def hp_go

bend-collections-laws-crypto@1.0.0.0 · src/crypto/argon2/argon2.bend:27

import Base
import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake2b/sized.bend as H

27# H' for T > 64 (RFC 9106 section 3.3): W1 || .. || Wr || V_{r+1}, where
28# Wi is the first 32 bytes of Vi, V_{i+1} = H^64(Vi) and V_{r+1} = H^{T-32r}(Vr).
29# (V_i is a 64-byte digest, never empty; it is inspected first so that proofs
30# keep the chain of hashes folded.)
31def hp_go(n: Nat, v: List<&2, U32>, +last: Nat) -> List<&2, U32>:
32  match n v:
33    case _ Nil{}:
34      Nil{}
35    case 0n +x <> +r:
36      cat(List.take(&2, U32, x <> r, 32n), H.hash(last, x <> r))
37    case 1n+p +x <> +r:
38      cat(List.take(&2, U32, x <> r, 32n), hp_go(p, H.hash(64n, x <> r), last))