Class KMAC

core/src/main/java/org/bouncycastle/crypto/macs/KMAC.java:22–279

KMAC - MAC with optional XOF mode. From NIST Special Publication 800-185 - SHA-3 Derived Functions:cSHAKE, KMAC, TupleHash and ParallelHash

 * </p>
 */
public class KMAC
    implements Mac, Xof, Memoable, EncodableDigest
{
    private static final byte[] padding = new byte[100];

    private final CSHAKEDigest cshake;
    
    private int bitLength;
    private int outputLength;

    private byte[] key;
    private boolean initialised;
    private boolean firstOutput;

    /**
     * Base constructor.
     *
     * @param bitLength bit length of the underlying SHAKE function, 128 or 256.
     * @param S         the customization string - available for local use.
     */
    public KMAC(int bitLength, byte[] S)
    {
        this.cshake = new CSHAKEDigest(bitLength, Strings.toByteArray("KMAC"), S);
        this.bitLength = bitLength;
        this.outputLength = bitLength * 2 / 8;
    }

    public KMAC(KMAC original)
    {
        this.cshake = new CSHAKEDigest(original.cshake);
        this.bitLength = original.bitLength;
        this.outputLength = original.outputLength;
        this.key = original.key;
        this.initialised = original.initialised;
        this.firstOutput = original.firstOutput;
    }

    public KMAC(byte[] state)
    {
        this.key = new byte[state[0] & 0xff];
        System.arraycopy(state, 1, key, 0, key.length);
        this.cshake = new CSHAKEDigest(Arrays.copyOfRange(state, 1 + key.length, state.length - 10));
                
        this.bitLength = Pack.bigEndianToInt(state, state.length - 10);
        this.outputLength = Pack.bigEndianToInt(state, state.length - 6);
        this.initialised = state[state.length - 2] != 0;
        this.firstOutput = state[state.length - 1] != 0;
    }

    private void copyIn(KMAC original)
    {
        this.cshake.reset(original.cshake);
        this.bitLength = original.bitLength;
        this.outputLength = original.outputLength;
        this.initialised = original.initialised;
        this.firstOutput = original.firstOutput;
    }