Update x-wing implementation to V06 of RFC

x-wing/README.md

@@ -11,7 +11,7 @@ Pure Rust implementation of X-Wing, a general-purpose post-quantum/traditional
 hybrid key encapsulation mechanism (PQ/T KEM) built on X25519 and ML-KEM-768.
 Built on the [ml-kem] and [x25519-dalek] crates.
 
-Current implementation matches the [draft RFC][RFC-DRAFT] version 04.
+Current implementation matches the [draft RFC][RFC-DRAFT] version 06.
 
 The original paper: [X-Wing The Hybrid KEM You’ve Been Looking For][X-WING-PAPER]
 

x-wing/src/lib.rs

@@ -37,7 +37,7 @@ use rand_core::CryptoRngCore;
 use rand_core::OsRng;
 use sha3::digest::core_api::XofReaderCoreWrapper;
 use sha3::digest::{ExtendableOutput, XofReader};
-use sha3::{Sha3_256, Shake128, Shake128ReaderCore};
+use sha3::{Sha3_256, Shake256, Shake256ReaderCore};
 use x25519_dalek::{x25519, X25519_BASEPOINT_BYTES};
 #[cfg(feature = "zeroize")]
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -182,7 +182,7 @@ impl DecapsulationKey {
         x25519_dalek::PublicKey,
     ) {
         use sha3::digest::Update;
-        let mut shaker = Shake128::default();
+        let mut shaker = Shake256::default();
         shaker.update(&self.sk);
         let mut expanded = shaker.finalize_xof();
 
@@ -266,15 +266,15 @@ fn combiner(
     use sha3::Digest;
 
     let mut hasher = Sha3_256::new();
-    hasher.update(X_WING_LABEL);
     hasher.update(ss_m);
     hasher.update(ss_x);
     hasher.update(ct_x);
     hasher.update(pk_x.as_bytes());
+    hasher.update(X_WING_LABEL);
     hasher.finalize().into()
 }
 
-fn read_from<const N: usize>(reader: &mut XofReaderCoreWrapper<Shake128ReaderCore>) -> [u8; N] {
+fn read_from<const N: usize>(reader: &mut XofReaderCoreWrapper<Shake256ReaderCore>) -> [u8; N] {
     let mut data = [0; N];
     reader.read(&mut data);
     data