cSHAKE implementation produces invalid output

[paulmillr]

You have issue with cshake implementation here: https://github.com/emn178/js-sha3/blob/b39d0910cb4cce54a6060c21e1491d55f70269bf/src/sha3.js#L326 it should be var paddingBytes = (w - bytes % w) % w;, since it should not pad if value is already divisible by block size without remainder. (spec: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-185.pdf: bytepad function step 3 here: while (len(z)/8) mod w ≠ 0: We encountered the same error in noble-hashes, which contains XKCP-generated test vectors

Test case which triggers the error:

let str='084fed08b978af4d7d196a7446a86b58009e636b611db16211b65a9aadff29c5084fed08b978af4d7d196a7446a86b58009e636b611db16211b65a9aadff29c5084fed08b978af4d7d196a7446a86b58009e636b611db16211b65a9aadff29c5084fed08b978af4d7d196a7446a86b58009e636b611db16211b65a9aad';
Buffer.from(new Uint8Array(require('js-sha3').kmac256.create(Buffer.from([]), 16*8, Buffer.from(str, 'hex')).update(Buffer([])).arrayBuffer())).toString('hex')==='031801b0b50ebeef772fbe7a279bc144'

Instead, it returns bc58e9c8534e5fa7346f06e6ab25e2db

[ren1244]

For cshake128(X, L, N, S) I get incorrect result if length of S is 161 and N is empty string.

[ren1244]

cshake128/256

• parameter function name does not support empty Array (including Uint8Array and ArrayBuffer)
• parameter customization does not support empty Array (including Uint8Array and ArrayBuffer)

for example

console.log(jsSha3.cshake128('',  128, '', ''));
//get: 7f9c2ba4e88f827d616045507605853e

console.log(jsSha3.cshake128([],  128, '', ''));
//get: 7f9c2ba4e88f827d616045507605853e

console.log(jsSha3.cshake128('',  128, [], ''));
//get: 1cdef541e61a208fd370edc896cc7ee0

console.log(jsSha3.cshake128('',  128, '', []));
//get: 1cdef541e61a208fd370edc896cc7ee0

console.log(jsSha3.cshake128([],  128, [], []));
//get: 1cdef541e61a208fd370edc896cc7ee0

[emn178]

Thank you for reporting. Will fix in next version.

[emn178]

fixed in v0.9.1, please check.