rind 0.1.11

// Written for Graviola by Joe Birr-Pixton, 2024.
// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0

#[derive(Clone)]
pub(crate) struct Blockwise<const N: usize> {
    buffer: [u8; N],
    used: usize,
}

impl<const N: usize> Blockwise<N> {
    pub(crate) const fn new() -> Self {
        Self {
            buffer: [0u8; N],
            used: 0,
        }
    }

    // SHA-3 and Poly1305 buffer through these methods, and 32-bit ARM builds
    // neither.
    #[cfg(not(target_arch = "arm"))]
    pub(crate) const fn used(&self) -> usize {
        self.used
    }

    #[cfg(not(target_arch = "arm"))]
    pub(crate) fn add(&mut self, bytes: &[u8]) {
        if self.used == 0 {
            self.add_trailing(bytes);
        } else {
            self.add_leading(bytes);
        }
    }

    /// Adds `bytes`, passing each run of whole blocks to `blocks` in order and
    /// holding the rest: what is short of a whole block, or the last whole
    /// block until more follows, so a hash can compress it with its padding
    /// in one call.
    pub(crate) fn update(&mut self, bytes: &[u8], blocks: impl FnMut(&[u8])) {
        let used = self.used;
        // A short update, such as a one-byte one, only copies. Storing
        // `used` first, and leaving blocks to another function, lets it
        // save no registers and tail-call the copy.
        if bytes.len() <= N - used {
            self.used = used + bytes.len();
            self.buffer[used..used + bytes.len()].copy_from_slice(bytes);
        } else {
            self.complete_blocks(bytes, blocks);
        }
    }

    /// As [`Self::update`], for `bytes` longer than the room left.
    #[inline(never)]
    fn complete_blocks(&mut self, mut bytes: &[u8], mut blocks: impl FnMut(&[u8])) {
        let used = self.used;
        if used > 0 {
            let (head, rest) = bytes.split_at(N - used);
            self.buffer[used..].copy_from_slice(head);
            blocks(&self.buffer);
            bytes = rest;
        }

        // Holds the last 1 to N bytes.
        let (whole, rest) = bytes.split_at((bytes.len() - 1) / N * N);
        if !whole.is_empty() {
            blocks(whole);
        }
        self.buffer[..rest.len()].copy_from_slice(rest);
        self.used = rest.len();
    }

    #[cfg(not(target_arch = "arm"))]
    pub(crate) fn add_leading<'a>(&mut self, bytes: &'a [u8]) -> &'a [u8] {
        if self.used == 0 {
            return bytes;
        }

        let space = N - self.used;
        let take = core::cmp::min(bytes.len(), space);
        let (taken, returned) = bytes.split_at(take);
        self.buffer[self.used..self.used + take].copy_from_slice(taken);
        self.used += take;
        returned
    }

    #[cfg(not(target_arch = "arm"))]
    pub(crate) fn take(&mut self) -> Option<[u8; N]> {
        if self.used == N {
            self.used = 0;
            Some(self.buffer)
        } else {
            None
        }
    }

    // Only Poly1305's tail reads it.
    #[cfg(any(target_arch = "x86_64", all(target_arch = "aarch64", test)))]
    pub(crate) fn peek_remaining(&self) -> Option<&[u8]> {
        if self.used > 0 {
            Some(&self.buffer[..self.used])
        } else {
            None
        }
    }

    /// The bytes [`Self::update`] holds, up to one whole block.
    pub(crate) fn buffered(&self) -> &[u8] {
        &self.buffer[..self.used]
    }

    #[cfg(not(target_arch = "arm"))]
    pub(crate) fn add_trailing(&mut self, trailing: &[u8]) {
        self.buffer[..trailing.len()].copy_from_slice(trailing);
        self.used += trailing.len();
    }
}

/// Pads the end of `message` for a Merkle-Damgard hash of `N`-byte blocks:
/// a 0x80 byte, zeroes, and `length`. Returns the whole blocks to compress
/// first, then the rest padded in `last`, which must be zeroed. The rest takes
/// the message's last whole block too where the padding fits after it, so the
/// routine runs once over both.
pub(crate) fn pad_message<'m, 'l, const N: usize, const L: usize>(
    message: &'m [u8],
    length: [u8; L],
    last: &'l mut [[u8; N]; 2],
) -> (&'m [u8], &'l [u8]) {
    let tail = message.len() % N;
    let start = if tail + 1 + L <= N && message.len() >= N {
        message.len() - tail - N
    } else {
        message.len() - tail
    };
    let (blocks, rest) = message.split_at(start);
    let padded = if rest.len() + 1 + L <= N { N } else { 2 * N };
    let last = &mut last.as_flattened_mut()[..padded];
    last[..rest.len()].copy_from_slice(rest);
    last[rest.len()] = 0x80;
    last[padded - L..].copy_from_slice(&length);
    (blocks, last)
}