Crate cyber_hemera

Expand description

Poseidon2 hash over the Goldilocks field (Hemera parameters).

§WARNING

This is novel, unaudited cryptography. The parameter set, sponge construction, and self-bootstrapping round constant generation have not been reviewed by third-party cryptographers. Do not use in production systems where cryptographic guarantees are required. Use at your own risk.

This crate provides a streaming hash API backed by the Poseidon2 algebraic hash function operating over the Goldilocks prime field (p = 2^64 - 2^32 + 1).

§Hemera Parameters

Field: Goldilocks (p = 2^64 - 2^32 + 1)
State width: t = 16
Full rounds: R_F = 8
Partial rounds: R_P = 64
S-box degree: d = 7 (x^7)
Rate: 8 elements (56 input bytes per block)
Capacity: 8 elements
Output: 8 elements (64 bytes)
Padding: 0x01 || 0x00*
Encoding: little-endian canonical

§Examples

use hemera::{hash, derive_key};

let digest = hash(b"hello world");
println!("{digest}");

let key = derive_key("my app v1", b"key material");

Modules§

hazmat: Low-level primitives for BAO-style Merkle tree construction.

Structs§

Hash: A 64-byte Poseidon2 hash output (Hemera: 8 Goldilocks elements).
Hasher: A streaming Poseidon2 hasher.
OutputReader: An extendable-output reader that can produce arbitrary-length output.

Constants§

CAPACITY: Number of capacity elements in the sponge.
COLLISION_BITS: Classical collision resistance in bits.
OUTPUT_BYTES: Number of output bytes per squeeze (8 elements × 8 bytes).
OUTPUT_ELEMENTS: Number of output elements extracted per squeeze (= rate).
RATE: Number of rate elements in the sponge.
RATE_BYTES: Number of input bytes that fill one rate block (8 elements × 7 bytes).
ROUNDS_F: Number of full (external) rounds — 4 initial + 4 final.
ROUNDS_P: Number of partial (internal) rounds.
SBOX_DEGREE: S-box degree (x → x^d).
WIDTH: Width of the Poseidon2 state (number of Goldilocks field elements).

Functions§

derive_key: Derive a key from a context string and key material.
hash: Hash the input bytes and return a 64-byte digest.
keyed_hash: Hash the input bytes with a key.