sha256-simd does not implement encoding.BinaryMarshaler/encoding.BinaryUnmarshaler

[zeripath]

Hi!

I know this was discussed in #29 and decided against, but the lack of implementation of these interfaces makes this library not a complete drop-in replacement for crypto/sha256.

Would it be possible to implement these?

[AudriusButkevicius]

Can you elaborate why it's not compatible?

You can always wrap the library in your own types.

[klauspost]

You can always argue whether assertible interfaces are compatible or not.

Let me see if we can add a compatible mode.

[zeripath]

The lack of the implementation of these interfaces means that you can't just do a find and replace for "crypto/sha256" because code that makes the assumption that these interfaces are implemented won't work.

Yes, the code should check but ... when unmarshaler isn't there you're at a bit of a loss as to what to do - you can't just implement itself because to marshal/unmarshal the hash requires access to the internal values of the the digest (which you do not have access to so you can't just wrap it)

[zeripath]

Although this code is heavily inspired by that in crypto/sha256 - In order for strict compatibility I think it has to be this way.

diff --git a/sha256.go b/sha256.go
index 00dd797..ea72d60 100644
--- a/sha256.go
+++ b/sha256.go
@@ -19,6 +19,7 @@ package sha256
 import (
 	"crypto/sha256"
 	"encoding/binary"
+	"errors"
 	"hash"
 )
 
@@ -260,6 +261,42 @@ func (d *digest) checkSum() (digest [Size]byte) {
 	return
 }
 
+var magic = "sha\x03" // This has to match the magic value used in crypto/sha256 for compatibility
+
+// MarshalBinary implements the encoding.BinaryMarshaler interface. This is an unadvertised interface on crypto/sha256 but is required for this to be a drop in replacement
+// The format used here is exactly the same as that used in crypto/sha256 in order to be compatible
+func (d *digest) MarshalBinary() ([]byte, error) {
+	b := make([]byte, 0, 108)
+	b = append(b, magic...)
+	for i := 0; i < 8; i++ {
+		b = binary.BigEndian.AppendUint32(b, d.h[i])
+	}
+	b = append(b, d.x[:d.nx]...)
+	b = b[:len(b)+len(d.x)-d.nx] // already zero
+	b = binary.BigEndian.AppendUint64(b, d.len)
+	return b, nil
+}
+
+// UnmarshalBinary implements the encoding.BinaryUnmarshaler interface. This is an unadvertised interface on crypto/sha256 but is required for this to be a drop in replacement
+// The format used here is exactly the same as that used in crypto/sha256 in order to be compatible
+func (d *digest) UnmarshalBinary(b []byte) error {
+	if len(b) < len(magic) || string(b[:len(magic)]) != magic {
+		return errors.New("crypto/sha256: invalid hash state identifier") // Must match the same error as crypto/sha256 for compatibility
+	}
+	if len(b) != 108 {
+		return errors.New("crypto/sha256: invalid hash state size") // Must match the same error as crypto/sha256 for compatibility
+	}
+	b = b[len(magic):]
+	for i := 0; i < 8; i++ {
+		d.h[i] = binary.BigEndian.Uint32(b)
+		b = b[4:]
+	}
+	b = b[copy(d.x[:], b):]
+	d.len = binary.BigEndian.Uint64(b)
+	d.nx = int(d.len % chunk)
+	return nil
+}
+
 func block(dig *digest, p []byte) {
 	if blockfunc == blockfuncIntelSha {
 		blockIntelShaGo(dig, p)

[klauspost]

@zeripath Yeah, took the same approach and also added the tests in #68 - they appear compatible with SHA extensions.