Add TurboSHAKE XOF functions.

[MarekKnapek]

TurboSHAKE128 and TurboSHAKE256 as described in https://keccak.team/files/TurboSHAKE.pdf.

#691

Checklist

• documentation is added or updated
• tests are added or updated

[levitte]

That PDF refers to https://datatracker.ietf.org/doc/draft-irtf-cfrg-kangarootwelve/, which also describes the algo, and provides test vectors. Might I suggest adding some tests, based on those test vectors?

[sjaeckel]

And TBH I'd prefer to have this only merged once the RFC is finalized.
I've been burned too often by standards changing in some future version before release.

[MarekKnapek]

I updated my branch, I added some unit tests. Regarding the standard being in draft stage. It seems to be draft since 2019-08-06 until 2025-02-21 and continuing to be draft until today, not sure what changed in the meantime. How would you like to continue? I have few ideas:

• Keep the TurboSHAKE functions in the library, but behind some #ifdef that clearly communicates to the user that this feature is "beta" or "standard not finished yet" and that it might change in the future or something like that.
• Do not add this functionality to your product until the RFC standardization is done. (You seem to like this approach.)
• Add this functionality to your product and if it breaks in the future, say to your customers "bad luck" your problem using unfinished standard, not mine. (You seem to don't like this approach.)
• Any more ideas?

[levitte]

I could go with having this as an unstable feature, only to be enabled on demand... especially if libtomcrypt already have infrastructure for that sort of thing (er, I forget if it has). If that ends up too hard, I'd go with keeping this PR as is until the standard is finalized.

I was a bit involved in the addition of TLS 1.3 in OpenSSL, and we did hold off a release with that until the RFC was actually published... and we did see some changes very late in the RFC process. So that is to say, there's quite some precedence to @sjaeckel's worries.

[sjaeckel]

Thanks for adding the tests and thanks for your input!

So a long lived PR this will be, until cfrg comes to a conclusion ...

[sjaeckel]

So a long lived PR this will be, until cfrg comes to a conclusion ...

That was faster than expected - https://datatracker.ietf.org/doc/rfc9861/

[MarekKnapek]

Nice. I just checked the test vectors with the RFC. They are the same. I updated my branch to reflect the RFC number.