From fa5997520000364231ca335c28069d8e8d7c407c Mon Sep 17 00:00:00 2001
From: zhang_haisong <zhang_haisong@itrus.com.cn>
Date: Wed, 19 Mar 2025 16:10:52 +0800
Subject: [PATCH] fix: correct AsconCXof128 impl and add tests with ascon-c
 vectors

---
 .../crypto/digests/AsconBaseDigest.java       |  1 +
 .../crypto/digests/AsconCXof128.java          |  3 +-
 .../bouncycastle/crypto/test/AsconTest.java   | 55 +++++++++++++++++++
 3 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/org/bouncycastle/crypto/digests/AsconBaseDigest.java b/core/src/main/java/org/bouncycastle/crypto/digests/AsconBaseDigest.java
index fe53fb5edc..29c77cc83b 100644
--- a/core/src/main/java/org/bouncycastle/crypto/digests/AsconBaseDigest.java
+++ b/core/src/main/java/org/bouncycastle/crypto/digests/AsconBaseDigest.java
@@ -53,6 +53,7 @@ protected void padAndAbsorb()
     {
         p.x0 ^= loadBytes(m_buf, 0, m_bufPos) ^ pad(m_bufPos);
         p.p(12);
+        m_bufPos = 0;
     }
 
     protected void squeeze(byte[] output, int outOff, int len)
diff --git a/core/src/main/java/org/bouncycastle/crypto/digests/AsconCXof128.java b/core/src/main/java/org/bouncycastle/crypto/digests/AsconCXof128.java
index 3df7d1a538..5d77eae15b 100644
--- a/core/src/main/java/org/bouncycastle/crypto/digests/AsconCXof128.java
+++ b/core/src/main/java/org/bouncycastle/crypto/digests/AsconCXof128.java
@@ -125,8 +125,7 @@ public void reset()
     private void initState(byte[] z, int zOff, int zLen)
     {
         p.set(7445901275803737603L, 4886737088792722364L, -1616759365661982283L, 3076320316797452470L, -8124743304765850554L);
-        long bitLength = ((long)zLen) << 3;
-        Pack.longToLittleEndian(bitLength, m_buf, 0);
+        p.x0 ^= ((long)zLen) << 3;
         p.p(12);
         update(z, zOff, zLen);
         padAndAbsorb();
diff --git a/core/src/test/java/org/bouncycastle/crypto/test/AsconTest.java b/core/src/test/java/org/bouncycastle/crypto/test/AsconTest.java
index 50374ee564..1d0684db60 100644
--- a/core/src/test/java/org/bouncycastle/crypto/test/AsconTest.java
+++ b/core/src/test/java/org/bouncycastle/crypto/test/AsconTest.java
@@ -47,6 +47,7 @@ public void performTest()
         testVectorsEngine_asconaead128();
         testVectorsDigest_AsconHash256();
         testVectorsXof_AsconXof128();
+        testVectorsAsconCXof128_512();
 
         testBufferingEngine_asconaead128();
         testBufferingEngine_ascon128();
@@ -514,6 +515,12 @@ public void testVectorsXof_AsconXof128()
         implTestVectorsXof(new AsconXof128(), "crypto/ascon/asconxof128", "LWC_HASH_KAT_256.txt");
     }
 
+    public void testVectorsAsconCXof128_512()
+            throws Exception
+    {
+        implTestVectorsAsconCXof128(512 / 8, "crypto/ascon/asconcxof128", "LWC_CXOF_KAT_128_512.txt");
+    }
+
     public void testVectorsXof_AsconXof()
         throws Exception
     {
@@ -1211,6 +1218,54 @@ private void implTestVectorsXof(Xof ascon, String path, String filename)
         }
     }
 
+    private void implTestVectorsAsconCXof128(int hash_length, String path, String filename)
+            throws Exception
+    {
+        Random random = new Random();
+
+        InputStream src = TestResourceFinder.findTestResource(path, filename);
+        BufferedReader bin = new BufferedReader(new InputStreamReader(src));
+        String line;
+        HashMap<String, String> map = new HashMap<String, String>();
+        while ((line = bin.readLine()) != null)
+        {
+            int a = line.indexOf('=');
+            if (a < 0)
+            {
+                byte[] zByte = Hex.decode((String)map.get("Z"));
+                byte[] ptByte = Hex.decode((String)map.get("Msg"));
+                byte[] expected = Hex.decode((String)map.get("MD"));
+
+                byte[] hash = new byte[hash_length];
+
+                AsconCXof128 ascon = new AsconCXof128(zByte);
+                ascon.update(ptByte, 0, ptByte.length);
+                ascon.doFinal(hash, 0, hash_length);
+                if (!areEqual(hash, expected))
+                {
+                    mismatch("Keystream " + map.get("Count"), (String)map.get("MD"), hash);
+                }
+
+                if (ptByte.length > 1)
+                {
+                    int split = random.nextInt(ptByte.length - 1) + 1;
+                    ascon = new AsconCXof128(zByte);
+                    ascon.update(ptByte, 0, split);
+                    ascon.update(ptByte, split, ptByte.length - split);
+                    ascon.doFinal(hash, 0, hash_length);
+                    if (!areEqual(hash, expected))
+                    {
+                        mismatch("Keystream " + map.get("Count"), (String)map.get("MD"), hash);
+                    }
+                }
+            }
+            else
+            {
+                map.put(line.substring(0, a).trim(), line.substring(a + 1).trim());
+            }
+        }
+    }
+
     private void mismatch(String name, String expected, byte[] found)
     {
         fail("mismatch on " + name, expected, new String(Hex.encode(found)));