def compress

bend-collections-laws-crypto@1.0.0.0 · spec/crypto/blake/blake2s.bend:96

import Base
import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake2s/types.bend as T

96# F(h, m, t, f) with r rounds (r = 10 for BLAKE2s): t = t0 + 2^32 * t1 is the
97# byte counter, f the final-block flag.
98def compress(+r: Nat, h: T.State, +m: List<&2,U32>, +t0: U32, +t1: U32, last: Bool) -> T.State:
99  match h:
100    case T.H{+h0, +h1, +h2, +h3, +h4, +h5, +h6, +h7}:
101      +v0 = List.append(&2, U32, [h0, h1, h2, h3, h4, h5, h6, h7], iv())
102      +v1 = put(v0, 12n, U32.xor(get(v0, 12n), t0))
103      +v2 = put(v1, 13n, U32.xor(get(v1, 13n), t1))
104      +v = rounds(r, 0n, invert(last, v2), m)
105      T.H{U32.xor(U32.xor(h0, get(v, 0n)), get(v, 8n)),
106          U32.xor(U32.xor(h1, get(v, 1n)), get(v, 9n)),
107          U32.xor(U32.xor(h2, get(v, 2n)), get(v, 10n)),
108          U32.xor(U32.xor(h3, get(v, 3n)), get(v, 11n)),
109          U32.xor(U32.xor(h4, get(v, 4n)), get(v, 12n)),
110          U32.xor(U32.xor(h5, get(v, 5n)), get(v, 13n)),
111          U32.xor(U32.xor(h6, get(v, 6n)), get(v, 14n)),
112          U32.xor(U32.xor(h7, get(v, 7n)), get(v, 15n))}