libdecaf_nif (libdecaf v3.0.0)
View SourceNative libdecaf bindings. For Hash and XOF usage and examples, see libdecaf.
Lengths are in bytes. Resources are immutable; retain returned states to advance them.
Summary
Types
ParallelHash block size in bytes. It is part of the construction and changes the digest.
Application-specific domain separation string; the default is empty.
A canonical 56-byte decaf448 point encoding.
An immutable native multiplication table for decaf448.
A canonical 56-byte decaf448 scalar encoding.
TurboSHAKE domain byte, defaulting to 16#1F.
An immutable native ED448 keypair resource.
A 57-byte ED448 public key encoding.
A 57-byte ED448 secret key encoding.
A 114-byte ED448 signature encoding.
A 114-byte ed448 signing key: secret seed followed by the matching public key.
An immutable native ed448ph sign state, distinct from other curves and operations.
An immutable native ed448ph verify state, distinct from other curves and operations.
Use no_context for pure Ed25519, or a context binary of at most 255 bytes.
An immutable native ED25519 keypair resource.
A 32-byte ED25519 public key encoding.
A 32-byte ED25519 secret key encoding.
A 64-byte ED25519 signature encoding.
A 64-byte ed25519 signing key: secret seed followed by the matching public key.
An immutable native ed25519ph sign state, distinct from other curves and operations.
An immutable native ed25519ph verify state, distinct from other curves and operations.
cSHAKE function-name string; the default is empty.
Supported hash algorithm selectors.
Algorithm atom or tuple containing initialization parameters in argument order.
An immutable native hash state, with its output length chosen at initialization.
Message bytes accepted as iodata, or one complete TupleHash element during absorption.
Selected Keccak backend name and preferred number of independent parallel states.
Secret KMAC or HopMAC key material accepted as iodata.
Requested number of output bytes, including zero.
A pending parallel HASH operation, private to its calling process.
Initialization parameters for KT128, KT256, HopMAC128, HopMAC256, ParallelHash128, and ParallelHash256.
An immutable parallel HASH state. Retain each returned state to advance the stream.
Native router configuration. names contains count registered names in ascending router order.
A pending parallel XOF operation, private to its calling process.
Initialization parameters for KT128, KT256, HopMAC128, HopMAC256, ParallelHashXOF128, and ParallelHashXOF256.
An immutable parallel XOF state. Retain each returned state to advance the stream.
Select an ordinary message (0) or an already computed 64-byte prehash (1).
A canonical 32-byte ristretto255 point encoding.
An immutable native multiplication table for ristretto255.
A canonical 32-byte ristretto255 scalar encoding.
A sponge PRNG resource. Continue with each operation's returned state.
A six-byte anonymity key, AK or AK*.
The two-byte authentication management field AMF.
A 16- or 32-byte confidentiality key CK.
Supported ck length values in bytes; default 16.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
A 16- or 32-byte integrity key IK.
Supported ik length values in bytes; default 16.
Number of complete 24-round Keccak-f[1600] permutations; default 1. Use the same count for TOPc derivation and its subsequent operations. Long evaluations yield between bounded batches and stop when their caller is terminated.
A 16- or 32-byte subscriber key K.
An 8-, 16-, or 32-byte authentication code, MAC-A or MAC-S.
Supported mac length values in bytes; default 8.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
The 16-byte authentication challenge RAND.
A 4-, 8-, 16-, or 32-byte authentication response RES.
Supported res length values in bytes; default 8.
The six-byte sequence number SQN (SQN_MS during resynchronization).
The 32-byte operator configuration TOP.
The 32-byte subscriber-specific TOPc derived from TOP and K.
A proper list of separately framed TupleHash elements.
A 56-byte X448 public key encoding.
A 56-byte X448 scalar encoding.
A 56-byte X448 shared secret encoding.
A 32-byte X25519 public key encoding.
A 32-byte X25519 scalar encoding.
A 32-byte X25519 shared secret encoding.
Supported xof algorithm selectors.
Algorithm atom or tuple containing initialization parameters in argument order.
An immutable native absorbing or squeezing state.
Decaf448
Return the canonical Decaf448 generator from RFC 9496.
Multiply the canonical Decaf448 generator by Scalar.
Return the Decaf448 identity element, encoded as 56 zero bytes.
Return the canonical encoding of Left + Right.
Return Point + Point in canonical encoding.
Return Scalar1 * Point1 + Scalar2 * Point2 in canonical encoding.
Return whether two encoded points represent the same group element.
Derive a Decaf448 element from exactly 112 bytes using RFC 9496.
Apply the upstream single map to exactly 56 bytes.
Return whether Point is a valid canonical 56-byte Decaf448 encoding.
Return the additive inverse of Point in canonical encoding.
Return Scalar * Point in canonical encoding.
Return the canonical encoding of Left - Right.
Build an immutable native multiplication table for Point.
Multiply the point stored in Precomputed by Scalar.
Return (Left + Right) mod l, where l is the group order.
Divide Scalar by two modulo the group order.
Return the multiplicative inverse of Scalar modulo the group order.
Return whether Scalar is a canonical 56-byte little-endian scalar.
Return (Left * Right) mod l, where l is the group order.
Return -Scalar mod l, where l is the group order.
Reduce an arbitrary-length unsigned little-endian integer modulo the group order.
Return (Left - Right) mod l, where l is the group order.
Diffie-Hellman
Compute a Diffie-Hellman shared secret.
The public key comes first and the secret scalar second.
Return error when the upstream operation rejects the input, including low-order points.
Derive an X448 public key from a secret scalar.
Compute a Diffie-Hellman shared secret.
The public key comes first and the secret scalar second.
Return error when the upstream operation rejects the input, including low-order points.
Derive an X25519 public key from a secret scalar.
Ed448
Derive an X448 scalar from a Ed448 secret seed.
Convert an encoded Ed448 public key to its X448 public-key encoding.
Derive an immutable Ed448 keypair resource from a secret seed.
Derive a Ed448 public key from a secret seed.
Extract the secret seed from a keypair resource. Keep the returned bytes private.
Extract the public key from a keypair resource.
Sign with a Ed448 keypair resource.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Prehash the message internally and sign using Ed448ph.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Sign using a Ed448 secret seed and matching public key.
Mismatched keys raise an error.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Prehash the message internally and sign using Ed448ph.
The secret seed and public key must match.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Verify a Ed448 signature, returning false when verification fails.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Prehash the message internally and verify a Ed448ph signature.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
Ed448ph: Start signing with an empty context.
Ed448ph: Start signing, retaining the keypair and a context of at most 255 bytes in native state.
Ed448ph: Sign the accumulated message without changing the signing state.
Ed448ph: Start signing with an encoded seed followed by its public key, using an empty context.
Ed448ph: Validate the encoded seed/public key pair and retain a native keypair with a context of at most 255 bytes.
Ed448ph: Prehash another message chunk. Return a new immutable signing state; large updates yield.
Ed448ph: Verify the accumulated message without changing the verification state.
Ed448ph: Start verification with an empty context.
Ed448ph: Start verification, retaining the signature, public key, and a context of at most 255 bytes in native state.
Ed448ph: Prehash another message chunk. Return a new immutable verification state; large updates yield.
Ed25519
Derive an X25519 scalar from a Ed25519 secret seed.
Convert an encoded Ed25519 public key to its X25519 public-key encoding.
Derive an immutable Ed25519 keypair resource from a secret seed.
Derive a Ed25519 public key from a secret seed.
Extract the secret seed from a keypair resource. Keep the returned bytes private.
Extract the public key from a keypair resource.
Sign with a Ed25519 keypair resource.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Prehash the message internally and sign using Ed25519ph.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Sign using a Ed25519 secret seed and matching public key.
Mismatched keys raise an error.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Prehash the message internally and sign using Ed25519ph.
The secret seed and public key must match.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Verify a Ed25519 signature, returning false when verification fails.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Prehash the message internally and verify a Ed25519ph signature.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
Ed25519ph: Start signing with an empty context.
Ed25519ph: Start signing, retaining the keypair and a context of at most 255 bytes in native state.
Ed25519ph: Sign the accumulated message without changing the signing state.
Ed25519ph: Start signing with an encoded seed followed by its public key, using an empty context.
Ed25519ph: Validate the encoded seed/public key pair and retain a native keypair with a context of at most 255 bytes.
Ed25519ph: Prehash another message chunk. Return a new immutable signing state; large updates yield.
Ed25519ph: Verify the accumulated message without changing the verification state.
Ed25519ph: Start verification with an empty context.
Ed25519ph: Start verification, retaining the signature, public key, and a context of at most 255 bytes in native state.
Ed25519ph: Prehash another message chunk. Return a new immutable verification state; large updates yield.
Hash API
Compute cshake128 hash.
Compute cshake128 hash.
Initialize cshake128 hash.
Initialize cshake128 hash.
Compute cshake256 hash.
Compute cshake256 hash.
Initialize cshake256 hash.
Initialize cshake256 hash.
Compute a hash from initialization parameters and input.
Return the output length selected during initialization.
Initialize a native state from an algorithm atom or parameter tuple.
Absorb input and return a new hash state.
Compute hopmac128 hash.
Compute hopmac128 hash.
Initialize hopmac128 hash.
Initialize hopmac128 hash.
Compute hopmac256 hash.
Compute hopmac256 hash.
Initialize hopmac256 hash.
Initialize hopmac256 hash.
Compute keccak_224 hash.
Compute keccak_224 hash.
Initialize keccak_224 hash.
Initialize keccak_224 hash.
Compute keccak_256 hash.
Compute keccak_256 hash.
Initialize keccak_256 hash.
Initialize keccak_256 hash.
Compute keccak_384 hash.
Compute keccak_384 hash.
Initialize keccak_384 hash.
Initialize keccak_384 hash.
Compute keccak_512 hash.
Compute keccak_512 hash.
Initialize keccak_512 hash.
Initialize keccak_512 hash.
Compute keccakxof_128 hash.
Initialize keccakxof_128 hash.
Compute keccakxof_256 hash.
Initialize keccakxof_256 hash.
Compute kmac128 hash.
Compute kmac128 hash.
Initialize kmac128 hash.
Initialize kmac128 hash.
Compute kmac256 hash.
Compute kmac256 hash.
Initialize kmac256 hash.
Initialize kmac256 hash.
Compute kt128 hash.
Compute kt128 hash.
Compute kt128 hash.
Initialize kt128 hash.
Initialize kt128 hash.
Initialize kt128 hash.
Compute kt256 hash.
Compute kt256 hash.
Compute kt256 hash.
Initialize kt256 hash.
Initialize kt256 hash.
Initialize kt256 hash.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Return the configured hash output without changing the input state.
Initialize a parallel Hash state.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Compute parallelhash128 hash.
Compute parallelhash128 hash.
Initialize parallelhash128 hash.
Initialize parallelhash128 hash.
Compute parallelhash256 hash.
Compute parallelhash256 hash.
Initialize parallelhash256 hash.
Initialize parallelhash256 hash.
Compute sha2_512 hash.
Compute sha2_512 hash.
Initialize sha2_512 hash.
Initialize sha2_512 hash.
Compute sha3_224 hash.
Compute sha3_224 hash.
Initialize sha3_224 hash.
Initialize sha3_224 hash.
Compute sha3_256 hash.
Compute sha3_256 hash.
Initialize sha3_256 hash.
Initialize sha3_256 hash.
Compute sha3_384 hash.
Compute sha3_384 hash.
Initialize sha3_384 hash.
Initialize sha3_384 hash.
Compute sha3_512 hash.
Compute sha3_512 hash.
Initialize sha3_512 hash.
Initialize sha3_512 hash.
Compute shake128 hash.
Initialize shake128 hash.
Compute shake256 hash.
Initialize shake256 hash.
Compute tuplehash128 hash.
Compute tuplehash128 hash.
Initialize tuplehash128 hash.
Initialize tuplehash128 hash.
Compute tuplehash256 hash.
Compute tuplehash256 hash.
Initialize tuplehash256 hash.
Initialize tuplehash256 hash.
Compute turboshake128 hash.
Compute turboshake128 hash.
Compute turboshake128 hash.
Initialize turboshake128 hash.
Initialize turboshake128 hash.
Initialize turboshake128 hash.
Compute turboshake256 hash.
Compute turboshake256 hash.
Compute turboshake256 hash.
Initialize turboshake256 hash.
Initialize turboshake256 hash.
Initialize turboshake256 hash.
Keccak API
Return the runtime-selected native Keccak backend and parallel permutation width. The backend name is a diagnostic binary; parallelism is 1, 2, 4 or 8. Selection reflects CPU and OS support, including portable fallback.
Parallel API
Process up to MaxRounds queued leaves on a dirty CPU scheduler, preferring RouterNumber. Idle workers steal from other queues. Zero drains until the pool has no queued leaves, and can run indefinitely if producers keep adding leaves.
Return the native parallel router count, limit, and registered names.
Names are numbered from one in scheduler order. The count uses the total
normal scheduler count at NIF load time, capped by limit; it does not
change when schedulers are taken offline. Routers need not be running.
Ristretto255
Return the canonical Ristretto255 generator from RFC 9496.
Multiply the canonical Ristretto255 generator by Scalar.
Return the Ristretto255 identity element, encoded as 32 zero bytes.
Return the canonical encoding of Left + Right.
Return Point + Point in canonical encoding.
Return Scalar1 * Point1 + Scalar2 * Point2 in canonical encoding.
Return whether two encoded points represent the same group element.
Derive a Ristretto255 element from exactly 64 bytes using RFC 9496.
Apply the upstream single map to exactly 32 bytes.
Return whether Point is a valid canonical 32-byte Ristretto255 encoding.
Return the additive inverse of Point in canonical encoding.
Return Scalar * Point in canonical encoding.
Return the canonical encoding of Left - Right.
Build an immutable native multiplication table for Point.
Multiply the point stored in Precomputed by Scalar.
Return (Left + Right) mod l, where l is the group order.
Divide Scalar by two modulo the group order.
Return the multiplicative inverse of Scalar modulo the group order.
Return whether Scalar is a canonical 32-byte little-endian scalar.
Return (Left * Right) mod l, where l is the group order.
Return -Scalar mod l, where l is the group order.
Reduce an arbitrary-length unsigned little-endian integer modulo the group order.
Return (Left - Right) mod l, where l is the group order.
Sponge PRNG
Initialize a sponge PRNG from seed bytes.
Deterministic selects the upstream PRNG's deterministic mode.
Initialize a sponge PRNG using /dev/urandom.
Raise an exception if the entropy source cannot be read.
Initialize a sponge PRNG by reading InputLen bytes from a file.
Filename contains nonempty native filename bytes; file errors raise an exception.
Generate bytes and return the new PRNG state together with those bytes. Continue with the returned state to advance the stream.
Mix additional seed bytes into a PRNG state and return a new state.
Generate bytes using an automatically OS-seeded, thread-local SpongeRNG.
Return need_seed if native entropy is unavailable; prefer libdecaf:strong_rand_bytes/1 for automatic
fallback.
Supply exactly 64 cryptographically random seed bytes and generate output from the calling thread's SpongeRNG.
Used by libdecaf:strong_rand_bytes/1 when native OS entropy is unavailable. Existing state is stirred, not
reset.
TUAK API
TUAK f1: Compute the network authentication code MAC-A over RAND, SQN, and AMF.
TUAK f1: Compute the network authentication code MAC-A over RAND, SQN, and AMF.
TUAK f1_star: Compute the resynchronization authentication code MAC-S.
TUAK f1_star: Compute the resynchronization authentication code MAC-S.
TUAK f2: Compute the authentication response RES for RAND.
TUAK f2: Compute the authentication response RES for RAND.
TUAK f3: Compute the confidentiality key CK for RAND.
TUAK f3: Compute the confidentiality key CK for RAND.
TUAK f4: Compute the integrity key IK for RAND.
TUAK f4: Compute the integrity key IK for RAND.
TUAK f5: Compute the six-byte anonymity key AK for RAND.
TUAK f5: Compute the six-byte anonymity key AK for RAND.
TUAK f5_star: Compute the six-byte resynchronization anonymity key AK* for RAND.
TUAK f5_star: Compute the six-byte resynchronization anonymity key AK* for RAND.
TUAK f2345: Compute the response RES, confidentiality key CK, integrity key IK, and anonymity key AK
TUAK f2345: Compute the response RES, confidentiality key CK, integrity key IK, and anonymity key AK
TUAK topc: Derive the subscriber-specific TOPc from the subscriber key and the operator's TOP.
TUAK topc: Derive the subscriber-specific TOPc from the subscriber key and the operator's TOP.
XOF API
Initialize cshake128 xof.
Initialize cshake128 xof.
Initialize cshake256 xof.
Initialize cshake256 xof.
Initialize hopmac128 xof.
Initialize hopmac128 xof.
Initialize hopmac256 xof.
Initialize hopmac256 xof.
Initialize keccakxof_128 xof.
Initialize keccakxof_256 xof.
Compute kmacxof128 xof.
Compute kmacxof128 xof.
Initialize kmacxof128 xof.
Initialize kmacxof128 xof.
Compute kmacxof256 xof.
Compute kmacxof256 xof.
Initialize kmacxof256 xof.
Initialize kmacxof256 xof.
Initialize kt128 xof.
Initialize kt128 xof.
Initialize kt256 xof.
Initialize kt256 xof.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
Initialize a parallel XOF state.
Read output and return {NextState, Output}.
Compute parallelhashxof128 xof.
Compute parallelhashxof128 xof.
Initialize parallelhashxof128 xof.
Initialize parallelhashxof128 xof.
Compute parallelhashxof256 xof.
Compute parallelhashxof256 xof.
Initialize parallelhashxof256 xof.
Initialize parallelhashxof256 xof.
Initialize shake128 xof.
Initialize shake256 xof.
Compute tuplehashxof128 xof.
Compute tuplehashxof128 xof.
Initialize tuplehashxof128 xof.
Initialize tuplehashxof128 xof.
Compute tuplehashxof256 xof.
Compute tuplehashxof256 xof.
Initialize tuplehashxof256 xof.
Initialize tuplehashxof256 xof.
Initialize turboshake128 xof.
Initialize turboshake128 xof.
Initialize turboshake256 xof.
Initialize turboshake256 xof.
Compute OutputLength XOF bytes using initialization parameters.
Absorb input and return a new absorbing state.
Initialize a native state from an algorithm atom or parameter tuple.
Return the advancing state and the next Length output bytes.
Types
-type block_size() :: pos_integer().
ParallelHash block size in bytes. It is part of the construction and changes the digest.
-type customization_string() :: iodata().
Application-specific domain separation string; the default is empty.
-type decaf448_point() :: <<_:448>>.
A canonical 56-byte decaf448 point encoding.
-type decaf448_precomputed() :: erlang:nif_resource().
An immutable native multiplication table for decaf448.
-type decaf448_scalar() :: <<_:448>>.
A canonical 56-byte decaf448 scalar encoding.
-type domain_separation() :: 1..127.
TurboSHAKE domain byte, defaulting to 16#1F.
-type ed448_keypair() :: erlang:nif_resource().
An immutable native ED448 keypair resource.
-type ed448_public_key() :: <<_:456>>.
A 57-byte ED448 public key encoding.
-type ed448_secret_key() :: <<_:456>>.
A 57-byte ED448 secret key encoding.
-type ed448_signature() :: <<_:912>>.
A 114-byte ED448 signature encoding.
-type ed448_signing_key() :: <<_:912>>.
A 114-byte ed448 signing key: secret seed followed by the matching public key.
-opaque ed448ph_sign_state()
An immutable native ed448ph sign state, distinct from other curves and operations.
-opaque ed448ph_verify_state()
An immutable native ed448ph verify state, distinct from other curves and operations.
-type ed25519_context() :: no_context | binary().
Use no_context for pure Ed25519, or a context binary of at most 255 bytes.
-type ed25519_keypair() :: erlang:nif_resource().
An immutable native ED25519 keypair resource.
-type ed25519_public_key() :: <<_:256>>.
A 32-byte ED25519 public key encoding.
-type ed25519_secret_key() :: <<_:256>>.
A 32-byte ED25519 secret key encoding.
-type ed25519_signature() :: <<_:512>>.
A 64-byte ED25519 signature encoding.
-type ed25519_signing_key() :: <<_:512>>.
A 64-byte ed25519 signing key: secret seed followed by the matching public key.
-opaque ed25519ph_sign_state()
An immutable native ed25519ph sign state, distinct from other curves and operations.
-opaque ed25519ph_verify_state()
An immutable native ed25519ph verify state, distinct from other curves and operations.
-type function_name() :: iodata().
cSHAKE function-name string; the default is empty.
-type hash_algorithm() ::
cshake128 | cshake256 | hopmac128 | hopmac256 | keccak_224 | keccak_256 | keccak_384 |
keccak_512 | keccakxof_128 | keccakxof_256 | kmac128 | kmac256 | kt128 | kt256 |
parallelhash128 | parallelhash256 | sha2_512 | sha3_224 | sha3_256 | sha3_384 | sha3_512 |
shake128 | shake256 | tuplehash128 | tuplehash256 | turboshake128 | turboshake256.
Supported hash algorithm selectors.
-type hash_parameters() :: {hopmac128 | hopmac256, output_length(), key()} | {hopmac128 | hopmac256, output_length(), key(), customization_string()} | {cshake128 | cshake256, output_length()} | {cshake128 | cshake256, output_length(), function_name(), customization_string()} | keccak_224 | keccak_256 | keccak_384 | keccak_512 | {keccak_224 | keccak_256 | keccak_384 | keccak_512} | {keccak_224 | keccak_256 | keccak_384 | keccak_512 | keccakxof_128 | keccakxof_256, output_length()} | {kmac128 | kmac256, output_length(), key()} | {kmac128 | kmac256, output_length(), key(), customization_string()} | kt128 | kt256 | {kt128 | kt256, output_length()} | {kt128 | kt256, output_length(), customization_string()} | {parallelhash128 | parallelhash256, output_length(), block_size()} | {parallelhash128 | parallelhash256, output_length(), block_size(), customization_string()} | sha2_512 | {sha2_512, output_length()} | sha3_224 | sha3_256 | sha3_384 | sha3_512 | {sha3_224 | sha3_256 | sha3_384 | sha3_512 | shake128 | shake256, output_length()} | {tuplehash128 | tuplehash256, output_length()} | {tuplehash128 | tuplehash256, output_length(), customization_string()} | turboshake128 | turboshake256 | {turboshake128 | turboshake256, output_length()} | {turboshake128 | turboshake256, output_length(), domain_separation()}.
Algorithm atom or tuple containing initialization parameters in argument order.
-opaque hash_state()
An immutable native hash state, with its output length chosen at initialization.
-type input() :: iodata().
Message bytes accepted as iodata, or one complete TupleHash element during absorption.
-type keccak_info() :: #{backend := binary(), parallelism := 1 | 2 | 4 | 8}.
Selected Keccak backend name and preferred number of independent parallel states.
-type key() :: iodata().
Secret KMAC or HopMAC key material accepted as iodata.
-type output_length() :: non_neg_integer().
Requested number of output bytes, including zero.
-opaque parallel_hash_operation()
A pending parallel HASH operation, private to its calling process.
-type parallel_hash_parameters() :: {hopmac128 | hopmac256, output_length(), key()} | {hopmac128 | hopmac256, output_length(), key(), customization_string()} | kt128 | kt256 | {kt128 | kt256, output_length()} | {kt128 | kt256, output_length(), customization_string()} | {parallelhash128 | parallelhash256, output_length(), block_size()} | {parallelhash128 | parallelhash256, output_length(), block_size(), customization_string()}.
Initialization parameters for KT128, KT256, HopMAC128, HopMAC256, ParallelHash128, and ParallelHash256.
-opaque parallel_hash_state()
An immutable parallel HASH state. Retain each returned state to advance the stream.
-type parallel_router_info() :: #{count := pos_integer(), limit := pos_integer(), names := [atom()], queued := non_neg_integer()}.
Native router configuration. names contains count registered names in ascending router order.
-opaque parallel_xof_operation()
A pending parallel XOF operation, private to its calling process.
-type parallel_xof_parameters() :: {hopmac128 | hopmac256, key()} | {hopmac128 | hopmac256, key(), customization_string()} | kt128 | kt256 | {kt128 | kt256, customization_string()} | {parallelhashxof128 | parallelhashxof256, block_size()} | {parallelhashxof128 | parallelhashxof256, block_size(), customization_string()}.
Initialization parameters for KT128, KT256, HopMAC128, HopMAC256, ParallelHashXOF128, and ParallelHashXOF256.
-opaque parallel_xof_state()
An immutable parallel XOF state. Retain each returned state to advance the stream.
-type prehashed() :: 0 | 1.
Select an ordinary message (0) or an already computed 64-byte prehash (1).
-type ristretto255_point() :: <<_:256>>.
A canonical 32-byte ristretto255 point encoding.
-type ristretto255_precomputed() :: erlang:nif_resource().
An immutable native multiplication table for ristretto255.
-type ristretto255_scalar() :: <<_:256>>.
A canonical 32-byte ristretto255 scalar encoding.
-type spongerng_state() :: erlang:nif_resource().
A sponge PRNG resource. Continue with each operation's returned state.
-type tuak_ak() :: <<_:48>>.
A six-byte anonymity key, AK or AK*.
-type tuak_amf() :: <<_:16>>.
The two-byte authentication management field AMF.
-type tuak_ck() :: <<_:128>> | <<_:256>>.
A 16- or 32-byte confidentiality key CK.
-type tuak_ck_length() :: 16 | 32.
Supported ck length values in bytes; default 16.
-type tuak_derive_options() :: #{res_length => tuak_res_length(), ck_length => tuak_ck_length(), ik_length => tuak_ik_length(), iterations => tuak_iterations()}.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
-type tuak_ik() :: <<_:128>> | <<_:256>>.
A 16- or 32-byte integrity key IK.
-type tuak_ik_length() :: 16 | 32.
Supported ik length values in bytes; default 16.
-type tuak_iterations() :: 1..4294967295.
Number of complete 24-round Keccak-f[1600] permutations; default 1. Use the same count for TOPc derivation and its subsequent operations. Long evaluations yield between bounded batches and stop when their caller is terminated.
-type tuak_key() :: <<_:128>> | <<_:256>>.
A 16- or 32-byte subscriber key K.
-type tuak_mac() :: <<_:64>> | <<_:128>> | <<_:256>>.
An 8-, 16-, or 32-byte authentication code, MAC-A or MAC-S.
-type tuak_mac_length() :: 8 | 16 | 32.
Supported mac length values in bytes; default 8.
-type tuak_mac_options() :: #{mac_length => tuak_mac_length(), iterations => tuak_iterations()}.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
-type tuak_options() :: #{iterations => tuak_iterations()}.
Optional settings for this TUAK operation. Unspecified settings use the configured defaults; unknown or inapplicable keys raise badarg. Lengths participate in domain separation.
-type tuak_rand() :: <<_:128>>.
The 16-byte authentication challenge RAND.
-type tuak_res() :: <<_:32>> | <<_:64>> | <<_:128>> | <<_:256>>.
A 4-, 8-, 16-, or 32-byte authentication response RES.
-type tuak_res_length() :: 4 | 8 | 16 | 32.
Supported res length values in bytes; default 8.
-type tuak_sqn() :: <<_:48>>.
The six-byte sequence number SQN (SQN_MS during resynchronization).
-type tuak_top() :: <<_:256>>.
The 32-byte operator configuration TOP.
-type tuak_topc() :: <<_:256>>.
The 32-byte subscriber-specific TOPc derived from TOP and K.
-type tuple_input() :: [iodata()].
A proper list of separately framed TupleHash elements.
-type x448_public_key() :: <<_:448>>.
A 56-byte X448 public key encoding.
-type x448_scalar() :: <<_:448>>.
A 56-byte X448 scalar encoding.
-type x25519_public_key() :: <<_:256>>.
A 32-byte X25519 public key encoding.
-type x25519_scalar() :: <<_:256>>.
A 32-byte X25519 scalar encoding.
-type xof_algorithm() ::
cshake128 | cshake256 | hopmac128 | hopmac256 | keccakxof_128 | keccakxof_256 | kmacxof128 |
kmacxof256 | kt128 | kt256 | parallelhashxof128 | parallelhashxof256 | shake128 | shake256 |
tuplehashxof128 | tuplehashxof256 | turboshake128 | turboshake256.
Supported xof algorithm selectors.
-type xof_parameters() :: {hopmac128 | hopmac256, key()} | {hopmac128 | hopmac256, key(), customization_string()} | cshake128 | cshake256 | {cshake128 | cshake256, function_name(), customization_string()} | keccakxof_128 | keccakxof_256 | {kmacxof128 | kmacxof256, key()} | {kmacxof128 | kmacxof256, key(), customization_string()} | kt128 | kt256 | {kt128 | kt256, customization_string()} | {parallelhashxof128 | parallelhashxof256, block_size()} | {parallelhashxof128 | parallelhashxof256, block_size(), customization_string()} | shake128 | shake256 | tuplehashxof128 | tuplehashxof256 | {tuplehashxof128 | tuplehashxof256, customization_string()} | turboshake128 | turboshake256 | {turboshake128 | turboshake256, domain_separation()}.
Algorithm atom or tuple containing initialization parameters in argument order.
-opaque xof_state()
An immutable native absorbing or squeezing state.
Decaf448
-spec decaf448_base() -> Result when Result :: decaf448_point().
Return the canonical Decaf448 generator from RFC 9496.
Use this point for interoperable generator multiplication. The base-scalar multiplication operation uses its built-in precomputed table.
-spec decaf448_base_scalarmul(Scalar) -> Result when Scalar :: decaf448_scalar(), Result :: decaf448_point().
Multiply the canonical Decaf448 generator by Scalar.
Uses the native library's built-in precomputed generator table.
The scalar must already be canonical; otherwise raises badarg.
-spec decaf448_identity() -> Result when Result :: decaf448_point().
Return the Decaf448 identity element, encoded as 56 zero bytes.
Adding this point leaves the other point unchanged. Multiplication by zero and multiplication of the identity by any scalar both return the identity.
-spec decaf448_point_add(Left, Right) -> Result when Left :: decaf448_point(), Right :: decaf448_point(), Result :: decaf448_point().
Return the canonical encoding of Left + Right.
Both operands must be valid point encodings; otherwise raises badarg.
Adding a point to its negation returns the identity.
-spec decaf448_point_double(Point) -> Result when Point :: decaf448_point(), Result :: decaf448_point().
Return Point + Point in canonical encoding.
This is equivalent to multiplication by the scalar two.
An invalid point encoding raises badarg.
-spec decaf448_point_double_scalarmul(Point1, Scalar1, Point2, Scalar2) -> Result when Point1 :: decaf448_point(), Scalar1 :: decaf448_scalar(), Point2 :: decaf448_point(), Scalar2 :: decaf448_scalar(), Result :: decaf448_point().
Return Scalar1 * Point1 + Scalar2 * Point2 in canonical encoding.
Computes the same result as two scalar multiplications followed by addition.
Both points must be valid and both scalars canonical; otherwise raises badarg.
-spec decaf448_point_eq(Left, Right) -> Result when Left :: decaf448_point(), Right :: decaf448_point(), Result :: boolean().
Return whether two encoded points represent the same group element.
Both operands are decoded and validated. Invalid encodings raise badarg;
false means that two valid points differ.
-spec decaf448_point_from_hash(UniformBytes) -> Result when UniformBytes :: binary(), Result :: decaf448_point().
Derive a Decaf448 element from exactly 112 bytes using RFC 9496.
The two halves are mapped separately and their points are added. Uniform
input gives an approximately uniform group element. This operation does
not hash a message: use a protocol-defined, domain-separated hash or XOF
to prepare the input. Wrong-sized binaries and non-binaries raise badarg.
-spec decaf448_point_from_hash_nonuniform(Bytes) -> Result when Bytes :: binary(), Result :: decaf448_point().
Apply the upstream single map to exactly 56 bytes.
This is one half of the two-map RFC 9496 derivation. Its output has a
different distribution, so use it only when a protocol requires the single
map. Wrong-sized binaries and non-binaries raise badarg.
Return whether Point is a valid canonical 56-byte Decaf448 encoding.
The identity is valid. Wrong-sized binaries, noncanonical encodings, and
non-binary terms return false instead of raising badarg.
-spec decaf448_point_negate(Point) -> Result when Point :: decaf448_point(), Result :: decaf448_point().
Return the additive inverse of Point in canonical encoding.
The input point and its negation add to the identity.
An invalid point encoding raises badarg.
-spec decaf448_point_scalarmul(Point, Scalar) -> Result when Point :: decaf448_point(), Scalar :: decaf448_scalar(), Result :: decaf448_point().
Return Scalar * Point in canonical encoding.
The point must be valid and the scalar must already be canonical.
Invalid operands raise badarg; zero and the identity are accepted.
-spec decaf448_point_sub(Left, Right) -> Result when Left :: decaf448_point(), Right :: decaf448_point(), Result :: decaf448_point().
Return the canonical encoding of Left - Right.
Both operands must be valid point encodings; otherwise raises badarg.
Subtracting a point from itself returns the identity.
-spec decaf448_precompute(Point) -> Result when Point :: decaf448_point(), Result :: decaf448_precomputed().
Build an immutable native multiplication table for Point.
Reuse the table when multiplying the same point by many scalars.
The resource can be shared between processes and is released automatically
when no references remain. It is specific to Decaf448; invalid points raise badarg.
-spec decaf448_precomputed_scalarmul(Precomputed, Scalar) -> Result when Precomputed :: decaf448_precomputed(), Scalar :: decaf448_scalar(), Result :: decaf448_point().
Multiply the point stored in Precomputed by Scalar.
The result matches ordinary point-scalar multiplication; the table is unchanged.
A resource from another group, a non-table term, or a noncanonical Decaf448
scalar raises badarg.
-spec decaf448_scalar_add(Left, Right) -> Result when Left :: decaf448_scalar(), Right :: decaf448_scalar(), Result :: decaf448_scalar().
Return (Left + Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
The result is canonically encoded.
-spec decaf448_scalar_halve(Scalar) -> Result when Scalar :: decaf448_scalar(), Result :: decaf448_scalar().
Divide Scalar by two modulo the group order.
This is multiplication by the modular inverse of two, rather than integer
division. Adding the result to itself recovers the input, including for odd
scalars. A noncanonical scalar raises badarg.
-spec decaf448_scalar_invert(Scalar) -> Result when Scalar :: decaf448_scalar(), Result :: decaf448_scalar() | error.
Return the multiplicative inverse of Scalar modulo the group order.
Multiplying a nonzero scalar by its inverse gives the canonical scalar one.
Zero has no inverse and returns error. Noncanonical scalars raise badarg.
Return whether Scalar is a canonical 56-byte little-endian scalar.
Its integer value must be smaller than the group order; zero is accepted.
Wrong-sized binaries, out-of-range values, and non-binaries return false.
-spec decaf448_scalar_mul(Left, Right) -> Result when Left :: decaf448_scalar(), Right :: decaf448_scalar(), Result :: decaf448_scalar().
Return (Left * Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
The result is canonically encoded.
-spec decaf448_scalar_negate(Scalar) -> Result when Scalar :: decaf448_scalar(), Result :: decaf448_scalar().
Return -Scalar mod l, where l is the group order.
The result adds to the input to give zero; zero is its own negation.
A noncanonical scalar raises badarg.
-spec decaf448_scalar_reduce(Bytes) -> Result when Bytes :: binary(), Result :: decaf448_scalar().
Reduce an arbitrary-length unsigned little-endian integer modulo the group order.
Returns a canonical 56-byte scalar. Leading zero bytes at the
most-significant end are allowed, and the empty binary reduces to zero.
This operation does not hash or clamp its input. Non-binaries raise badarg.
-spec decaf448_scalar_sub(Left, Right) -> Result when Left :: decaf448_scalar(), Right :: decaf448_scalar(), Result :: decaf448_scalar().
Return (Left - Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
A negative difference wraps modulo l and the result is canonically encoded.
Diffie-Hellman
-spec x448(PublicKey, Scalar) -> Result when PublicKey :: x448_public_key(), Scalar :: x448_scalar(), Result :: x448_shared_secret() | error.
Compute a Diffie-Hellman shared secret.
The public key comes first and the secret scalar second.
Return error when the upstream operation rejects the input, including low-order points.
-spec x448_derive_public_key(Scalar) -> Result when Scalar :: x448_scalar(), Result :: x448_public_key().
Derive an X448 public key from a secret scalar.
-spec x25519(PublicKey, Scalar) -> Result when PublicKey :: x25519_public_key(), Scalar :: x25519_scalar(), Result :: x25519_shared_secret() | error.
Compute a Diffie-Hellman shared secret.
The public key comes first and the secret scalar second.
Return error when the upstream operation rejects the input, including low-order points.
-spec x25519_derive_public_key(Scalar) -> Result when Scalar :: x25519_scalar(), Result :: x25519_public_key().
Derive an X25519 public key from a secret scalar.
Ed448
-spec ed448_convert_private_key_to_x448(SecretKey) -> Result when SecretKey :: ed448_secret_key(), Result :: x448_scalar().
Derive an X448 scalar from a Ed448 secret seed.
-spec ed448_convert_public_key_to_x448(PublicKey) -> Result when PublicKey :: ed448_public_key(), Result :: x448_public_key().
Convert an encoded Ed448 public key to its X448 public-key encoding.
-spec ed448_derive_keypair(SecretKey) -> Result when SecretKey :: ed448_secret_key(), Result :: ed448_keypair().
Derive an immutable Ed448 keypair resource from a secret seed.
-spec ed448_derive_public_key(SecretKey) -> Result when SecretKey :: ed448_secret_key(), Result :: ed448_public_key().
Derive a Ed448 public key from a secret seed.
-spec ed448_keypair_extract_private_key(Keypair) -> Result when Keypair :: ed448_keypair(), Result :: ed448_secret_key().
Extract the secret seed from a keypair resource. Keep the returned bytes private.
-spec ed448_keypair_extract_public_key(Keypair) -> Result when Keypair :: ed448_keypair(), Result :: ed448_public_key().
Extract the public key from a keypair resource.
-spec ed448_keypair_sign(Keypair, Message, Prehashed, Context) -> Result when Keypair :: ed448_keypair(), Message :: binary(), Prehashed :: prehashed(), Context :: binary(), Result :: ed448_signature().
Sign with a Ed448 keypair resource.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448_keypair_sign_prehash(Keypair, Message, Context) -> Result when Keypair :: ed448_keypair(), Message :: binary(), Context :: binary(), Result :: ed448_signature().
Prehash the message internally and sign using Ed448ph.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448_sign(SecretKey, PublicKey, Message, Prehashed, Context) -> Result when SecretKey :: ed448_secret_key(), PublicKey :: ed448_public_key(), Message :: binary(), Prehashed :: prehashed(), Context :: binary(), Result :: ed448_signature().
Sign using a Ed448 secret seed and matching public key.
Mismatched keys raise an error.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448_sign_prehash(SecretKey, PublicKey, Message, Context) -> Result when SecretKey :: ed448_secret_key(), PublicKey :: ed448_public_key(), Message :: binary(), Context :: binary(), Result :: ed448_signature().
Prehash the message internally and sign using Ed448ph.
The secret seed and public key must match.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448_verify(Signature, PublicKey, Message, Prehashed, Context) -> Result when Signature :: ed448_signature(), PublicKey :: ed448_public_key(), Message :: binary(), Prehashed :: prehashed(), Context :: binary(), Result :: boolean().
Verify a Ed448 signature, returning false when verification fails.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448_verify_prehash(Signature, PublicKey, Message, Context) -> Result when Signature :: ed448_signature(), PublicKey :: ed448_public_key(), Message :: binary(), Context :: binary(), Result :: boolean().
Prehash the message internally and verify a Ed448ph signature.
Context is a binary of at most 255 bytes; use <<>> for an empty context.
-spec ed448ph_keypair_sign_init(Keypair) -> Result when Keypair :: ed448_keypair(), Result :: ed448ph_sign_state().
Ed448ph: Start signing with an empty context.
-spec ed448ph_keypair_sign_init(Keypair, Context) -> Result when Keypair :: ed448_keypair(), Context :: binary(), Result :: ed448ph_sign_state().
Ed448ph: Start signing, retaining the keypair and a context of at most 255 bytes in native state.
-spec ed448ph_sign_final(State) -> Result when State :: ed448ph_sign_state(), Result :: ed448_signature().
Ed448ph: Sign the accumulated message without changing the signing state.
-spec ed448ph_sign_init(SigningKey) -> Result when SigningKey :: ed448_signing_key(), Result :: ed448ph_sign_state().
Ed448ph: Start signing with an encoded seed followed by its public key, using an empty context.
-spec ed448ph_sign_init(SigningKey, Context) -> Result when SigningKey :: ed448_signing_key(), Context :: binary(), Result :: ed448ph_sign_state().
Ed448ph: Validate the encoded seed/public key pair and retain a native keypair with a context of at most 255 bytes.
-spec ed448ph_sign_update(State, Input) -> Result when State :: ed448ph_sign_state(), Input :: iodata(), Result :: ed448ph_sign_state().
Ed448ph: Prehash another message chunk. Return a new immutable signing state; large updates yield.
-spec ed448ph_verify_final(State) -> Result when State :: ed448ph_verify_state(), Result :: boolean().
Ed448ph: Verify the accumulated message without changing the verification state.
-spec ed448ph_verify_init(Signature, PublicKey) -> Result when Signature :: ed448_signature(), PublicKey :: ed448_public_key(), Result :: ed448ph_verify_state().
Ed448ph: Start verification with an empty context.
-spec ed448ph_verify_init(Signature, PublicKey, Context) -> Result when Signature :: ed448_signature(), PublicKey :: ed448_public_key(), Context :: binary(), Result :: ed448ph_verify_state().
Ed448ph: Start verification, retaining the signature, public key, and a context of at most 255 bytes in native state.
-spec ed448ph_verify_update(State, Input) -> Result when State :: ed448ph_verify_state(), Input :: iodata(), Result :: ed448ph_verify_state().
Ed448ph: Prehash another message chunk. Return a new immutable verification state; large updates yield.
Ed25519
-spec ed25519_convert_private_key_to_x25519(SecretKey) -> Result when SecretKey :: ed25519_secret_key(), Result :: x25519_scalar().
Derive an X25519 scalar from a Ed25519 secret seed.
-spec ed25519_convert_public_key_to_x25519(PublicKey) -> Result when PublicKey :: ed25519_public_key(), Result :: x25519_public_key().
Convert an encoded Ed25519 public key to its X25519 public-key encoding.
-spec ed25519_derive_keypair(SecretKey) -> Result when SecretKey :: ed25519_secret_key(), Result :: ed25519_keypair().
Derive an immutable Ed25519 keypair resource from a secret seed.
-spec ed25519_derive_public_key(SecretKey) -> Result when SecretKey :: ed25519_secret_key(), Result :: ed25519_public_key().
Derive a Ed25519 public key from a secret seed.
-spec ed25519_keypair_extract_private_key(Keypair) -> Result when Keypair :: ed25519_keypair(), Result :: ed25519_secret_key().
Extract the secret seed from a keypair resource. Keep the returned bytes private.
-spec ed25519_keypair_extract_public_key(Keypair) -> Result when Keypair :: ed25519_keypair(), Result :: ed25519_public_key().
Extract the public key from a keypair resource.
-spec ed25519_keypair_sign(Keypair, Message, Prehashed, Context) -> Result when Keypair :: ed25519_keypair(), Message :: binary(), Prehashed :: prehashed(), Context :: ed25519_context(), Result :: ed25519_signature().
Sign with a Ed25519 keypair resource.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519_keypair_sign_prehash(Keypair, Message, Context) -> Result when Keypair :: ed25519_keypair(), Message :: binary(), Context :: ed25519_context(), Result :: ed25519_signature().
Prehash the message internally and sign using Ed25519ph.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519_sign(SecretKey, PublicKey, Message, Prehashed, Context) -> Result when SecretKey :: ed25519_secret_key(), PublicKey :: ed25519_public_key(), Message :: binary(), Prehashed :: prehashed(), Context :: ed25519_context(), Result :: ed25519_signature().
Sign using a Ed25519 secret seed and matching public key.
Mismatched keys raise an error.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519_sign_prehash(SecretKey, PublicKey, Message, Context) -> Result when SecretKey :: ed25519_secret_key(), PublicKey :: ed25519_public_key(), Message :: binary(), Context :: ed25519_context(), Result :: ed25519_signature().
Prehash the message internally and sign using Ed25519ph.
The secret seed and public key must match.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519_verify(Signature, PublicKey, Message, Prehashed, Context) -> Result when Signature :: ed25519_signature(), PublicKey :: ed25519_public_key(), Message :: binary(), Prehashed :: prehashed(), Context :: ed25519_context(), Result :: boolean().
Verify a Ed25519 signature, returning false when verification fails.
Prehashed is 0 for a message or 1 for an already computed 64-byte prehash.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519_verify_prehash(Signature, PublicKey, Message, Context) -> Result when Signature :: ed25519_signature(), PublicKey :: ed25519_public_key(), Message :: binary(), Context :: ed25519_context(), Result :: boolean().
Prehash the message internally and verify a Ed25519ph signature.
Use no_context for pure Ed25519, or a binary of at most 255 bytes for Ed25519ctx/Ed25519ph.
-spec ed25519ph_keypair_sign_init(Keypair) -> Result when Keypair :: ed25519_keypair(), Result :: ed25519ph_sign_state().
Ed25519ph: Start signing with an empty context.
-spec ed25519ph_keypair_sign_init(Keypair, Context) -> Result when Keypair :: ed25519_keypair(), Context :: binary(), Result :: ed25519ph_sign_state().
Ed25519ph: Start signing, retaining the keypair and a context of at most 255 bytes in native state.
-spec ed25519ph_sign_final(State) -> Result when State :: ed25519ph_sign_state(), Result :: ed25519_signature().
Ed25519ph: Sign the accumulated message without changing the signing state.
-spec ed25519ph_sign_init(SigningKey) -> Result when SigningKey :: ed25519_signing_key(), Result :: ed25519ph_sign_state().
Ed25519ph: Start signing with an encoded seed followed by its public key, using an empty context.
-spec ed25519ph_sign_init(SigningKey, Context) -> Result when SigningKey :: ed25519_signing_key(), Context :: binary(), Result :: ed25519ph_sign_state().
Ed25519ph: Validate the encoded seed/public key pair and retain a native keypair with a context of at most 255 bytes.
-spec ed25519ph_sign_update(State, Input) -> Result when State :: ed25519ph_sign_state(), Input :: iodata(), Result :: ed25519ph_sign_state().
Ed25519ph: Prehash another message chunk. Return a new immutable signing state; large updates yield.
-spec ed25519ph_verify_final(State) -> Result when State :: ed25519ph_verify_state(), Result :: boolean().
Ed25519ph: Verify the accumulated message without changing the verification state.
-spec ed25519ph_verify_init(Signature, PublicKey) -> Result when Signature :: ed25519_signature(), PublicKey :: ed25519_public_key(), Result :: ed25519ph_verify_state().
Ed25519ph: Start verification with an empty context.
-spec ed25519ph_verify_init(Signature, PublicKey, Context) -> Result when Signature :: ed25519_signature(), PublicKey :: ed25519_public_key(), Context :: binary(), Result :: ed25519ph_verify_state().
Ed25519ph: Start verification, retaining the signature, public key, and a context of at most 255 bytes in native state.
-spec ed25519ph_verify_update(State, Input) -> Result when State :: ed25519ph_verify_state(), Input :: iodata(), Result :: ed25519ph_verify_state().
Ed25519ph: Prehash another message chunk. Return a new immutable verification state; large updates yield.
Hash API
-spec cshake128(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute cshake128 hash.
-spec cshake128(Input, OutputLength, FunctionName, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), FunctionName :: function_name(), CustomizationString :: customization_string(), Output :: binary().
Compute cshake128 hash.
-spec cshake128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize cshake128 hash.
-spec cshake128_hash_init(OutputLength, FunctionName, CustomizationString) -> HashState when OutputLength :: output_length(), FunctionName :: function_name(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize cshake128 hash.
-spec cshake256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute cshake256 hash.
-spec cshake256(Input, OutputLength, FunctionName, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), FunctionName :: function_name(), CustomizationString :: customization_string(), Output :: binary().
Compute cshake256 hash.
-spec cshake256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize cshake256 hash.
-spec cshake256_hash_init(OutputLength, FunctionName, CustomizationString) -> HashState when OutputLength :: output_length(), FunctionName :: function_name(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize cshake256 hash.
-spec hash(Parameters, Input) -> Output when Parameters :: hash_parameters(), Input :: input() | tuple_input(), Output :: binary().
Compute a hash from initialization parameters and input.
-spec hash_final(HashState) -> Output when HashState :: hash_state(), Output :: binary().
Return the output length selected during initialization.
-spec hash_init(Parameters) -> Result when Parameters :: hash_parameters(), Result :: hash_state().
Initialize a native state from an algorithm atom or parameter tuple.
-spec hash_update(HashState, Input) -> NewHashState when HashState :: hash_state(), Input :: input(), NewHashState :: hash_state().
Absorb input and return a new hash state.
-spec hopmac128(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute hopmac128 hash.
-spec hopmac128(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute hopmac128 hash.
-spec hopmac128_hash_init(OutputLength, Key) -> HashState when OutputLength :: output_length(), Key :: key(), HashState :: hash_state().
Initialize hopmac128 hash.
-spec hopmac128_hash_init(OutputLength, Key, CustomizationString) -> HashState when OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize hopmac128 hash.
-spec hopmac256(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute hopmac256 hash.
-spec hopmac256(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute hopmac256 hash.
-spec hopmac256_hash_init(OutputLength, Key) -> HashState when OutputLength :: output_length(), Key :: key(), HashState :: hash_state().
Initialize hopmac256 hash.
-spec hopmac256_hash_init(OutputLength, Key, CustomizationString) -> HashState when OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize hopmac256 hash.
Compute keccak_224 hash.
-spec keccak_224(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccak_224 hash.
-spec keccak_224_hash_init() -> HashState when HashState :: hash_state().
Initialize keccak_224 hash.
-spec keccak_224_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccak_224 hash.
Compute keccak_256 hash.
-spec keccak_256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccak_256 hash.
-spec keccak_256_hash_init() -> HashState when HashState :: hash_state().
Initialize keccak_256 hash.
-spec keccak_256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccak_256 hash.
Compute keccak_384 hash.
-spec keccak_384(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccak_384 hash.
-spec keccak_384_hash_init() -> HashState when HashState :: hash_state().
Initialize keccak_384 hash.
-spec keccak_384_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccak_384 hash.
Compute keccak_512 hash.
-spec keccak_512(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccak_512 hash.
-spec keccak_512_hash_init() -> HashState when HashState :: hash_state().
Initialize keccak_512 hash.
-spec keccak_512_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccak_512 hash.
-spec keccakxof_128(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccakxof_128 hash.
-spec keccakxof_128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccakxof_128 hash.
-spec keccakxof_256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute keccakxof_256 hash.
-spec keccakxof_256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize keccakxof_256 hash.
-spec kmac128(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute kmac128 hash.
-spec kmac128(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute kmac128 hash.
-spec kmac128_hash_init(OutputLength, Key) -> HashState when OutputLength :: output_length(), Key :: key(), HashState :: hash_state().
Initialize kmac128 hash.
-spec kmac128_hash_init(OutputLength, Key, CustomizationString) -> HashState when OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize kmac128 hash.
-spec kmac256(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute kmac256 hash.
-spec kmac256(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute kmac256 hash.
-spec kmac256_hash_init(OutputLength, Key) -> HashState when OutputLength :: output_length(), Key :: key(), HashState :: hash_state().
Initialize kmac256 hash.
-spec kmac256_hash_init(OutputLength, Key, CustomizationString) -> HashState when OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize kmac256 hash.
Compute kt128 hash.
-spec kt128(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute kt128 hash.
-spec kt128(Input, OutputLength, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute kt128 hash.
-spec kt128_hash_init() -> HashState when HashState :: hash_state().
Initialize kt128 hash.
-spec kt128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize kt128 hash.
-spec kt128_hash_init(OutputLength, CustomizationString) -> HashState when OutputLength :: output_length(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize kt128 hash.
Compute kt256 hash.
-spec kt256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute kt256 hash.
-spec kt256(Input, OutputLength, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute kt256 hash.
-spec kt256_hash_init() -> HashState when HashState :: hash_state().
Initialize kt256 hash.
-spec kt256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize kt256 hash.
-spec kt256_hash_init(OutputLength, CustomizationString) -> HashState when OutputLength :: output_length(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize kt256 hash.
-spec parallel_hash(Parameters, Input) -> Output when Parameters :: parallel_hash_parameters(), Input :: input(), Output :: {done, reference(), parallel_hash_state()} | {finalize, reference(), parallel_hash_state(), output_length()} | {await, reference(), parallel_hash_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallel_hash_continue(Operation) -> Result when Operation :: parallel_hash_operation(), Result :: {done, reference(), parallel_hash_state()} | {finalize, reference(), parallel_hash_state(), output_length()} | {await, reference(), parallel_hash_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallel_hash_final(State) -> Output when State :: parallel_hash_state(), Output :: binary().
Return the configured hash output without changing the input state.
State = libdecaf:parallel_hash_update(libdecaf:parallel_hash_init(kt128), <<"abc">>),
Digest = libdecaf:parallel_hash_final(State),
Digest = libdecaf:hash(kt128, <<"abc">>).-spec parallel_hash_init(Parameters) -> State when Parameters :: parallel_hash_parameters(), State :: parallel_hash_state().
Initialize a parallel Hash state.
Accepts the same parameter forms as hash_init/1 for KT128, KT256,
HopMAC128, HopMAC256, and ParallelHash128, ParallelHash256.
Other algorithms raise badarg. KT and HopMAC use 8192-byte leaves;
ParallelHash uses its configured block size. States remain immutable.
S0 = libdecaf:parallel_hash_init({parallelhash128, 32, 8192}),
S1 = libdecaf:parallel_hash_update(S0, <<"invoice-42">>),
Output = libdecaf:parallel_hash_final(S1).-spec parallel_hash_update(State, Input) -> NewState when State :: parallel_hash_state(), Input :: input(), NewState :: {done, reference(), parallel_hash_state()} | {finalize, reference(), parallel_hash_state(), output_length()} | {await, reference(), parallel_hash_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallelhash128(Input, OutputLength, BlockSize) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), Output :: binary().
Compute parallelhash128 hash.
-spec parallelhash128(Input, OutputLength, BlockSize, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), Output :: binary().
Compute parallelhash128 hash.
-spec parallelhash128_hash_init(OutputLength, BlockSize) -> HashState when OutputLength :: output_length(), BlockSize :: block_size(), HashState :: hash_state().
Initialize parallelhash128 hash.
-spec parallelhash128_hash_init(OutputLength, BlockSize, CustomizationString) -> HashState when OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize parallelhash128 hash.
-spec parallelhash256(Input, OutputLength, BlockSize) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), Output :: binary().
Compute parallelhash256 hash.
-spec parallelhash256(Input, OutputLength, BlockSize, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), Output :: binary().
Compute parallelhash256 hash.
-spec parallelhash256_hash_init(OutputLength, BlockSize) -> HashState when OutputLength :: output_length(), BlockSize :: block_size(), HashState :: hash_state().
Initialize parallelhash256 hash.
-spec parallelhash256_hash_init(OutputLength, BlockSize, CustomizationString) -> HashState when OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize parallelhash256 hash.
Compute sha2_512 hash.
-spec sha2_512(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute sha2_512 hash.
-spec sha2_512_hash_init() -> HashState when HashState :: hash_state().
Initialize sha2_512 hash.
-spec sha2_512_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize sha2_512 hash.
Compute sha3_224 hash.
-spec sha3_224(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute sha3_224 hash.
-spec sha3_224_hash_init() -> HashState when HashState :: hash_state().
Initialize sha3_224 hash.
-spec sha3_224_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize sha3_224 hash.
Compute sha3_256 hash.
-spec sha3_256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute sha3_256 hash.
-spec sha3_256_hash_init() -> HashState when HashState :: hash_state().
Initialize sha3_256 hash.
-spec sha3_256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize sha3_256 hash.
Compute sha3_384 hash.
-spec sha3_384(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute sha3_384 hash.
-spec sha3_384_hash_init() -> HashState when HashState :: hash_state().
Initialize sha3_384 hash.
-spec sha3_384_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize sha3_384 hash.
Compute sha3_512 hash.
-spec sha3_512(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute sha3_512 hash.
-spec sha3_512_hash_init() -> HashState when HashState :: hash_state().
Initialize sha3_512 hash.
-spec sha3_512_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize sha3_512 hash.
-spec shake128(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute shake128 hash.
-spec shake128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize shake128 hash.
-spec shake256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute shake256 hash.
-spec shake256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize shake256 hash.
-spec tuplehash128(Input, OutputLength) -> Output when Input :: tuple_input(), OutputLength :: output_length(), Output :: binary().
Compute tuplehash128 hash.
-spec tuplehash128(Input, OutputLength, CustomizationString) -> Output when Input :: tuple_input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute tuplehash128 hash.
-spec tuplehash128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize tuplehash128 hash.
-spec tuplehash128_hash_init(OutputLength, CustomizationString) -> HashState when OutputLength :: output_length(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize tuplehash128 hash.
-spec tuplehash256(Input, OutputLength) -> Output when Input :: tuple_input(), OutputLength :: output_length(), Output :: binary().
Compute tuplehash256 hash.
-spec tuplehash256(Input, OutputLength, CustomizationString) -> Output when Input :: tuple_input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute tuplehash256 hash.
-spec tuplehash256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize tuplehash256 hash.
-spec tuplehash256_hash_init(OutputLength, CustomizationString) -> HashState when OutputLength :: output_length(), CustomizationString :: customization_string(), HashState :: hash_state().
Initialize tuplehash256 hash.
Compute turboshake128 hash.
-spec turboshake128(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute turboshake128 hash.
-spec turboshake128(Input, OutputLength, DomainSeparation) -> Output when Input :: input(), OutputLength :: output_length(), DomainSeparation :: domain_separation(), Output :: binary().
Compute turboshake128 hash.
-spec turboshake128_hash_init() -> HashState when HashState :: hash_state().
Initialize turboshake128 hash.
-spec turboshake128_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize turboshake128 hash.
-spec turboshake128_hash_init(OutputLength, DomainSeparation) -> HashState when OutputLength :: output_length(), DomainSeparation :: domain_separation(), HashState :: hash_state().
Initialize turboshake128 hash.
Compute turboshake256 hash.
-spec turboshake256(Input, OutputLength) -> Output when Input :: input(), OutputLength :: output_length(), Output :: binary().
Compute turboshake256 hash.
-spec turboshake256(Input, OutputLength, DomainSeparation) -> Output when Input :: input(), OutputLength :: output_length(), DomainSeparation :: domain_separation(), Output :: binary().
Compute turboshake256 hash.
-spec turboshake256_hash_init() -> HashState when HashState :: hash_state().
Initialize turboshake256 hash.
-spec turboshake256_hash_init(OutputLength) -> HashState when OutputLength :: output_length(), HashState :: hash_state().
Initialize turboshake256 hash.
-spec turboshake256_hash_init(OutputLength, DomainSeparation) -> HashState when OutputLength :: output_length(), DomainSeparation :: domain_separation(), HashState :: hash_state().
Initialize turboshake256 hash.
Keccak API
-spec keccak_info() -> KeccakInfo when KeccakInfo :: keccak_info().
Return the runtime-selected native Keccak backend and parallel permutation width. The backend name is a diagnostic binary; parallelism is 1, 2, 4 or 8. Selection reflects CPU and OS support, including portable fallback.
Parallel API
-spec parallel_absorb(RouterNumber, MaxRounds) -> Result when RouterNumber :: pos_integer(), MaxRounds :: non_neg_integer(), Result :: ok.
Process up to MaxRounds queued leaves on a dirty CPU scheduler, preferring RouterNumber. Idle workers steal from other queues. Zero drains until the pool has no queued leaves, and can run indefinitely if producers keep adding leaves.
-spec parallel_router_info() -> RouterInfo when RouterInfo :: parallel_router_info().
Return the native parallel router count, limit, and registered names.
Names are numbered from one in scheduler order. The count uses the total
normal scheduler count at NIF load time, capped by limit; it does not
change when schedulers are taken offline. Routers need not be running.
Ristretto255
-spec ristretto255_base() -> Result when Result :: ristretto255_point().
Return the canonical Ristretto255 generator from RFC 9496.
Use this point for interoperable generator multiplication. The base-scalar multiplication operation uses its built-in precomputed table.
-spec ristretto255_base_scalarmul(Scalar) -> Result when Scalar :: ristretto255_scalar(), Result :: ristretto255_point().
Multiply the canonical Ristretto255 generator by Scalar.
Uses the native library's built-in precomputed generator table.
The scalar must already be canonical; otherwise raises badarg.
-spec ristretto255_identity() -> Result when Result :: ristretto255_point().
Return the Ristretto255 identity element, encoded as 32 zero bytes.
Adding this point leaves the other point unchanged. Multiplication by zero and multiplication of the identity by any scalar both return the identity.
-spec ristretto255_point_add(Left, Right) -> Result when Left :: ristretto255_point(), Right :: ristretto255_point(), Result :: ristretto255_point().
Return the canonical encoding of Left + Right.
Both operands must be valid point encodings; otherwise raises badarg.
Adding a point to its negation returns the identity.
-spec ristretto255_point_double(Point) -> Result when Point :: ristretto255_point(), Result :: ristretto255_point().
Return Point + Point in canonical encoding.
This is equivalent to multiplication by the scalar two.
An invalid point encoding raises badarg.
-spec ristretto255_point_double_scalarmul(Point1, Scalar1, Point2, Scalar2) -> Result when Point1 :: ristretto255_point(), Scalar1 :: ristretto255_scalar(), Point2 :: ristretto255_point(), Scalar2 :: ristretto255_scalar(), Result :: ristretto255_point().
Return Scalar1 * Point1 + Scalar2 * Point2 in canonical encoding.
Computes the same result as two scalar multiplications followed by addition.
Both points must be valid and both scalars canonical; otherwise raises badarg.
-spec ristretto255_point_eq(Left, Right) -> Result when Left :: ristretto255_point(), Right :: ristretto255_point(), Result :: boolean().
Return whether two encoded points represent the same group element.
Both operands are decoded and validated. Invalid encodings raise badarg;
false means that two valid points differ.
-spec ristretto255_point_from_hash(UniformBytes) -> Result when UniformBytes :: binary(), Result :: ristretto255_point().
Derive a Ristretto255 element from exactly 64 bytes using RFC 9496.
The two halves are mapped separately and their points are added. Uniform
input gives an approximately uniform group element. This operation does
not hash a message: use a protocol-defined, domain-separated hash or XOF
to prepare the input. Wrong-sized binaries and non-binaries raise badarg.
-spec ristretto255_point_from_hash_nonuniform(Bytes) -> Result when Bytes :: binary(), Result :: ristretto255_point().
Apply the upstream single map to exactly 32 bytes.
This is one half of the two-map RFC 9496 derivation. Its output has a
different distribution, so use it only when a protocol requires the single
map. Wrong-sized binaries and non-binaries raise badarg.
Return whether Point is a valid canonical 32-byte Ristretto255 encoding.
The identity is valid. Wrong-sized binaries, noncanonical encodings, and
non-binary terms return false instead of raising badarg.
-spec ristretto255_point_negate(Point) -> Result when Point :: ristretto255_point(), Result :: ristretto255_point().
Return the additive inverse of Point in canonical encoding.
The input point and its negation add to the identity.
An invalid point encoding raises badarg.
-spec ristretto255_point_scalarmul(Point, Scalar) -> Result when Point :: ristretto255_point(), Scalar :: ristretto255_scalar(), Result :: ristretto255_point().
Return Scalar * Point in canonical encoding.
The point must be valid and the scalar must already be canonical.
Invalid operands raise badarg; zero and the identity are accepted.
-spec ristretto255_point_sub(Left, Right) -> Result when Left :: ristretto255_point(), Right :: ristretto255_point(), Result :: ristretto255_point().
Return the canonical encoding of Left - Right.
Both operands must be valid point encodings; otherwise raises badarg.
Subtracting a point from itself returns the identity.
-spec ristretto255_precompute(Point) -> Result when Point :: ristretto255_point(), Result :: ristretto255_precomputed().
Build an immutable native multiplication table for Point.
Reuse the table when multiplying the same point by many scalars.
The resource can be shared between processes and is released automatically
when no references remain. It is specific to Ristretto255; invalid points raise badarg.
-spec ristretto255_precomputed_scalarmul(Precomputed, Scalar) -> Result when Precomputed :: ristretto255_precomputed(), Scalar :: ristretto255_scalar(), Result :: ristretto255_point().
Multiply the point stored in Precomputed by Scalar.
The result matches ordinary point-scalar multiplication; the table is unchanged.
A resource from another group, a non-table term, or a noncanonical Ristretto255
scalar raises badarg.
-spec ristretto255_scalar_add(Left, Right) -> Result when Left :: ristretto255_scalar(), Right :: ristretto255_scalar(), Result :: ristretto255_scalar().
Return (Left + Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
The result is canonically encoded.
-spec ristretto255_scalar_halve(Scalar) -> Result when Scalar :: ristretto255_scalar(), Result :: ristretto255_scalar().
Divide Scalar by two modulo the group order.
This is multiplication by the modular inverse of two, rather than integer
division. Adding the result to itself recovers the input, including for odd
scalars. A noncanonical scalar raises badarg.
-spec ristretto255_scalar_invert(Scalar) -> Result when Scalar :: ristretto255_scalar(), Result :: ristretto255_scalar() | error.
Return the multiplicative inverse of Scalar modulo the group order.
Multiplying a nonzero scalar by its inverse gives the canonical scalar one.
Zero has no inverse and returns error. Noncanonical scalars raise badarg.
-spec ristretto255_scalar_is_canonical(Scalar) -> Result when Scalar :: term(), Result :: boolean().
Return whether Scalar is a canonical 32-byte little-endian scalar.
Its integer value must be smaller than the group order; zero is accepted.
Wrong-sized binaries, out-of-range values, and non-binaries return false.
-spec ristretto255_scalar_mul(Left, Right) -> Result when Left :: ristretto255_scalar(), Right :: ristretto255_scalar(), Result :: ristretto255_scalar().
Return (Left * Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
The result is canonically encoded.
-spec ristretto255_scalar_negate(Scalar) -> Result when Scalar :: ristretto255_scalar(), Result :: ristretto255_scalar().
Return -Scalar mod l, where l is the group order.
The result adds to the input to give zero; zero is its own negation.
A noncanonical scalar raises badarg.
-spec ristretto255_scalar_reduce(Bytes) -> Result when Bytes :: binary(), Result :: ristretto255_scalar().
Reduce an arbitrary-length unsigned little-endian integer modulo the group order.
Returns a canonical 32-byte scalar. Leading zero bytes at the
most-significant end are allowed, and the empty binary reduces to zero.
This operation does not hash or clamp its input. Non-binaries raise badarg.
-spec ristretto255_scalar_sub(Left, Right) -> Result when Left :: ristretto255_scalar(), Right :: ristretto255_scalar(), Result :: ristretto255_scalar().
Return (Left - Right) mod l, where l is the group order.
Both operands must already be canonical scalars; otherwise raises badarg.
A negative difference wraps modulo l and the result is canonically encoded.
Sponge PRNG
-spec spongerng_csprng_init_from_buffer(Seed, Deterministic) -> Result when Seed :: iodata(), Deterministic :: boolean(), Result :: spongerng_state().
Initialize a sponge PRNG from seed bytes.
Deterministic selects the upstream PRNG's deterministic mode.
-spec spongerng_csprng_init_from_dev_urandom() -> Result when Result :: spongerng_state().
Initialize a sponge PRNG using /dev/urandom.
Raise an exception if the entropy source cannot be read.
-spec spongerng_csprng_init_from_file(Filename, InputLen, Deterministic) -> Result when Filename :: iodata(), InputLen :: non_neg_integer(), Deterministic :: boolean(), Result :: spongerng_state().
Initialize a sponge PRNG by reading InputLen bytes from a file.
Filename contains nonempty native filename bytes; file errors raise an exception.
-spec spongerng_csprng_next(State, OutputLen) -> Result when State :: spongerng_state(), OutputLen :: non_neg_integer(), Result :: {spongerng_state(), binary()}.
Generate bytes and return the new PRNG state together with those bytes. Continue with the returned state to advance the stream.
-spec spongerng_csprng_stir(State, Input) -> Result when State :: spongerng_state(), Input :: iodata(), Result :: spongerng_state().
Mix additional seed bytes into a PRNG state and return a new state.
-spec strong_rand_bytes(Length) -> Output when Length :: non_neg_integer(), Output :: binary() | need_seed.
Generate bytes using an automatically OS-seeded, thread-local SpongeRNG.
Return need_seed if native entropy is unavailable; prefer libdecaf:strong_rand_bytes/1 for automatic
fallback.
-spec strong_rand_bytes(Length, Seed) -> Output when Length :: non_neg_integer(), Seed :: binary(), Output :: binary().
Supply exactly 64 cryptographically random seed bytes and generate output from the calling thread's SpongeRNG.
Used by libdecaf:strong_rand_bytes/1 when native OS entropy is unavailable. Existing state is stirred, not
reset.
TUAK API
-spec tuak_f1(Key, TOPc, RAND, SQN, AMF) -> MAC_A when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), SQN :: tuak_sqn(), AMF :: tuak_amf(), MAC_A :: tuak_mac().
TUAK f1: Compute the network authentication code MAC-A over RAND, SQN, and AMF.
-spec tuak_f1(Key, TOPc, RAND, SQN, AMF, Options) -> MAC_A when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), SQN :: tuak_sqn(), AMF :: tuak_amf(), Options :: tuak_mac_options(), MAC_A :: tuak_mac().
TUAK f1: Compute the network authentication code MAC-A over RAND, SQN, and AMF.
-spec tuak_f1_star(Key, TOPc, RAND, SQN, AMF) -> MAC_S when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), SQN :: tuak_sqn(), AMF :: tuak_amf(), MAC_S :: tuak_mac().
TUAK f1_star: Compute the resynchronization authentication code MAC-S.
-spec tuak_f1_star(Key, TOPc, RAND, SQN, AMF, Options) -> MAC_S when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), SQN :: tuak_sqn(), AMF :: tuak_amf(), Options :: tuak_mac_options(), MAC_S :: tuak_mac().
TUAK f1_star: Compute the resynchronization authentication code MAC-S.
-spec tuak_f2(Key, TOPc, RAND) -> RES when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), RES :: tuak_res().
TUAK f2: Compute the authentication response RES for RAND.
-spec tuak_f2(Key, TOPc, RAND, Options) -> RES when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_derive_options(), RES :: tuak_res().
TUAK f2: Compute the authentication response RES for RAND.
-spec tuak_f3(Key, TOPc, RAND) -> CK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), CK :: tuak_ck().
TUAK f3: Compute the confidentiality key CK for RAND.
-spec tuak_f3(Key, TOPc, RAND, Options) -> CK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_derive_options(), CK :: tuak_ck().
TUAK f3: Compute the confidentiality key CK for RAND.
-spec tuak_f4(Key, TOPc, RAND) -> IK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), IK :: tuak_ik().
TUAK f4: Compute the integrity key IK for RAND.
-spec tuak_f4(Key, TOPc, RAND, Options) -> IK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_derive_options(), IK :: tuak_ik().
TUAK f4: Compute the integrity key IK for RAND.
-spec tuak_f5(Key, TOPc, RAND) -> AK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), AK :: tuak_ak().
TUAK f5: Compute the six-byte anonymity key AK for RAND.
-spec tuak_f5(Key, TOPc, RAND, Options) -> AK when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_derive_options(), AK :: tuak_ak().
TUAK f5: Compute the six-byte anonymity key AK for RAND.
-spec tuak_f5_star(Key, TOPc, RAND) -> AK_Star when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), AK_Star :: tuak_ak().
TUAK f5_star: Compute the six-byte resynchronization anonymity key AK* for RAND.
-spec tuak_f5_star(Key, TOPc, RAND, Options) -> AK_Star when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_options(), AK_Star :: tuak_ak().
TUAK f5_star: Compute the six-byte resynchronization anonymity key AK* for RAND.
-spec tuak_f2345(Key, TOPc, RAND) -> Outputs when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Outputs :: {tuak_res(), tuak_ck(), tuak_ik(), tuak_ak()}.
TUAK f2345: Compute the response RES, confidentiality key CK, integrity key IK, and anonymity key AK
-spec tuak_f2345(Key, TOPc, RAND, Options) -> Outputs when Key :: tuak_key(), TOPc :: tuak_topc(), RAND :: tuak_rand(), Options :: tuak_derive_options(), Outputs :: {tuak_res(), tuak_ck(), tuak_ik(), tuak_ak()}.
TUAK f2345: Compute the response RES, confidentiality key CK, integrity key IK, and anonymity key AK
TUAK topc: Derive the subscriber-specific TOPc from the subscriber key and the operator's TOP.
-spec tuak_topc(Key, TOP, Options) -> TOPc when Key :: tuak_key(), TOP :: tuak_top(), Options :: tuak_options(), TOPc :: tuak_topc().
TUAK topc: Derive the subscriber-specific TOPc from the subscriber key and the operator's TOP.
XOF API
-spec cshake128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize cshake128 xof.
-spec cshake128_xof_init(FunctionName, CustomizationString) -> XOFState when FunctionName :: function_name(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize cshake128 xof.
-spec cshake256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize cshake256 xof.
-spec cshake256_xof_init(FunctionName, CustomizationString) -> XOFState when FunctionName :: function_name(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize cshake256 xof.
Initialize hopmac128 xof.
-spec hopmac128_xof_init(Key, CustomizationString) -> XOFState when Key :: key(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize hopmac128 xof.
Initialize hopmac256 xof.
-spec hopmac256_xof_init(Key, CustomizationString) -> XOFState when Key :: key(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize hopmac256 xof.
-spec keccakxof_128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize keccakxof_128 xof.
-spec keccakxof_256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize keccakxof_256 xof.
-spec kmacxof128(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute kmacxof128 xof.
-spec kmacxof128(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute kmacxof128 xof.
Initialize kmacxof128 xof.
-spec kmacxof128_xof_init(Key, CustomizationString) -> XOFState when Key :: key(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize kmacxof128 xof.
-spec kmacxof256(Input, OutputLength, Key) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), Output :: binary().
Compute kmacxof256 xof.
-spec kmacxof256(Input, OutputLength, Key, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), Key :: key(), CustomizationString :: customization_string(), Output :: binary().
Compute kmacxof256 xof.
Initialize kmacxof256 xof.
-spec kmacxof256_xof_init(Key, CustomizationString) -> XOFState when Key :: key(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize kmacxof256 xof.
-spec kt128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize kt128 xof.
-spec kt128_xof_init(CustomizationString) -> XOFState when CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize kt128 xof.
-spec kt256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize kt256 xof.
-spec kt256_xof_init(CustomizationString) -> XOFState when CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize kt256 xof.
-spec parallel_xof(Parameters, Input, OutputLength) -> Output when Parameters :: parallel_xof_parameters(), Input :: input(), OutputLength :: output_length(), Output :: {done, reference(), parallel_xof_state()} | {finalize, reference(), parallel_xof_state(), output_length()} | {await, reference(), parallel_xof_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallel_xof_absorb(State, Input) -> NewState when State :: parallel_xof_state(), Input :: input(), NewState :: {done, reference(), parallel_xof_state()} | {finalize, reference(), parallel_xof_state(), output_length()} | {await, reference(), parallel_xof_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallel_xof_continue(Operation) -> Result when Operation :: parallel_xof_operation(), Result :: {done, reference(), parallel_xof_state()} | {finalize, reference(), parallel_xof_state(), output_length()} | {await, reference(), parallel_xof_operation()}.
Return {done, Reference, State}, {finalize, Reference, State, Length}, or
{await, Reference, Operation}. On {libdecaf_parallel, Reference}, call the
matching continuation. finalize requests hash finalization or XOF output.
Polling also recovers unavailable routers. See libdecaf for synchronous wrappers.
-spec parallel_xof_init(Parameters) -> State when Parameters :: parallel_xof_parameters(), State :: parallel_xof_state().
Initialize a parallel XOF state.
Accepts the same parameter forms as xof_init/1 for KT128, KT256,
HopMAC128, HopMAC256, and ParallelHashXOF128, ParallelHashXOF256.
Other algorithms raise badarg. KT and HopMAC use 8192-byte leaves;
ParallelHash uses its configured block size. States remain immutable.
S0 = libdecaf:parallel_xof_init({parallelhashxof128, 8192}),
S1 = libdecaf:parallel_xof_absorb(S0, <<"invoice-42">>),
{_S2, Output} = libdecaf:parallel_xof_squeeze(S1, 32).-spec parallel_xof_squeeze(State, OutputLength) -> Result when State :: parallel_xof_state(), OutputLength :: output_length(), Result :: {parallel_xof_state(), binary()}.
Read output and return {NextState, Output}.
The returned state can keep squeezing, but cannot absorb further input. The input state remains reusable. Output lengths are in bytes.
S0 = libdecaf:parallel_xof_absorb(libdecaf:parallel_xof_init(kt128), <<"abc">>),
{S1, First} = libdecaf:parallel_xof_squeeze(S0, 32),
{_S2, Next} = libdecaf:parallel_xof_squeeze(S1, 32),
Combined = <<First/binary, Next/binary>>,
Combined = libdecaf:xof(kt128, <<"abc">>, 64).-spec parallelhashxof128(Input, OutputLength, BlockSize) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), Output :: binary().
Compute parallelhashxof128 xof.
-spec parallelhashxof128(Input, OutputLength, BlockSize, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), Output :: binary().
Compute parallelhashxof128 xof.
-spec parallelhashxof128_xof_init(BlockSize) -> XOFState when BlockSize :: block_size(), XOFState :: xof_state().
Initialize parallelhashxof128 xof.
-spec parallelhashxof128_xof_init(BlockSize, CustomizationString) -> XOFState when BlockSize :: block_size(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize parallelhashxof128 xof.
-spec parallelhashxof256(Input, OutputLength, BlockSize) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), Output :: binary().
Compute parallelhashxof256 xof.
-spec parallelhashxof256(Input, OutputLength, BlockSize, CustomizationString) -> Output when Input :: input(), OutputLength :: output_length(), BlockSize :: block_size(), CustomizationString :: customization_string(), Output :: binary().
Compute parallelhashxof256 xof.
-spec parallelhashxof256_xof_init(BlockSize) -> XOFState when BlockSize :: block_size(), XOFState :: xof_state().
Initialize parallelhashxof256 xof.
-spec parallelhashxof256_xof_init(BlockSize, CustomizationString) -> XOFState when BlockSize :: block_size(), CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize parallelhashxof256 xof.
-spec shake128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize shake128 xof.
-spec shake256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize shake256 xof.
-spec tuplehashxof128(Input, OutputLength) -> Output when Input :: tuple_input(), OutputLength :: output_length(), Output :: binary().
Compute tuplehashxof128 xof.
-spec tuplehashxof128(Input, OutputLength, CustomizationString) -> Output when Input :: tuple_input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute tuplehashxof128 xof.
-spec tuplehashxof128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize tuplehashxof128 xof.
-spec tuplehashxof128_xof_init(CustomizationString) -> XOFState when CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize tuplehashxof128 xof.
-spec tuplehashxof256(Input, OutputLength) -> Output when Input :: tuple_input(), OutputLength :: output_length(), Output :: binary().
Compute tuplehashxof256 xof.
-spec tuplehashxof256(Input, OutputLength, CustomizationString) -> Output when Input :: tuple_input(), OutputLength :: output_length(), CustomizationString :: customization_string(), Output :: binary().
Compute tuplehashxof256 xof.
-spec tuplehashxof256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize tuplehashxof256 xof.
-spec tuplehashxof256_xof_init(CustomizationString) -> XOFState when CustomizationString :: customization_string(), XOFState :: xof_state().
Initialize tuplehashxof256 xof.
-spec turboshake128_xof_init() -> XOFState when XOFState :: xof_state().
Initialize turboshake128 xof.
-spec turboshake128_xof_init(DomainSeparation) -> XOFState when DomainSeparation :: domain_separation(), XOFState :: xof_state().
Initialize turboshake128 xof.
-spec turboshake256_xof_init() -> XOFState when XOFState :: xof_state().
Initialize turboshake256 xof.
-spec turboshake256_xof_init(DomainSeparation) -> XOFState when DomainSeparation :: domain_separation(), XOFState :: xof_state().
Initialize turboshake256 xof.
-spec xof(Parameters, Input, OutputLength) -> Output when Parameters :: xof_parameters(), Input :: input() | tuple_input(), OutputLength :: output_length(), Output :: binary().
Compute OutputLength XOF bytes using initialization parameters.
-spec xof_absorb(XOFState, Input) -> NewXOFState when XOFState :: xof_state(), Input :: input(), NewXOFState :: xof_state().
Absorb input and return a new absorbing state.
-spec xof_init(Parameters) -> Result when Parameters :: xof_parameters(), Result :: xof_state().
Initialize a native state from an algorithm atom or parameter tuple.
-spec xof_squeeze(XOFState, Length) -> Result when XOFState :: xof_state(), Length :: output_length(), Result :: {xof_state(), binary()}.
Return the advancing state and the next Length output bytes.