Frank Denis a5d4ad17b7
crypto.keccak.State: add checks to prevent insecure transitions (#22020)
* crypto.keccak.State: don't unconditionally permute after a squeeze()

Now, squeeze() behaves like absorb()

Namely,

squeeze(x[0..t]);
squeeze(x[t..n)); with t <= n

becomes equivalent to squeeze(x[0..n]).

* keccak: in debug mode, track transitions to prevent insecure ones.

Fixes #22019
2024-11-20 11:16:09 +01:00
..
2024-11-12 21:55:46 -08:00
2024-09-19 18:20:22 -07:00
2024-09-19 18:20:21 -07:00
2024-09-24 23:58:21 -07:00
2024-10-23 16:27:39 -07:00
2024-11-05 23:46:10 +01:00