Module haraka 

Haraka-512 v2 and the 144-bit DSig chain-compression primitive.

Why this module exists

DSig signs with W-OTS+ (a Winternitz one-time signature, here with w = 4). Its secret key is 68 short chains. Each chain starts at an 18-byte (144-bit) secret node, and every step along the chain hashes the current node once. A signature needs 204 of these chain steps, so the chain hash is the single most-repeated operation in the whole signer.

The DSIG_FPGA_W4_HARAKA_BLAKE3_V1 profile uses Haraka-512 v2 for that hash. Haraka is built entirely from AES rounds, which suits hardware: an AES round is a few table lookups and XORs, and it pipelines well. This module is the meaning of Haraka in this crate. It holds:

• a plain-Rust reference (haraka512, dsig_chain) that the tests and the host use as an oracle;
• the constants (round keys, the word mix, the truncation) shared by every hardware variant;
• small RHDL kernels for each piece of an AES round;
• a general 20-stage pipeline (Haraka512Pipeline) that hashes any block.

The signer itself uses a specialised copy in crate::chain_step, which reuses the kernels and constants here but folds away the constant bytes of a chain block. The S-box memories live in crate::aes_table. crate::chain_lane picks which chain hash is compiled in.

Haraka-512 in one picture

The 64-byte state is four 16-byte AES lanes. (Here “lane” means a 16-byte quarter of the state. Elsewhere in the crate a “lane” is a whole hardware chain-step pipeline; the context makes clear which.) One Haraka round is two AES rounds on every AES lane, then a fixed shuffle of 32-bit words across lanes (MIX_WORDS). There are five Haraka rounds:

  input (64 B) ─┬───────────────────────────────────────────────────────┐
                ▼                                                       │
  AES lane 0  [AES][AES]┐                                               │
  AES lane 1  [AES][AES]├─ MIX ─▶ ... repeat: 5 Haraka rounds in all     │
  AES lane 2  [AES][AES]│        = 5 × 2 AES rounds × 4 lanes            │
  AES lane 3  [AES][AES]┘        = 40 AES rounds                         │
                │                                                       │
                ▼                                                       ▼
  final state ── pick 32 bytes (DIGEST_BYTES) ──▶ XOR ◀── same 32 input bytes
                                                   │       ("feed-forward")
                                                   ▼
                                         32-byte Haraka-512 digest
                                                   │
                                         first 18 bytes = next DSig chain node

Each [AES] box is one AES round (AESENC), drawn in detail in crate::aes_table: SubBytes → ShiftRows → MixColumns → AddRoundKey. The feed-forward (XOR the input back in) is what turns the reversible AES permutation into a one-way compression function.

From the picture to a pipeline

Each AES round is cut into two registered halves: the S-box lookups on one side, the XOR network of MixColumns and the key on the other. That way an S-box can be a synchronous ROM whose own output register is the stage register (see crate::aes_table). Ten AES rounds give 20 stages (HARAKA_PIPELINE_LATENCY):

  stage:   0          1                2          3                     ...  19
         SubBytes   MixColumns       SubBytes   MixColumns
         +ShiftRows +AddRoundKey     +ShiftRows +AddRoundKey + MIX
         (round 0)  (round 0)        (round 1)  (round 1)
           reg        reg              reg        reg                        reg

Even stages are sub_shift512_kernel; odd stages are mix_key512_kernel, and every fourth stage (3, 7, 11, 15, 19) also applies the word mix. A new block can enter every clock (initiation interval, “II”, of 1), and its digest leaves 20 clocks later.

Reference, pipeline and provenance

haraka512 is a byte-oriented, allocation-free reference. The reference uses field arithmetic independently of the hardware S-box. It is an oracle, not a side-channel-hardened software signing implementation. The RHDL Haraka512Pipeline has twenty registered stages: each AES round is split between SubBytes/ShiftRows and MixColumns/AddRoundKey. Haraka’s inter-lane permutation is wiring following every second AES round. A separate valid pipeline resets ownership; resetless state and tags are never meaningful while valid is false. No throughput, clock, or resource figure here is a synthesis or hardware measurement.

Constants, lane permutations, and the official known-answer vector follow kste/haraka, Haraka v2. DSig’s mid_haraka512 selects exactly the first eighteen bytes of the standard 32-byte output, not the first eighteen bytes of the full 64-byte state. The salt layout follows DSig commit 1647bfbb12c42a249d68ce4909f81c74baab69bc (dsig/src/util.hpp, third-party/src/haraka/haraka.h).

Derived Haraka constants/permutation attribution: Copyright (c) 2016 kste. The MIT License (MIT): Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Structs

HarakaInput

One input token; every asserted valid bit is accepted on the next edge.

HarakaOutput

Final digest token; all fields except valid are unspecified when invalid.

HarakaPipeline

Prefix of the twenty-stage Haraka pipeline, for bounded validation.

Constants

AES_ROUNDS

AES rounds per Haraka-512 invocation (two rounds per mixing layer).

DIGEST_BYTES

Source-byte positions of the standard 256-bit feed-forward/truncation.

HARAKA_PIPELINE_LATENCY

Registered transfers per complete hash; there is no input backpressure.

MIX_WORDS

Source-word positions for the Haraka-512 32-bit inter-lane permutation.

ROUND_CONSTANTS

Haraka v2 constants as integers whose little-endian bytes match AES-NI.

ROUND_KEYS_RHDL

Four compile-time AES round keys per registered linear stage.

SBOX

aes_sbox evaluated once for every input at compile time.

Functions

aes_mix_key_kernel

Second half of AESENC: MixColumns followed by AddRoundKey.

aes_round

One reference AESENC round, including MixColumns and the supplied key.

aes_round_kernel

One complete AESENC round for small-stage lowering/equivalence gates.

aes_sbox

Independent reference AES S-box via inversion in GF(2^8) and affine map.

aes_sbox_kernel

Exhaustive combinational AES S-box for synthesis as fixed Boolean logic.

aes_sub_shift_kernel

First half of an AESENC round, with conventional AES column-major bytes.

aes_xtime_kernel

AES field multiplication by x, reduced modulo x^8 + x^4 + x^3 + x + 1.

dsig_chain

Applies one DSig chain step at the given index and depth (Haraka-512 in the V1 profile; see chain_lane).

dsig_chain_block

Builds DSig’s 64-byte chain block with wrapping low-32-bit nonce salt.

dsig_chain_block_kernel

RHDL byte packing for the exact dsig_chain_block salt domain.

haraka512

Pure Rust Haraka-512 v2 with fixed standard constants and 32-byte output.

haraka512_verilog

Generates the complete twenty-stage pipeline’s RHDL-authored Verilog.

haraka_pipeline_kernel

Connectivity of the resetless datapath and resettable ownership pipeline.

haraka_pipeline_verilog

Generates a registered prefix for focused lowering and RTL tests.

mid_haraka512

DSig’s 144-bit Haraka output, exactly the prefix of haraka512.

mix512_kernel

Pure wiring of the sixteen 32-bit Haraka lane words.

mix_key512_kernel

Parallel linear half-round with optional post-round inter-lane wiring.

sub_shift512_kernel

Parallel nonlinear half-round for all four AES lanes.

Type Aliases

Haraka512Pipeline

Complete Haraka-512 v2 pipeline with twenty-cycle registered latency.