Just on this note, I wonder if Keccak might actually be quite a neat fit for several parts of this construction, rather than just avoiding the SHA-2 length-extension issue. A small Keccak sponge implementation could provide:
- KMAC for the keyed resource-class derivation;
- SHAKE for
hll_hash_into_ring, instead of manually extending SHA-512 withhash(prefix || counter); - clean domain separation / structured hashing (TupleHash) for the various distinct hash roles.
I will confess that I don’t have a full understanding of the proposal here (haven’t sat down and thought about the whole); this might just be rose-tinted glasses after gaining an appreciation for the algorithmic elegance of Keccak/SHA3 in the course of implementing KangarooTwelve.jl ![]()