Hi Ayoub, On 2026-09-18T17:21:23, Ayoub Zaki <[email protected]> wrote: > crypto: add SHAKE128 and SHAKE256 support > > Add generic incremental and one-shot SHAKE interfaces backed by > Keccak-f[1600].
This patch also adds the fixed-output SHA3-224/256/384/512 digests (sha3_224() etc. and the sha3_ctx API), but the commit message does not mention them. Nothing in the series uses them, they are not wired into the hash framework and patch 3 only tests SHAKE. Please can you either drop them or mention them here and add known-answer tests? If they stay, the Kconfig symbol should probably be SHA3 rather than SHAKE, since it builds both. > > Adapt the implementation from the Linux SHA-3 library introduced by > commit 0593447248044ab609b43b947d0e198c887ac281. Retain its > provenance and licensing. This patch cites three different Linux commits: 0593447248044 in the commit message, f1799d17285c in include/crypto/sha3.h and 0354d3c1f1b8 in lib/crypto/sha3.c. Since you plan to track upstream fixes, please say clearly which tree/tag each file was synced from, ideally the same one for both files. > > Signed-off-by: Ayoub Zaki <[email protected]> > > include/crypto/sha3.h | 353 ++++++++++++++++++++++++++++++++++++++++++++++ > lib/crypto/sha3.c | 382 > ++++++++++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 735 insertions(+) > diff --git a/lib/crypto/sha3.c b/lib/crypto/sha3.c > @@ -0,0 +1,382 @@ > +void __sha3_update(struct __sha3_ctx *ctx, const u8 *in, size_t in_len) > +{ > + const size_t block_size = ctx->block_size; > + size_t absorb_offset = ctx->absorb_offset; > + > + /* Warn if squeezing has already begun. */ > + if (absorb_offset >= block_size) > + return; The comment says 'warn', but the code silently drops the input. Linux uses WARN_ON_ONCE() here. For a hash this is a nasty failure mode: a caller that misuses the API gets a digest that does not cover all its data, with no sign of a problem. U-Boot has WARN_ON_ONCE() in linux/bug.h, so you could keep that, or at least somehow return an error. > diff --git a/lib/crypto/sha3.c b/lib/crypto/sha3.c > @@ -0,0 +1,382 @@ > +static inline u64 sha3_rol64(u64 value, unsigned int shift) > +{ > + return (value << shift) | (value >> (64 - shift)); > +} > + > +#define rol64(value, shift) sha3_rol64((value), (shift)) U-Boot's linux/bitops.h lacks rol64(), so I see why this is here. I suggest adding rol64() and ror64() to include/linux/bitops.h, matching Linux, so this file stays closer to upstream and other code can use them. > diff --git a/lib/crypto/sha3.c b/lib/crypto/sha3.c > @@ -0,0 +1,382 @@ > +#ifndef sha3_224_arch > +static inline bool sha3_224_arch(const u8 *in, size_t in_len, > + u8 out[SHA3_224_DIGEST_SIZE]) > +{ > + return false; > +} > +#endif Nothing in U-Boot defines sha3_*_arch, so these four stubs are dead code, as are the __maybe_unused and the sha3_keccakf/sha3_absorb_blocks #define indirection. You could keep them to make Linux syncs easier, but then please say so in the commit message (or the doc in patch 4) so that later readers don't tidy them away. Otherwise I'd drop them. Regards, Simon
