leviathan-crypto 2.0.1 → 3.0.0

package/dist/sha2/index.js

@@ -22,23 +22,15 @@
 // src/ts/sha2/index.ts
 //
 // Public API classes for the SHA-2 WASM module.
-// Uses the init() module cache — call sha2Init(source) before constructing.
-import { getInstance, initModule } from '../init.js';
+// Uses the init() module cache, call sha2Init(source) before constructing.
+import { getInstance, initModule, _assertNotOwned } from '../init.js';
 export async function sha2Init(source) {
     return initModule('sha2', source);
 }
+export { isInitialized } from '../init.js';
 function getExports() {
     return getInstance('sha2').exports;
 }
-export function _sha2Ready() {
-    try {
-        getInstance('sha2');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 // Write msg into input buffer in chunks, calling update for each chunk.
 function feedHash(x, msg, inputOff, chunkSize, updateFn) {
     const mem = new Uint8Array(x.memory.buffer);
@@ -57,6 +49,7 @@ export class SHA256 {
         this.x = getExports();
     }
     hash(msg) {
+        _assertNotOwned('sha2');
         this.x.sha256Init();
         feedHash(this.x, msg, this.x.getSha256InputOffset(), 64, this.x.sha256Update);
         this.x.sha256Final();
@@ -64,6 +57,7 @@ export class SHA256 {
         return mem.slice(this.x.getSha256OutOffset(), this.x.getSha256OutOffset() + 32);
     }
     dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
@@ -74,6 +68,7 @@ export class SHA512 {
         this.x = getExports();
     }
     hash(msg) {
+        _assertNotOwned('sha2');
         this.x.sha512Init();
         feedHash(this.x, msg, this.x.getSha512InputOffset(), 128, this.x.sha512Update);
         this.x.sha512Final();
@@ -81,6 +76,7 @@ export class SHA512 {
         return mem.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 64);
     }
     dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
@@ -91,6 +87,7 @@ export class SHA384 {
         this.x = getExports();
     }
     hash(msg) {
+        _assertNotOwned('sha2');
         this.x.sha384Init();
         feedHash(this.x, msg, this.x.getSha512InputOffset(), 128, this.x.sha512Update);
         this.x.sha384Final();
@@ -98,6 +95,70 @@ export class SHA384 {
         return mem.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 48);
     }
     dispose() {
+        _assertNotOwned('sha2');
+        this.x.wipeBuffers();
+    }
+}
+// ── SHA224 ──────────────────────────────────────────────────────────────────
+// FIPS 180-4 §6.3, SHA-256 round logic with the §5.3.2 IV; output is the
+// leftmost 224 bits (28 bytes) of the SHA-256 state.
+export class SHA224 {
+    x;
+    constructor() {
+        this.x = getExports();
+    }
+    hash(msg) {
+        _assertNotOwned('sha2');
+        this.x.sha224Init();
+        feedHash(this.x, msg, this.x.getSha256InputOffset(), 64, this.x.sha256Update);
+        this.x.sha224Final();
+        const mem = new Uint8Array(this.x.memory.buffer);
+        return mem.slice(this.x.getSha256OutOffset(), this.x.getSha256OutOffset() + 28);
+    }
+    dispose() {
+        _assertNotOwned('sha2');
+        this.x.wipeBuffers();
+    }
+}
+// ── SHA512_224 ──────────────────────────────────────────────────────────────
+// FIPS 180-4 §6.7.1, SHA-512 round logic with the §5.3.6.1 IV; output is the
+// leftmost 224 bits (28 bytes) of the SHA-512 state.
+export class SHA512_224 {
+    x;
+    constructor() {
+        this.x = getExports();
+    }
+    hash(msg) {
+        _assertNotOwned('sha2');
+        this.x.sha512_224Init();
+        feedHash(this.x, msg, this.x.getSha512InputOffset(), 128, this.x.sha512Update);
+        this.x.sha512_224Final();
+        const mem = new Uint8Array(this.x.memory.buffer);
+        return mem.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 28);
+    }
+    dispose() {
+        _assertNotOwned('sha2');
+        this.x.wipeBuffers();
+    }
+}
+// ── SHA512_256 ──────────────────────────────────────────────────────────────
+// FIPS 180-4 §6.7.2, SHA-512 round logic with the §5.3.6.2 IV; output is the
+// leftmost 256 bits (32 bytes) of the SHA-512 state.
+export class SHA512_256 {
+    x;
+    constructor() {
+        this.x = getExports();
+    }
+    hash(msg) {
+        _assertNotOwned('sha2');
+        this.x.sha512_256Init();
+        feedHash(this.x, msg, this.x.getSha512InputOffset(), 128, this.x.sha512Update);
+        this.x.sha512_256Final();
+        const mem = new Uint8Array(this.x.memory.buffer);
+        return mem.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 32);
+    }
+    dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
@@ -108,6 +169,7 @@ export class HMAC_SHA256 {
         this.x = getExports();
     }
     hash(key, msg) {
+        _assertNotOwned('sha2');
         let k = key;
         // RFC 2104 §3: keys longer than block size are pre-hashed
         if (k.length > 64) {
@@ -126,6 +188,7 @@ export class HMAC_SHA256 {
         return out.slice(this.x.getSha256OutOffset(), this.x.getSha256OutOffset() + 32);
     }
     dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
@@ -136,6 +199,7 @@ export class HMAC_SHA512 {
         this.x = getExports();
     }
     hash(key, msg) {
+        _assertNotOwned('sha2');
         let k = key;
         // RFC 2104 §3: keys longer than block size (128) are pre-hashed
         if (k.length > 128) {
@@ -154,6 +218,7 @@ export class HMAC_SHA512 {
         return out.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 64);
     }
     dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
@@ -164,6 +229,7 @@ export class HMAC_SHA384 {
         this.x = getExports();
     }
     hash(key, msg) {
+        _assertNotOwned('sha2');
         let k = key;
         // RFC 2104 §3: keys longer than block size (128) are pre-hashed with SHA-384
         if (k.length > 128) {
@@ -182,8 +248,11 @@ export class HMAC_SHA384 {
         return out.slice(this.x.getSha512OutOffset(), this.x.getSha512OutOffset() + 48);
     }
     dispose() {
+        _assertNotOwned('sha2');
         this.x.wipeBuffers();
     }
 }
 // ── HKDF ────────────────────────────────────────────────────────────────────
 export { HKDF_SHA256, HKDF_SHA512 } from './hkdf.js';
+// ── SHA256Hash ──────────────────────────────────────────────────────────────
+export { SHA256Hash } from './hash.js';

package/dist/sha2/types.d.ts

@@ -1,5 +1,44 @@
-/** WASM exports for the sha2 module */
+/** WASM exports for the sha2 module, full FIPS 180-4 surface plus
+ *  HMAC variants. Importable from cross-module wrappers (e.g. mldsa's
+ *  HashML-DSA pre-hash dispatcher) that need to drive sha2 directly
+ *  without going through the public class API. */
 export interface Sha2Exports {
     memory: WebAssembly.Memory;
-    getModuleId(): number;
+    getModuleId: () => number;
+    getSha256InputOffset: () => number;
+    getSha256OutOffset: () => number;
+    getSha256HOffset: () => number;
+    getSha512InputOffset: () => number;
+    getSha512OutOffset: () => number;
+    getSha512HOffset: () => number;
+    getHmac256IpadOffset: () => number;
+    getHmac256OpadOffset: () => number;
+    getHmac256InnerOffset: () => number;
+    getHmac512IpadOffset: () => number;
+    getHmac512OpadOffset: () => number;
+    getHmac512InnerOffset: () => number;
+    sha256Init: () => void;
+    sha256Update: (len: number) => void;
+    sha256Final: () => void;
+    sha224Init: () => void;
+    sha224Final: () => void;
+    sha512Init: () => void;
+    sha384Init: () => void;
+    sha512_224Init: () => void;
+    sha512_256Init: () => void;
+    sha512Update: (len: number) => void;
+    sha512Final: () => void;
+    sha384Final: () => void;
+    sha512_224Final: () => void;
+    sha512_256Final: () => void;
+    hmac256Init: (keyLen: number) => void;
+    hmac256Update: (len: number) => void;
+    hmac256Final: () => void;
+    hmac512Init: (keyLen: number) => void;
+    hmac512Update: (len: number) => void;
+    hmac512Final: () => void;
+    hmac384Init: (keyLen: number) => void;
+    hmac384Update: (len: number) => void;
+    hmac384Final: () => void;
+    wipeBuffers: () => void;
 }

package/dist/sha3/hash.d.ts

@@ -0,0 +1,2 @@
+import type { HashFn } from '../types.js';
+export declare const SHA3_256Hash: HashFn;

package/dist/sha3/hash.js

@@ -0,0 +1,53 @@
+//                  ▄▄▄▄▄▄▄▄▄▄
+//           ▄████████████████████▄▄          ▒  ▄▀▀ ▒ ▒ █ ▄▀▄ ▀█▀ █ ▒ ▄▀▄ █▀▄
+//        ▄██████████████████████ ▀████▄      ▓  ▓▀  ▓ ▓ ▓ ▓▄▓  ▓  ▓▀▓ ▓▄▓ ▓ ▓
+//      ▄█████████▀▀▀     ▀███████▄▄███████▌  ▀▄ ▀▄▄ ▀▄▀ ▒ ▒ ▒  ▒  ▒ █ ▒ ▒ ▒ █
+//     ▐████████▀   ▄▄▄▄     ▀████████▀██▀█▌
+//     ████████      ███▀▀     ████▀  █▀ █▀       Leviathan Crypto Library
+//     ███████▌    ▀██▀         ███
+//      ███████   ▀███           ▀██ ▀█▄      Repository & Mirror:
+//       ▀██████   ▄▄██            ▀▀  ██▄    github.com/xero/leviathan-crypto
+//         ▀█████▄   ▄██▄             ▄▀▄▀    unpkg.com/leviathan-crypto
+//            ▀████▄   ▄██▄
+//              ▐████   ▐███                  Author: xero (https://x-e.ro)
+//       ▄▄██████████    ▐███         ▄▄      License: MIT
+//    ▄██▀▀▀▀▀▀▀▀▀▀     ▄████      ▄██▀
+//  ▄▀  ▄▄█████████▄▄  ▀▀▀▀▀     ▄███         This file is provided completely
+//   ▄██████▀▀▀▀▀▀██████▄ ▀▄▄▄▄████▀          free, "as is", and without
+//  ████▀    ▄▄▄▄▄▄▄ ▀████▄ ▀█████▀  ▄▄▄▄     warranty of any kind. The author
+//  █████▄▄█████▀▀▀▀▀▀▄ ▀███▄      ▄████      assumes absolutely no liability
+//   ▀██████▀             ▀████▄▄▄████▀       for its {ab,mis,}use.
+//                           ▀█████▀▀
+//
+// src/ts/sha3/hash.ts
+//
+// Stateless SHA3-256 HashFn for Fortuna's accumulator and reseed slots.
+import { _assertNotOwned, getInstance } from '../init.js';
+export const SHA3_256Hash = {
+    outputSize: 32,
+    wasmModules: ['sha3'],
+    digest(msg) {
+        _assertNotOwned('sha3');
+        const x = getInstance('sha3').exports;
+        const mem = new Uint8Array(x.memory.buffer);
+        try {
+            x.sha3_256Init();
+            const inOff = x.getInputOffset();
+            let pos = 0;
+            while (pos < msg.length) {
+                const n = Math.min(msg.length - pos, 168);
+                mem.set(msg.subarray(pos, pos + n), inOff);
+                x.keccakAbsorb(n);
+                pos += n;
+            }
+            x.sha3_256Final();
+            const outOff = x.getOutOffset();
+            return mem.slice(outOff, outOff + 32);
+        }
+        finally {
+            // Wipe the keccak input/output/sponge state so secret-derived
+            // inputs (e.g. Fortuna pool entropy) do not outlive this call.
+            x.wipeBuffers();
+        }
+    },
+};

package/dist/sha3/index.d.ts

@@ -1,7 +1,7 @@
 import type { WasmSource } from '../wasm-source.js';
 export declare function sha3Init(source: WasmSource): Promise<void>;
 export type { WasmSource };
-export declare function _sha3Ready(): boolean;
+export { isInitialized } from '../init.js';
 export declare class SHA3_256 {
     private readonly x;
     constructor();
@@ -26,13 +26,20 @@ export declare class SHA3_224 {
     hash(msg: Uint8Array): Uint8Array;
     dispose(): void;
 }
-/** SHAKE128 XOF — extendable output, multi-squeeze capable. */
+/**
+ * SHAKE128 XOF, extendable output, multi-squeeze capable.
+ *
+ * Holds exclusive access to the `sha3` WASM module from construction until
+ * `dispose()`. Constructing a second SHAKE128/SHAKE256 or any other sha3
+ * user while this instance is live throws. Call `dispose()` when done.
+ */
 export declare class SHAKE128 {
     private readonly x;
     private readonly _rate;
     private _squeezing;
     private _block;
     private _blockPos;
+    private _tok;
     constructor();
     reset(): this;
     absorb(msg: Uint8Array): this;
@@ -40,13 +47,20 @@ export declare class SHAKE128 {
     hash(msg: Uint8Array, outputLength: number): Uint8Array;
     dispose(): void;
 }
-/** SHAKE256 XOF — extendable output, multi-squeeze capable. */
+/**
+ * SHAKE256 XOF, extendable output, multi-squeeze capable.
+ *
+ * Holds exclusive access to the `sha3` WASM module from construction until
+ * `dispose()`. Constructing a second SHAKE128/SHAKE256 or any other sha3
+ * user while this instance is live throws. Call `dispose()` when done.
+ */
 export declare class SHAKE256 {
     private readonly x;
     private readonly _rate;
     private _squeezing;
     private _block;
     private _blockPos;
+    private _tok;
     constructor();
     reset(): this;
     absorb(msg: Uint8Array): this;
@@ -54,3 +68,73 @@ export declare class SHAKE256 {
     hash(msg: Uint8Array, outputLength: number): Uint8Array;
     dispose(): void;
 }
+/**
+ * Incremental SHA3-256. Construct, `update()` chunks (any size), `finalize()`
+ * to get the 32-byte digest. Finalize disposes the instance.
+ *
+ * Holds exclusive access to the `sha3` WASM module from construction until
+ * `dispose()` or `finalize()`. Mirrors SHAKE128 lifecycle.
+ */
+export declare class SHA3_256Stream {
+    private readonly x;
+    private _tok;
+    constructor();
+    update(chunk: Uint8Array): this;
+    finalize(): Uint8Array;
+    dispose(): void;
+}
+/**
+ * Incremental SHA3-512. Construct, `update()` chunks (any size), `finalize()`
+ * to get the 64-byte digest. Finalize disposes the instance.
+ *
+ * Holds exclusive access to the `sha3` WASM module from construction until
+ * `dispose()` or `finalize()`. Mirrors SHAKE128 lifecycle.
+ */
+export declare class SHA3_512Stream {
+    private readonly x;
+    private _tok;
+    constructor();
+    update(chunk: Uint8Array): this;
+    finalize(): Uint8Array;
+    dispose(): void;
+}
+/**
+ * Single-shot streaming SHAKE128. `outputLen` is bound at construction;
+ * `update()` absorbs chunks of any size, `finalize()` pads and squeezes
+ * exactly `outputLen` bytes, then disposes the instance.
+ *
+ * Used by `createRunningHash` in the sign layer: each StreamableSignatureSuite
+ * with `prehashAlgorithm: 'shake-128'` declares its `prehashSize` and that
+ * value is passed in here at construction time. The multi-squeeze
+ * `SHAKE128` class above remains for the XOF surface; this class is the
+ * fixed-output cousin that matches the RunningHash contract.
+ *
+ * Holds exclusive access to the `sha3` WASM module from construction until
+ * `dispose()` or `finalize()`. Mirrors `SHA3_256Stream` lifecycle.
+ */
+export declare class SHAKE128Stream {
+    private readonly x;
+    private readonly _rate;
+    private readonly outputLen;
+    private _tok;
+    constructor(outputLen: number);
+    update(chunk: Uint8Array): this;
+    finalize(): Uint8Array;
+    dispose(): void;
+}
+/**
+ * Single-shot streaming SHAKE256. `outputLen` is bound at construction;
+ * mirrors `SHAKE128Stream`. See that class for usage notes.
+ */
+export declare class SHAKE256Stream {
+    private readonly x;
+    private readonly _rate;
+    private readonly outputLen;
+    private _tok;
+    constructor(outputLen: number);
+    update(chunk: Uint8Array): this;
+    finalize(): Uint8Array;
+    dispose(): void;
+}
+export { SHA3_256Hash } from './hash.js';
+export { CSHAKE128, CSHAKE256, KMAC128, KMAC256, KMACXOF128, KMACXOF256 } from './kmac.js';