SHAKE Incremental Byte Squeezes && EVP_ Tests

crypto/digest_extra/digest_extra.c

@@ -254,8 +254,9 @@ const EVP_MD *EVP_get_digestbyname(const char *name) {
 
 static void blake2b256_init(EVP_MD_CTX *ctx) { BLAKE2B256_Init(ctx->md_data); }
 
-static void blake2b256_update(EVP_MD_CTX *ctx, const void *data, size_t len) {
+static int blake2b256_update(EVP_MD_CTX *ctx, const void *data, size_t len) {
   BLAKE2B256_Update(ctx->md_data, data, len);
+  return 1;
 }
 
 static void blake2b256_final(EVP_MD_CTX *ctx, uint8_t *md) {
@@ -271,14 +272,15 @@ static const EVP_MD evp_md_blake2b256 = {
   blake2b256_final,
   BLAKE2B_CBLOCK,
   sizeof(BLAKE2B_CTX),
-  /*finalXOf*/ NULL,
+  /*finalXOf*/   NULL,
+  /*squeezeXOf*/ NULL
 };
 
 const EVP_MD *EVP_blake2b256(void) { return &evp_md_blake2b256; }
 
 static void null_init(EVP_MD_CTX *ctx) {}
 
-static void null_update(EVP_MD_CTX *ctx, const void *data, size_t count) {}
+static int null_update(EVP_MD_CTX *ctx, const void *data, size_t count) { return 1;}
 
 static void null_final(EVP_MD_CTX *ctx, unsigned char *md) {}
 
@@ -291,7 +293,8 @@ static const EVP_MD evp_md_null = {
   null_final,
   0,
   sizeof(EVP_MD_CTX),
-  NULL,
+  /*finalXOf*/   NULL,
+  /*squeezeXOf*/ NULL
 };
 
 const EVP_MD *EVP_md_null(void) { return &evp_md_null; }

crypto/fipsmodule/digest/digest.c

@@ -135,6 +135,11 @@ void EVP_MD_CTX_free(EVP_MD_CTX *ctx) {
 
 void EVP_MD_CTX_destroy(EVP_MD_CTX *ctx) { EVP_MD_CTX_free(ctx); }
 
+// EVP_DigestFinalXOF is a single-call XOF output generation function.
+// The |ctx->digest| check prevents calling EVP_DigestFinalXOF consecutively. 
+// To catch single-call XOF EVP_DigestFinalXOF calls after |EVP_DigestSqueeze|,
+// the return |SHAKE_Final| value is used (the check is internally performed via 
+// the |KECCAK1600_CTX *ctx| state flag).
 int EVP_DigestFinalXOF(EVP_MD_CTX *ctx, uint8_t *out, size_t len) {
   if (ctx->digest == NULL) {
     return 0;
@@ -143,8 +148,23 @@ int EVP_DigestFinalXOF(EVP_MD_CTX *ctx, uint8_t *out, size_t len) {
     OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
-  ctx->digest->finalXOF(ctx, out, len);
+  int ok = ctx->digest->finalXOF(ctx, out, len);
   EVP_MD_CTX_cleanse(ctx);
+  return ok;
+}
+
+// EVP_DigestSqueeze is a streaming XOF output squeeze function
+// It can be called multiple times to generate an output of length 
+// |len| bytes. 
+int EVP_DigestSqueeze(EVP_MD_CTX *ctx, uint8_t *out, size_t len) {
+  if (ctx->digest == NULL) {
+    return 0;
+  }
+  if ((EVP_MD_flags(ctx->digest) & EVP_MD_FLAG_XOF) == 0) {
+    OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+  ctx->digest->squeezeXOF(ctx, out, len);
   return 1;
 }
 
@@ -273,8 +293,7 @@ int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) {
   if (ctx->update == NULL) {
     return 0;
   }
-  ctx->update(ctx, data, len);
-  return 1;
+  return ctx->update(ctx, data, len);
 }
 
 int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, uint8_t *md_out, unsigned int *size) {