feat: update RPO's padding rule to use that in the xHash paper (#318)

src/hash/rescue/rpx/mod.rs

@@ -11,6 +11,9 @@ use super::{
 mod digest;
 pub use digest::{RpxDigest, RpxDigestError};
 
+#[cfg(test)]
+mod tests;
+
 pub type CubicExtElement = CubeExtension<Felt>;
 
 // HASHER IMPLEMENTATION
@@ -55,7 +58,7 @@ pub type CubicExtElement = CubeExtension<Felt>;
 ///
 /// Thus, if the underlying data consists of valid field elements, it might make more sense
 /// to deserialize them into field elements and then hash them using
-/// [hash_elements()](Rpx256::hash_elements) function rather then hashing the serialized bytes
+/// [hash_elements()](Rpx256::hash_elements) function rather than hashing the serialized bytes
 /// using [hash()](Rpx256::hash) function.
 ///
 /// ## Domain separation
@@ -68,6 +71,10 @@ pub type CubicExtElement = CubeExtension<Felt>;
 /// the bottleneck for the security bound of the sponge in overwrite-mode only when it is
 /// lower than 2^128, we see that the target 128-bit security level is maintained as long as
 /// the size of the domain identifier space, including for padding, is less than 2^128.
+///
+/// ## Hashing of empty input
+/// The current implementation hashes empty input to the zero digest [0, 0, 0, 0]. This has
+/// the benefit of requiring no calls to the RPX permutation when hashing empty input.
 #[derive(Debug, Copy, Clone, Eq, PartialEq)]
 pub struct Rpx256();
 
@@ -99,11 +106,18 @@ impl Hasher for Rpx256 {
         // into the state.
         //
         // every time the rate range is filled, a permutation is performed. if the final value of
-        // `i` is not zero, then the chunks count wasn't enough to fill the state range, and an
-        // additional permutation must be performed.
-        let i = bytes.chunks(BINARY_CHUNK_SIZE).fold(0, |i, chunk| {
+        // `rate_pos` is not zero, then the chunks count wasn't enough to fill the state range,
+        // and an additional permutation must be performed.
+        let mut current_chunk_idx = 0_usize;
+        // handle the case of an empty `bytes`
+        let last_chunk_idx = if num_field_elem == 0 {
+            current_chunk_idx
+        } else {
+            num_field_elem - 1
+        };
+        let rate_pos = bytes.chunks(BINARY_CHUNK_SIZE).fold(0, |rate_pos, chunk| {
             // copy the chunk into the buffer
-            if i != num_field_elem - 1 {
+            if current_chunk_idx != last_chunk_idx {
                 buf[..BINARY_CHUNK_SIZE].copy_from_slice(chunk);
             } else {
                 // on the last iteration, we pad `buf` with a 1 followed by as many 0's as are
@@ -112,18 +126,19 @@ impl Hasher for Rpx256 {
                 buf[..chunk.len()].copy_from_slice(chunk);
                 buf[chunk.len()] = 1;
             }
+            current_chunk_idx += 1;
 
             // set the current rate element to the input. since we take at most 7 bytes, we are
             // guaranteed that the inputs data will fit into a single field element.
-            state[RATE_RANGE.start + i] = Felt::new(u64::from_le_bytes(buf));
+            state[RATE_RANGE.start + rate_pos] = Felt::new(u64::from_le_bytes(buf));
 
             // proceed filling the range. if it's full, then we apply a permutation and reset the
             // counter to the beginning of the range.
-            if i == RATE_WIDTH - 1 {
+            if rate_pos == RATE_WIDTH - 1 {
                 Self::apply_permutation(&mut state);
                 0
             } else {
-                i + 1
+                rate_pos + 1
             }
         });
 
@@ -132,8 +147,8 @@ impl Hasher for Rpx256 {
         // don't need to apply any extra padding because the first capacity element contains a
         // flag indicating the number of field elements constituting the last block when the latter
         // is not divisible by `RATE_WIDTH`.
-        if i != 0 {
-            state[RATE_RANGE.start + i..RATE_RANGE.end].fill(ZERO);
+        if rate_pos != 0 {
+            state[RATE_RANGE.start + rate_pos..RATE_RANGE.end].fill(ZERO);
             Self::apply_permutation(&mut state);
         }
 
@@ -172,7 +187,7 @@ impl Hasher for Rpx256 {
             state[CAPACITY_RANGE.start] = Felt::from(6_u8);
         }
 
-        // apply the RPX permutation and return the first four elements of the state
+        // apply the RPX permutation and return the first four elements of the rate
         Self::apply_permutation(&mut state);
         RpxDigest::new(state[DIGEST_RANGE].try_into().unwrap())
     }

src/hash/rescue/rpx/tests.rs

@@ -0,0 +1,186 @@
+use alloc::{collections::BTreeSet, vec::Vec};
+
+use proptest::prelude::*;
+use rand_utils::rand_value;
+
+use super::{Felt, Hasher, Rpx256, StarkField, ZERO};
+use crate::{hash::rescue::RpxDigest, ONE};
+
+#[test]
+fn hash_elements_vs_merge() {
+    let elements = [Felt::new(rand_value()); 8];
+
+    let digests: [RpxDigest; 2] = [
+        RpxDigest::new(elements[..4].try_into().unwrap()),
+        RpxDigest::new(elements[4..].try_into().unwrap()),
+    ];
+
+    let m_result = Rpx256::merge(&digests);
+    let h_result = Rpx256::hash_elements(&elements);
+    assert_eq!(m_result, h_result);
+}
+
+#[test]
+fn merge_vs_merge_in_domain() {
+    let elements = [Felt::new(rand_value()); 8];
+
+    let digests: [RpxDigest; 2] = [
+        RpxDigest::new(elements[..4].try_into().unwrap()),
+        RpxDigest::new(elements[4..].try_into().unwrap()),
+    ];
+    let merge_result = Rpx256::merge(&digests);
+
+    // ----- merge with domain = 0 ----------------------------------------------------------------
+
+    // set domain to ZERO. This should not change the result.
+    let domain = ZERO;
+
+    let merge_in_domain_result = Rpx256::merge_in_domain(&digests, domain);
+    assert_eq!(merge_result, merge_in_domain_result);
+
+    // ----- merge with domain = 1 ----------------------------------------------------------------
+
+    // set domain to ONE. This should change the result.
+    let domain = ONE;
+
+    let merge_in_domain_result = Rpx256::merge_in_domain(&digests, domain);
+    assert_ne!(merge_result, merge_in_domain_result);
+}
+
+#[test]
+fn hash_elements_vs_merge_with_int() {
+    let tmp = [Felt::new(rand_value()); 4];
+    let seed = RpxDigest::new(tmp);
+
+    // ----- value fits into a field element ------------------------------------------------------
+    let val: Felt = Felt::new(rand_value());
+    let m_result = Rpx256::merge_with_int(seed, val.as_int());
+
+    let mut elements = seed.as_elements().to_vec();
+    elements.push(val);
+    let h_result = Rpx256::hash_elements(&elements);
+
+    assert_eq!(m_result, h_result);
+
+    // ----- value does not fit into a field element ----------------------------------------------
+    let val = Felt::MODULUS + 2;
+    let m_result = Rpx256::merge_with_int(seed, val);
+
+    let mut elements = seed.as_elements().to_vec();
+    elements.push(Felt::new(val));
+    elements.push(ONE);
+    let h_result = Rpx256::hash_elements(&elements);
+
+    assert_eq!(m_result, h_result);
+}
+
+#[test]
+fn hash_padding() {
+    // adding a zero bytes at the end of a byte string should result in a different hash
+    let r1 = Rpx256::hash(&[1_u8, 2, 3]);
+    let r2 = Rpx256::hash(&[1_u8, 2, 3, 0]);
+    assert_ne!(r1, r2);
+
+    // same as above but with bigger inputs
+    let r1 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6]);
+    let r2 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6, 0]);
+    assert_ne!(r1, r2);
+
+    // same as above but with input splitting over two elements
+    let r1 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6, 7]);
+    let r2 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6, 7, 0]);
+    assert_ne!(r1, r2);
+
+    // same as above but with multiple zeros
+    let r1 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6, 7, 0, 0]);
+    let r2 = Rpx256::hash(&[1_u8, 2, 3, 4, 5, 6, 7, 0, 0, 0, 0]);
+    assert_ne!(r1, r2);
+}
+
+#[test]
+fn hash_elements_padding() {
+    let e1 = [Felt::new(rand_value()); 2];
+    let e2 = [e1[0], e1[1], ZERO];
+
+    let r1 = Rpx256::hash_elements(&e1);
+    let r2 = Rpx256::hash_elements(&e2);
+    assert_ne!(r1, r2);
+}
+
+#[test]
+fn hash_elements() {
+    let elements = [
+        ZERO,
+        ONE,
+        Felt::new(2),
+        Felt::new(3),
+        Felt::new(4),
+        Felt::new(5),
+        Felt::new(6),
+        Felt::new(7),
+    ];
+
+    let digests: [RpxDigest; 2] = [
+        RpxDigest::new(elements[..4].try_into().unwrap()),
+        RpxDigest::new(elements[4..8].try_into().unwrap()),
+    ];
+
+    let m_result = Rpx256::merge(&digests);
+    let h_result = Rpx256::hash_elements(&elements);
+    assert_eq!(m_result, h_result);
+}
+
+#[test]
+fn hash_empty() {
+    let elements: Vec<Felt> = vec![];
+
+    let zero_digest = RpxDigest::default();
+    let h_result = Rpx256::hash_elements(&elements);
+    assert_eq!(zero_digest, h_result);
+}
+
+#[test]
+fn hash_empty_bytes() {
+    let bytes: Vec<u8> = vec![];
+
+    let zero_digest = RpxDigest::default();
+    let h_result = Rpx256::hash(&bytes);
+    assert_eq!(zero_digest, h_result);
+}
+
+#[test]
+fn sponge_bytes_with_remainder_length_wont_panic() {
+    // this test targets to assert that no panic will happen with the edge case of having an inputs
+    // with length that is not divisible by the used binary chunk size. 113 is a non-negligible
+    // input length that is prime; hence guaranteed to not be divisible by any choice of chunk
+    // size.
+    //
+    // this is a preliminary test to the fuzzy-stress of proptest.
+    Rpx256::hash(&[0; 113]);
+}
+
+#[test]
+fn sponge_collision_for_wrapped_field_element() {
+    let a = Rpx256::hash(&[0; 8]);
+    let b = Rpx256::hash(&Felt::MODULUS.to_le_bytes());
+    assert_ne!(a, b);
+}
+
+#[test]
+fn sponge_zeroes_collision() {
+    let mut zeroes = Vec::with_capacity(255);
+    let mut set = BTreeSet::new();
+    (0..255).for_each(|_| {
+        let hash = Rpx256::hash(&zeroes);
+        zeroes.push(0);
+        // panic if a collision was found
+        assert!(set.insert(hash));
+    });
+}
+
+proptest! {
+    #[test]
+    fn rpo256_wont_panic_with_arbitrary_input(ref bytes in any::<Vec<u8>>()) {
+        Rpx256::hash(bytes);
+    }
+}