher/keccak.c
> +++ b/cipher/keccak.c
> @@ -1694,7 +1694,7 @@ cshake_input_s (KECCAK_CONTEXT *ctx, const void *s, unsigned int s_len,
>    keccak_write (ctx, s, s_len);
>
>    len_written += buf[0] + 1 + s_len;
> -  padlen = ctx->blocksize - (len_written % ctx->blocksize);
> +  padlen = (ctx->blocksize - (len_written % ctx->blocksize)) % ctx->blocksize;
>    memset (buf, 0, padlen);
>    keccak_write (ctx, buf, padlen);
>  }

While the expression is correct, I'm not sure if multiple %-operations
can be optimized well by compiler.  Just in case, I think that it's
better to use a single %-operation in the expression.

Attached is a patch with a single %-operation.

If no objections, I will push this to 1.11, 1.12 and master.
-- 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-cipher-keccak-Fix-padding-in-cSHAKE.patch
Type: text/x-diff
Size: 1529 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gcrypt-devel/attachments/20260910/5aac6b36/attachment-0003.patch>