Module legacy 

Byte-compatible LEGACY_KECCAK fused private-seed signing engine.

This module is intentionally separate from the SHA-256 performance datapath. It implements the pinned HashSigsRS construction with legacy Keccak-256 0x01 padding; it is not SHA3-256, XMSS, or SLH-DSA.

LegacyFusedPrivateSeedEngine owns one area-oriented keccak_rhdl::IterativeKeccak and executes the complete fixed-work fused operation serially. It accepts an exact 32-byte private seed and an exact 32-byte already-hashed message, captures all 67 32-byte signature segments, derives the 64-byte public key, and emits the canonical 35-beat 512-bit result stream. Every accepted operation executes exactly 1,173 Keccak-f[1600] permutations.

Secret ownership

The seed and derived private-key material live only in resetless internal datapath registers and are never connected to an output port. Resettable control bits make those registers invalid after reset. The input seed is overwritten as soon as its hash request is issued; the derived private key and transient chain secrets are overwritten after the final segment no longer needs them. This is an architectural non-disclosure boundary, not a physical zeroization or side-channel claim. The caller must still ensure that a seed is never submitted twice: WOTS private-key reuse is catastrophic.

Evidence boundary

Unit tests exercise the fixed block builders and the composed RHDL machine. They do not establish synthesis, timing, utilization, route, side-channel, or physical-zeroization evidence.

Re-exports

pub use seed_wrapper::legacy_fused_private_seed_kernel;

pub use key_wrapper::legacy_fused_private_key_kernel;

Structs

LegacyChainStateInput

Input to legacy_chain_state_kernel.

LegacyEndpointBlockInput

Input to legacy_endpoint_block_state_kernel.

LegacyFusedBeat

One canonical fused-output stream beat.

LegacyFusedInput

Input accepted by LegacyFusedPrivateSeedEngine.

LegacyFusedOutput

Status and stream output from either explicit legacy fused engine.

LegacyFusedPrivateKeyEngine

Fused legacy signing engine with an explicit private-key ingress.

LegacyFusedPrivateKeyInput

Input accepted by LegacyFusedPrivateKeyEngine.

LegacyFusedPrivateSeedEngine

Fused legacy signing engine with an explicit private-seed ingress.

LegacyOutputBeatInput

Input to legacy_output_beat_kernel.

LegacyPrfStateInput

Input to legacy_prf_state_kernel.

LegacySecretStateInput

Input to legacy_secret_state_kernel.

Constants

LEGACY_CHAIN_STEPS

Hash-chain transitions executed for every signature segment.

LEGACY_ENDPOINT_BLOCKS

Number of 136-byte rate blocks needed for the 2,144-byte endpoint string.

LEGACY_FUSED_OUTPUT_BEATS

Number of 512-bit result beats.

LEGACY_FUSED_PERMUTATIONS

Keccak-f[1600] permutations in one fused private-seed operation.

LEGACY_FUSED_PRIVATE_KEY_PERMUTATIONS

Permutations when the explicit private-key wrapper bypasses seed hashing.

LEGACY_HASH_BYTES

Bytes in a legacy hash value, private seed, or already-hashed message.

LEGACY_MASK_COUNT

Observable randomization masks used by pinned HashSigsRS.

Functions

legacy_bytes_to_lanes_kernel

Convert 32 ascending bytes to four little-endian Keccak lanes.

legacy_chain_state_kernel

Build the padded state for one 32-byte randomized chain transition.

legacy_digest_lanes_kernel

Extract the first 32 rate bytes from a completed permutation.

legacy_endpoint_block_state_kernel

XOR one fixed 136-byte endpoint block into the preceding sponge state.

legacy_fused_private_key_kernel

Statically bind a private-key request to the shared legacy datapath.

legacy_fused_private_seed_kernel

Statically bind a private-seed request to the shared legacy datapath.

legacy_hash32_state_kernel

Build the single padded rate state for a 32-byte legacy Keccak hash.

legacy_output_beat_kernel

Select one canonical signature/public-key output beat.

legacy_prf_state_kernel

Build the padded state for 0x03 || seed || u16_be(index) (35 bytes).

legacy_secret_state_kernel

Build the padded state for function_key || secret_prf (64 bytes).

Type Aliases

LegacyBeatBytes

One 512-bit output transfer in ascending byte-lane order.

LegacyHashLanes

One 32-byte Keccak digest represented as four little-endian 64-bit lanes.

LegacyMaskStore

All 16 observable WOTS randomization masks.

LegacyPrivateSeedBytes

Exact 32-byte private-seed input in ascending byte order.

LegacySegmentStore

All 67 signature or endpoint values in lane order.