Hojun-Cho
8e9e28e357
Port of ref/hare/crypto/sha256/sha256.ha — block-processed [64]u8
chunks, u32 modular arithmetic, hash::hash + io.writer surface. The
state embeds hash.hash (inline vtable at offset 0); the vtable + sum/
reset slots are wired post-construction (base64/memio convention).
u32 WRAPPING + vtable dispatch CONFIRMED CLEAN: all NIST vectors verify
byte-identical — empty, "abc", the 56-byte block-boundary case, and the
one-million-'a' multi-block stream (1000-byte chunks across many blocks,
stressing write()'s partial-block carry). cgen truncates u32 add/shift/
rotate to 32 bits correctly; no masking workaround needed.
Semantics-preserving spelling divergences (slice-copy as byte loops,
close()/digest loops) are noted at-site per CLAUDE.md rule 5/13.
ONE BEHAVIORAL DIVERGENCE, blocked on a cgen bug (flagged for ken/drew):
Hare's sum() snapshots the state (`let copy = *h`) so it is re-entrant.
That deref-copy of an array-containing struct miscompiles in ww cgen
(copied array fields come back zeroed). So sum() runs on the live state
and is SINGLE-SHOT until the cgen fix lands; every current caller does
one terminal sum(), so the digests are unaffected. Minimal repro:
type t = struct { h: [4]u32 };
let c: t = *(&s); // c.h reads back wrong
A sibling bug (array return-by-value zeroes the result) was also found
and is avoided in the test's buffer-based helper. Both filed for ken.
The hash/crypto modules are dead-imported (no selfhost combined.ww
regen). 9xx test numbers are full, so the run-test shares the 989
prefix with siphash (distinct `short` name; 949_* multi-file precedent).
110 lines
3.1 KiB
Plaintext
110 lines
3.1 KiB
Plaintext
// sha256_test — exercises lib/crypto/sha256 against the standard NIST
|
|
// SHA-256 vectors (FIPS 180-4 examples + the classic "one million a's").
|
|
// Run with `out/bin/ww run lib/crypto/sha256/sha256_test.ww`.
|
|
//
|
|
// The digest is the cgen-correctness oracle for u32 wrapping arithmetic
|
|
// + the hash-vtable dispatch: any u32-overflow / rotate miscompile shows
|
|
// up as a byte mismatch. Same signalled-then-fail()-with-+10 pattern as
|
|
// the rest of the 9xx stdlib tests; the non-zero exit pinpoints the
|
|
// failing case. Expected digests come through the (separately tested)
|
|
// hex.decodestr so the vectors stay readable.
|
|
package sha256;
|
|
|
|
import bytes;
|
|
import crypto.sha256;
|
|
import errors;
|
|
import hash;
|
|
import encoding.hex;
|
|
import strings;
|
|
import os;
|
|
|
|
let signalled: i32 = 0;
|
|
fn fail() void = { os.exit(signalled + 10); };
|
|
|
|
// dohash — one-shot hash of `msg` into the caller's `out` (>= 32 bytes).
|
|
// Mirrors the sum()-writes-into-a-buffer API (no array-by-value return).
|
|
fn dohash(msg: []u8, out: []u8) void = {
|
|
let st: sha256.state = sha256.sha256();
|
|
let h: *hash.hash = (&st): *hash.hash;
|
|
hash.write(h, msg);
|
|
hash.sum(h, out);
|
|
};
|
|
|
|
fn checkbytes(got: []u8, want: str) void = {
|
|
match (hex.decodestr(want)) {
|
|
case let w: []u8 => {
|
|
if (!bytes.equal(got, w)) { fail(); };
|
|
};
|
|
case let e: errors.invalid => fail();
|
|
};
|
|
};
|
|
|
|
fn check(msg: []u8, want: str) void = {
|
|
let out: [32]u8;
|
|
dohash(msg, out[0:32]);
|
|
checkbytes(out[0:32], want);
|
|
};
|
|
|
|
// FIPS 180-4 Appendix B.1/B.2/B.3 vectors.
|
|
|
|
@test fn empty() void = {
|
|
let e: [1]u8;
|
|
check(e[0:0],
|
|
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
|
|
};
|
|
|
|
@test fn abc() void = {
|
|
check(strings.toutf8("abc"),
|
|
"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
|
|
};
|
|
|
|
// 56-byte message: crosses no block boundary but lands exactly on the
|
|
// padding edge (56 == BLOCKSZ - 8), the worst case for the pad length
|
|
// branch in sum().
|
|
@test fn twoblockpad() void = {
|
|
check(strings.toutf8(
|
|
"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"),
|
|
"248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1");
|
|
};
|
|
|
|
// One million 'a' fed 1000 bytes at a time. 1000 is not a multiple of
|
|
// BLOCKSZ, so this drives the partial-block carry in write() across many
|
|
// calls and many full blocks — the strongest streaming + u32-wrapping
|
|
// stress in the set.
|
|
@test fn millionas() void = {
|
|
let st: sha256.state = sha256.sha256();
|
|
let h: *hash.hash = (&st): *hash.hash;
|
|
let chunk: [1000]u8;
|
|
let i: i32 = 0;
|
|
for (i < 1000) {
|
|
chunk[i] = 'a': u8;
|
|
i += 1;
|
|
};
|
|
i = 0;
|
|
for (i < 1000) {
|
|
hash.write(h, chunk[0:1000]);
|
|
i += 1;
|
|
};
|
|
let out: [32]u8;
|
|
hash.sum(h, out[0:32]);
|
|
checkbytes(out[0:32],
|
|
"cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0");
|
|
};
|
|
|
|
// sz()/bsz() report the SHA-256 constants regardless of state.
|
|
@test fn sizes() void = {
|
|
let st: sha256.state = sha256.sha256();
|
|
let h: *hash.hash = (&st): *hash.hash;
|
|
if (hash.sz(h) != 32: size) { fail(); };
|
|
if (hash.bsz(h) != 64: size) { fail(); };
|
|
};
|
|
|
|
export fn main() i32 = {
|
|
signalled = 1; empty();
|
|
signalled = 2; abc();
|
|
signalled = 3; twoblockpad();
|
|
signalled = 4; millionas();
|
|
signalled = 5; sizes();
|
|
return 0;
|
|
};
|