xof: Implemented SHAKE128 and SHAKE256 Extended Output Functions
authorAndreas Steffen <andreas.steffen@strongswan.org>
Thu, 28 Jul 2016 12:46:56 +0000 (14:46 +0200)
committerAndreas Steffen <andreas.steffen@strongswan.org>
Fri, 29 Jul 2016 10:36:14 +0000 (12:36 +0200)
src/libstrongswan/plugins/sha3/Makefile.am
src/libstrongswan/plugins/sha3/sha3_hasher.c
src/libstrongswan/plugins/sha3/sha3_keccak.c [new file with mode: 0644]
src/libstrongswan/plugins/sha3/sha3_keccak.h [new file with mode: 0644]
src/libstrongswan/plugins/sha3/sha3_plugin.c
src/libstrongswan/plugins/sha3/sha3_shake.c [new file with mode: 0644]
src/libstrongswan/plugins/sha3/sha3_shake.h [new file with mode: 0644]
src/libstrongswan/plugins/test_vectors/Makefile.am
src/libstrongswan/plugins/test_vectors/test_vectors.h
src/libstrongswan/plugins/test_vectors/test_vectors/sha3.c
src/libstrongswan/plugins/test_vectors/test_vectors/sha3_shake.c [new file with mode: 0644]

index 7ccf58c..a776b1d 100644 (file)
@@ -11,6 +11,9 @@ plugin_LTLIBRARIES = libstrongswan-sha3.la
 endif
 
 libstrongswan_sha3_la_SOURCES = \
-       sha3_plugin.h sha3_plugin.c sha3_hasher.c sha3_hasher.h
+       sha3_plugin.h sha3_plugin.c \
+       sha3_hasher.c sha3_hasher.h \
+       sha3_shake.h sha3_shake.c \
+       sha3_keccak.h sha3_keccak.c
 
 libstrongswan_sha3_la_LDFLAGS = -module -avoid-version
index b34a025..0fbcbb8 100644 (file)
@@ -1,53 +1,25 @@
 /*
- * Copyright (C) 2015 Andreas Steffen
+ * Copyright (C) 2015-2016 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
- * Based on the implementation by the Keccak, Keyak and Ketje Teams, namely,
- * Guido Bertoni, Joan Daemen, Michaël Peeters, Gilles Van Assche and
- * Ronny Van Keer, hereby denoted as "the implementer".
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  *
- * To the extent possible under law, the implementer has waived all copyright
- * and related or neighboring rights to the source code in this file.
- * http://creativecommons.org/publicdomain/zero/1.0/
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
  */
 
 #include <string.h>
 
 #include "sha3_hasher.h"
+#include "sha3_keccak.h"
 
 typedef struct private_sha3_hasher_t private_sha3_hasher_t;
 
-#define KECCAK_STATE_SIZE       200    /* bytes */
-#define KECCAK_MAX_RATE                 144    /* bytes */
-#define DELIMITED_SUFFIX       0x06
-
-static const uint64_t round_constants[] = {
-    0x0000000000000001ULL,
-    0x0000000000008082ULL,
-    0x800000000000808aULL,
-    0x8000000080008000ULL,
-    0x000000000000808bULL,
-    0x0000000080000001ULL,
-    0x8000000080008081ULL,
-    0x8000000000008009ULL,
-    0x000000000000008aULL,
-    0x0000000000000088ULL,
-    0x0000000080008009ULL,
-    0x000000008000000aULL,
-    0x000000008000808bULL,
-    0x800000000000008bULL,
-    0x8000000000008089ULL,
-    0x8000000000008003ULL,
-    0x8000000000008002ULL,
-    0x8000000000000080ULL,
-    0x000000000000800aULL,
-    0x800000008000000aULL,
-    0x8000000080008081ULL,
-    0x8000000000008080ULL,
-    0x0000000080000001ULL,
-    0x8000000080008008ULL
-};
-
 /**
  * Private data structure with hashing context for SHA-3
  */
@@ -64,309 +36,16 @@ struct private_sha3_hasher_t {
        hash_algorithm_t algorithm;
 
        /**
-        * Internal state of 1600 bits as defined by FIPS-202
-        */
-       uint8_t state[KECCAK_STATE_SIZE];
-
-       /**
-        * Rate in bytes
+        * SHA-3 Keccak state
         */
-       u_int rate;
-
-       /**
-        * Rate input buffer
-        */
-       uint8_t rate_buffer[KECCAK_MAX_RATE];
-
-       /**
-        * Index pointing to the current position in the rate buffer
-        */
-       u_int rate_index;
+       sha3_keccak_t *keccak;
 
 };
 
-#if BYTE_ORDER != LITTLE_ENDIAN
-/**
- * Function to load a 64-bit value using the little-endian (LE) convention.
- * On a LE platform, this could be greatly simplified using a cast.
- */
-static uint64_t load64(const uint8_t *x)
-{
-       int i;
-       uint64_t u = 0;
-
-       for (i = 7; i >= 0; --i)
-       {
-               u <<= 8;
-               u |= x[i];
-       }
-       return u;
-}
-
-/**
- * Function to store a 64-bit value using the little-endian (LE) convention.
- * On a LE platform, this could be greatly simplified using a cast.
- */
-static void store64(uint8_t *x, uint64_t u)
-{
-       u_int i;
-
-       for (i = 0; i < 8; ++i)
-       {
-               x[i] = u;
-               u >>= 8;
-       }
-}
-
-/**
- * Function to XOR into a 64-bit value using the little-endian (LE) convention.
- * On a LE platform, this could be greatly simplified using a cast.
- */
-static void xor64(uint8_t *x, uint64_t u)
-{
-       u_int i;
-
-       for (i = 0; i < 8; ++i)
-       {
-               x[i] ^= u;
-               u >>= 8;
-       }
-}
-#endif
-
-/**
- * Some macros used by the Keccak-f[1600] permutation.
- */
-#define ROL64(a, offset) ((((uint64_t)a) << offset) ^ (((uint64_t)a) >> (64-offset)))
-
-#if BYTE_ORDER == LITTLE_ENDIAN
-    #define readLane(i)          (((uint64_t*)state)[i])
-    #define writeLane(i, lane)   (((uint64_t*)state)[i])  = (lane)
-    #define XORLane(i, lane)     (((uint64_t*)state)[i]) ^= (lane)
-#elif BYTE_ORDER == BIG_ENDIAN
-    #define readLane(i)          load64((uint8_t*)state+sizeof(uint64_t)*i))
-    #define writeLane(i, lane)   store64((uint8_t*)state+sizeof(uint64_t)*i, lane)
-    #define XORLane(i, lane)     xor64((uint8_t*)state+sizeof(uint64_t)*i, lane)
-#endif
-
-/**
- * Function that computes the Keccak-f[1600] permutation on the given state.
- */
-static void keccak_f1600_state_permute(void *state)
-{
-       int round;
-
-       for (round = 0; round < 24; round++)
-       {
-               {   /* θ step (see [Keccak Reference, Section 2.3.2]) */
-
-                       uint64_t C[5], D;
-
-                       /* Compute the parity of the columns */
-                       C[0] = readLane(0) ^ readLane( 5) ^ readLane(10)
-                                                          ^ readLane(15) ^ readLane(20);
-                       C[1] = readLane(1) ^ readLane( 6) ^ readLane(11)
-                                                          ^ readLane(16) ^ readLane(21);
-                       C[2] = readLane(2) ^ readLane( 7) ^ readLane(12)
-                                                          ^ readLane(17) ^ readLane(22);
-                       C[3] = readLane(3) ^ readLane( 8) ^ readLane(13)
-                                                          ^ readLane(18) ^ readLane(23);
-                       C[4] = readLane(4) ^ readLane( 9) ^ readLane(14)
-                                                          ^ readLane(19) ^ readLane(24);
-
-                       /* Compute and add the θ effect to the whole column */
-                       D = C[4] ^ ROL64(C[1], 1);
-                       XORLane( 0, D);
-                       XORLane( 5, D);
-                       XORLane(10, D);
-                       XORLane(15, D);
-                       XORLane(20, D);
-
-                       D = C[0] ^ ROL64(C[2], 1);
-                       XORLane( 1, D);
-                       XORLane( 6, D);
-                       XORLane(11, D);
-                       XORLane(16, D);
-                       XORLane(21, D);
-
-                       D = C[1] ^ ROL64(C[3], 1);
-                       XORLane( 2, D);
-                       XORLane( 7, D);
-                       XORLane(12, D);
-                       XORLane(17, D);
-                       XORLane(22, D);
-
-                       D = C[2] ^ ROL64(C[4], 1);
-                       XORLane( 3, D);
-                       XORLane( 8, D);
-                       XORLane(13, D);
-                       XORLane(18, D);
-                       XORLane(23, D);
-
-                       D = C[3] ^ ROL64(C[0], 1);
-                       XORLane( 4, D);
-                       XORLane( 9, D);
-                       XORLane(14, D);
-                       XORLane(19, D);
-                       XORLane(24, D);
-               }
-
-               {   /* ρ and π steps (see [Keccak Reference, Sections 2.3.3 and 2.3.4]) */
-
-                       uint64_t t1, t2;
-
-                       t1 = readLane( 1);
-
-                       t2 = readLane(10);
-                       writeLane(10, ROL64(t1,  1));
-
-                       t1 = readLane( 7);
-                       writeLane( 7, ROL64(t2,  3));
-
-                       t2 = readLane(11);
-                       writeLane(11, ROL64(t1,  6));
-
-                       t1 = readLane(17);
-                       writeLane(17, ROL64(t2, 10));
-
-                       t2 = readLane(18);
-                       writeLane(18, ROL64(t1, 15));
-
-                       t1 = readLane( 3);
-                       writeLane( 3, ROL64(t2, 21));
-
-                       t2 = readLane( 5);
-                       writeLane( 5, ROL64(t1, 28));
-
-                       t1 = readLane(16);
-                       writeLane(16, ROL64(t2, 36));
-
-                       t2 = readLane( 8);
-                       writeLane( 8, ROL64(t1, 45));
-
-                       t1 = readLane(21);
-                       writeLane(21, ROL64(t2, 55));
-
-                       t2 = readLane(24);
-                       writeLane(24, ROL64(t1,  2));
-
-                       t1 = readLane( 4);
-                       writeLane( 4, ROL64(t2, 14));
-
-                       t2 = readLane(15);
-                       writeLane(15, ROL64(t1, 27));
-
-                       t1 = readLane(23);
-                       writeLane(23, ROL64(t2, 41));
-
-                       t2 = readLane(19);
-                       writeLane(19, ROL64(t1, 56));
-
-                       t1 = readLane(13);
-                       writeLane(13, ROL64(t2,  8));
-
-                       t2 = readLane(12);
-                       writeLane(12, ROL64(t1, 25));
-
-                       t1 = readLane( 2);
-                       writeLane( 2, ROL64(t2, 43));
-
-                       t2 = readLane(20);
-                       writeLane(20, ROL64(t1, 62));
-
-                       t1 = readLane(14);
-                       writeLane(14, ROL64(t2, 18));
-
-                       t2 = readLane(22);
-                       writeLane(22, ROL64(t1, 39));
-
-                       t1 = readLane( 9);
-                       writeLane( 9, ROL64(t2, 61));
-
-                       t2 = readLane( 6);
-                       writeLane( 6, ROL64(t1, 20));
-
-                       writeLane( 1, ROL64(t2, 44));
-               }
-
-               {   /* χ step (see [Keccak Reference, Section 2.3.1]) */
-
-                       uint64_t t[5];
-
-                       t[0] = readLane(0);
-                       t[1] = readLane(1);
-                       t[2] = readLane(2);
-                       t[3] = readLane(3);
-                       t[4] = readLane(4);
-
-                       writeLane(0, t[0] ^ ((~t[1]) & t[2]));
-                       writeLane(1, t[1] ^ ((~t[2]) & t[3]));
-                       writeLane(2, t[2] ^ ((~t[3]) & t[4]));
-                       writeLane(3, t[3] ^ ((~t[4]) & t[0]));
-                       writeLane(4, t[4] ^ ((~t[0]) & t[1]));
-
-                       t[0] = readLane(5);
-                       t[1] = readLane(6);
-                       t[2] = readLane(7);
-                       t[3] = readLane(8);
-                       t[4] = readLane(9);
-
-                       writeLane(5, t[0] ^ ((~t[1]) & t[2]));
-                       writeLane(6, t[1] ^ ((~t[2]) & t[3]));
-                       writeLane(7, t[2] ^ ((~t[3]) & t[4]));
-                       writeLane(8, t[3] ^ ((~t[4]) & t[0]));
-                       writeLane(9, t[4] ^ ((~t[0]) & t[1]));
-
-                       t[0] = readLane(10);
-                       t[1] = readLane(11);
-                       t[2] = readLane(12);
-                       t[3] = readLane(13);
-                       t[4] = readLane(14);
-
-                       writeLane(10, t[0] ^ ((~t[1]) & t[2]));
-                       writeLane(11, t[1] ^ ((~t[2]) & t[3]));
-                       writeLane(12, t[2] ^ ((~t[3]) & t[4]));
-                       writeLane(13, t[3] ^ ((~t[4]) & t[0]));
-                       writeLane(14, t[4] ^ ((~t[0]) & t[1]));
-
-                       t[0] = readLane(15);
-                       t[1] = readLane(16);
-                       t[2] = readLane(17);
-                       t[3] = readLane(18);
-                       t[4] = readLane(19);
-
-                       writeLane(15, t[0] ^ ((~t[1]) & t[2]));
-                       writeLane(16, t[1] ^ ((~t[2]) & t[3]));
-                       writeLane(17, t[2] ^ ((~t[3]) & t[4]));
-                       writeLane(18, t[3] ^ ((~t[4]) & t[0]));
-                       writeLane(19, t[4] ^ ((~t[0]) & t[1]));
-
-                       t[0] = readLane(20);
-                       t[1] = readLane(21);
-                       t[2] = readLane(22);
-                       t[3] = readLane(23);
-                       t[4] = readLane(24);
-
-                       writeLane(20, t[0] ^ ((~t[1]) & t[2]));
-                       writeLane(21, t[1] ^ ((~t[2]) & t[3]));
-                       writeLane(22, t[2] ^ ((~t[3]) & t[4]));
-                       writeLane(23, t[3] ^ ((~t[4]) & t[0]));
-                       writeLane(24, t[4] ^ ((~t[0]) & t[1]));
-               }
-
-               {   /* ι step (see [Keccak Reference, Section 2.3.5]) */
-
-                       XORLane(0, round_constants[round]);
-               }
-       }
-}
-
 METHOD(hasher_t, reset, bool,
        private_sha3_hasher_t *this)
 {
-    memset(this->state, 0x00, KECCAK_STATE_SIZE);
-       this->rate_index = 0;
-
+       this->keccak->reset(this->keccak);
        return TRUE;
 }
 
@@ -388,79 +67,17 @@ METHOD(hasher_t, get_hash_size, size_t,
        }
 }
 
-static void sha3_absorb(private_sha3_hasher_t *this, chunk_t data)
-{
-       uint64_t *buffer_lanes, *state_lanes;
-       size_t len, rate_lanes;
-       int i;
-
-       buffer_lanes = (uint64_t*)this->rate_buffer;
-       state_lanes  = (uint64_t*)this->state;
-       rate_lanes = this->rate / sizeof(uint64_t);
-
-       while (data.len)
-       {
-               len = min(data.len, this->rate - this->rate_index);
-               memcpy(this->rate_buffer + this->rate_index, data.ptr, len);
-               this->rate_index += len;
-               data.ptr += len;
-               data.len -= len;
-
-               if (this->rate_index == this->rate)
-               {
-                       for (i = 0; i < rate_lanes; i++)
-                       {
-                               state_lanes[i] ^= buffer_lanes[i];
-                       }
-                       this->rate_index = 0;
-
-                       keccak_f1600_state_permute(this->state);
-               }
-       }
-}
-
-static void sha3_final(private_sha3_hasher_t *this)
-{
-       uint64_t *buffer_lanes, *state_lanes;
-       size_t rate_lanes, remainder;
-       int i;
-
-       /* Add the delimitedSuffix as the first bit of padding */
-       this->rate_buffer[this->rate_index++] = DELIMITED_SUFFIX;
-
-       buffer_lanes = (uint64_t*)this->rate_buffer;
-       state_lanes  = (uint64_t*)this->state;
-       rate_lanes = this->rate_index / sizeof(uint64_t);
-
-       remainder = this->rate_index - rate_lanes * sizeof(uint64_t);
-       if (remainder)
-       {
-               memset(this->rate_buffer + this->rate_index, 0x00,
-                          sizeof(uint64_t) - remainder);
-               rate_lanes++;
-       }
-       for (i = 0; i < rate_lanes; i++)
-       {
-               state_lanes[i] ^= buffer_lanes[i];
-       }
-
-       /* Add the second bit of padding */
-       this->state[this->rate - 1] ^= 0x80;
-
-       /* Switch to the squeezing phase */
-       keccak_f1600_state_permute(this->state);
-}
 
 METHOD(hasher_t, get_hash, bool,
        private_sha3_hasher_t *this, chunk_t chunk, uint8_t *buffer)
 {
-       sha3_absorb(this, chunk);
+       this->keccak->absorb(this->keccak, chunk);
 
        if (buffer != NULL)
        {
-               sha3_final(this);
-               memcpy(buffer, this->state, get_hash_size(this));
-               reset(this);
+               this->keccak->finalize(this->keccak);
+               this->keccak->squeeze(this->keccak, get_hash_size(this), buffer);
+               this->keccak->reset(this->keccak);
        }
        return TRUE;
 }
@@ -470,22 +87,24 @@ METHOD(hasher_t, allocate_hash, bool,
 {
        chunk_t allocated_hash;
 
-       sha3_absorb(this, chunk);
+       this->keccak->absorb(this->keccak, chunk);
 
        if (hash != NULL)
        {
-               sha3_final(this);
+               this->keccak->finalize(this->keccak);
                allocated_hash = chunk_alloc(get_hash_size(this));
-               memcpy(allocated_hash.ptr, this->state, allocated_hash.len);
-               reset(this);
+               this->keccak->squeeze(this->keccak, allocated_hash.len,
+                                                                                       allocated_hash.ptr);
+               this->keccak->reset(this->keccak);
                *hash = allocated_hash;
        }
        return TRUE;
 }
 
 METHOD(hasher_t, destroy, void,
-       sha3_hasher_t *this)
+       private_sha3_hasher_t *this)
 {
+       this->keccak->destroy(this->keccak);
        free(this);
 }
 
@@ -510,18 +129,22 @@ sha3_hasher_t *sha3_hasher_create(hash_algorithm_t algorithm)
        INIT(this,
                .public = {
                        .hasher_interface = {
-                       .reset = _reset,
-                       .get_hash_size = _get_hash_size,
-                       .get_hash = _get_hash,
-                       .allocate_hash = _allocate_hash,
-                       .destroy = _destroy,
+                               .reset = _reset,
+                               .get_hash_size = _get_hash_size,
+                               .get_hash = _get_hash,
+                               .allocate_hash = _allocate_hash,
+                               .destroy = _destroy,
                        },
                },
                .algorithm = algorithm,
        );
 
-       this->rate = KECCAK_STATE_SIZE - 2*get_hash_size(this);
-       reset(this);
+       this->keccak = sha3_keccak_create(2*get_hash_size(this), 0x06);
+       if (!this->keccak)
+       {
+               free(this);
+               return NULL;
+       }
 
        return &this->public;
 }
diff --git a/src/libstrongswan/plugins/sha3/sha3_keccak.c b/src/libstrongswan/plugins/sha3/sha3_keccak.c
new file mode 100644 (file)
index 0000000..1be1db1
--- /dev/null
@@ -0,0 +1,498 @@
+/*
+ * Copyright (C) 2015-2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * Based on the implementation by the Keccak, Keyak and Ketje Teams, namely,
+ * Guido Bertoni, Joan Daemen, Michaël Peeters, Gilles Van Assche and
+ * Ronny Van Keer, hereby denoted as "the implementer".
+ *
+ * To the extent possible under law, the implementer has waived all copyright
+ * and related or neighboring rights to the source code in this file.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+#include <string.h>
+
+#include "sha3_keccak.h"
+
+typedef struct private_sha3_keccak_t private_sha3_keccak_t;
+
+#define KECCAK_STATE_SIZE       200    /* bytes */
+#define KECCAK_MAX_RATE                 168    /* bytes */
+
+static const uint64_t round_constants[] = {
+    0x0000000000000001ULL,
+    0x0000000000008082ULL,
+    0x800000000000808aULL,
+    0x8000000080008000ULL,
+    0x000000000000808bULL,
+    0x0000000080000001ULL,
+    0x8000000080008081ULL,
+    0x8000000000008009ULL,
+    0x000000000000008aULL,
+    0x0000000000000088ULL,
+    0x0000000080008009ULL,
+    0x000000008000000aULL,
+    0x000000008000808bULL,
+    0x800000000000008bULL,
+    0x8000000000008089ULL,
+    0x8000000000008003ULL,
+    0x8000000000008002ULL,
+    0x8000000000000080ULL,
+    0x000000000000800aULL,
+    0x800000008000000aULL,
+    0x8000000080008081ULL,
+    0x8000000000008080ULL,
+    0x0000000080000001ULL,
+    0x8000000080008008ULL
+};
+
+/**
+ * Private data structure with hashing context for SHA-3
+ */
+struct private_sha3_keccak_t {
+
+       /**
+        * Public interface for this hasher.
+        */
+       sha3_keccak_t public;
+
+       /**
+        * Internal state of 1600 bits as defined by FIPS-202
+        */
+       uint8_t state[KECCAK_STATE_SIZE];
+
+       /**
+        * Rate in bytes
+        */
+       u_int rate;
+
+       /**
+        * Rate input buffer
+        */
+       uint8_t rate_buffer[KECCAK_MAX_RATE];
+
+       /**
+        * Index pointing to the current position in the rate buffer
+        */
+       u_int rate_index;
+
+       /**
+        * Suffix delimiting the input message
+        */
+       uint8_t delimited_suffix;
+
+};
+
+#if BYTE_ORDER != LITTLE_ENDIAN
+/**
+ * Function to load a 64-bit value using the little-endian (LE) convention.
+ * On a LE platform, this could be greatly simplified using a cast.
+ */
+static uint64_t load64(const uint8_t *x)
+{
+       int i;
+       uint64_t u = 0;
+
+       for (i = 7; i >= 0; --i)
+       {
+               u <<= 8;
+               u |= x[i];
+       }
+       return u;
+}
+
+/**
+ * Function to store a 64-bit value using the little-endian (LE) convention.
+ * On a LE platform, this could be greatly simplified using a cast.
+ */
+static void store64(uint8_t *x, uint64_t u)
+{
+       u_int i;
+
+       for (i = 0; i < 8; ++i)
+       {
+               x[i] = u;
+               u >>= 8;
+       }
+}
+
+/**
+ * Function to XOR into a 64-bit value using the little-endian (LE) convention.
+ * On a LE platform, this could be greatly simplified using a cast.
+ */
+static void xor64(uint8_t *x, uint64_t u)
+{
+       u_int i;
+
+       for (i = 0; i < 8; ++i)
+       {
+               x[i] ^= u;
+               u >>= 8;
+       }
+}
+#endif
+
+/**
+ * Some macros used by the Keccak-f[1600] permutation.
+ */
+#define ROL64(a, offset) ((((uint64_t)a) << offset) ^ (((uint64_t)a) >> (64-offset)))
+
+#if BYTE_ORDER == LITTLE_ENDIAN
+    #define readLane(i)          (((uint64_t*)state)[i])
+    #define writeLane(i, lane)   (((uint64_t*)state)[i])  = (lane)
+    #define XORLane(i, lane)     (((uint64_t*)state)[i]) ^= (lane)
+#elif BYTE_ORDER == BIG_ENDIAN
+    #define readLane(i)          load64((uint8_t*)state+sizeof(uint64_t)*i))
+    #define writeLane(i, lane)   store64((uint8_t*)state+sizeof(uint64_t)*i, lane)
+    #define XORLane(i, lane)     xor64((uint8_t*)state+sizeof(uint64_t)*i, lane)
+#endif
+
+/**
+ * Function that computes the Keccak-f[1600] permutation on the given state.
+ */
+static void keccak_f1600_state_permute(void *state)
+{
+       int round;
+
+       for (round = 0; round < 24; round++)
+       {
+               {   /* θ step (see [Keccak Reference, Section 2.3.2]) */
+
+                       uint64_t C[5], D;
+
+                       /* Compute the parity of the columns */
+                       C[0] = readLane(0) ^ readLane( 5) ^ readLane(10)
+                                                          ^ readLane(15) ^ readLane(20);
+                       C[1] = readLane(1) ^ readLane( 6) ^ readLane(11)
+                                                          ^ readLane(16) ^ readLane(21);
+                       C[2] = readLane(2) ^ readLane( 7) ^ readLane(12)
+                                                          ^ readLane(17) ^ readLane(22);
+                       C[3] = readLane(3) ^ readLane( 8) ^ readLane(13)
+                                                          ^ readLane(18) ^ readLane(23);
+                       C[4] = readLane(4) ^ readLane( 9) ^ readLane(14)
+                                                          ^ readLane(19) ^ readLane(24);
+
+                       /* Compute and add the θ effect to the whole column */
+                       D = C[4] ^ ROL64(C[1], 1);
+                       XORLane( 0, D);
+                       XORLane( 5, D);
+                       XORLane(10, D);
+                       XORLane(15, D);
+                       XORLane(20, D);
+
+                       D = C[0] ^ ROL64(C[2], 1);
+                       XORLane( 1, D);
+                       XORLane( 6, D);
+                       XORLane(11, D);
+                       XORLane(16, D);
+                       XORLane(21, D);
+
+                       D = C[1] ^ ROL64(C[3], 1);
+                       XORLane( 2, D);
+                       XORLane( 7, D);
+                       XORLane(12, D);
+                       XORLane(17, D);
+                       XORLane(22, D);
+
+                       D = C[2] ^ ROL64(C[4], 1);
+                       XORLane( 3, D);
+                       XORLane( 8, D);
+                       XORLane(13, D);
+                       XORLane(18, D);
+                       XORLane(23, D);
+
+                       D = C[3] ^ ROL64(C[0], 1);
+                       XORLane( 4, D);
+                       XORLane( 9, D);
+                       XORLane(14, D);
+                       XORLane(19, D);
+                       XORLane(24, D);
+               }
+
+               {   /* ρ and π steps (see [Keccak Reference, Sections 2.3.3 and 2.3.4]) */
+
+                       uint64_t t1, t2;
+
+                       t1 = readLane( 1);
+
+                       t2 = readLane(10);
+                       writeLane(10, ROL64(t1,  1));
+
+                       t1 = readLane( 7);
+                       writeLane( 7, ROL64(t2,  3));
+
+                       t2 = readLane(11);
+                       writeLane(11, ROL64(t1,  6));
+
+                       t1 = readLane(17);
+                       writeLane(17, ROL64(t2, 10));
+
+                       t2 = readLane(18);
+                       writeLane(18, ROL64(t1, 15));
+
+                       t1 = readLane( 3);
+                       writeLane( 3, ROL64(t2, 21));
+
+                       t2 = readLane( 5);
+                       writeLane( 5, ROL64(t1, 28));
+
+                       t1 = readLane(16);
+                       writeLane(16, ROL64(t2, 36));
+
+                       t2 = readLane( 8);
+                       writeLane( 8, ROL64(t1, 45));
+
+                       t1 = readLane(21);
+                       writeLane(21, ROL64(t2, 55));
+
+                       t2 = readLane(24);
+                       writeLane(24, ROL64(t1,  2));
+
+                       t1 = readLane( 4);
+                       writeLane( 4, ROL64(t2, 14));
+
+                       t2 = readLane(15);
+                       writeLane(15, ROL64(t1, 27));
+
+                       t1 = readLane(23);
+                       writeLane(23, ROL64(t2, 41));
+
+                       t2 = readLane(19);
+                       writeLane(19, ROL64(t1, 56));
+
+                       t1 = readLane(13);
+                       writeLane(13, ROL64(t2,  8));
+
+                       t2 = readLane(12);
+                       writeLane(12, ROL64(t1, 25));
+
+                       t1 = readLane( 2);
+                       writeLane( 2, ROL64(t2, 43));
+
+                       t2 = readLane(20);
+                       writeLane(20, ROL64(t1, 62));
+
+                       t1 = readLane(14);
+                       writeLane(14, ROL64(t2, 18));
+
+                       t2 = readLane(22);
+                       writeLane(22, ROL64(t1, 39));
+
+                       t1 = readLane( 9);
+                       writeLane( 9, ROL64(t2, 61));
+
+                       t2 = readLane( 6);
+                       writeLane( 6, ROL64(t1, 20));
+
+                       writeLane( 1, ROL64(t2, 44));
+               }
+
+               {   /* χ step (see [Keccak Reference, Section 2.3.1]) */
+
+                       uint64_t t[5];
+
+                       t[0] = readLane(0);
+                       t[1] = readLane(1);
+                       t[2] = readLane(2);
+                       t[3] = readLane(3);
+                       t[4] = readLane(4);
+
+                       writeLane(0, t[0] ^ ((~t[1]) & t[2]));
+                       writeLane(1, t[1] ^ ((~t[2]) & t[3]));
+                       writeLane(2, t[2] ^ ((~t[3]) & t[4]));
+                       writeLane(3, t[3] ^ ((~t[4]) & t[0]));
+                       writeLane(4, t[4] ^ ((~t[0]) & t[1]));
+
+                       t[0] = readLane(5);
+                       t[1] = readLane(6);
+                       t[2] = readLane(7);
+                       t[3] = readLane(8);
+                       t[4] = readLane(9);
+
+                       writeLane(5, t[0] ^ ((~t[1]) & t[2]));
+                       writeLane(6, t[1] ^ ((~t[2]) & t[3]));
+                       writeLane(7, t[2] ^ ((~t[3]) & t[4]));
+                       writeLane(8, t[3] ^ ((~t[4]) & t[0]));
+                       writeLane(9, t[4] ^ ((~t[0]) & t[1]));
+
+                       t[0] = readLane(10);
+                       t[1] = readLane(11);
+                       t[2] = readLane(12);
+                       t[3] = readLane(13);
+                       t[4] = readLane(14);
+
+                       writeLane(10, t[0] ^ ((~t[1]) & t[2]));
+                       writeLane(11, t[1] ^ ((~t[2]) & t[3]));
+                       writeLane(12, t[2] ^ ((~t[3]) & t[4]));
+                       writeLane(13, t[3] ^ ((~t[4]) & t[0]));
+                       writeLane(14, t[4] ^ ((~t[0]) & t[1]));
+
+                       t[0] = readLane(15);
+                       t[1] = readLane(16);
+                       t[2] = readLane(17);
+                       t[3] = readLane(18);
+                       t[4] = readLane(19);
+
+                       writeLane(15, t[0] ^ ((~t[1]) & t[2]));
+                       writeLane(16, t[1] ^ ((~t[2]) & t[3]));
+                       writeLane(17, t[2] ^ ((~t[3]) & t[4]));
+                       writeLane(18, t[3] ^ ((~t[4]) & t[0]));
+                       writeLane(19, t[4] ^ ((~t[0]) & t[1]));
+
+                       t[0] = readLane(20);
+                       t[1] = readLane(21);
+                       t[2] = readLane(22);
+                       t[3] = readLane(23);
+                       t[4] = readLane(24);
+
+                       writeLane(20, t[0] ^ ((~t[1]) & t[2]));
+                       writeLane(21, t[1] ^ ((~t[2]) & t[3]));
+                       writeLane(22, t[2] ^ ((~t[3]) & t[4]));
+                       writeLane(23, t[3] ^ ((~t[4]) & t[0]));
+                       writeLane(24, t[4] ^ ((~t[0]) & t[1]));
+               }
+
+               {   /* ι step (see [Keccak Reference, Section 2.3.5]) */
+
+                       XORLane(0, round_constants[round]);
+               }
+       }
+}
+
+METHOD(sha3_keccak_t, get_rate, u_int,
+       private_sha3_keccak_t *this)
+{
+       return this->rate;
+}
+
+METHOD(sha3_keccak_t, reset, void,
+       private_sha3_keccak_t *this)
+{
+    memset(this->state, 0x00, KECCAK_STATE_SIZE);
+       this->rate_index = 0;
+}
+
+
+METHOD(sha3_keccak_t, absorb, void,
+       private_sha3_keccak_t *this, chunk_t data)
+{
+       uint64_t *buffer_lanes, *state_lanes;
+       size_t len, rate_lanes;
+       int i;
+
+       buffer_lanes = (uint64_t*)this->rate_buffer;
+       state_lanes  = (uint64_t*)this->state;
+       rate_lanes = this->rate / sizeof(uint64_t);
+
+       while (data.len)
+       {
+               len = min(data.len, this->rate - this->rate_index);
+               memcpy(this->rate_buffer + this->rate_index, data.ptr, len);
+               this->rate_index += len;
+               data.ptr += len;
+               data.len -= len;
+
+               if (this->rate_index == this->rate)
+               {
+                       for (i = 0; i < rate_lanes; i++)
+                       {
+                               state_lanes[i] ^= buffer_lanes[i];
+                       }
+                       this->rate_index = 0;
+
+                       keccak_f1600_state_permute(this->state);
+               }
+       }
+}
+
+METHOD(sha3_keccak_t, finalize, void,
+       private_sha3_keccak_t *this)
+{
+       uint64_t *buffer_lanes, *state_lanes;
+       size_t rate_lanes, remainder;
+       int i;
+
+       /* Add the delimitedSuffix as the first bit of padding */
+       this->rate_buffer[this->rate_index++] = this->delimited_suffix;
+
+       buffer_lanes = (uint64_t*)this->rate_buffer;
+       state_lanes  = (uint64_t*)this->state;
+       rate_lanes = this->rate_index / sizeof(uint64_t);
+
+       remainder = this->rate_index - rate_lanes * sizeof(uint64_t);
+       if (remainder)
+       {
+               memset(this->rate_buffer + this->rate_index, 0x00,
+                          sizeof(uint64_t) - remainder);
+               rate_lanes++;
+       }
+       for (i = 0; i < rate_lanes; i++)
+       {
+               state_lanes[i] ^= buffer_lanes[i];
+       }
+
+       /* Add the second bit of padding */
+       this->state[this->rate - 1] ^= 0x80;
+
+       /* Switch to the squeezing phase */
+       keccak_f1600_state_permute(this->state);
+       this->rate_index = 0;
+}
+
+METHOD(sha3_keccak_t, squeeze, void,
+       private_sha3_keccak_t *this, size_t out_len, uint8_t *out)
+{
+       size_t index = 0, len;
+
+       while (index < out_len)
+       {
+               if (this->rate_index == this->rate)
+               {
+                       keccak_f1600_state_permute(this->state);
+                       this->rate_index = 0;
+               }
+               len = min(out_len - index, this->rate - this->rate_index);
+               memcpy(out, &this->state[this->rate_index], len);
+               out += len;
+               index += len;
+               this->rate_index += len;
+       }
+}
+
+METHOD(sha3_keccak_t, destroy, void,
+       private_sha3_keccak_t *this)
+{
+       free(this);
+}
+
+/*
+ * Described in header.
+ */
+sha3_keccak_t *sha3_keccak_create(u_int capacity, uint8_t delimited_suffix)
+{
+       private_sha3_keccak_t *this;
+       int rate;
+
+       rate = KECCAK_STATE_SIZE - capacity;
+
+       if (rate <= 0 || rate > KECCAK_MAX_RATE)
+       {
+               return NULL;
+       }
+
+       INIT(this,
+               .public = {
+                       .get_rate = _get_rate,
+                       .reset = _reset,
+                       .absorb = _absorb,
+                       .finalize = _finalize,
+                       .squeeze = _squeeze,
+                       .destroy = _destroy,
+               },
+               .rate = rate,
+               .delimited_suffix = delimited_suffix,
+       );
+
+       return &this->public;
+}
diff --git a/src/libstrongswan/plugins/sha3/sha3_keccak.h b/src/libstrongswan/plugins/sha3/sha3_keccak.h
new file mode 100644 (file)
index 0000000..32ff988
--- /dev/null
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+n */
+
+/**
+ * @defgroup sha3_keccak sha3_keccak
+ * @{ @ingroup sha3_p
+ */
+
+#ifndef SHA3_KECCAK_H_
+#define SHA3_KECCAK_H_
+
+typedef struct sha3_keccak_t sha3_keccak_t;
+
+#include <crypto/hashers/hasher.h>
+
+/**
+ * Implements the Keccak-f[1600] sponge function as defined by FIPS-202.
+ */
+struct sha3_keccak_t {
+
+       /**
+        * Get the available rate in bytes
+        *
+        * @return                      rate in bytes
+        */
+       u_int (*get_rate)(sha3_keccak_t *this);
+
+       /**
+        * Resets the interal Keccak state
+        */
+       void (*reset)(sha3_keccak_t *this);
+
+       /**
+        * Absorbs data into the Keccak state
+        *
+        * @param data          data to be absorbed
+        */
+       void (*absorb)(sha3_keccak_t *this, chunk_t data);
+
+       /**
+        * Finalize the absorbtion phase and switch to the squeeze phase
+        */
+       void (*finalize)(sha3_keccak_t *this);
+
+       /**
+        * Squeeze the Keccak state to get output data
+        * Can be called multiple times
+        *
+        * @param out_len       number of output bytes requested
+        * @param out           output buffer, must comprise at least out_len bytes
+        */
+       void (*squeeze)(sha3_keccak_t *this, size_t out_len, uint8_t *out);
+
+       /**
+        * Destroy the sha3_keccak_t object
+        */
+       void (*destroy)(sha3_keccak_t *this);
+
+};
+
+/**
+ * Creates a new sha3_keccak_t.
+ *
+ * @param      capacity                required capacity to achieve a given security level
+ * @param delimited_suffix     bits delimiting the input message
+ * @return                                     sha3_keccak_t object, NULL if capacity too big
+ */
+sha3_keccak_t *sha3_keccak_create(u_int capacity, uint8_t delimited_suffix);
+
+#endif /** SHA3_KECCAK_H_ @}*/
index 28068f3..8268e67 100644 (file)
  */
 
 #include "sha3_plugin.h"
+#include "sha3_hasher.h"
+#include "sha3_shake.h"
 
 #include <library.h>
-#include "sha3_hasher.h"
 
 typedef struct private_sha3_plugin_t private_sha3_plugin_t;
 
@@ -46,6 +47,9 @@ METHOD(plugin_t, get_features, int,
                        PLUGIN_PROVIDE(HASHER, HASH_SHA3_256),
                        PLUGIN_PROVIDE(HASHER, HASH_SHA3_384),
                        PLUGIN_PROVIDE(HASHER, HASH_SHA3_512),
+               PLUGIN_REGISTER(XOF, sha3_shake_create),
+                       PLUGIN_PROVIDE(XOF, XOF_SHAKE_128),
+                       PLUGIN_PROVIDE(XOF, XOF_SHAKE_256),
        };
        *features = f;
        return countof(f);
diff --git a/src/libstrongswan/plugins/sha3/sha3_shake.c b/src/libstrongswan/plugins/sha3/sha3_shake.c
new file mode 100644 (file)
index 0000000..fef26bb
--- /dev/null
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "sha3_shake.h"
+#include "sha3_keccak.h"
+
+typedef struct private_sha3_shake_t private_sha3_shake_t;
+
+
+/**
+ * Private data structure with hashing context for SHA-3
+ */
+struct private_sha3_shake_t {
+
+       /**
+        * Public interface for this hasher.
+        */
+       sha3_shake_t public;
+
+       /**
+        * XOF algorithm to be used (XOF_SHAKE_128 or XOF_SHAKE_256)
+        */
+       ext_out_function_t algorithm;
+
+       /**
+        * SHA-3 Keccak state
+        */
+       sha3_keccak_t *keccak;
+
+       /**
+        * Capacity in bytes of the SHA-3 Keccak state
+        */
+       u_int capacity;
+
+};
+
+
+METHOD(xof_t, get_bytes, bool,
+       private_sha3_shake_t *this, size_t out_len, uint8_t *buffer)
+{
+       this->keccak->squeeze(this->keccak, out_len, buffer);
+       return TRUE;
+}
+
+METHOD(xof_t, allocate_bytes, bool,
+       private_sha3_shake_t *this, size_t out_len, chunk_t *chunk)
+{
+       *chunk = chunk_alloc(out_len);
+       this->keccak->squeeze(this->keccak, out_len, chunk->ptr);
+       return TRUE;
+}
+
+METHOD(xof_t, get_block_size, size_t,
+       private_sha3_shake_t *this)
+{
+       return this->keccak->get_rate(this->keccak);
+}
+
+METHOD(xof_t, get_seed_size, size_t,
+       private_sha3_shake_t *this)
+{
+       return this->capacity;
+}
+
+METHOD(xof_t, set_seed, bool,
+       private_sha3_shake_t *this, chunk_t seed)
+{
+       this->keccak->reset(this->keccak);
+       this->keccak->absorb(this->keccak, seed);
+       this->keccak->finalize(this->keccak);
+       return TRUE;
+}
+
+
+METHOD(xof_t, destroy, void,
+       private_sha3_shake_t *this)
+{
+       this->keccak->destroy(this->keccak);
+       free(this);
+}
+
+/*
+ * Described in header.
+ */
+sha3_shake_t* sha3_shake_create(ext_out_function_t algorithm)
+{
+       private_sha3_shake_t *this;
+       u_int capacity = 0;
+
+       switch (algorithm)
+       {
+               case XOF_SHAKE_128:
+                       capacity = 32;
+                       break;
+               case XOF_SHAKE_256:
+                       capacity = 64;
+                       break;
+               default:
+                       return NULL;
+       }
+
+       INIT(this,
+               .public = {
+                       .xof_interface = {
+                               .get_bytes = _get_bytes,
+                               .allocate_bytes = _allocate_bytes,
+                               .get_block_size = _get_block_size,
+                               .get_seed_size = _get_seed_size,
+                               .set_seed = _set_seed,
+                               .destroy = _destroy,
+                       },
+               },
+               .algorithm = algorithm,
+               .capacity = capacity,
+       );
+
+       this->keccak = sha3_keccak_create(capacity, 0x1f);
+       if (!this->keccak)
+       {
+               free(this);
+               return NULL;
+       }
+
+       return &this->public;
+}
diff --git a/src/libstrongswan/plugins/sha3/sha3_shake.h b/src/libstrongswan/plugins/sha3/sha3_shake.h
new file mode 100644 (file)
index 0000000..a8643ed
--- /dev/null
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup sha3_shake sha3_shake
+ * @{ @ingroup sha3_p
+ */
+
+#ifndef SHA3_SHAKE_H_
+#define SHA3_SHAKE_H_
+
+typedef struct sha3_shake_t sha3_shake_t;
+
+#include <crypto/xofs/xof.h>
+
+/**
+ * Implementation of xof_t interface using the SHA-3 XOF algorithm family
+ * SHAKE128 and SHAKE256 as defined by FIPS-202.
+ */
+struct sha3_shake_t {
+
+       /**
+        * Generic xof_t interface for this Extended Output Function (XOF).
+        */
+       xof_t xof_interface;
+};
+
+/**
+ * Creates a new sha3_shake_t.
+ *
+ * @param      algorithm       XOF_SHAKE_128 or XOF_SHAKE_256
+ * @return                             sha3_shake_t object, NULL if not supported
+ */
+sha3_shake_t* sha3_shake_create(ext_out_function_t algorithm);
+
+#endif /** SHA3_SHAKE_H_ @}*/
index ab540e7..88c023f 100644 (file)
@@ -41,6 +41,7 @@ libstrongswan_test_vectors_la_SOURCES = \
        test_vectors/sha2.c \
        test_vectors/sha2_hmac.c \
        test_vectors/sha3.c \
+       test_vectors/sha3_shake.c \
        test_vectors/fips_prf.c \
        test_vectors/modp.c \
        test_vectors/modpsub.c \
index 3ff211d..309040c 100644 (file)
@@ -258,6 +258,17 @@ TEST_VECTOR_PRF(sha512_hmac_p5)
 TEST_VECTOR_PRF(sha512_hmac_p6)
 TEST_VECTOR_PRF(fips_prf_1)
 
+TEST_VECTOR_XOF(shake_128_0)
+TEST_VECTOR_XOF(shake_128_32)
+TEST_VECTOR_XOF(shake_128_167)
+TEST_VECTOR_XOF(shake_128_168)
+TEST_VECTOR_XOF(shake_128_255)
+TEST_VECTOR_XOF(shake_256_0)
+TEST_VECTOR_XOF(shake_256_64)
+TEST_VECTOR_XOF(shake_256_135)
+TEST_VECTOR_XOF(shake_256_136)
+TEST_VECTOR_XOF(shake_256_255)
+
 TEST_VECTOR_RNG(rng_monobit_1)
 TEST_VECTOR_RNG(rng_monobit_2)
 TEST_VECTOR_RNG(rng_monobit_3)
index e659f66..d8212f8 100644 (file)
@@ -23,7 +23,6 @@ hasher_test_vector_t sha3_224_0 = {
        .data   = "",
        .hash   = "\x6B\x4E\x03\x42\x36\x67\xDB\xB7\x3B\x6E\x15\x45\x4F\x0E\xB1\xAB"
                          "\xD4\x59\x7F\x9A\x1B\x07\x8E\x3F\x5B\x5A\x6B\xC7"
-
 };
 
 hasher_test_vector_t sha3_224_1 = {
diff --git a/src/libstrongswan/plugins/test_vectors/test_vectors/sha3_shake.c b/src/libstrongswan/plugins/test_vectors/test_vectors/sha3_shake.c
new file mode 100644 (file)
index 0000000..0150d0a
--- /dev/null
@@ -0,0 +1,472 @@
+/*
+ * Copyright (C) 2016 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the Licenseor (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be usefulbut
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <crypto/crypto_tester.h>
+
+/**
+ * SHAKE-128 vectors from "https://github.com/gvanas/KeccakCodePackage/"
+ */
+xof_test_vector_t shake_128_0 = {
+       .alg = XOF_SHAKE_128, .len = 0,
+       .seed   = "",
+       .out_len = 512,
+       .out    = "\x7F\x9C\x2B\xA4\xE8\x8F\x82\x7D\x61\x60\x45\x50\x76\x05\x85\x3E"
+                         "\xD7\x3B\x80\x93\xF6\xEF\xBC\x88\xEB\x1A\x6E\xAC\xFA\x66\xEF\x26"
+                         "\x3C\xB1\xEE\xA9\x88\x00\x4B\x93\x10\x3C\xFB\x0A\xEE\xFD\x2A\x68"
+                         "\x6E\x01\xFA\x4A\x58\xE8\xA3\x63\x9C\xA8\xA1\xE3\xF9\xAE\x57\xE2"
+                         "\x35\xB8\xCC\x87\x3C\x23\xDC\x62\xB8\xD2\x60\x16\x9A\xFA\x2F\x75"
+                         "\xAB\x91\x6A\x58\xD9\x74\x91\x88\x35\xD2\x5E\x6A\x43\x50\x85\xB2"
+                         "\xBA\xDF\xD6\xDF\xAA\xC3\x59\xA5\xEF\xBB\x7B\xCC\x4B\x59\xD5\x38"
+                         "\xDF\x9A\x04\x30\x2E\x10\xC8\xBC\x1C\xBF\x1A\x0B\x3A\x51\x20\xEA"
+                         "\x17\xCD\xA7\xCF\xAD\x76\x5F\x56\x23\x47\x4D\x36\x8C\xCC\xA8\xAF"
+                         "\x00\x07\xCD\x9F\x5E\x4C\x84\x9F\x16\x7A\x58\x0B\x14\xAA\xBD\xEF"
+                         "\xAE\xE7\xEE\xF4\x7C\xB0\xFC\xA9\x76\x7B\xE1\xFD\xA6\x94\x19\xDF"
+                         "\xB9\x27\xE9\xDF\x07\x34\x8B\x19\x66\x91\xAB\xAE\xB5\x80\xB3\x2D"
+                         "\xEF\x58\x53\x8B\x8D\x23\xF8\x77\x32\xEA\x63\xB0\x2B\x4F\xA0\xF4"
+                         "\x87\x33\x60\xE2\x84\x19\x28\xCD\x60\xDD\x4C\xEE\x8C\xC0\xD4\xC9"
+                         "\x22\xA9\x61\x88\xD0\x32\x67\x5C\x8A\xC8\x50\x93\x3C\x7A\xFF\x15"
+                         "\x33\xB9\x4C\x83\x4A\xDB\xB6\x9C\x61\x15\xBA\xD4\x69\x2D\x86\x19"
+                         "\xF9\x0B\x0C\xDF\x8A\x7B\x9C\x26\x40\x29\xAC\x18\x5B\x70\xB8\x3F"
+                         "\x28\x01\xF2\xF4\xB3\xF7\x0C\x59\x3E\xA3\xAE\xEB\x61\x3A\x7F\x1B"
+                         "\x1D\xE3\x3F\xD7\x50\x81\xF5\x92\x30\x5F\x2E\x45\x26\xED\xC0\x96"
+                         "\x31\xB1\x09\x58\xF4\x64\xD8\x89\xF3\x1B\xA0\x10\x25\x0F\xDA\x7F"
+                         "\x13\x68\xEC\x29\x67\xFC\x84\xEF\x2A\xE9\xAF\xF2\x68\xE0\xB1\x70"
+                         "\x0A\xFF\xC6\x82\x0B\x52\x3A\x3D\x91\x71\x35\xF2\xDF\xF2\xEE\x06"
+                         "\xBF\xE7\x2B\x31\x24\x72\x1D\x4A\x26\xC0\x4E\x53\xA7\x5E\x30\xE7"
+                         "\x3A\x7A\x9C\x4A\x95\xD9\x1C\x55\xD4\x95\xE9\xF5\x1D\xD0\xB5\xE9"
+                         "\xD8\x3C\x6D\x5E\x8C\xE8\x03\xAA\x62\xB8\xD6\x54\xDB\x53\xD0\x9B"
+                         "\x8D\xCF\xF2\x73\xCD\xFE\xB5\x73\xFA\xD8\xBC\xD4\x55\x78\xBE\xC2"
+                         "\xE7\x70\xD0\x1E\xFD\xE8\x6E\x72\x1A\x3F\x7C\x6C\xCE\x27\x5D\xAB"
+                         "\xE6\xE2\x14\x3F\x1A\xF1\x8D\xA7\xEF\xDD\xC4\xC7\xB7\x0B\x5E\x34"
+                         "\x5D\xB9\x3C\xC9\x36\xBE\xA3\x23\x49\x1C\xCB\x38\xA3\x88\xF5\x46"
+                         "\xA9\xFF\x00\xDD\x4E\x13\x00\xB9\xB2\x15\x3D\x20\x41\xD2\x05\xB4"
+                         "\x43\xE4\x1B\x45\xA6\x53\xF2\xA5\xC4\x49\x2C\x1A\xDD\x54\x45\x12"
+                         "\xDD\xA2\x52\x98\x33\x46\x2B\x71\xA4\x1A\x45\xBE\x97\x29\x0B\x6F"
+};
+
+xof_test_vector_t shake_128_32 = {
+       .alg = XOF_SHAKE_128, .len = 32,
+       .seed   = "\x9F\x2F\xCC\x7C\x90\xDE\x09\x0D\x6B\x87\xCD\x7E\x97\x18\xC1\xEA"
+                         "\x6C\xB2\x11\x18\xFC\x2D\x5D\xE9\xF9\x7E\x5D\xB6\xAC\x1E\x9C\x10",
+       .out_len = 512,
+       .out    = "\xFC\xDE\xAD\x82\xF3\x9C\xDF\xCE\xF9\x9C\x1B\xAB\xB6\x74\xA9\xA8"
+                         "\xE2\x4A\xC5\x94\x64\x6C\x31\xD0\x20\xA4\xCD\x2B\xC2\x55\x4A\xFD"
+                         "\x78\xC4\xE4\x13\xF7\x80\x4F\xA1\x70\x8B\x9F\x40\x00\xFD\x86\x0E"
+                         "\x30\x70\xF2\xE1\xBA\x9E\xEE\x38\x05\x35\x2A\xAD\x65\x5B\x4B\x0A"
+                         "\x72\x8F\x2D\x5F\xCC\x43\x24\x38\x25\xBC\x0D\xCE\x33\xCA\x71\x66"
+                         "\x26\xDC\x76\xE9\x20\xD7\x25\x75\xE2\x6D\xDD\x71\x10\xD0\xF9\x91"
+                         "\xA9\x12\x00\xB5\x13\xAE\xE2\x3A\xC9\xBC\x70\x43\xA1\x52\xAC\xE0"
+                         "\xCD\x0B\x49\x18\x1D\x2B\xB6\xBD\x36\xE9\x3C\x0B\x62\x7A\xCA\x9C"
+                         "\x6A\xB6\xC8\x5E\xD7\x0C\xE7\x62\x42\x9C\x8F\x26\x27\x08\x10\x32"
+                         "\x84\xC0\xA7\x92\x13\x8F\x10\xE8\x56\x8E\xFB\x23\x99\xB3\x8A\x31"
+                         "\x05\x5C\x11\x88\xBA\x59\x34\x4E\x6A\x2B\x73\xD5\xC0\x4A\xA5\x24"
+                         "\x05\x66\x49\x84\x4D\x1D\xAD\xCD\x07\xD3\x5D\xF5\xD8\x51\xEB\xAF"
+                         "\xFC\xA5\x70\x3B\x80\x15\x3E\xA6\x27\xB1\xBA\xDF\xB2\x88\x5F\x70"
+                         "\xF7\x86\xD3\x4F\x56\x50\xFE\x73\xE3\x69\x0A\x8A\x96\x61\x00\x59"
+                         "\x25\x3D\xD3\xAB\xB5\xFA\x7C\x54\xCF\x6E\x77\x69\x5D\x24\xA6\x59"
+                         "\x40\x77\xEE\x4D\x36\x73\xF9\xFC\x56\xC6\x2F\xC7\xF7\x10\xCF\x87"
+                         "\x20\x14\xC0\xA7\xDE\x8B\x1C\xA6\xAE\x8C\xEF\xAA\xDE\xAF\x5F\x4D"
+                         "\x05\x5F\xF7\x65\xAD\x41\x87\x13\xF2\xDD\x08\xEA\xFB\x5E\x16\xEE"
+                         "\xD9\xFE\x34\x4E\xE8\xD4\x38\x8F\xDC\x22\x35\x1F\x63\x83\x40\x17"
+                         "\xB5\x39\xE3\xFF\x14\x3F\x39\x4B\x5B\x74\xD0\x6F\x65\xE9\x6A\x7A"
+                         "\x3D\x02\x8F\xD1\x4F\x6C\x70\x01\xEB\x7A\xD2\xDC\xFC\xF4\xB2\x44"
+                         "\x7A\xA1\x73\xA2\xAE\x8E\xDB\x58\x1B\x5B\xBD\x89\xE8\xA4\x68\xFE"
+                         "\x0A\x38\x50\x75\x30\xB9\x79\x5D\xA3\xBC\xEC\x6D\xDE\xBC\xE9\xEB"
+                         "\x31\x32\xEF\x18\xC9\xC2\xA8\xB9\x36\xA4\x31\xC8\xB1\x21\xFA\x99"
+                         "\x6F\xF9\xBA\x5C\xE5\x22\x98\x6B\x67\x8A\x5E\xC9\x9A\x10\x3A\x91"
+                         "\xCF\x33\x19\x6E\x08\xC8\x2D\xC6\x5E\x68\xAE\xD2\x38\xA9\x31\x6A"
+                         "\x73\xE7\x1C\xF5\xA6\x7C\xE4\x40\xB9\x3B\xDB\x84\x5B\x3A\x60\x53"
+                         "\x9E\xCC\xDC\xE4\x1B\xC7\x23\xEC\x9A\x14\xEE\x4E\x08\x2F\x60\xC0"
+                         "\xBE\x3D\x5E\x50\xDF\xC8\xBE\x1E\x86\xA9\x7E\xCE\xE9\xD8\x8E\x2B"
+                         "\xB2\xA3\xAF\xF4\x7F\xBD\x6D\x66\x75\xD8\x1E\xFE\x07\x08\x92\x6B"
+                         "\x81\xAB\x31\x4A\x52\x4F\xC7\x45\x09\x01\x62\xD2\xAC\x72\x3C\x43"
+                         "\x26\xE0\xF9\xE1\x6F\xBD\xBA\x2B\x1E\x99\x14\xBB\xEE\xDF\xF9\x6B"
+};
+
+xof_test_vector_t shake_128_167 = {
+       .alg = XOF_SHAKE_128, .len = 167,
+       .seed   = "\x0D\x8D\x09\xAE\xD1\x9F\x10\x13\x96\x9C\xE5\xE7\xEB\x92\xF8\x3A"
+                         "\x20\x9A\xE7\x6B\xE3\x1C\x75\x48\x44\xEA\x91\x16\xCE\xB3\x9A\x22"
+                         "\xEB\xB6\x00\x30\x17\xBB\xCF\x26\x55\x5F\xA6\x62\x41\x85\x18\x7D"
+                         "\xB8\xF0\xCB\x35\x64\xB8\xB1\xC0\x6B\xF6\x85\xD4\x7F\x32\x86\xED"
+                         "\xA2\x0B\x83\x35\x8F\x59\x9D\x20\x44\xBB\xF0\x58\x3F\xAB\x8D\x78"
+                         "\xF8\x54\xFE\x0A\x59\x61\x83\x23\x0C\x5E\xF8\xE5\x44\x26\x75\x0E"
+                         "\xAF\x2C\xC4\xE2\x9D\x3B\xDD\x03\x7E\x73\x4D\x86\x3C\x2B\xD9\x78"
+                         "\x9B\x4C\x24\x30\x96\x13\x8F\x76\x72\xC2\x32\x31\x4E\xFF\xDF\xC6"
+                         "\x51\x34\x27\xE2\xDA\x76\x91\x6B\x52\x48\x93\x3B\xE3\x12\xEB\x5D"
+                         "\xDE\x4C\xF7\x08\x04\xFB\x25\x8A\xC5\xFB\x82\xD5\x8D\x08\x17\x7A"
+                         "\xC6\xF4\x75\x60\x17\xFF\xF5",
+       .out_len = 512,
+       .out    = "\xC7\x3D\x8F\xAA\xB5\xD0\xB4\xD6\x60\xBD\x50\x82\xE4\x4C\x3C\xAC"
+                         "\x97\xE6\x16\x48\xBE\x0A\x04\xB1\x16\x72\x4E\x6F\x6B\x65\x76\x84"
+                         "\x67\x4B\x4B\x0E\x90\xD0\xAE\x96\xC0\x85\x3E\xBD\x83\x7B\xD8\x24"
+                         "\x9A\xDB\xD3\xB6\x0A\x1A\xD1\xFC\xF8\xA6\xAB\x8E\x2F\x5A\xA7\xFF"
+                         "\x19\x7A\x3D\x7D\xBE\xDE\xFB\x43\x3B\x61\x35\x36\xAE\xC4\xD6\x55"
+                         "\xB7\xBC\xD7\x78\x52\x6B\xE6\x67\x84\x7A\xCD\x2E\x05\x64\xD9\x6C"
+                         "\xE5\x14\x0C\x91\x35\x7F\xAD\xE0\x00\xEF\xCB\x40\x45\x7E\x1B\x6C"
+                         "\xED\x41\xFA\x10\x2E\x36\xE7\x99\x79\x2D\xB0\x3E\x9A\x40\xC7\x99"
+                         "\xBC\xA9\x12\x62\x94\x8E\x17\x60\x50\x65\xFB\xF6\x38\xFB\x40\xA1"
+                         "\x57\xB4\x5C\xF7\x91\x1A\x75\x3D\x0D\x20\x5D\xF8\x47\x16\xA5\x71"
+                         "\x12\xBE\xAB\x44\xF6\x20\x1F\xF7\x5A\xAD\xE0\xBA\xFB\xA5\x04\x74"
+                         "\x5C\xFE\x23\xE4\xE6\x0E\x67\xE3\x99\x36\x22\xAE\xD7\x3A\x1D\xD6"
+                         "\xA4\x65\xBD\x45\x3D\xD3\xC5\xBA\x7D\x2C\xDF\x3F\x1D\x39\x37\x6A"
+                         "\x67\xC2\x3E\x55\x5F\x5A\xCF\x25\xBC\xE1\xE5\x5F\x30\x72\x52\xB9"
+                         "\xAA\xC2\xC0\xA3\x9C\x88\x5C\x7E\x44\xF2\x04\xCB\x82\x1C\x0D\x37"
+                         "\xA2\x2D\xE3\xA7\x1F\x3A\x19\x09\xB1\x1B\x71\x81\xC4\x2B\xE9\xB7"
+                         "\x8A\xA0\xD0\xA1\x54\x44\xF3\x30\x00\x75\x54\xBC\xFC\xC0\xD8\xFD"
+                         "\x87\xD6\x43\x1F\xB9\x3C\x7C\xC3\x87\x67\xA5\x5D\x30\xD3\x54\x55"
+                         "\x60\xBD\x38\x0D\xB8\xC4\xC0\xED\xA9\x39\x9F\x68\xF8\x54\x64\x42"
+                         "\x66\xC1\xB7\x95\x8B\x27\x0E\x75\xB7\x91\x34\xAA\x01\xE7\xDC\xF1"
+                         "\xE6\xFD\xB6\xD9\xAE\x5D\x02\xCC\xE8\xCE\x8E\x48\x04\x75\xE9\x61"
+                         "\x7C\xC4\x2A\x91\xC0\x8D\x9A\xF6\xE5\x10\x1B\x8A\xC5\x83\x4A\xDB"
+                         "\x2C\x66\x98\x7F\x42\xA5\x80\xBB\x50\x3A\x4B\x34\xA9\xF1\x5A\xDC"
+                         "\xD0\xE2\x3D\x0D\x40\x29\x47\x97\x64\x83\x1D\x06\xB5\xCA\xF3\xF1"
+                         "\x4B\x91\x44\x9F\x15\xA2\x91\xF4\xAC\x25\x0B\x27\x0B\x6C\xB3\xC3"
+                         "\x04\x72\x5C\x99\xE3\x26\x45\xE1\xFC\x02\xA0\xCD\xDD\x9E\x71\x79"
+                         "\x11\xF2\x34\x2D\x94\x82\xF8\xE0\x97\x99\x85\xA0\x17\x0D\x72\x5D"
+                         "\xAB\x4E\xA6\x6D\x44\xF6\x26\xBA\x47\x59\x25\xFA\x39\xFC\x9D\xEE"
+                         "\x92\x9C\x06\xD0\x09\x41\x6C\x0A\xDC\x1D\x98\x7C\xD6\x25\xA2\x0A"
+                         "\xCB\xA4\xCC\x87\xF7\x2F\x61\x08\x67\xC3\xA7\xA9\x28\xA3\xA0\x37"
+                         "\x96\x76\xE8\xFE\x25\x71\x07\xAB\x2F\x5C\x03\x0B\xD2\x48\x0E\x3D"
+                         "\x18\x63\x56\x2E\x1F\xD0\x79\x02\x80\x33\x3E\xD9\xD5\xDD\x5A\x5C"
+};
+
+xof_test_vector_t shake_128_168 = {
+       .alg = XOF_SHAKE_128, .len = 168,
+       .seed   = "\xC3\x23\x6B\x73\xDE\xB7\x66\x2B\xF3\xF3\xDA\xA5\x8F\x13\x7B\x35"
+                         "\x8B\xA6\x10\x56\x0E\xF7\x45\x57\x85\xA9\xBE\xFD\xB0\x35\xA0\x66"
+                         "\xE9\x07\x04\xF9\x29\xBD\x96\x89\xCE\xF0\xCE\x3B\xDA\x5A\xCF\x44"
+                         "\x80\xBC\xEB\x8D\x09\xD1\x0B\x09\x8A\xD8\x50\x0D\x9B\x60\x71\xDF"
+                         "\xC3\xA1\x4A\xF6\xC7\x75\x11\xD8\x1E\x3A\xA8\x84\x49\x86\xC3\xBE"
+                         "\xA6\xF4\x69\xF9\xE0\x21\x94\xC9\x28\x68\xCD\x5F\x51\x64\x62\x56"
+                         "\x79\x8F\xF0\x42\x49\x54\xC1\x43\x4B\xDF\xED\x9F\xAC\xB3\x90\xB0"
+                         "\x7D\x34\x2E\x99\x29\x36\xE0\xF8\x8B\xFD\x0E\x88\x4A\x0D\xDB\x67"
+                         "\x9D\x05\x47\xCC\xDE\xC6\x38\x42\x85\xA4\x54\x29\xD1\x15\xAC\x7D"
+                         "\x23\x5A\x71\x72\x42\x02\x1D\x1D\xC3\x56\x41\xF5\xF0\xA4\x8E\x84"
+                         "\x45\xDB\xA5\x8E\x6C\xB2\xC8\xEA",
+       .out_len = 512,
+       .out    = "\x4A\x05\xF2\xEF\x1A\xAD\x5F\xF4\x30\x64\x29\xEC\x0F\x19\x04\x40"
+                         "\x77\xFB\x64\xBF\xE1\xDC\xC5\x0F\x74\xC3\xF0\x45\xE9\xA9\xC3\xDE"
+                         "\x4A\x3B\x59\x63\xAE\xF7\x71\xB0\x49\x11\x1B\x7B\x46\x40\xE2\x0B"
+                         "\x1B\xA8\x4E\xD7\xAF\xEE\x32\x55\x71\xAC\xF3\x47\xE3\x11\xF3\x3C"
+                         "\x1D\x42\x1F\x21\xD6\x63\x06\x5C\x4D\xAD\xDB\xD1\x78\x5C\x5D\xAC"
+                         "\x0D\x55\x4C\xED\xB1\xA4\x5A\x32\xE2\x81\x45\xE9\x8F\x49\xDE\xE2"
+                         "\x85\xB3\x3D\xE1\x4C\x33\x6D\x10\x95\x0E\xCC\x30\x96\x6B\x79\xE8"
+                         "\x61\x3F\xFE\xBB\x70\x2F\xCC\x00\xA1\xC4\x25\x0D\xD3\x85\xAB\xB5"
+                         "\x37\xA2\x84\xE9\x10\x8D\x16\xB6\xF0\x8F\x4E\x10\x3F\x2C\x5E\x9E"
+                         "\x5C\x87\x9C\xB5\x09\x55\x34\x15\x1E\x3C\x9A\x31\x6D\x06\xDC\xE5"
+                         "\x3B\x7F\x01\xB4\x24\xD3\x75\xB5\x64\xFE\x68\x39\xD1\xD1\xF0\x0A"
+                         "\x2E\x62\x60\x40\x60\xA9\x74\x8B\xCD\xC8\x14\x37\x37\x95\x9F\xAB"
+                         "\xBC\xAE\x18\x51\x21\x3E\x6D\xC2\x8B\xEF\xDA\x48\x14\x9D\xE6\xAA"
+                         "\xF4\xA6\x0D\x46\x15\xBE\xD6\x7D\x11\x79\x6F\x61\x73\xC3\xDC\xF1"
+                         "\x39\x03\x7B\x31\xEE\xC9\xA8\x40\x4D\xF0\x75\x97\xBC\x26\x6D\x3C"
+                         "\x7D\x9E\xB9\xA7\xCA\xBF\x74\x9F\xB4\x4E\x40\xD7\x46\xD0\xE9\xDF"
+                         "\xB5\xC8\xBB\xEB\x25\xE3\xF1\x61\x2D\x03\xD3\xEB\x0C\x15\x4D\xE4"
+                         "\xB2\x70\x8C\x4F\x8A\x89\x76\x2E\x17\x1F\x74\x45\x18\xAE\xC1\x34"
+                         "\xA0\x2E\xEA\xF4\x9D\xB2\xE2\xC6\xC9\x91\x47\x11\x28\x8D\x6B\x0C"
+                         "\xE8\x77\x86\x1D\x9B\x10\xAC\xFC\xC1\x96\x43\x73\x82\x87\xDA\x00"
+                         "\x52\x82\xF3\xFC\x82\xF9\xF5\x0A\xA6\x81\xF2\xF5\x5F\xE1\x80\x9C"
+                         "\x9E\x23\xA3\xA5\x9E\x51\xC2\xE8\x94\xF7\x18\x37\x2F\x9F\xA1\x56"
+                         "\x4B\x47\xAB\x3F\x43\xF0\x74\x7A\x17\x83\x9E\x93\x33\x69\xB6\x77"
+                         "\x80\x53\xE1\x76\x4F\x52\xC5\xF3\x19\xE3\x3C\x8B\x25\x67\x8F\x72"
+                         "\x33\x2E\x33\xCC\xA9\x7C\x68\xF1\x9E\x05\x8E\x70\xC3\x14\x10\xDF"
+                         "\x4D\xE7\xE0\x81\x69\xD6\x09\x6B\x7B\x4E\xA4\x82\x71\xEB\x68\x4F"
+                         "\xEE\x9F\xC8\xB5\x61\xC3\xFE\xE2\xDC\xE8\x3D\x09\x2B\x14\x2B\xEC"
+                         "\x14\x78\xD2\x6B\x48\xC3\xC6\xE5\x97\xA7\xB2\xE4\x40\x27\xE1\xEC"
+                         "\xA2\x31\x78\xD3\xAF\xCC\x67\xBB\x53\x0A\x52\x9C\x7E\x13\x36\xE1"
+                         "\xAD\xAE\x74\xEF\x0B\xE9\xCD\x61\xE9\x1C\x6A\xEA\x57\xF7\xCC\xB2"
+                         "\x3B\x64\xB2\xF8\x48\x61\xCE\x15\x92\x09\xFE\xF7\xA8\x97\xA1\x6A"
+                         "\x87\x1A\xA9\x9E\x63\xA5\x12\x6D\xF2\xB0\x33\x87\xE4\x2C\x3D\x18"
+};
+
+xof_test_vector_t shake_128_255 = {
+       .alg = XOF_SHAKE_128, .len = 255,
+       .seed   = "\x3A\x3A\x81\x9C\x48\xEF\xDE\x2A\xD9\x14\xFB\xF0\x0E\x18\xAB\x6B"
+                         "\xC4\xF1\x45\x13\xAB\x27\xD0\xC1\x78\xA1\x88\xB6\x14\x31\xE7\xF5"
+                         "\x62\x3C\xB6\x6B\x23\x34\x67\x75\xD3\x86\xB5\x0E\x98\x2C\x49\x3A"
+                         "\xDB\xBF\xC5\x4B\x9A\x3C\xD3\x83\x38\x23\x36\xA1\xA0\xB2\x15\x0A"
+                         "\x15\x35\x8F\x33\x6D\x03\xAE\x18\xF6\x66\xC7\x57\x3D\x55\xC4\xFD"
+                         "\x18\x1C\x29\xE6\xCC\xFD\xE6\x3E\xA3\x5F\x0A\xDF\x58\x85\xCF\xC0"
+                         "\xA3\xD8\x4A\x2B\x2E\x4D\xD2\x44\x96\xDB\x78\x9E\x66\x31\x70\xCE"
+                         "\xF7\x47\x98\xAA\x1B\xBC\xD4\x57\x4E\xA0\xBB\xA4\x04\x89\xD7\x64"
+                         "\xB2\xF8\x3A\xAD\xC6\x6B\x14\x8B\x4A\x0C\xD9\x52\x46\xC1\x27\xD5"
+                         "\x87\x1C\x4F\x11\x41\x86\x90\xA5\xDD\xF0\x12\x46\xA0\xC8\x0A\x43"
+                         "\xC7\x00\x88\xB6\x18\x36\x39\xDC\xFD\xA4\x12\x5B\xD1\x13\xA8\xF4"
+                         "\x9E\xE2\x3E\xD3\x06\xFA\xAC\x57\x6C\x3F\xB0\xC1\xE2\x56\x67\x1D"
+                         "\x81\x7F\xC2\x53\x4A\x52\xF5\xB4\x39\xF7\x2E\x42\x4D\xE3\x76\xF4"
+                         "\xC5\x65\xCC\xA8\x23\x07\xDD\x9E\xF7\x6D\xA5\xB7\xC4\xEB\x7E\x08"
+                         "\x51\x72\xE3\x28\x80\x7C\x02\xD0\x11\xFF\xBF\x33\x78\x53\x78\xD7"
+                         "\x9D\xC2\x66\xF6\xA5\xBE\x6B\xB0\xE4\xA9\x2E\xCE\xEB\xAE\xB1",
+       .out_len = 512,
+       .out    = "\x14\x23\x6E\x75\xB9\x78\x4D\xF4\xF5\x79\x35\xF9\x45\x35\x6C\xBE"
+                         "\x38\x3F\xE5\x13\xED\x30\x28\x6F\x91\x06\x07\x59\xBC\xB0\xEF\x4B"
+                         "\xAA\xC8\x58\xEC\xAE\x7C\x6E\x7E\xDD\x49\x8F\x01\xA0\x82\xB6\x3F"
+                         "\xA5\x7D\x22\x54\x02\x31\xE2\xE2\x5C\x83\xEF\xB3\xB3\xF2\x95\x3A"
+                         "\x5F\x67\x45\x02\xAB\x63\x52\x26\x44\x6B\x84\x93\x76\x43\xDC\xD5"
+                         "\x78\x9E\xE7\x3F\x1D\x73\x4B\xC8\xFE\x5F\x7F\x08\x83\xAB\x10\x96"
+                         "\x1B\x9A\x31\xFF\x60\xDE\xE1\x61\x59\xBC\x69\x82\xEF\xB0\x85\x45"
+                         "\x98\x4B\xF7\x1F\xED\x1C\x4C\xD8\x1C\x09\x14\xB4\xC1\x9F\xCF\xEE"
+                         "\xF5\x4A\xF4\xBB\xE3\x72\xF1\x8C\xFC\xD3\xA1\x86\x57\xF5\xB9\x45"
+                         "\x0F\x99\xA7\x8F\x0F\xA2\xC3\xCD\xCA\x74\x61\xC4\xED\x75\x69\x53"
+                         "\x68\x83\xB6\x6C\xD8\x7E\x9C\x20\x09\x62\x90\x2E\xAA\x16\xA5\x4D"
+                         "\xB6\xA0\xA5\xCC\x26\xD8\x89\x03\x8C\x07\x60\x81\x0B\x5B\xB4\xF3"
+                         "\x3F\x1E\x5D\x63\x9B\x6F\x9B\xC7\xCA\x62\xBA\x6F\x8C\x9F\x8D\xE7"
+                         "\x70\x26\x0A\xFE\x47\xF4\xE0\xF8\x2F\x10\x21\x98\xEB\xA2\x7F\x54"
+                         "\x32\x52\xAC\x8D\xDD\x83\xE1\xB8\xDB\x0A\x91\xAC\x65\x63\x3F\xD1"
+                         "\x2A\x55\x0E\xBE\x96\xF9\x3A\xA6\x70\x4E\xD5\x90\x5C\x23\x4F\xA6"
+                         "\xD9\x20\x39\x10\xCB\xD0\x2D\xE1\x66\xC4\xC3\x34\x8F\xB8\x1E\xF7"
+                         "\xB8\x4A\xE1\x45\x5F\xE3\x18\xB5\xFD\x17\x08\x83\xF4\x9B\xA2\xF2"
+                         "\x42\x89\xC4\x79\xA2\xC7\x53\x14\x06\xBA\x98\x9B\xEA\xEF\x3A\x79"
+                         "\xF6\x59\x02\x86\x42\xE9\xB0\x33\xF7\xDE\xB9\xEC\xEC\x3A\x7A\x9F"
+                         "\x1D\xBD\x24\x51\xFC\xB4\x7C\x81\xE2\x1E\x91\xD2\x0B\x92\x4C\x6B"
+                         "\xD0\x4C\x1F\x0B\x27\x10\xD2\xE5\x70\xCD\x24\xBA\xD5\xB5\xDE\x4E"
+                         "\x49\xAA\x80\xB6\xAD\xD5\x50\x7B\x4D\x2E\x51\x03\x70\xC7\xAF\xA8"
+                         "\x14\xD7\xE1\xA7\xE2\x78\xE5\x3D\x7C\xCF\x49\xA0\xA8\x66\xCA\x3A"
+                         "\x7B\x5B\xB7\x1E\xF3\x42\x5E\x46\x0F\xEE\xB2\x91\x49\xF2\x17\x06"
+                         "\x66\x13\x69\x5F\x85\x50\x6A\x09\x46\xCF\x68\x97\x9F\x04\xAE\x07"
+                         "\x3A\xF8\x02\x89\x76\xBF\x0C\x5B\xDC\x22\x12\xE8\xC3\x64\x58\x3D"
+                         "\xE9\xFB\xD0\x3B\x34\xDD\xEE\x5E\xC4\xCF\xA8\xED\x8C\xE5\x92\x97"
+                         "\x1D\x01\x08\xFA\xF7\x6C\x89\x40\xE2\x5E\x6C\x5F\x86\x55\x84\xC3"
+                         "\x4A\x23\x3C\x14\xF0\x05\x32\x67\x3F\xDB\xE3\x88\xCC\x7E\x98\xA5"
+                         "\xB8\x67\xB1\xC5\x91\x30\x7A\x90\x15\x11\x2B\x56\x7F\xF6\xB4\xF3"
+                         "\x18\x11\x41\x11\xFC\x95\xE5\xBD\x7C\x9C\x60\xB7\x4C\x1F\x87\x25"
+};
+
+/**
+ * SHAKE-256 vectors from "https://github.com/gvanas/KeccakCodePackage/"
+ */
+xof_test_vector_t shake_256_0 = {
+       .alg = XOF_SHAKE_256, .len = 0,
+       .seed   = "",
+       .out_len = 512,
+       .out    = "\x46\xB9\xDD\x2B\x0B\xA8\x8D\x13\x23\x3B\x3F\xEB\x74\x3E\xEB\x24"
+                         "\x3F\xCD\x52\xEA\x62\xB8\x1B\x82\xB5\x0C\x27\x64\x6E\xD5\x76\x2F"
+                         "\xD7\x5D\xC4\xDD\xD8\xC0\xF2\x00\xCB\x05\x01\x9D\x67\xB5\x92\xF6"
+                         "\xFC\x82\x1C\x49\x47\x9A\xB4\x86\x40\x29\x2E\xAC\xB3\xB7\xC4\xBE"
+                         "\x14\x1E\x96\x61\x6F\xB1\x39\x57\x69\x2C\xC7\xED\xD0\xB4\x5A\xE3"
+                         "\xDC\x07\x22\x3C\x8E\x92\x93\x7B\xEF\x84\xBC\x0E\xAB\x86\x28\x53"
+                         "\x34\x9E\xC7\x55\x46\xF5\x8F\xB7\xC2\x77\x5C\x38\x46\x2C\x50\x10"
+                         "\xD8\x46\xC1\x85\xC1\x51\x11\xE5\x95\x52\x2A\x6B\xCD\x16\xCF\x86"
+                         "\xF3\xD1\x22\x10\x9E\x3B\x1F\xDD\x94\x3B\x6A\xEC\x46\x8A\x2D\x62"
+                         "\x1A\x7C\x06\xC6\xA9\x57\xC6\x2B\x54\xDA\xFC\x3B\xE8\x75\x67\xD6"
+                         "\x77\x23\x13\x95\xF6\x14\x72\x93\xB6\x8C\xEA\xB7\xA9\xE0\xC5\x8D"
+                         "\x86\x4E\x8E\xFD\xE4\xE1\xB9\xA4\x6C\xBE\x85\x47\x13\x67\x2F\x5C"
+                         "\xAA\xAE\x31\x4E\xD9\x08\x3D\xAB\x4B\x09\x9F\x8E\x30\x0F\x01\xB8"
+                         "\x65\x0F\x1F\x4B\x1D\x8F\xCF\x3F\x3C\xB5\x3F\xB8\xE9\xEB\x2E\xA2"
+                         "\x03\xBD\xC9\x70\xF5\x0A\xE5\x54\x28\xA9\x1F\x7F\x53\xAC\x26\x6B"
+                         "\x28\x41\x9C\x37\x78\xA1\x5F\xD2\x48\xD3\x39\xED\xE7\x85\xFB\x7F"
+                         "\x5A\x1A\xAA\x96\xD3\x13\xEA\xCC\x89\x09\x36\xC1\x73\xCD\xCD\x0F"
+                         "\xAB\x88\x2C\x45\x75\x5F\xEB\x3A\xED\x96\xD4\x77\xFF\x96\x39\x0B"
+                         "\xF9\xA6\x6D\x13\x68\xB2\x08\xE2\x1F\x7C\x10\xD0\x4A\x3D\xBD\x4E"
+                         "\x36\x06\x33\xE5\xDB\x4B\x60\x26\x01\xC1\x4C\xEA\x73\x7D\xB3\xDC"
+                         "\xF7\x22\x63\x2C\xC7\x78\x51\xCB\xDD\xE2\xAA\xF0\xA3\x3A\x07\xB3"
+                         "\x73\x44\x5D\xF4\x90\xCC\x8F\xC1\xE4\x16\x0F\xF1\x18\x37\x8F\x11"
+                         "\xF0\x47\x7D\xE0\x55\xA8\x1A\x9E\xDA\x57\xA4\xA2\xCF\xB0\xC8\x39"
+                         "\x29\xD3\x10\x91\x2F\x72\x9E\xC6\xCF\xA3\x6C\x6A\xC6\xA7\x58\x37"
+                         "\x14\x30\x45\xD7\x91\xCC\x85\xEF\xF5\xB2\x19\x32\xF2\x38\x61\xBC"
+                         "\xF2\x3A\x52\xB5\xDA\x67\xEA\xF7\xBA\xAE\x0F\x5F\xB1\x36\x9D\xB7"
+                         "\x8F\x3A\xC4\x5F\x8C\x4A\xC5\x67\x1D\x85\x73\x5C\xDD\xDB\x09\xD2"
+                         "\xB1\xE3\x4A\x1F\xC0\x66\xFF\x4A\x16\x2C\xB2\x63\xD6\x54\x12\x74"
+                         "\xAE\x2F\xCC\x86\x5F\x61\x8A\xBE\x27\xC1\x24\xCD\x8B\x07\x4C\xCD"
+                         "\x51\x63\x01\xB9\x18\x75\x82\x4D\x09\x95\x8F\x34\x1E\xF2\x74\xBD"
+                         "\xAB\x0B\xAE\x31\x63\x39\x89\x43\x04\xE3\x58\x77\xB0\xC2\x8A\x9B"
+                         "\x1F\xD1\x66\xC7\x96\xB9\xCC\x25\x8A\x06\x4A\x8F\x57\xE2\x7F\x2A"
+};
+
+xof_test_vector_t shake_256_64 = {
+       .alg = XOF_SHAKE_256, .len = 64,
+       .seed   = "\xE9\x26\xAE\x8B\x0A\xF6\xE5\x31\x76\xDB\xFF\xCC\x2A\x6B\x88\xC6"
+                         "\xBD\x76\x5F\x93\x9D\x3D\x17\x8A\x9B\xDE\x9E\xF3\xAA\x13\x1C\x61"
+                         "\xE3\x1C\x1E\x42\xCD\xFA\xF4\xB4\xDC\xDE\x57\x9A\x37\xE1\x50\xEF"
+                         "\xBE\xF5\x55\x5B\x4C\x1C\xB4\x04\x39\xD8\x35\xA7\x24\xE2\xFA\xE7",
+       .out_len = 512,
+       .out    = "\x77\xB7\x49\x6E\xD0\x8C\x39\x33\xBD\x75\x98\x3C\x0C\x04\x94\xBD"
+                         "\xD8\x26\x24\x93\xA4\xB5\x5D\xDC\xCC\x64\x16\x7E\x67\xEA\xC0\xF6"
+                         "\xE6\x30\x7A\xCC\x15\xC3\x3F\x39\x63\x74\x4E\x26\xCA\x6C\x50\x4D"
+                         "\x39\x3B\x3E\xE8\x16\x5E\x4D\x49\xEB\x3B\x6E\x64\x92\x07\x65\x30"
+                         "\x48\xF8\xB8\x22\xFF\x88\x4D\xC7\x49\x37\x44\x3B\x1C\x4A\x88\x8C"
+              "\x7A\x76\x8C\x63\xD5\xB5\xD2\x9E\x74\x46\x87\x39\x23\xB9\xD7\xA5"
+                         "\x6F\xA5\xD9\xE9\x07\x60\xAB\x86\xD5\x71\x8E\x34\x64\x82\x1B\x79"
+                         "\xEB\x46\xD1\x69\x14\x1F\xF1\x61\x20\xBF\xB6\x50\xC7\x6D\x4B\x3E"
+                         "\x5B\x3F\x6C\xE6\x1F\xEB\xDB\xE0\x9A\xED\x7F\x4C\x91\x06\x6D\x90"
+                         "\x3A\xF6\xE5\x65\x31\xE8\xFF\x71\x54\x95\x08\xB6\xE4\x20\xCA\xC6"
+                         "\xBE\xDF\xE0\xCB\xEA\xE6\xBC\x22\x84\x76\xBC\x8C\x00\xEA\xE4\x3D"
+                         "\x40\xC8\x2C\xBD\xF6\xB4\x60\xC3\x76\xD7\xC1\x16\x48\xEB\x28\x15"
+                         "\xB6\x50\x6A\xBD\x43\x39\xB2\x5D\x58\xD4\x5C\xDD\x0A\x0B\x9E\x35"
+                         "\xA8\x8E\x25\x1F\xDC\x34\xD4\x81\x0D\x65\x9D\x17\x9F\x59\xEB\xD0"
+                         "\x37\x17\xFD\x31\xA6\x39\x4C\xE1\x2C\xD5\x56\x90\x66\xE1\x38\x88"
+                         "\x5C\xB2\xBD\xEB\xBA\x06\x36\x75\x57\xCE\x84\x9E\xB8\x69\xF3\xCA"
+                         "\xC3\x88\x00\xD5\x1C\x22\xB6\x66\xAE\x27\x01\xE5\x80\x79\x63\x94"
+                         "\xDF\xA0\x2F\x49\x10\xBF\x5F\x86\xAA\xB5\x39\x51\x23\x33\x64\xEA"
+                         "\x20\xCD\xA3\x5A\xFB\xAB\x44\x5B\xE7\xF6\x86\x64\x38\x56\xF8\x25"
+                         "\x39\x4B\xE7\xB4\xB6\xD2\xC9\x18\xD0\x15\x1F\x46\xFB\x9A\xEE\x8A"
+                         "\x7B\xA2\xD7\x06\xE4\x8C\xB0\xBC\x42\x9B\x06\x42\x62\xC1\xA0\xEB"
+                         "\x35\x24\xFF\x14\x63\x2F\x51\x84\x57\x5C\x15\xF6\xF4\xA3\x44\x6E"
+                         "\x93\xCB\x4E\x86\xB6\xA9\x31\xBA\x26\x84\x09\xCE\x30\xB4\x59\x5F"
+                         "\xD2\x05\x9A\x27\x18\x3B\x3B\xA8\xD0\xAC\xE8\xE4\x82\x86\x6D\x5C"
+                         "\x7D\x5B\x03\xDB\x8D\xBD\x24\xB9\x9D\x59\xEB\x6E\xEF\xFD\x20\x9E"
+                         "\x12\x45\x35\xD1\x54\xB9\x8F\x99\x91\xD8\x4F\xE1\xAA\x76\x3C\x51"
+                         "\x33\xD4\x1E\xCC\x23\x39\x30\x95\x7D\xCE\xB7\x89\x6A\xF7\x0F\x73"
+                         "\x5A\x2F\x5C\x1E\x79\x48\x0A\xFD\x50\x94\x3B\xC5\x01\x4B\xCF\x0A"
+                         "\x73\x54\xAA\x7F\x71\x31\x63\xB5\x5A\x1E\x41\xBD\xD0\x5F\xBB\xA9"
+                         "\xC1\xDB\x2C\x69\x04\x3E\xD9\xEE\xA4\xFA\x45\xC9\x90\xCC\xB4\xA8"
+                         "\xDC\x41\xAF\xAB\x18\x16\x40\x18\xE5\x4C\x47\xAC\x5B\xD6\x98\x0F"
+                         "\xD7\x96\xAC\xF0\xDD\xB4\x2C\x70\x42\xA4\x87\x7E\x8B\xE3\xDE\x29"
+};
+
+xof_test_vector_t shake_256_135 = {
+       .alg = XOF_SHAKE_256, .len = 135,
+       .seed   = "\xB7\x71\xD5\xCE\xF5\xD1\xA4\x1A\x93\xD1\x56\x43\xD7\x18\x1D\x2A"
+                         "\x2E\xF0\xA8\xE8\x4D\x91\x81\x2F\x20\xED\x21\xF1\x47\xBE\xF7\x32"
+                         "\xBF\x3A\x60\xEF\x40\x67\xC3\x73\x4B\x85\xBC\x8C\xD4\x71\x78\x0F"
+                         "\x10\xDC\x9E\x82\x91\xB5\x83\x39\xA6\x77\xB9\x60\x21\x8F\x71\xE7"
+                         "\x93\xF2\x79\x7A\xEA\x34\x94\x06\x51\x28\x29\x06\x5D\x37\xBB\x55"
+                         "\xEA\x79\x6F\xA4\xF5\x6F\xD8\x89\x6B\x49\xB2\xCD\x19\xB4\x32\x15"
+                         "\xAD\x96\x7C\x71\x2B\x24\xE5\x03\x2D\x06\x52\x32\xE0\x2C\x12\x74"
+                         "\x09\xD2\xED\x41\x46\xB9\xD7\x5D\x76\x3D\x52\xDB\x98\xD9\x49\xD3"
+                         "\xB0\xFE\xD6\xA8\x05\x2F\xBB",
+       .out_len = 512,
+       .out    = "\x6C\x60\x95\x5D\xCB\x8A\x66\x3B\x6D\xC7\xF5\xEF\x7E\x06\x9C\xA8"
+                         "\xFE\x3D\xA9\x9A\x66\xDF\x65\x96\x92\x5D\x55\x7F\xED\x91\xF4\x70"
+                         "\x91\x40\x7D\x6F\xDE\x32\x02\x3B\x57\xE2\xEE\x4C\x6A\xC9\x7B\x07"
+                         "\x76\x24\xFA\xC2\x5F\x6E\x13\xF4\x19\x16\x96\xB4\x0A\x4D\xF7\x5F"
+                         "\x61\xCD\x55\x21\xD9\x82\xC6\xD0\x9D\x83\x42\xC1\x7A\x36\x6E\xC6"
+                         "\x34\x6E\x35\x28\xB2\x6C\xFF\x91\x5B\xE9\x44\x2B\x9E\xBC\xC3\x0F"
+                         "\xF2\xF6\xAD\xD0\xE8\x2B\xA9\x04\xC7\x37\x00\xCC\x99\xAC\xFF\x48"
+                         "\x0C\xAF\x04\x87\xCE\xE5\x4C\xBA\x37\x53\xB6\xA5\xDD\x6F\x0D\xFE"
+                         "\x65\x71\xF0\x11\x5E\x87\x37\xB0\x71\x03\x10\x23\xB6\xBB\x0D\x79"
+                         "\x86\x4C\x3F\x33\x16\x2E\x78\x26\x9C\xEE\x23\xFC\xE4\x7B\x91\xB4"
+                         "\xFD\xF9\x1F\x98\x46\x4A\x1D\x21\xE7\x99\xD1\x7F\x76\xC1\xBB\x80"
+                         "\x7D\xEE\x66\x7B\x0B\x27\x30\x54\xBE\x29\x82\x99\xBD\x12\xB7\xA8"
+                         "\x0F\xB3\x54\xCE\x3E\x6D\x1A\xCF\x98\x44\x38\x79\xA5\x54\xEC\xA6"
+                         "\xB9\x6D\xF0\x61\xD0\x4A\x11\x7C\x98\xAE\xEC\x1C\xDE\x1A\xFA\x9C"
+                         "\xEF\x62\xDD\x68\x6D\xA9\x1B\xB2\xB1\xF1\x23\x79\xBB\xDC\x9F\xA3"
+                         "\x2A\x6B\x69\x98\xB7\x7E\x8E\xB0\xB5\x05\x07\x86\x2A\xFA\x77\x99"
+                         "\xD0\x18\xE2\x72\x09\x1F\x51\xCA\xDD\x81\xAD\xB5\x87\xEF\x67\xBA"
+                         "\x67\x61\x8C\x45\xD1\xF3\xD5\x59\xDB\xD2\x99\xAB\xC2\x6E\xC7\x12"
+                         "\xDA\x8F\xA3\x4B\xA3\x3B\xFF\x40\x0D\x1F\x0F\x8B\x63\x45\xCF\x57"
+                         "\x26\x9B\x85\x85\x78\xC0\x07\x2A\x91\xA6\x3E\xF8\x5F\x9D\x37\x89"
+                         "\x00\xCD\x1A\x55\xD2\xBD\x46\x30\xDB\x82\x9E\xB4\x84\xD8\x9C\xE7"
+                         "\xA4\x14\xAC\xA1\x73\xC5\x25\x34\xAD\x5F\x93\x55\xE8\x0E\x39\x5E"
+                         "\x79\x15\x6D\x75\x1A\x93\x0F\x7F\x8B\x5D\x9F\x4D\x5A\x2C\x9A\x75"
+                         "\x37\x23\x08\x3C\x5E\x8E\xC6\xCB\x24\xD8\xEF\x93\xC8\xFE\xF2\xD1"
+                         "\xBE\x4E\xCA\x22\x2C\x6E\x6C\x2A\xCF\xD6\x84\x89\x3C\xEA\x65\xCB"
+                         "\xF5\xB0\x96\xB3\xD8\x66\x00\x71\x36\x12\x6A\x33\xEF\x49\x6B\xF2"
+                         "\x31\x0F\x29\x3B\xFA\x4C\x93\xAB\x82\x68\x21\xE2\xB9\x32\x59\xC4"
+                         "\x64\xE0\xAE\xB0\x6D\x6D\xF8\xFF\xA3\x0B\x1C\x1E\x7E\x38\x4C\x7E"
+                         "\x42\x7A\x2B\xA3\xD9\x9F\xF8\xA6\x66\x38\x0C\x5C\x1B\x67\x8F\x74"
+                         "\x2C\x57\xB0\xC3\xB0\x88\x49\xFD\x65\x30\x0D\xF1\x34\x99\xDD\x89"
+                         "\x4E\xFC\x33\x11\x6E\x7D\x07\x74\x06\x43\x31\xFD\xD4\x07\x48\x74"
+                         "\x17\xD1\x3B\xBA\x42\x85\x29\x9A\xF6\x50\xD3\x06\x5D\x95\x11\x31"
+};
+
+xof_test_vector_t shake_256_136 = {
+       .alg = XOF_SHAKE_256, .len = 136,
+       .seed   = "\xB3\x2D\x95\xB0\xB9\xAA\xD2\xA8\x81\x6D\xE6\xD0\x6D\x1F\x86\x00"
+                         "\x85\x05\xBD\x8C\x14\x12\x4F\x6E\x9A\x16\x3B\x5A\x2A\xDE\x55\xF8"
+                         "\x35\xD0\xEC\x38\x80\xEF\x50\x70\x0D\x3B\x25\xE4\x2C\xC0\xAF\x05"
+                         "\x0C\xCD\x1B\xE5\xE5\x55\xB2\x30\x87\xE0\x4D\x7B\xF9\x81\x36\x22"
+                         "\x78\x0C\x73\x13\xA1\x95\x4F\x87\x40\xB6\xEE\x2D\x3F\x71\xF7\x68"
+                         "\xDD\x41\x7F\x52\x04\x82\xBD\x3A\x08\xD4\xF2\x22\xB4\xEE\x9D\xBD"
+                         "\x01\x54\x47\xB3\x35\x07\xDD\x50\xF3\xAB\x42\x47\xC5\xDE\x9A\x8A"
+                         "\xBD\x62\xA8\xDE\xCE\xA0\x1E\x3B\x87\xC8\xB9\x27\xF5\xB0\x8B\xEB"
+                         "\x37\x67\x4C\x6F\x8E\x38\x0C\x04",
+       .out_len = 512,
+       .out    = "\xCC\x2E\xAA\x04\xEE\xF8\x47\x9C\xDA\xE8\x56\x6E\xB8\xFF\xA1\x10"
+                         "\x0A\x40\x79\x95\xBF\x99\x9A\xE9\x7E\xDE\x52\x66\x81\xDC\x34\x90"
+                         "\x61\x6F\x28\x44\x2D\x20\xDA\x92\x12\x4C\xE0\x81\x58\x8B\x81\x49"
+                         "\x1A\xED\xF6\x5C\xAA\xF0\xD2\x7E\x82\xA4\xB0\xE1\xD1\xCA\xB2\x38"
+                         "\x33\x32\x8F\x1B\x8D\xA4\x30\xC8\xA0\x87\x66\xA8\x63\x70\xFA\x84"
+                         "\x8A\x79\xB5\x99\x8D\xB3\xCF\xFD\x05\x7B\x96\xE1\xE2\xEE\x0E\xF2"
+                         "\x29\xEC\xA1\x33\xC1\x55\x48\xF9\x83\x99\x02\x04\x37\x30\xE4\x4B"
+                         "\xC5\x2C\x39\xFA\xDC\x1D\xDE\xEA\xD9\x5F\x99\x39\xF2\x20\xCA\x30"
+                         "\x06\x61\x54\x0D\xF7\xED\xD9\xAF\x37\x8A\x5D\x4A\x19\xB2\xB9\x3E"
+                         "\x6C\x78\xF4\x9C\x35\x33\x43\xA0\xB5\xF1\x19\x13\x2B\x53\x12\xD0"
+                         "\x04\x83\x1D\x01\x76\x9A\x31\x6D\x2F\x51\xBF\x64\xCC\xB2\x0A\x21"
+                         "\xC2\xCF\x7A\xC8\xFB\x6F\x6E\x90\x70\x61\x26\xBD\xAE\x06\x11\xDD"
+                         "\x13\x96\x2E\x8B\x53\xD6\xEA\xE2\x6C\x7B\x0D\x25\x51\xDA\xF6\x24"
+                         "\x8E\x9D\x65\x81\x73\x82\xB0\x4D\x23\x39\x2D\x10\x8E\x4D\x34\x43"
+                         "\xDE\x5A\xDC\x72\x73\xC7\x21\xA8\xF8\x32\x0E\xCF\xE8\x17\x7A\xC0"
+                         "\x67\xCA\x8A\x50\x16\x9A\x6E\x73\x00\x0E\xBC\xDC\x1E\x4E\xE6\x33"
+                         "\x9F\xC8\x67\xC3\xD7\xAE\xAB\x84\x14\x63\x98\xD7\xBA\xDE\x12\x1D"
+                         "\x19\x89\xFA\x45\x73\x35\x56\x4E\x97\x57\x70\xA3\xA0\x02\x59\xCA"
+                         "\x08\x70\x61\x08\x26\x1A\xA2\xD3\x4D\xE0\x0F\x8C\xAC\x7D\x45\xD3"
+                         "\x5E\x5A\xA6\x3E\xA6\x9E\x1D\x1A\x2F\x7D\xAB\x39\x00\xD5\x1E\x0B"
+                         "\xC6\x53\x48\xA2\x55\x54\x00\x70\x39\xA5\x2C\x3C\x30\x99\x80\xD1"
+                         "\x7C\xAD\x20\xF1\x15\x63\x10\xA3\x9C\xD3\x93\x76\x0C\xFE\x58\xF6"
+                         "\xF8\xAD\xE4\x21\x31\x28\x82\x80\xA3\x5E\x1D\xB8\x70\x81\x83\xB9"
+                         "\x1C\xFA\xF5\x82\x7E\x96\xB0\xF7\x74\xC4\x50\x93\xB4\x17\xAF\xF9"
+                         "\xDD\x64\x17\xE5\x99\x64\xA0\x1B\xD2\xA6\x12\xFF\xCF\xBA\x18\xA0"
+                         "\xF1\x93\xDB\x29\x7B\x9A\x6C\xC1\xD2\x70\xD9\x7A\xAE\x8F\x8A\x3A"
+                         "\x6B\x26\x69\x5A\xB6\x64\x31\xC2\x02\xE1\x39\xD6\x3D\xD3\xA2\x47"
+                         "\x78\x67\x6C\xEF\xE3\xE2\x1B\x02\xEC\x4E\x8F\x5C\xFD\x66\x58\x7A"
+                         "\x12\xB4\x40\x78\xFC\xD3\x9E\xEE\x44\xBB\xEF\x4A\x94\x9A\x63\xC0"
+                         "\xDF\xD5\x8C\xF2\xFB\x2C\xD5\xF0\x02\xE2\xB0\x21\x92\x66\xCF\xC0"
+                         "\x31\x81\x74\x86\xDE\x70\xB4\x28\x5A\x8A\x70\xF3\xD3\x8A\x61\xD3"
+                         "\x15\x5D\x99\xAA\xF4\xC2\x53\x90\xD7\x36\x45\xAB\x3E\x8D\x80\xF0"
+};
+
+xof_test_vector_t shake_256_255 = {
+       .alg = XOF_SHAKE_256, .len = 255,
+       .seed   = "\x3A\x3A\x81\x9C\x48\xEF\xDE\x2A\xD9\x14\xFB\xF0\x0E\x18\xAB\x6B"
+                         "\xC4\xF1\x45\x13\xAB\x27\xD0\xC1\x78\xA1\x88\xB6\x14\x31\xE7\xF5"
+                         "\x62\x3C\xB6\x6B\x23\x34\x67\x75\xD3\x86\xB5\x0E\x98\x2C\x49\x3A"
+                         "\xDB\xBF\xC5\x4B\x9A\x3C\xD3\x83\x38\x23\x36\xA1\xA0\xB2\x15\x0A"
+                         "\x15\x35\x8F\x33\x6D\x03\xAE\x18\xF6\x66\xC7\x57\x3D\x55\xC4\xFD"
+                         "\x18\x1C\x29\xE6\xCC\xFD\xE6\x3E\xA3\x5F\x0A\xDF\x58\x85\xCF\xC0"
+                         "\xA3\xD8\x4A\x2B\x2E\x4D\xD2\x44\x96\xDB\x78\x9E\x66\x31\x70\xCE"
+                         "\xF7\x47\x98\xAA\x1B\xBC\xD4\x57\x4E\xA0\xBB\xA4\x04\x89\xD7\x64"
+                         "\xB2\xF8\x3A\xAD\xC6\x6B\x14\x8B\x4A\x0C\xD9\x52\x46\xC1\x27\xD5"
+                         "\x87\x1C\x4F\x11\x41\x86\x90\xA5\xDD\xF0\x12\x46\xA0\xC8\x0A\x43"
+                         "\xC7\x00\x88\xB6\x18\x36\x39\xDC\xFD\xA4\x12\x5B\xD1\x13\xA8\xF4"
+                         "\x9E\xE2\x3E\xD3\x06\xFA\xAC\x57\x6C\x3F\xB0\xC1\xE2\x56\x67\x1D"
+                         "\x81\x7F\xC2\x53\x4A\x52\xF5\xB4\x39\xF7\x2E\x42\x4D\xE3\x76\xF4"
+                         "\xC5\x65\xCC\xA8\x23\x07\xDD\x9E\xF7\x6D\xA5\xB7\xC4\xEB\x7E\x08"
+                         "\x51\x72\xE3\x28\x80\x7C\x02\xD0\x11\xFF\xBF\x33\x78\x53\x78\xD7"
+                         "\x9D\xC2\x66\xF6\xA5\xBE\x6B\xB0\xE4\xA9\x2E\xCE\xEB\xAE\xB1",
+       .out_len = 512,
+       .out    = "\x8A\x51\x99\xB4\xA7\xE1\x33\xE2\x64\xA8\x62\x02\x72\x06\x55\x89"
+                         "\x4D\x48\xCF\xF3\x44\xA9\x28\xCF\x83\x47\xF4\x83\x79\xCE\xF3\x47"
+                         "\xDF\xC5\xBC\xFF\xAB\x99\xB2\x7B\x1F\x89\xAA\x27\x35\xE2\x3D\x30"
+                         "\x08\x8F\xFA\x03\xB9\xED\xB0\x2B\x96\x35\x47\x0A\xB9\xF1\x03\x89"
+                         "\x85\xD5\x5F\x9C\xA7\x74\x57\x2D\xD0\x06\x47\x0E\xA6\x51\x45\x46"
+                         "\x96\x09\xF9\xFA\x08\x31\xBF\x1F\xFD\x84\x2D\xC2\x4A\xCA\xDE\x27"
+                         "\xBD\x98\x16\xE3\xB5\xBF\x28\x76\xCB\x11\x22\x32\xA0\xEB\x44\x75"
+                         "\xF1\xDF\xF9\xF5\xC7\x13\xD9\xFF\xD4\xCC\xB8\x9A\xE5\x60\x7F\xE3"
+                         "\x57\x31\xDF\x06\x31\x79\x49\xEE\xF6\x46\xE9\x59\x1C\xF3\xBE\x53"
+                         "\xAD\xD6\xB7\xDD\x2B\x60\x96\xE2\xB3\xFB\x06\xE6\x62\xEC\x8B\x2D"
+                         "\x77\x42\x2D\xAA\xD9\x46\x3C\xD1\x55\x20\x4A\xCD\xBD\x38\xE3\x19"
+                         "\x61\x3F\x39\xF9\x9B\x6D\xFB\x35\xCA\x93\x65\x16\x00\x66\xDB\x19"
+                         "\x83\x58\x88\xC2\x24\x1F\xF9\xA7\x31\xA4\xAC\xBB\x56\x63\x72\x7A"
+                         "\xAC\x34\xA4\x01\x24\x7F\xBA\xA7\x49\x9E\x7D\x5E\xE5\xB6\x9D\x31"
+                         "\x02\x5E\x63\xD0\x4C\x35\xC7\x98\xBC\xA1\x26\x2D\x56\x73\xA9\xCF"
+                         "\x09\x30\xB5\xAD\x89\xBD\x48\x55\x99\xDC\x18\x45\x28\xDA\x47\x90"
+                         "\xF0\x88\xEB\xD1\x70\xB6\x35\xD9\x58\x16\x32\xD2\xFF\x90\xDB\x79"
+                         "\x66\x5C\xED\x43\x00\x89\xAF\x13\xC9\xF2\x1F\x6D\x44\x3A\x81\x80"
+                         "\x64\xF1\x7A\xEC\x9E\x9C\x54\x57\x00\x1F\xA8\xDC\x6A\xFB\xAD\xBE"
+                         "\x31\x38\xF3\x88\xD8\x9D\x0E\x6F\x22\xF6\x66\x71\x25\x5B\x21\x07"
+                         "\x54\xED\x63\xD8\x1D\xCE\x75\xCE\x8F\x18\x9B\x53\x4E\x6D\x6B\x35"
+                         "\x39\xAA\x51\xE8\x37\xC4\x2D\xF9\xDF\x59\xC7\x1E\x61\x71\xCD\x49"
+                         "\x02\xFE\x1B\xDC\x73\xFB\x17\x75\xB5\xC7\x54\xA1\xED\x4E\xA7\xF3"
+                         "\x10\x5F\xC5\x43\xEE\x04\x18\xDA\xD2\x56\xF3\xF6\x11\x8E\xA7\x71"
+                         "\x14\xA1\x6C\x15\x35\x5B\x42\x87\x7A\x1D\xB2\xA7\xDF\x0E\x15\x5A"
+                         "\xE1\xD8\x67\x0A\xBC\xEC\x34\x50\xF4\xE2\xEE\xC9\x83\x8F\x89\x54"
+                         "\x23\xEF\x63\xD2\x61\x13\x8B\xAA\xF5\xD9\xF1\x04\xCB\x5A\x95\x7A"
+                         "\xEA\x06\xC0\xB9\xB8\xC7\x8B\x0D\x44\x17\x96\xDC\x03\x50\xDD\xEA"
+                         "\xBB\x78\xA3\x3B\x6F\x1F\x9E\x68\xED\xE3\xD1\x80\x5C\x7B\x7E\x2C"
+                         "\xFD\x54\xE0\xFA\xD6\x2F\x0D\x8C\xA6\x7A\x77\x5D\xC4\x54\x6A\xF9"
+                         "\x09\x6F\x2E\xDB\x22\x1D\xB4\x28\x43\xD6\x53\x27\x86\x12\x82\xDC"
+                         "\x94\x6A\x0B\xA0\x1A\x11\x86\x3A\xB2\xD1\xDF\xD1\x6E\x39\x73\xD4"
+};