Update x-wing implementation to V06 of RFC (#80)

Updates the X-Wing implementation to V06 of the draft RFC: [Diff](https://author-tools.ietf.org/iddiff?url1=draft-connolly-cfrg-xwing-kem-04&url2=draft-connolly-cfrg-xwing-kem-06&difftype=--html) Co-authored-by: Christiaan676 <[email protected]>
RustCrypto · Jan 20, 2025 · 2425fe5 · 2425fe5
1 parent 664ec76
commit 2425fe5
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 14 deletions.
diff --git a/x-wing/README.md b/x-wing/README.md
@@ -11,7 +11,7 @@ Pure Rust implementation of X-Wing, a general-purpose post-quantum/traditional
 hybrid key encapsulation mechanism (PQ/T KEM) built on X25519 and ML-KEM-768.
 Built on the [ml-kem] and [x25519-dalek] crates.
 
-Current implementation matches the [draft RFC][RFC-DRAFT] version 04.
+Current implementation matches the [draft RFC][RFC-DRAFT] version 06.
 
 The original paper: [X-Wing The Hybrid KEM You’ve Been Looking For][X-WING-PAPER]
 

diff --git a/x-wing/src/lib.rs b/x-wing/src/lib.rs
@@ -37,7 +37,7 @@ use rand_core::CryptoRngCore;
 use rand_core::OsRng;
 use sha3::digest::core_api::XofReaderCoreWrapper;
 use sha3::digest::{ExtendableOutput, XofReader};
-use sha3::{Sha3_256, Shake128, Shake128ReaderCore};
+use sha3::{Sha3_256, Shake256, Shake256ReaderCore};
 use x25519_dalek::{x25519, X25519_BASEPOINT_BYTES};
 #[cfg(feature = "zeroize")]
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -182,7 +182,7 @@ impl DecapsulationKey {
         x25519_dalek::PublicKey,
     ) {
         use sha3::digest::Update;
-        let mut shaker = Shake128::default();
+        let mut shaker = Shake256::default();
         shaker.update(&self.sk);
         let mut expanded = shaker.finalize_xof();
 
@@ -266,15 +266,15 @@ fn combiner(
     use sha3::Digest;
 
     let mut hasher = Sha3_256::new();
-    hasher.update(X_WING_LABEL);
     hasher.update(ss_m);
     hasher.update(ss_x);
     hasher.update(ct_x);
     hasher.update(pk_x.as_bytes());
+    hasher.update(X_WING_LABEL);
     hasher.finalize().into()
 }
 
-fn read_from<const N: usize>(reader: &mut XofReaderCoreWrapper<Shake128ReaderCore>) -> [u8; N] {
+fn read_from<const N: usize>(reader: &mut XofReaderCoreWrapper<Shake256ReaderCore>) -> [u8; N] {
     let mut data = [0; N];
     reader.read(&mut data);
     data