Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lib/crypto/sha256: restore faithful re-entrant sum() (#265 unblocked)

Browse Source 
The port shipped sum() single-shot — mutating the live hash state —
because Hare's state snapshot `let copy = *h; let h = ©` (a
deref-rhs aggregate let-init of an array-containing struct) miscompiled
in cgen. #265 fold-1 (master 4d3f846) landed the full-size aggregate
copy for that axis, so restore the faithful form: pad+finalize the
snapshot, leave the live state untouched, close() the copy.

sum() is now non-destructive — summing twice yields the same digest and
writing after a sum() continues the stream. Pinned by a new reentrant()
@test (sum-twice identical + write-after-sum continuity). NIST vectors
unchanged.
This commit is contained in:
Hojun-Cho
2026-06-02 09:48:39 +09:00
parent 8e9e28e357
commit e9bd06a193
2 changed files with 42 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
lib/crypto/sha256/sha256.ww
View File

@@ -11,11 +11,7 @@
// mismatch would mean cgen promoted a u32 op to 64-bit without wrapping
// (a cgen bug to STOP+report, NOT to mask here).
//
// DIVERGENCES from sha256.ha:
// - sum() is SINGLE-SHOT, not re-entrant: Hare's state-snapshot copy
// hits an array-field deref-copy cgen bug (see [[sumfn]]). This is
// the one BEHAVIORAL divergence (blocked on a filed cgen fix); the
// rest below are semantics-preserving spellings.
// DIVERGENCES from sha256.ha (all semantics-preserving spellings):
// - `state` embeds [[hash.hash]], whose first field is an inline
// io.vtable (not Hare's `stream: io::stream` pointer); see
// lib/hash/hash.ww. The vtable slots are wired post-construction in
@@ -168,21 +164,17 @@ fn writefn(s: io.stream, buf: []u8) (size | io.error) = {
// sumfn — finalize and emit the digest. ref/hare/crypto/sha256/sha256.ha:115-143.
//
// DIVERGENCE (re-entrancy / blocked on a cgen bug). Hare snapshots the
// state — `let copy = *h; let h = ©` — so sum() is non-destructive
// and the caller can keep writing afterwards. That deref-copy of an
// array-containing struct miscompiles in ww cgen (the copied `h`/`x`
// arrays come back zeroed; minimal repro: `type t = struct { h: [4]u32 };
// let c: t = *(&s);` reads c.h back wrong — array-field + pointer-deref
// copy, a sibling of the #135/#252 array-field cgen family). Filed for
// ken; flagged for a drew fidelity ruling. Until it lands, sum() runs on
// the live state and is therefore SINGLE-SHOT: writing or summing again
// after a sum() yields wrong results. Every current caller does exactly
// one terminal sum(), so the NIST digests are unaffected (all vectors,
// incl. the multi-block million-'a' stream, verify byte-identical). The
// final close() still wipes the live state per Hare.
// Re-entrant per Hare: snapshot the state (`let copy = *h; let h = ©`)
// and pad+finalize the COPY, so the live hash is untouched and the caller
// can keep writing or sum() again. The deref-copy of this array-containing
// struct was blocked by a cgen bug (#265) — fold-1 (master 4d3f846) landed
// the full-size aggregate copy for deref-rhs let-init, unblocking it. The
// close() at the end wipes the copy (Hare's `defer hash::close(h)`), not
// the live state.
fn sumfn(h: *hash.hash, buf: []u8) void = {
let st: *state = h: *state;
let live: *state = h: *state;
let copy: state = *live;
let st: *state = (&copy);
let ln: size = st.ln;
let tmp: [64]u8 = [0...];
@@ -219,7 +211,7 @@ fn sumfn(h: *hash.hash, buf: []u8) void = {
i += 1;
};
hash.close(h);
hash.close((&copy): *hash.hash);
};
// block — process every whole 64-byte block in `buf`.