wots_rhdl/

legacy.rs

//! Byte-compatible `LEGACY_KECCAK` fused private-seed signing engine.
//!
//! This module is intentionally separate from the SHA-256 performance
//! datapath.  It implements the pinned `HashSigsRS` construction with legacy
//! Keccak-256 `0x01` padding; it is not SHA3-256, XMSS, or SLH-DSA.
//!
//! [`LegacyFusedPrivateSeedEngine`] owns one area-oriented
//! [`keccak_rhdl::IterativeKeccak`] and executes the complete fixed-work fused
//! operation serially.  It accepts an exact 32-byte private seed and an exact
//! 32-byte already-hashed message, captures all 67 32-byte signature segments,
//! derives the 64-byte public key, and emits the canonical 35-beat 512-bit
//! result stream.  Every accepted operation executes exactly 1,173
//! `Keccak-f[1600]` permutations.
//!
//! # Secret ownership
//!
//! The seed and derived private-key material live only in resetless internal
//! datapath registers and are never connected to an output port.  Resettable
//! control bits make those registers invalid after reset.  The input seed is
//! overwritten as soon as its hash request is issued; the derived private key
//! and transient chain secrets are overwritten after the final segment no
//! longer needs them.  This is an architectural non-disclosure boundary, not a
//! physical zeroization or side-channel claim.  The caller must still ensure
//! that a seed is never submitted twice: WOTS private-key reuse is catastrophic.
//!
//! # Evidence boundary
//!
//! Unit tests exercise the fixed block builders and the composed RHDL machine.
//! They do not establish synthesis, timing, utilization, route, side-channel,
//! or physical-zeroization evidence.

use keccak_rhdl::{IterativeInput, IterativeKeccak, KeccakState};
use rhdl::prelude::*;
use rhdl_fpga::core::dff::DFF;
use rhdl_primitives::NoResetDff;

use crate::digits::{CHAIN_COUNT, MessageBytes, MessageDigitArray, message_digits_kernel};

/// Bytes in a legacy hash value, private seed, or already-hashed message.
pub const LEGACY_HASH_BYTES: usize = 32;

/// Observable randomization masks used by pinned `HashSigsRS`.
pub const LEGACY_MASK_COUNT: usize = 16;

/// Hash-chain transitions executed for every signature segment.
pub const LEGACY_CHAIN_STEPS: usize = 15;

/// `Keccak-f[1600]` permutations in one fused private-seed operation.
pub const LEGACY_FUSED_PERMUTATIONS: usize = 1_173;

/// Permutations when the explicit private-key wrapper bypasses seed hashing.
pub const LEGACY_FUSED_PRIVATE_KEY_PERMUTATIONS: usize = 1_172;

/// Number of 136-byte rate blocks needed for the 2,144-byte endpoint string.
pub const LEGACY_ENDPOINT_BLOCKS: usize = 16;

/// Number of 512-bit result beats.
pub const LEGACY_FUSED_OUTPUT_BEATS: usize = 35;

/// One 32-byte Keccak digest represented as four little-endian 64-bit lanes.
pub type LegacyHashLanes = [b64; 4];

/// All 67 signature or endpoint values in lane order.
pub type LegacySegmentStore = [LegacyHashLanes; CHAIN_COUNT];

/// All 16 observable WOTS randomization masks.
pub type LegacyMaskStore = [LegacyHashLanes; LEGACY_MASK_COUNT];

/// Exact 32-byte private-seed input in ascending byte order.
pub type LegacyPrivateSeedBytes = [b8; LEGACY_HASH_BYTES];

/// One 512-bit output transfer in ascending byte-lane order.
pub type LegacyBeatBytes = [b8; 64];

const PHASE_PRIVATE_SEED: u128 = 0;
const PHASE_PUBLIC_SEED: u128 = 1;
const PHASE_MASK: u128 = 2;
const PHASE_SEGMENT_PRF: u128 = 3;
const PHASE_SECRET_HASH: u128 = 4;
const PHASE_CHAIN: u128 = 5;
const PHASE_PUBLIC_KEY: u128 = 6;

const FINAL_OUTPUT_BEAT: u128 = 34;
const FULL_KEEP: u128 = u64::MAX as u128;
const FINAL_KEEP: u128 = 0xffff_ffff;

const _: () = {
    assert!(CHAIN_COUNT == 67);
    assert!(LEGACY_HASH_BYTES == 32);
    assert!(LEGACY_MASK_COUNT == 16);
    assert!(LEGACY_CHAIN_STEPS == 15);
    assert!(LEGACY_FUSED_PERMUTATIONS == 1_173);
    assert!(LEGACY_FUSED_PRIVATE_KEY_PERMUTATIONS == 1_172);
    assert!(LEGACY_ENDPOINT_BLOCKS == 16);
    assert!(LEGACY_FUSED_OUTPUT_BEATS == 35);
};

/// Input accepted by [`LegacyFusedPrivateSeedEngine`].
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacyFusedInput {
    /// Presents one new one-time signing operation.
    pub start_valid: bool,
    /// Caller-supplied private seed.  It is captured only with a start transfer.
    pub private_seed: LegacyPrivateSeedBytes,
    /// Already-hashed 32-byte WOTS message.
    pub message: MessageBytes,
    /// Whole-result buffer credit available for reservation.
    pub output_credit_available: bool,
    /// Downstream accepts the currently presented output beat.
    pub output_ready: bool,
}

/// Input accepted by [`LegacyFusedPrivateKeyEngine`].
///
/// This compatibility-only ingress exists so the five pinned upstream vectors,
/// which provide a private key but no private-seed preimage, can exercise the
/// complete hardware traversal.  It executes 1,172 permutations because it
/// explicitly bypasses the one seed-to-private-key hash.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacyFusedPrivateKeyInput {
    /// Presents one new one-time signing operation.
    pub start_valid: bool,
    /// Exact 32-byte upstream-format private key.
    pub private_key: LegacyPrivateSeedBytes,
    /// Already-hashed 32-byte WOTS message.
    pub message: MessageBytes,
    /// Whole-result buffer credit available for reservation.
    pub output_credit_available: bool,
    /// Downstream accepts the currently presented output beat.
    pub output_ready: bool,
}

/// One canonical fused-output stream beat.
#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
pub struct LegacyFusedBeat {
    /// Sixty-four bytes in signature-then-public-key order.
    pub data: LegacyBeatBytes,
    /// One validity bit per byte lane.
    pub keep: b64,
    /// True only for beat 34.
    pub last: bool,
}

impl Default for LegacyFusedBeat {
    fn default() -> Self {
        Self {
            data: [b8(0); 64],
            keep: b64(0),
            last: false,
        }
    }
}

/// Status and stream output from either explicit legacy fused engine.
#[allow(clippy::struct_excessive_bools)] // Each flag is an independent hardware contract.
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacyFusedOutput {
    /// A start transfer is accepted when this and `start_valid` are true.
    pub start_ready: bool,
    /// The cryptographic traversal is in progress.
    pub active: bool,
    /// A whole-result credit is owned by this engine.
    pub output_credit_reserved: bool,
    /// The output beat is valid and remains stable under backpressure.
    pub output_valid: bool,
    /// Canonical output beat; zero whenever `output_valid` is false.
    pub output: LegacyFusedBeat,
    /// One-cycle pulse when the public-key hash completes.
    pub computed_done: bool,
    /// One-cycle pulse when the final output transfer returns its credit.
    pub output_credit_release: bool,
    /// Completed permutation count for the active or buffered result.
    pub permutation_count: b11,
    /// True when completion disagrees with the ingress type's exact work count.
    pub audit_error: bool,
}

/// Input to [`legacy_prf_state_kernel`].
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacyPrfStateInput {
    /// 32-byte PRF seed in digest lane order.
    pub seed: LegacyHashLanes,
    /// Big-endian 16-bit PRF index in the byte preimage.
    pub index: b16,
}

/// Input to [`legacy_secret_state_kernel`].
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacySecretStateInput {
    /// Function key, equal to mask zero.
    pub function_key: LegacyHashLanes,
    /// Domain-separated segment PRF result.
    pub secret_prf: LegacyHashLanes,
}

/// Input to [`legacy_chain_state_kernel`].
#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
pub struct LegacyChainStateInput {
    /// Current WOTS chain value.
    pub state: LegacyHashLanes,
    /// One-based transition mask.
    pub mask: LegacyHashLanes,
}

/// Input to [`legacy_endpoint_block_state_kernel`].
#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
pub struct LegacyEndpointBlockInput {
    /// State returned by the preceding endpoint absorption, or zero for block 0.
    pub sponge: KeccakState,
    /// All 67 chain endpoints in canonical segment order.
    pub endpoints: LegacySegmentStore,
    /// Fixed endpoint rate-block index in `0..=15`.
    pub block_index: b5,
}

impl Default for LegacyEndpointBlockInput {
    fn default() -> Self {
        Self {
            sponge: [b64(0); 25],
            endpoints: [[b64(0); 4]; CHAIN_COUNT],
            block_index: b5(0),
        }
    }
}

/// Input to [`legacy_output_beat_kernel`].
#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
pub struct LegacyOutputBeatInput {
    /// Captured signature segments.
    pub signature: LegacySegmentStore,
    /// Public seed stored in the public key's first 32 bytes.
    pub public_seed: LegacyHashLanes,
    /// Hash of the concatenated endpoints.
    pub public_key_hash: LegacyHashLanes,
    /// Canonical beat index in `0..=34`.
    pub beat_index: b6,
}

impl Default for LegacyOutputBeatInput {
    fn default() -> Self {
        Self {
            signature: [[b64(0); 4]; CHAIN_COUNT],
            public_seed: [b64(0); 4],
            public_key_hash: [b64(0); 4],
            beat_index: b6(0),
        }
    }
}

/// Convert 32 ascending bytes to four little-endian Keccak lanes.
#[kernel]
pub fn legacy_bytes_to_lanes_kernel(bytes: LegacyPrivateSeedBytes) -> LegacyHashLanes {
    let mut lanes = [b64(0); 4];
    for lane in 0..4 {
        let byte_zero: b64 = bytes[lane * 8].resize();
        let byte_one: b64 = bytes[lane * 8 + 1].resize();
        let byte_two: b64 = bytes[lane * 8 + 2].resize();
        let byte_three: b64 = bytes[lane * 8 + 3].resize();
        let byte_four: b64 = bytes[lane * 8 + 4].resize();
        let byte_five: b64 = bytes[lane * 8 + 5].resize();
        let byte_six: b64 = bytes[lane * 8 + 6].resize();
        let byte_seven: b64 = bytes[lane * 8 + 7].resize();
        lanes[lane] = byte_zero
            | (byte_one << 8)
            | (byte_two << 16)
            | (byte_three << 24)
            | (byte_four << 32)
            | (byte_five << 40)
            | (byte_six << 48)
            | (byte_seven << 56);
    }
    lanes
}

/// Build the single padded rate state for a 32-byte legacy Keccak hash.
#[kernel]
pub fn legacy_hash32_state_kernel(value: LegacyHashLanes) -> KeccakState {
    let mut state = [b64(0); 25];
    state[0] = value[0];
    state[1] = value[1];
    state[2] = value[2];
    state[3] = value[3];
    state[4] = b64(0x01);
    state[16] = b64(0x8000_0000_0000_0000);
    state
}

/// Build the padded state for `0x03 || seed || u16_be(index)` (35 bytes).
#[kernel]
pub fn legacy_prf_state_kernel(input: LegacyPrfStateInput) -> KeccakState {
    let mut state = [b64(0); 25];
    let index_high_byte: b8 = (input.index >> 8).resize();
    let index_low_byte: b8 = input.index.resize();
    let index_high: b64 = index_high_byte.resize();
    let index_low: b64 = index_low_byte.resize();
    state[0] = b64(0x03) | (input.seed[0] << 8);
    state[1] = (input.seed[0] >> 56) | (input.seed[1] << 8);
    state[2] = (input.seed[1] >> 56) | (input.seed[2] << 8);
    state[3] = (input.seed[2] >> 56) | (input.seed[3] << 8);
    state[4] = (input.seed[3] >> 56) | (index_high << 8) | (index_low << 16) | b64(0x01_00_00_00);
    state[16] = b64(0x8000_0000_0000_0000);
    state
}

/// Build the padded state for `function_key || secret_prf` (64 bytes).
#[kernel]
pub fn legacy_secret_state_kernel(input: LegacySecretStateInput) -> KeccakState {
    let mut state = [b64(0); 25];
    state[0] = input.function_key[0];
    state[1] = input.function_key[1];
    state[2] = input.function_key[2];
    state[3] = input.function_key[3];
    state[4] = input.secret_prf[0];
    state[5] = input.secret_prf[1];
    state[6] = input.secret_prf[2];
    state[7] = input.secret_prf[3];
    state[8] = b64(0x01);
    state[16] = b64(0x8000_0000_0000_0000);
    state
}

/// Build the padded state for one 32-byte randomized chain transition.
#[kernel]
pub fn legacy_chain_state_kernel(input: LegacyChainStateInput) -> KeccakState {
    legacy_hash32_state_kernel([
        input.state[0] ^ input.mask[0],
        input.state[1] ^ input.mask[1],
        input.state[2] ^ input.mask[2],
        input.state[3] ^ input.mask[3],
    ])
}

/// Extract the first 32 rate bytes from a completed permutation.
#[kernel]
pub fn legacy_digest_lanes_kernel(state: KeccakState) -> LegacyHashLanes {
    [state[0], state[1], state[2], state[3]]
}

/// XOR one fixed 136-byte endpoint block into the preceding sponge state.
///
/// Blocks 0 through 14 contain 17 complete endpoint lanes.  Block 15 contains
/// the final 13 lanes (104 bytes), then legacy domain byte `0x01`, zero fill,
/// and final rate bit `0x80`.  Together these blocks cover the exact 2,144-byte
/// endpoint string without a host-side byte buffer.
#[kernel]
#[allow(clippy::needless_range_loop)] // Static ranges lower predictably in RHDL.
pub fn legacy_endpoint_block_state_kernel(input: LegacyEndpointBlockInput) -> KeccakState {
    let mut state = input.sponge;
    let block_wide: b9 = input.block_index.resize();
    let base: b9 = (block_wide << 4) + block_wide;

    if input.block_index < b5(15) {
        for lane in 0..17 {
            let absolute = base + b9(lane as u128);
            let segment: b7 = (absolute >> 2).resize();
            let word: b2 = absolute.resize();
            state[lane] ^= input.endpoints[segment][word];
        }
    } else {
        for lane in 0..13 {
            let absolute = b9(255 + lane as u128);
            let segment: b7 = (absolute >> 2).resize();
            let word: b2 = absolute.resize();
            state[lane] ^= input.endpoints[segment][word];
        }
        state[13] ^= b64(0x01);
        state[16] ^= b64(0x8000_0000_0000_0000);
    }
    state
}

/// Select one canonical signature/public-key output beat.
#[kernel]
#[allow(clippy::comparison_chain, clippy::needless_range_loop)] // Explicit branches and static ranges describe the wire framing directly.
pub fn legacy_output_beat_kernel(input: LegacyOutputBeatInput) -> LegacyFusedBeat {
    let mut lanes = [b64(0); 8];
    let mut keep = b64(FULL_KEEP);
    let mut last = false;

    if input.beat_index < b6(33) {
        let beat_wide: b9 = input.beat_index.resize();
        let base = beat_wide << 3;
        for lane in 0..8 {
            let absolute = base + b9(lane as u128);
            let segment: b7 = (absolute >> 2).resize();
            let word: b2 = absolute.resize();
            lanes[lane] = input.signature[segment][word];
        }
    } else if input.beat_index == b6(33) {
        lanes[0] = input.signature[66][0];
        lanes[1] = input.signature[66][1];
        lanes[2] = input.signature[66][2];
        lanes[3] = input.signature[66][3];
        lanes[4] = input.public_seed[0];
        lanes[5] = input.public_seed[1];
        lanes[6] = input.public_seed[2];
        lanes[7] = input.public_seed[3];
    } else {
        lanes[0] = input.public_key_hash[0];
        lanes[1] = input.public_key_hash[1];
        lanes[2] = input.public_key_hash[2];
        lanes[3] = input.public_key_hash[3];
        keep = b64(FINAL_KEEP);
        last = true;
    }

    let mut data = [b8(0); 64];
    for lane in 0..8 {
        data[lane * 8] = lanes[lane].resize();
        data[lane * 8 + 1] = (lanes[lane] >> 8).resize();
        data[lane * 8 + 2] = (lanes[lane] >> 16).resize();
        data[lane * 8 + 3] = (lanes[lane] >> 24).resize();
        data[lane * 8 + 4] = (lanes[lane] >> 32).resize();
        data[lane * 8 + 5] = (lanes[lane] >> 40).resize();
        data[lane * 8 + 6] = (lanes[lane] >> 48).resize();
        data[lane * 8 + 7] = (lanes[lane] >> 56).resize();
    }
    LegacyFusedBeat { data, keep, last }
}

#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
#[doc(hidden)]
#[allow(clippy::struct_excessive_bools)] // Independent hardware ownership/control wires.
pub struct LegacyControl {
    active: bool,
    waiting: bool,
    credit_reserved: bool,
    result_valid: bool,
    computed_done: bool,
    credit_release: bool,
    audit_error: bool,
    from_private_seed: bool,
    phase: b3,
    mask_index: b5,
    segment: b7,
    chain_step: b4,
    public_key_block: b5,
    output_beat: b6,
    permutation_count: b11,
}

#[derive(Clone, Copy, Debug, Default, Digital, Eq, PartialEq)]
#[doc(hidden)]
#[allow(clippy::struct_excessive_bools)] // Independent wrapper handshake wires.
pub struct LegacyCoreInput {
    start_valid: bool,
    secret: LegacyPrivateSeedBytes,
    message: MessageBytes,
    output_credit_available: bool,
    output_ready: bool,
    from_private_seed: bool,
}

#[derive(Clone, Copy, Debug, Digital, Eq, PartialEq)]
#[doc(hidden)]
pub struct LegacyData {
    private_seed: LegacyHashLanes,
    message_digits: MessageDigitArray,
    private_key: LegacyHashLanes,
    public_seed: LegacyHashLanes,
    masks: LegacyMaskStore,
    signature: LegacySegmentStore,
    endpoints: LegacySegmentStore,
    secret_prf: LegacyHashLanes,
    chain_state: LegacyHashLanes,
    public_key_sponge: KeccakState,
    public_key_hash: LegacyHashLanes,
}

/// Shared serial datapath behind the two statically explicit legacy wrappers.
///
/// Only one operation/result can be owned at a time.  An accepted start reserves
/// one whole-result output credit.  Once computation completes, the engine
/// presents 35 canonical beats and changes the beat index only after
/// `output_valid && output_ready`.  Consequently every output byte and control
/// bit remains stable for arbitrarily long downstream stalls.  The reserved
/// credit is released only with the final beat transfer.
#[derive(Clone, Debug, Synchronous, SynchronousDQ)]
#[rhdl(dq_no_prefix)]
#[doc(hidden)]
pub struct LegacyFusedCore {
    keccak: IterativeKeccak,
    control: DFF<LegacyControl>,
    data: NoResetDff<LegacyData>,
}

impl Default for LegacyFusedCore {
    fn default() -> Self {
        Self {
            keccak: IterativeKeccak::default(),
            control: DFF::new(LegacyControl::default()),
            data: NoResetDff::new(),
        }
    }
}

impl SynchronousIO for LegacyFusedCore {
    type I = LegacyCoreInput;
    type O = LegacyFusedOutput;
    type Kernel = legacy_fused_core_kernel;
}

#[kernel]
#[doc(hidden)]
#[allow(clippy::used_underscore_binding)] // The RHDL macro consumes this port.
pub fn legacy_fused_core_kernel(
    _clock_reset: ClockReset,
    input: LegacyCoreInput,
    q: Q,
) -> (LegacyFusedOutput, D) {
    let mut d = D::dont_care();
    let mut control = q.control;
    let mut data = q.data;
    d.keccak = IterativeInput::default();

    control.computed_done = false;
    control.credit_release = false;

    let start_ready = !q.control.active && !q.control.result_valid && input.output_credit_available;

    if start_ready && input.start_valid {
        control.active = true;
        control.waiting = false;
        control.credit_reserved = true;
        control.result_valid = false;
        control.audit_error = false;
        control.from_private_seed = input.from_private_seed;
        if input.from_private_seed {
            control.phase = b3(PHASE_PRIVATE_SEED);
        } else {
            control.phase = b3(PHASE_PUBLIC_SEED);
        }
        control.mask_index = b5(0);
        control.segment = b7(0);
        control.chain_step = b4(0);
        control.public_key_block = b5(0);
        control.output_beat = b6(0);
        control.permutation_count = b11(0);
        if input.from_private_seed {
            data.private_seed = legacy_bytes_to_lanes_kernel(input.secret);
            data.private_key = [b64(0); 4];
        } else {
            data.private_seed = [b64(0); 4];
            data.private_key = legacy_bytes_to_lanes_kernel(input.secret);
        }
        data.message_digits = message_digits_kernel(input.message);
        data.public_seed = [b64(0); 4];
        data.masks = [[b64(0); 4]; LEGACY_MASK_COUNT];
        data.signature = [[b64(0); 4]; CHAIN_COUNT];
        data.endpoints = [[b64(0); 4]; CHAIN_COUNT];
        data.secret_prf = [b64(0); 4];
        data.chain_state = [b64(0); 4];
        data.public_key_sponge = [b64(0); 25];
        data.public_key_hash = [b64(0); 4];
    } else if q.control.active {
        if q.control.waiting {
            if q.keccak.done {
                let digest = legacy_digest_lanes_kernel(q.keccak.state);
                control.waiting = false;
                control.permutation_count = q.control.permutation_count + b11(1);

                match q.control.phase {
                    Bits::<3>(0) => {
                        data.private_key = digest;
                        control.phase = b3(PHASE_PUBLIC_SEED);
                    }
                    Bits::<3>(1) => {
                        data.public_seed = digest;
                        control.phase = b3(PHASE_MASK);
                        control.mask_index = b5(0);
                    }
                    Bits::<3>(2) => {
                        data.masks[q.control.mask_index] = digest;
                        if q.control.mask_index == b5(15) {
                            control.phase = b3(PHASE_SEGMENT_PRF);
                            control.segment = b7(0);
                        } else {
                            control.mask_index = q.control.mask_index + b5(1);
                        }
                    }
                    Bits::<3>(3) => {
                        data.secret_prf = digest;
                        control.phase = b3(PHASE_SECRET_HASH);
                    }
                    Bits::<3>(4) => {
                        data.chain_state = digest;
                        if q.data.message_digits[q.control.segment] == b4(0) {
                            data.signature[q.control.segment] = digest;
                        }
                        control.phase = b3(PHASE_CHAIN);
                        control.chain_step = b4(1);
                    }
                    Bits::<3>(5) => {
                        data.chain_state = digest;
                        if q.data.message_digits[q.control.segment] == q.control.chain_step {
                            data.signature[q.control.segment] = digest;
                        }
                        if q.control.chain_step == b4(15) {
                            data.endpoints[q.control.segment] = digest;
                            if q.control.segment == b7(66) {
                                // These secrets have reached their last use.
                                data.private_key = [b64(0); 4];
                                data.secret_prf = [b64(0); 4];
                                data.chain_state = [b64(0); 4];
                                control.phase = b3(PHASE_PUBLIC_KEY);
                                control.public_key_block = b5(0);
                                data.public_key_sponge = [b64(0); 25];
                            } else {
                                control.segment = q.control.segment + b7(1);
                                control.phase = b3(PHASE_SEGMENT_PRF);
                            }
                        } else {
                            control.chain_step = q.control.chain_step + b4(1);
                        }
                    }
                    _ => {
                        data.public_key_sponge = q.keccak.state;
                        if q.control.public_key_block == b5(15) {
                            data.public_key_hash = digest;
                            control.active = false;
                            control.result_valid = true;
                            control.computed_done = true;
                            if q.control.from_private_seed {
                                control.audit_error = q.control.permutation_count != b11(1_172);
                            } else {
                                control.audit_error = q.control.permutation_count != b11(1_171);
                            }
                            control.output_beat = b6(0);
                        } else {
                            control.public_key_block = q.control.public_key_block + b5(1);
                        }
                    }
                }
            }
        } else if q.keccak.ready {
            let mut request_state = legacy_hash32_state_kernel(q.data.private_seed);
            match q.control.phase {
                Bits::<3>(0) => {
                    // The original seed is never needed after this acceptance.
                    data.private_seed = [b64(0); 4];
                }
                Bits::<3>(1) => {
                    request_state = legacy_prf_state_kernel(LegacyPrfStateInput {
                        seed: q.data.private_key,
                        index: b16(0),
                    });
                }
                Bits::<3>(2) => {
                    request_state = legacy_prf_state_kernel(LegacyPrfStateInput {
                        seed: q.data.public_seed,
                        index: q.control.mask_index.resize(),
                    });
                }
                Bits::<3>(3) => {
                    let segment_index: b16 = q.control.segment.resize();
                    request_state = legacy_prf_state_kernel(LegacyPrfStateInput {
                        seed: q.data.private_key,
                        index: segment_index + b16(1),
                    });
                }
                Bits::<3>(4) => {
                    request_state = legacy_secret_state_kernel(LegacySecretStateInput {
                        function_key: q.data.masks[0],
                        secret_prf: q.data.secret_prf,
                    });
                }
                Bits::<3>(5) => {
                    request_state = legacy_chain_state_kernel(LegacyChainStateInput {
                        state: q.data.chain_state,
                        mask: q.data.masks[q.control.chain_step],
                    });
                }
                _ => {
                    request_state = legacy_endpoint_block_state_kernel(LegacyEndpointBlockInput {
                        sponge: q.data.public_key_sponge,
                        endpoints: q.data.endpoints,
                        block_index: q.control.public_key_block,
                    });
                }
            }
            d.keccak = IterativeInput {
                start: true,
                state: request_state,
            };
            control.waiting = true;
        }
    } else if q.control.result_valid && input.output_ready {
        if q.control.output_beat == b6(FINAL_OUTPUT_BEAT) {
            control.result_valid = false;
            control.credit_reserved = false;
            control.credit_release = true;
            control.output_beat = b6(0);
            control.permutation_count = b11(0);
            // Public output material may also be invalidated after transfer.
            data.public_seed = [b64(0); 4];
            data.public_key_hash = [b64(0); 4];
            data.signature = [[b64(0); 4]; CHAIN_COUNT];
            data.endpoints = [[b64(0); 4]; CHAIN_COUNT];
            data.masks = [[b64(0); 4]; LEGACY_MASK_COUNT];
        } else {
            control.output_beat = q.control.output_beat + b6(1);
        }
    }

    let mut output_beat = LegacyFusedBeat {
        data: [b8(0); 64],
        keep: b64(0),
        last: false,
    };
    if q.control.result_valid {
        output_beat = legacy_output_beat_kernel(LegacyOutputBeatInput {
            signature: q.data.signature,
            public_seed: q.data.public_seed,
            public_key_hash: q.data.public_key_hash,
            beat_index: q.control.output_beat,
        });
    }

    d.control = control;
    d.data = data;
    let output = LegacyFusedOutput {
        start_ready,
        active: q.control.active,
        output_credit_reserved: q.control.credit_reserved,
        output_valid: q.control.result_valid,
        output: output_beat,
        computed_done: q.control.computed_done,
        output_credit_release: q.control.credit_release,
        permutation_count: q.control.permutation_count,
        audit_error: q.control.audit_error,
    };
    (output, d)
}

mod seed_wrapper {
    #[allow(clippy::wildcard_imports)] // RHDL derives require their generated support traits.
    use super::*;

    /// Fused legacy signing engine with an explicit private-seed ingress.
    ///
    /// Each accepted operation executes exactly 1,173 permutations: the shared
    /// 1,172-permutation private-key traversal plus the seed-to-private-key hash.
    /// The explicit type prevents a private key from being mistaken for a seed in
    /// test manifests or host adapters.
    ///
    /// The authored machine contains 43,460 logical storage bits: 41,804 bits in
    /// the outer resetless datapath store, 1,600 bits in the resetless permutation
    /// state, and 56 resettable control bits.  This is a source-level register-bit
    /// inventory, not a claim about inferred flip-flops, BRAMs, LUTs, or any mapped
    /// FPGA resource.
    #[derive(Clone, Debug, Default, Synchronous, SynchronousDQ)]
    #[rhdl(dq_no_prefix)]
    pub struct LegacyFusedPrivateSeedEngine {
        core: LegacyFusedCore,
    }

    impl SynchronousIO for LegacyFusedPrivateSeedEngine {
        type I = LegacyFusedInput;
        type O = LegacyFusedOutput;
        type Kernel = legacy_fused_private_seed_kernel;
    }

    /// Statically bind a private-seed request to the shared legacy datapath.
    #[kernel]
    #[allow(clippy::used_underscore_binding)] // The RHDL macro consumes this port.
    pub fn legacy_fused_private_seed_kernel(
        _clock_reset: ClockReset,
        input: LegacyFusedInput,
        q: Q,
    ) -> (LegacyFusedOutput, D) {
        let mut d = D::dont_care();
        d.core = LegacyCoreInput {
            start_valid: input.start_valid,
            secret: input.private_seed,
            message: input.message,
            output_credit_available: input.output_credit_available,
            output_ready: input.output_ready,
            from_private_seed: true,
        };
        (q.core, d)
    }
}

pub use seed_wrapper::{LegacyFusedPrivateSeedEngine, legacy_fused_private_seed_kernel};

mod key_wrapper {
    #[allow(clippy::wildcard_imports)] // RHDL derives require their generated support traits.
    use super::*;

    /// Fused legacy signing engine with an explicit private-key ingress.
    ///
    /// This wrapper is byte-compatible with the private keys in the five pinned
    /// upstream vectors.  It executes exactly 1,172 permutations and cannot be
    /// confused with [`LegacyFusedPrivateSeedEngine`] at the Rust/RHDL type
    /// boundary.  Its storage inventory and stream/credit contract are otherwise
    /// identical to the private-seed engine.
    #[derive(Clone, Debug, Default, Synchronous, SynchronousDQ)]
    #[rhdl(dq_no_prefix)]
    pub struct LegacyFusedPrivateKeyEngine {
        core: LegacyFusedCore,
    }

    impl SynchronousIO for LegacyFusedPrivateKeyEngine {
        type I = LegacyFusedPrivateKeyInput;
        type O = LegacyFusedOutput;
        type Kernel = legacy_fused_private_key_kernel;
    }

    /// Statically bind a private-key request to the shared legacy datapath.
    #[kernel]
    #[allow(clippy::used_underscore_binding)] // The RHDL macro consumes this port.
    pub fn legacy_fused_private_key_kernel(
        _clock_reset: ClockReset,
        input: LegacyFusedPrivateKeyInput,
        q: Q,
    ) -> (LegacyFusedOutput, D) {
        let mut d = D::dont_care();
        d.core = LegacyCoreInput {
            start_valid: input.start_valid,
            secret: input.private_key,
            message: input.message,
            output_credit_available: input.output_credit_available,
            output_ready: input.output_ready,
            from_private_seed: false,
        };
        (q.core, d)
    }
}

pub use key_wrapper::{LegacyFusedPrivateKeyEngine, legacy_fused_private_key_kernel};