Struct Shake256 

pub struct Shake256;

SHAKE256 single-stage KDF (KDF id 0x0011), as specified in draft-ietf-hpke-pq-05 Section 5.

SHAKE256 is a single-stage KDF with an output size of 64 bytes. It derives the key schedule with a single Kdf::labeled_derive call instead of the two-stage LabeledExtract/LabeledExpand construction, and is a natural pairing with the hybrid post-quantum KEMs defined in the same draft.

Example

use hpke::kdf::{Kdf, Shake256};

let suite_id = b"HPKE\x64\x7a\x00\x11\x00\x03";
let mut output_keying_material = [0u8; 32];
Shake256::labeled_derive(&mut output_keying_material, &[b"ikm"], suite_id, b"label", &[b"info"]).unwrap();

Trait Implementations

impl Clone for Shake256

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Shake256

impl Debug for Shake256

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Shake256

impl Kdf for Shake256

const HPKE_KDF_ID: u16 = 0x0011

The HPKE KDF identifier (draft-ietf-hpke-hpke-05 Section 7.2, IANA “HPKE KDF Identifiers”), used to build the ciphersuite suite_id.

const SINGLE_STAGE: bool = true

Whether this is a single-stage KDF (draft-ietf-hpke-hpke-05 Section 4).

type Hash = Shake256

The hash function underlying the default HKDF construction.

fn labeled_derive( out: &mut [u8], input_keying_material: &[&[u8]], suite_id: &[u8], label: &[u8], context: &[&[u8]], ) -> Result<(), HpkeError>

draft-ietf-hpke-hpke-05 Section 4.4 LabeledDerive(input_keying_material, label, context, L): Derive(input_keying_material || "HPKE-v1" || suite_id || I2OSP(len(label), 2) || label || I2OSP(L, 2) || context, L), where L == out.len() and the elements of input_keying_material and context are absorbed in order.

const OUTPUT_SIZE: usize = <Self::Hash as crypto::Hasher>::OUTPUT_SIZE

Output size of the extract step (the hash output size).

fn labeled_extract( salt: &[u8], suite_id: &[u8], label: &[u8], input_keying_material: &[u8], ) -> Hash

draft-ietf-hpke-hpke-05 Section 4.4 LabeledExtract(salt, label, input_keying_material): Extract(salt, "HPKE-v1" || suite_id || label || input_keying_material).

fn labeled_expand( out: &mut [u8], pseudorandom_key: &[u8], suite_id: &[u8], label: &[u8], info: &[u8], ) -> Result<(), HpkeError>

draft-ietf-hpke-hpke-05 Section 4.4 LabeledExpand(pseudorandom_key, label, info, L): Expand(pseudorandom_key, I2OSP(L, 2) || "HPKE-v1" || suite_id || label || info, L), where L == out.len(). The info string is absorbed incrementally, so it may be arbitrarily long.

impl PartialEq for Shake256

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Shake256