From e4c0b56c7c9f95ec5906aeb176f25936c02737a3 Mon Sep 17 00:00:00 2001
From: Tony Arcieri <bascule@gmail.com>
Date: Sat, 11 Feb 2023 12:28:02 -0700
Subject: [PATCH] ascon: add `no_std` support (#36)

The permutation does not have any `std`/`alloc` dependency.

The current AEAD interface requires `alloc` (though we should migrate it
to use the `aead` crate anyway).
---
 .github/workflows/ascon.yml | 23 +++++++++++++++++++++++
 ascon/Cargo.toml            |  8 ++++++++
 ascon/src/aead.rs           | 20 ++++++++++++++++----
 ascon/src/lib.rs            |  5 +++++
 ascon/src/util.rs           | 12 ------------
 5 files changed, 52 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/ascon.yml b/.github/workflows/ascon.yml
index fcd2585..fdba916 100644
--- a/.github/workflows/ascon.yml
+++ b/.github/workflows/ascon.yml
@@ -35,6 +35,28 @@ jobs:
           override: true
       - run: cargo build --benches
 
+  build:
+    needs: set-msrv
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rust:
+          - ${{needs.set-msrv.outputs.msrv}}
+          - stable
+        target:
+          - thumbv7em-none-eabi
+          - wasm32-unknown-unknown
+    steps:
+      - uses: actions/checkout@v3
+      - uses: RustCrypto/actions/cargo-cache@master
+      - uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: ${{ matrix.rust }}
+          target: ${{ matrix.target }}
+          override: true
+      - run: cargo build --no-default-features --target ${{ matrix.target }}
+
   minimal-versions:
     uses: RustCrypto/actions/.github/workflows/minimal-versions.yml@master
     with:
@@ -56,4 +78,5 @@ jobs:
           profile: minimal
           toolchain: ${{ matrix.rust }}
           override: true
+      - run: cargo test --no-default-features
       - run: cargo test
diff --git a/ascon/Cargo.toml b/ascon/Cargo.toml
index 859901e..60a8171 100644
--- a/ascon/Cargo.toml
+++ b/ascon/Cargo.toml
@@ -16,3 +16,11 @@ edition = "2018"
 
 [dependencies]
 byteorder = { version = "1.0", default-features = false }
+
+[features]
+default = ["alloc"]
+alloc = []
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
diff --git a/ascon/src/aead.rs b/ascon/src/aead.rs
index 4cc4a4c..e847139 100644
--- a/ascon/src/aead.rs
+++ b/ascon/src/aead.rs
@@ -1,6 +1,7 @@
 //! Authenticated Encryption with Associated Data.
 
-use crate::{finalization, initialization, permutation, util, B, KEY_LEN, RATE, S_SIZE};
+use crate::{finalization, initialization, permutation, B, KEY_LEN, RATE, S_SIZE};
+use alloc::{vec, vec::Vec};
 
 /// Decryption errors.
 #[derive(Debug)]
@@ -117,13 +118,26 @@ pub fn decrypt(
     // finalization
     finalization(&mut ss, key);
 
-    if util::eq(&ss[S_SIZE - KEY_LEN..], tag) {
+    if ct_eq(&ss[S_SIZE - KEY_LEN..], tag) {
         Ok(mm[..ciphertext.len()].into())
     } else {
         Err(DecryptFail::AuthenticationFail)
     }
 }
 
+// TODO(tarcieri): use `subtle`
+fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        false
+    } else {
+        a.iter()
+            .zip(b)
+            .map(|(x, y)| x ^ y)
+            .fold(0, |sum, next| sum | next)
+            .eq(&0)
+    }
+}
+
 fn process_aad(ss: &mut [u8], aa: &[u8], s: usize) {
     for i in 0..s {
         for j in 0..RATE {
@@ -136,7 +150,6 @@ fn process_aad(ss: &mut [u8], aa: &[u8], s: usize) {
 #[cfg(test)]
 mod tests {
     use super::{decrypt, encrypt};
-    use crate::util;
 
     #[test]
     fn round_trip() {
@@ -148,7 +161,6 @@ mod tests {
         let (ciphertext, tag) = encrypt(&key, &iv, &message, &aad);
         let plaintext = decrypt(&key, &iv, &ciphertext, &aad, &tag).unwrap();
         assert_eq!(plaintext, &message[..]);
-        assert!(util::eq(&message, &plaintext));
     }
 
     #[test]
diff --git a/ascon/src/lib.rs b/ascon/src/lib.rs
index 04302de..bf9e33e 100644
--- a/ascon/src/lib.rs
+++ b/ascon/src/lib.rs
@@ -20,6 +20,7 @@
 //! [NIST Lightweight Cryptography]: https://csrc.nist.gov/projects/lightweight-cryptography/finalists
 //! [CAESAR competition]: https://competitions.cr.yp.to/caesar-submissions.html
 
+#![no_std]
 #![doc(
     html_logo_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg",
     html_favicon_url = "https://raw.githubusercontent.com/RustCrypto/meta/master/logo.svg"
@@ -33,6 +34,10 @@
     unused_qualifications
 )]
 
+#[cfg(feature = "alloc")]
+extern crate alloc;
+
+#[cfg(feature = "alloc")]
 pub mod aead;
 
 mod util;
diff --git a/ascon/src/util.rs b/ascon/src/util.rs
index 8e932d0..4f2410b 100644
--- a/ascon/src/util.rs
+++ b/ascon/src/util.rs
@@ -15,15 +15,3 @@ pub fn u64_to_u8(input: &[u64], output: &mut [u8]) {
         Endian::write_u64(&mut output[(i * 8)..((i + 1) * 8)], b)
     }
 }
-
-pub fn eq(a: &[u8], b: &[u8]) -> bool {
-    if a.len() != b.len() {
-        false
-    } else {
-        a.iter()
-            .zip(b)
-            .map(|(x, y)| x ^ y)
-            .fold(0, |sum, next| sum | next)
-            .eq(&0)
-    }
-}