add blake2 from libcrux

ciphers/Cargo.toml

@@ -12,6 +12,7 @@ readme = "readme.md"
 [features]
 experiment_libcrux = [
     "dep:libcrux",
+    "dep:libcrux-blake2",
     "dep:libcrux-chacha20poly1305",
     "dep:libcrux-ml-kem",
 ]
@@ -30,9 +31,10 @@ chacha20poly1305 = { workspace = true }
 blake2 = { workspace = true }
 libcrux = { workspace = true, optional = true }
 libcrux-chacha20poly1305 = { workspace = true, optional = true }
+rand = { workspace = true }
+libcrux-blake2 = { workspace = true, optional = true }
 libcrux-ml-kem = { workspace = true, optional = true, features = ["kyber"] }
 sha3 = { workspace = true }
-rand = { workspace = true }
 
 [dev-dependencies]
 rand = { workspace = true }

ciphers/src/subtle/libcrux/blake2b.rs

@@ -0,0 +1,39 @@
+use rosenpass_cipher_traits::algorithms::KeyedHashBlake2b;
+use rosenpass_cipher_traits::primitives::KeyedHash;
+
+use libcrux_blake2::Blake2bBuilder;
+
+pub enum Error {
+    InternalError,
+    DataTooLong,
+}
+
+pub struct Blake2b;
+
+pub const KEY_LEN: usize = 32;
+pub const HASH_LEN: usize = 32;
+
+impl KeyedHash<KEY_LEN, HASH_LEN> for Blake2b {
+    type Error = Error;
+
+    fn keyed_hash(
+        key: &[u8; KEY_LEN],
+        data: &[u8],
+        out: &mut [u8; HASH_LEN],
+    ) -> Result<(), Self::Error> {
+        let mut h = Blake2bBuilder::new_keyed_const(key)
+            // this may fail if the key length is invalid, but 32 is fine
+            .map_err(|_| Error::InternalError)?
+            .build_const_digest_len()
+            .map_err(|_|
+            // this can only fail if the output length is invalid, but 32 is fine.
+            Error::InternalError)?;
+
+        h.update(data).map_err(|_| Error::DataTooLong)?;
+        h.finalize(out);
+
+        Ok(())
+    }
+}
+
+impl KeyedHashBlake2b for Blake2b {}

ciphers/src/subtle/libcrux/mod.rs

@@ -1,4 +1,5 @@
 //! Implementations backed by libcrux, a verified crypto library
 
+pub mod blake2b;
 pub mod chacha20poly1305_ietf;
 pub mod kyber512;