binius_hash/groestl/
compression.rs

1// Copyright 2024-2025 Irreducible Inc.
2
3use digest::Output;
4
5use super::digest::Groestl256;
6use crate::{
7	groestl::{GroestlShortImpl, GroestlShortInternal},
8	PseudoCompressionFunction,
9};
10
11/// One-way compression function that compresses two 32-byte strings into a single 32-byte string.
12///
13/// This operation is the Grøstl-256 output transformation, described in section 3.3 of the
14/// [Grøstl] specification. Section 4.6 explains that the output transformation is based on the
15/// Matyas-Meyer-Oseas construction for hash functions based on block ciphers. The section argues
16/// that the output transformation $\omega$ is one-way and collision resistant, based on the
17/// security of the P permutation.
18///
19/// [Grøstl]: <https://www.groestl.info/Groestl.pdf>
20#[derive(Debug, Default, Clone)]
21pub struct Groestl256ByteCompression;
22
23impl PseudoCompressionFunction<Output<Groestl256>, 2> for Groestl256ByteCompression {
24	fn compress(&self, input: [Output<Groestl256>; 2]) -> Output<Groestl256> {
25		let mut state_bytes = [0u8; 64];
26		let (half0, half1) = state_bytes.split_at_mut(32);
27		half0.copy_from_slice(&input[0]);
28		half1.copy_from_slice(&input[1]);
29		let input = GroestlShortImpl::state_from_bytes(&state_bytes);
30		let mut state = input;
31		GroestlShortImpl::p_perm(&mut state);
32		GroestlShortImpl::xor_state(&mut state, &input);
33		state_bytes = GroestlShortImpl::state_to_bytes(&state);
34		*<Output<Groestl256>>::from_slice(&state_bytes[32..])
35	}
36}
binius_hash/groestl/compression.rs

binius_hash/groestl/
compression.rs
