crypto: streebog - add Streebog hash function

PATCH Superseded Vitaly Chikunov 2 participants 10 messages Oct 24, 2018 – Nov 5, 2018

Subsystems (2)

Crypto API Arm STM32

lore

Share & tools

lore

Vitaly Chikunov

author

2018-10-24 03:24 UTC #0 lore raw

v3 cover crypto: streebog - add Streebog hash function

Add GOST/IETF Streebog hash function (GOST R 34.11-2012, RFC 6986) generic hash transformation with appropriate testmgr and tcrypt tests and vectors.

Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian cryptographic standard algorithms (called GOST algorithms).

References:
https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
https://tools.ietf.org/html/rfc6986

Tested using testmgr and tcrypt on x86_64, arm, arm64, and s390x on qemu.

Changes from v1:
- Fix of big-endian problem in add512.
- More architectures are tested, including big-endian and 32-bit.

Changes from v2:
- Register hash in Hash Info for use by IMA.
- Add hmac() tests.

Vitaly Chikunov (3):
crypto: streebog - add Streebog hash function
crypto: streebog - register Streebog in hash info for IMA
crypto: streebog - add Streebog test vectors

 crypto/Kconfig                 |   12 +
 crypto/Makefile                |    1 +
 crypto/hash_info.c             |    4 +
 crypto/streebog_generic.c      | 1142 ++++++++++++++++++++++++++++++++++++++++
 crypto/tcrypt.c                |   35 ++
 crypto/testmgr.c               |   24 +
 crypto/testmgr.h               |  114 ++++
 include/crypto/hash_info.h     |    1 +
 include/crypto/streebog.h      |   34 ++
 include/uapi/linux/hash_info.h |    2 +
 10 files changed, 1369 insertions(+)
 create mode 100644 crypto/streebog_generic.c
 create mode 100644 include/crypto/streebog.h

Signature · 1 line

2.11.0

Vitaly Chikunov

author

2018-10-24 03:25 UTC #1 lore raw

PATCH v3 1/3 crypto: streebog - add Streebog hash function

Add GOST/IETF Streebog hash function (GOST R 34.11-2012, RFC 6986) generic hash transformation.

Signed-off-by Vitaly Chikunov <[email protected]>

---
 crypto/Kconfig            |   12 +
 crypto/Makefile           |    1 +
 crypto/streebog_generic.c | 1142 +++++++++++++++++++++++++++++++++++++++++++++
 include/crypto/streebog.h |   34 ++
 4 files changed, 1189 insertions(+)
 create mode 100644 crypto/streebog_generic.c
 create mode 100644 include/crypto/streebog.h

crypto/Kconfig +12 -0

index f3e40ac56d93..587c32f65cfe 100644
@@ -986,6 +986,18 @@ config CRYPTO_SM3
 	  http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
 	  https://datatracker.ietf.org/doc/html/draft-shen-sm3-hash
 
+config CRYPTO_STREEBOG
+	tristate "Streebog Hash Function"
+	select CRYPTO_HASH
+	help
+	  Streebog Hash Function (GOST R 34.11-2012, RFC 6986) is one of the Russian
+	  cryptographic standard algorithms (called GOST algorithms).
+	  This setting enables two hash algorithms with 256 and 512 bits output.
+
+	  References:
+	  https://tc26.ru/upload/iblock/fed/feddbb4d26b685903faa2ba11aea43f6.pdf
+	  https://tools.ietf.org/html/rfc6986
+
 config CRYPTO_TGR192
 	tristate "Tiger digest algorithms"
 	select CRYPTO_HASH

crypto/Makefile +1 -0

index 6d1d40eeb964..65be945da35c 100644
@@ -70,6 +70,7 @@ obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o
 obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o
 obj-$(CONFIG_CRYPTO_SHA3) += sha3_generic.o
 obj-$(CONFIG_CRYPTO_SM3) += sm3_generic.o
+obj-$(CONFIG_CRYPTO_STREEBOG) += streebog_generic.o
 obj-$(CONFIG_CRYPTO_WP512) += wp512.o
 CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns)  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149
 obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o

crypto/streebog_generic.c new file +1142 -0

1,142 lines not on this page · raw message

include/crypto/streebog.h new file +34 -0

new file mode 100644
index 000000000000..8d5c676225b0
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0+ OR BSD-2-Clause */
+/*
+ * Copyright (c) 2013 Alexey Degtyarev <[email protected]>
+ * Copyright (c) 2018 Vitaly Chikunov <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#ifndef _CRYPTO_STREEBOG_H_
+#define _CRYPTO_STREEBOG_H_
+
+#include <linux/types.h>
+
+#define STREEBOG256_DIGEST_SIZE	32
+#define STREEBOG512_DIGEST_SIZE	64
+#define STREEBOG_BLOCK_SIZE	64
+
+struct streebog_uint512 {
+	u64 qword[8];
+} __aligned(16);
+
+struct streebog_state {
+	u8 buffer[64] __aligned(16);
+	struct streebog_uint512 hash;
+	struct streebog_uint512 h;
+	struct streebog_uint512 N;
+	struct streebog_uint512 Sigma;
+	size_t bufsize;
+};
+
+#endif /* !_CRYPTO_STREEBOG_H_ */

Signature · 1 line

2.11.0

Vitaly Chikunov

author

2018-11-05 14:36 UTC #3 lore raw

Ard,

I will address your suggestions in v4. And below is my comments for a few of them.

Quoted 5 lines · Ard Biesheuvel

crypto/streebog_generic.c line 81
Quoted 2 lines
crypto/streebog_generic.c new file +2 -0
+static const struct streebog_uint512 buffer512 = { {
+       cpu_to_le64(0x200ULL),
Can we keep the memory representation in native endianness, and only swab the in/output [where needed]?

Yes. This will slightly affect performance on big-endian architectures, but, probably this is not a concern.

Quoted 1 line

Also, did you test this code on a big-endian system?

Yes, on s390x on qemu.

Quoted 3 lines

Quoted 1 line
+ .cra_name = "sb256",
Please use the full name 'streebog256' (and 512 below)

First, I thought of shortening name like Whirlpool do with wp256, but now I rethought this and agree.

Thanks!

Vitaly Chikunov

author

2018-11-05 18:23 UTC #4 lore raw

In reply to Ard Biesheuvel

Ard,

Quoted 6 lines · Ard Biesheuvel

crypto/streebog_generic.c line 81
Quoted 3 lines
crypto/streebog_generic.c new file +2 -0
+static const struct streebog_uint512 buffer512 = { {
+       cpu_to_le64(0x200ULL),
Can we keep the memory representation in native endianness, and only swab the in/output [where needed]?

I hope you do not insist on that?

The code is using same primitives to add/xor/permute with data from these arrays (buffer512[] and C[], those which use cpu_to_le64), and from generic data buffers. Having these arrays in native endianness will cause complexities - code split and duplications. For example, XLPS permutation will require two versions, with one accessing (y) as is and another as cpu_to_le64(y).

The code is based on canonical implementation by RFC 6986 ("GOST R 34.11-2012: Hash Function") author, and I don't want it do deviate that much from the original, which would complicate algorithm reviews.

Thanks,

Ard Biesheuvel

2018-11-05 18:58 UTC #5 lore raw

Quoted 19 lines · Vitaly Chikunov

Ard,
Quoted 6 lines · Ard Biesheuvel
crypto/streebog_generic.c line 81
Quoted 3 lines
crypto/streebog_generic.c new file +2 -0
+static const struct streebog_uint512 buffer512 = { {
+       cpu_to_le64(0x200ULL),
Can we keep the memory representation in native endianness, and only swab the in/output [where needed]?
I hope you do not insist on that?
The code is using same primitives to add/xor/permute with data from these arrays (buffer512[] and C[], those which use cpu_to_le64), and from generic data buffers. Having these arrays in native endianness will cause complexities - code split and duplications. For example, XLPS permutation will require two versions, with one accessing (y) as is and another as cpu_to_le64(y).

Quoted 4 lines

The code is based on canonical implementation by RFC 6986 ("GOST R 34.11-2012: Hash Function") author, and I don't want it do deviate that much from the original, which would complicate algorithm reviews.

That is a very good reason, so unless anyone has concerns about the performance on BE systems, let's leave it as is.

Vitaly Chikunov

author

2018-10-24 03:25 UTC #6 lore raw

PATCH v3 2/3 crypto: streebog - register Streebog in hash info for IMA

In reply to Vitaly Chikunov

Signed-off-by Vitaly Chikunov <[email protected]>

---
 crypto/hash_info.c             | 4 ++++
 include/crypto/hash_info.h     | 1 +
 include/uapi/linux/hash_info.h | 2 ++
 3 files changed, 7 insertions(+)

crypto/hash_info.c +4 -0

index 7b1e0b188ce6..b0b91eb0973a 100644
@@ -32,6 +32,8 @@ const char *const hash_algo_name[HASH_ALGO__LAST] = {
 	[HASH_ALGO_TGR_160]	= "tgr160",
 	[HASH_ALGO_TGR_192]	= "tgr192",
 	[HASH_ALGO_SM3_256]	= "sm3-256",
+	[HASH_ALGO_SB256]	= "sb256",
+	[HASH_ALGO_SB512]	= "sb512",
 };
 EXPORT_SYMBOL_GPL(hash_algo_name);

@@ -54,5 +56,7 @@ const int hash_digest_size[HASH_ALGO__LAST] = {
 	[HASH_ALGO_TGR_160]	= TGR160_DIGEST_SIZE,
 	[HASH_ALGO_TGR_192]	= TGR192_DIGEST_SIZE,
 	[HASH_ALGO_SM3_256]	= SM3256_DIGEST_SIZE,
+	[HASH_ALGO_SB256]	= STREEBOG256_DIGEST_SIZE,
+	[HASH_ALGO_SB512]	= STREEBOG512_DIGEST_SIZE,
 };
 EXPORT_SYMBOL_GPL(hash_digest_size);

include/crypto/hash_info.h +1 -0

index 56f217d41f12..91786b68dbdb 100644
@@ -15,6 +15,7 @@
 
 #include <crypto/sha.h>
 #include <crypto/md5.h>
+#include <crypto/streebog.h>
 
 #include <uapi/linux/hash_info.h>

include/uapi/linux/hash_info.h +2 -0

index eea5d02c58de..5e8b8d952ba0 100644
@@ -33,6 +33,8 @@ enum hash_algo {
 	HASH_ALGO_TGR_160,
 	HASH_ALGO_TGR_192,
 	HASH_ALGO_SM3_256,
+	HASH_ALGO_SB256,
+	HASH_ALGO_SB512,
 	HASH_ALGO__LAST
 };

Signature · 1 line

2.11.0

Ard Biesheuvel

2018-11-05 13:23 UTC #7 lore raw

Re: [PATCH v3 2/3] crypto: streebog - register Streebog in hash info for IMA

Quoted 48 lines · Vitaly Chikunov

Signed-off-by Vitaly Chikunov <[email protected]>

---
 crypto/hash_info.c             | 4 ++++
 include/crypto/hash_info.h     | 1 +
 include/uapi/linux/hash_info.h | 2 ++
 3 files changed, 7 insertions(+)

crypto/hash_info.c +4 -0

index 7b1e0b188ce6..b0b91eb0973a 100644
@@ -32,6 +32,8 @@ const char *const hash_algo_name[HASH_ALGO__LAST] = {
        [HASH_ALGO_TGR_160]     = "tgr160",
        [HASH_ALGO_TGR_192]     = "tgr192",
        [HASH_ALGO_SM3_256]     = "sm3-256",
+       [HASH_ALGO_SB256]       = "sb256",
+       [HASH_ALGO_SB512]       = "sb512",
 };
 EXPORT_SYMBOL_GPL(hash_algo_name);

@@ -54,5 +56,7 @@ const int hash_digest_size[HASH_ALGO__LAST] = {
        [HASH_ALGO_TGR_160]     = TGR160_DIGEST_SIZE,
        [HASH_ALGO_TGR_192]     = TGR192_DIGEST_SIZE,
        [HASH_ALGO_SM3_256]     = SM3256_DIGEST_SIZE,
+       [HASH_ALGO_SB256]       = STREEBOG256_DIGEST_SIZE,
+       [HASH_ALGO_SB512]       = STREEBOG512_DIGEST_SIZE,
 };
 EXPORT_SYMBOL_GPL(hash_digest_size);

include/crypto/hash_info.h +1 -0

index 56f217d41f12..91786b68dbdb 100644
@@ -15,6 +15,7 @@
 
 #include <crypto/sha.h>
 #include <crypto/md5.h>
+#include <crypto/streebog.h>
 
 #include <uapi/linux/hash_info.h>

include/uapi/linux/hash_info.h +0 -0

index eea5d02c58de..5e8b8d952ba0 100644

include/uapi/linux/hash_info.h enum hash_algo { · line 37

Quoted 5 lines

include/uapi/linux/hash_info.h +2 -0

@@ -33,6 +33,8 @@ enum hash_algo {
        HASH_ALGO_TGR_160,
        HASH_ALGO_TGR_192,
        HASH_ALGO_SM3_256,
+       HASH_ALGO_SB256,
+       HASH_ALGO_SB512,

Could we make this HASH_ALGO_STREEBOG_xxx please?

Quoted 6 lines

include/uapi/linux/hash_info.h +0 -1
        HASH_ALGO__LAST
 };
 
--
2.11.0

Vitaly Chikunov

author

2018-10-24 03:25 UTC #8 lore raw

PATCH v3 3/3 crypto: streebog - add Streebog test vectors

In reply to Vitaly Chikunov

Add testmgr and tcrypt tests and vectors for Streebog hash function from RFC 6986 and GOST R 34.11-2012, for HMAC-Streebog vectors are from R 50.1.113-2016.

Signed-off-by Vitaly Chikunov <[email protected]>

---
 crypto/tcrypt.c  |  35 +++++++++++++++++
 crypto/testmgr.c |  24 ++++++++++++
 crypto/testmgr.h | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 173 insertions(+)

crypto/tcrypt.c +35 -0

index bdde95e8d369..5dae2eb16c8d 100644
@@ -77,6 +77,7 @@ static char *check[] = {
 	"khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
 	"camellia", "seed", "salsa20", "rmd128", "rmd160", "rmd256", "rmd320",
 	"lzo", "cts", "zlib", "sha3-224", "sha3-256", "sha3-384", "sha3-512",
+	"sb256", "sb512",
 	NULL
 };

@@ -1914,6 +1915,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("sm3");
 		break;
 
+	case 53:
+		ret += tcrypt_test("sb256");
+		break;
+
+	case 54:
+		ret += tcrypt_test("sb512");
+		break;
+
 	case 100:
 		ret += tcrypt_test("hmac(md5)");
 		break;

@@ -1970,6 +1979,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		ret += tcrypt_test("hmac(sha3-512)");
 		break;
 
+	case 115:
+		ret += tcrypt_test("hmac(sb256)");
+		break;
+
+	case 116:
+		ret += tcrypt_test("hmac(sb512)");
+		break;
+
 	case 150:
 		ret += tcrypt_test("ansi_cprng");
 		break;

@@ -2392,6 +2409,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 		test_hash_speed("sm3", sec, generic_hash_speed_template);
 		if (mode > 300 && mode < 400) break;
 		/* fall through */
+	case 327:
+		test_hash_speed("sb256", sec, generic_hash_speed_template);
+		if (mode > 300 && mode < 400) break;
+		/* fall through */
+	case 328:
+		test_hash_speed("sb512", sec, generic_hash_speed_template);
+		if (mode > 300 && mode < 400) break;
+		/* fall through */
 	case 399:
 		break;

@@ -2505,6 +2530,16 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
 				    num_mb);
 		if (mode > 400 && mode < 500) break;
 		/* fall through */
+	case 426:
+		test_mb_ahash_speed("sb256", sec, generic_hash_speed_template,
+				    num_mb);
+		if (mode > 400 && mode < 500) break;
+		/* fall through */
+	case 427:
+		test_mb_ahash_speed("sb512", sec, generic_hash_speed_template,
+				    num_mb);
+		if (mode > 400 && mode < 500) break;
+		/* fall through */
 	case 499:
 		break;

crypto/testmgr.c +24 -0

index a1d42245082a..6f3f0379260b 100644
@@ -3122,6 +3122,18 @@ static const struct alg_test_desc alg_test_descs[] = {
 			.hash = __VECS(hmac_rmd160_tv_template)
 		}
 	}, {
+		.alg = "hmac(sb256)",
+		.test = alg_test_hash,
+		.suite = {
+			.hash = __VECS(hmac_sb256_tv_template)
+		}
+	}, {
+		.alg = "hmac(sb512)",
+		.test = alg_test_hash,
+		.suite = {
+			.hash = __VECS(hmac_sb512_tv_template)
+		}
+	}, {
 		.alg = "hmac(sha1)",
 		.test = alg_test_hash,
 		.fips_allowed = 1,

@@ -3428,6 +3440,18 @@ static const struct alg_test_desc alg_test_descs[] = {
 			.cipher = __VECS(salsa20_stream_tv_template)
 		}
 	}, {
+		.alg = "sb256",
+		.test = alg_test_hash,
+		.suite = {
+			.hash = __VECS(sb256_tv_template)
+		}
+	}, {
+		.alg = "sb512",
+		.test = alg_test_hash,
+		.suite = {
+			.hash = __VECS(sb512_tv_template)
+		}
+	}, {
 		.alg = "sha1",
 		.test = alg_test_hash,
 		.fips_allowed = 1,

crypto/testmgr.h +114 -0

120 lines not on this page · raw message

Signature · 1 line

2.11.0

Ard Biesheuvel

Acked-by on v3 3/3

2018-11-05 13:24 UTC #9 lore raw

Re: [PATCH v3 3/3] crypto: streebog - add Streebog test vectors

Quoted 16 lines · Vitaly Chikunov

Add testmgr and tcrypt tests and vectors for Streebog hash function from RFC 6986 and GOST R 34.11-2012, for HMAC-Streebog vectors are from R 50.1.113-2016.
Signed-off-by Vitaly Chikunov <[email protected]>
---
 crypto/tcrypt.c  |  35 +++++++++++++++++
 crypto/testmgr.c |  24 ++++++++++++
 crypto/testmgr.h | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 173 insertions(+)
crypto/tcrypt.c +0 -0
index bdde95e8d369..5dae2eb16c8d 100644

crypto/tcrypt.c static char *check[] = { · line 80

Quoted 4 lines

crypto/tcrypt.c +1 -0

@@ -77,6 +77,7 @@ static char *check[] = {
        "khazad", "wp512", "wp384", "wp256", "tnepres", "xeta",  "fcrypt",
        "camellia", "seed", "salsa20", "rmd128", "rmd160", "rmd256", "rmd320",
        "lzo", "cts", "zlib", "sha3-224", "sha3-256", "sha3-384", "sha3-512",
+       "sb256", "sb512",

After changing this to "streebog256", "streebog512"

Acked-by Ard Biesheuvel <[email protected]>

Quoted 235 lines

crypto/tcrypt.c +34 -0

        NULL
 };

@@ -1914,6 +1915,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
                ret += tcrypt_test("sm3");
                break;
 
+       case 53:
+               ret += tcrypt_test("sb256");
+               break;
+
+       case 54:
+               ret += tcrypt_test("sb512");
+               break;
+
        case 100:
                ret += tcrypt_test("hmac(md5)");
                break;

@@ -1970,6 +1979,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
                ret += tcrypt_test("hmac(sha3-512)");
                break;
 
+       case 115:
+               ret += tcrypt_test("hmac(sb256)");
+               break;
+
+       case 116:
+               ret += tcrypt_test("hmac(sb512)");
+               break;
+
        case 150:
                ret += tcrypt_test("ansi_cprng");
                break;

@@ -2392,6 +2409,14 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
                test_hash_speed("sm3", sec, generic_hash_speed_template);
                if (mode > 300 && mode < 400) break;
                /* fall through */
+       case 327:
+               test_hash_speed("sb256", sec, generic_hash_speed_template);
+               if (mode > 300 && mode < 400) break;
+               /* fall through */
+       case 328:
+               test_hash_speed("sb512", sec, generic_hash_speed_template);
+               if (mode > 300 && mode < 400) break;
+               /* fall through */
        case 399:
                break;

@@ -2505,6 +2530,16 @@ static int do_test(const char *alg, u32 type, u32 mask, int m, u32 num_mb)
                                    num_mb);
                if (mode > 400 && mode < 500) break;
                /* fall through */
+       case 426:
+               test_mb_ahash_speed("sb256", sec, generic_hash_speed_template,
+                                   num_mb);
+               if (mode > 400 && mode < 500) break;
+               /* fall through */
+       case 427:
+               test_mb_ahash_speed("sb512", sec, generic_hash_speed_template,
+                                   num_mb);
+               if (mode > 400 && mode < 500) break;
+               /* fall through */
        case 499:
                break;

crypto/testmgr.c +24 -0

index a1d42245082a..6f3f0379260b 100644
@@ -3122,6 +3122,18 @@ static const struct alg_test_desc alg_test_descs[] = {
                        .hash = __VECS(hmac_rmd160_tv_template)
                }
        }, {
+               .alg = "hmac(sb256)",
+               .test = alg_test_hash,
+               .suite = {
+                       .hash = __VECS(hmac_sb256_tv_template)
+               }
+       }, {
+               .alg = "hmac(sb512)",
+               .test = alg_test_hash,
+               .suite = {
+                       .hash = __VECS(hmac_sb512_tv_template)
+               }
+       }, {
                .alg = "hmac(sha1)",
                .test = alg_test_hash,
                .fips_allowed = 1,

@@ -3428,6 +3440,18 @@ static const struct alg_test_desc alg_test_descs[] = {
                        .cipher = __VECS(salsa20_stream_tv_template)
                }
        }, {
+               .alg = "sb256",
+               .test = alg_test_hash,
+               .suite = {
+                       .hash = __VECS(sb256_tv_template)
+               }
+       }, {
+               .alg = "sb512",
+               .test = alg_test_hash,
+               .suite = {
+                       .hash = __VECS(sb512_tv_template)
+               }
+       }, {
                .alg = "sha1",
                .test = alg_test_hash,
                .fips_allowed = 1,

crypto/testmgr.h +114 -1

index 173111c70746..a48ba2945093 100644
@@ -2309,6 +2309,120 @@ static const struct hash_testvec crct10dif_tv_template[] = {
        }
 };
 
+/*
+ * Streebog test vectors from RFC 6986 and GOST R 34.11-2012
+ */
+static const struct hash_testvec sb256_tv_template[] = {
+       { /* M1 */
+               .plaintext = "012345678901234567890123456789012345678901234567890123456789012",
+               .psize = 63,
+               .digest =
+                       "\x9d\x15\x1e\xef\xd8\x59\x0b\x89"
+                       "\xda\xa6\xba\x6c\xb7\x4a\xf9\x27"
+                       "\x5d\xd0\x51\x02\x6b\xb1\x49\xa4"
+                       "\x52\xfd\x84\xe5\xe5\x7b\x55\x00",
+       },
+       { /* M2 */
+               .plaintext =
+                       "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8"
+                       "\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
+                       "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8"
+                       "\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
+                       "\xf1\x20\xec\xee\xf0\xff\x20\xf1"
+                       "\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
+                       "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0"
+                       "\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
+                       "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
+               .psize = 72,
+               .digest =
+                       "\x9d\xd2\xfe\x4e\x90\x40\x9e\x5d"
+                       "\xa8\x7f\x53\x97\x6d\x74\x05\xb0"
+                       "\xc0\xca\xc6\x28\xfc\x66\x9a\x74"
+                       "\x1d\x50\x06\x3c\x55\x7e\x8f\x50",
+       },
+};
+
+static const struct hash_testvec sb512_tv_template[] = {
+       { /* M1 */
+               .plaintext = "012345678901234567890123456789012345678901234567890123456789012",
+               .psize = 63,
+               .digest =
+                       "\x1b\x54\xd0\x1a\x4a\xf5\xb9\xd5"
+                       "\xcc\x3d\x86\xd6\x8d\x28\x54\x62"
+                       "\xb1\x9a\xbc\x24\x75\x22\x2f\x35"
+                       "\xc0\x85\x12\x2b\xe4\xba\x1f\xfa"
+                       "\x00\xad\x30\xf8\x76\x7b\x3a\x82"
+                       "\x38\x4c\x65\x74\xf0\x24\xc3\x11"
+                       "\xe2\xa4\x81\x33\x2b\x08\xef\x7f"
+                       "\x41\x79\x78\x91\xc1\x64\x6f\x48",
+       },
+       { /* M2 */
+               .plaintext =
+                       "\xd1\xe5\x20\xe2\xe5\xf2\xf0\xe8"
+                       "\x2c\x20\xd1\xf2\xf0\xe8\xe1\xee"
+                       "\xe6\xe8\x20\xe2\xed\xf3\xf6\xe8"
+                       "\x2c\x20\xe2\xe5\xfe\xf2\xfa\x20"
+                       "\xf1\x20\xec\xee\xf0\xff\x20\xf1"
+                       "\xf2\xf0\xe5\xeb\xe0\xec\xe8\x20"
+                       "\xed\xe0\x20\xf5\xf0\xe0\xe1\xf0"
+                       "\xfb\xff\x20\xef\xeb\xfa\xea\xfb"
+                       "\x20\xc8\xe3\xee\xf0\xe5\xe2\xfb",
+               .psize = 72,
+               .digest =
+                       "\x1e\x88\xe6\x22\x26\xbf\xca\x6f"
+                       "\x99\x94\xf1\xf2\xd5\x15\x69\xe0"
+                       "\xda\xf8\x47\x5a\x3b\x0f\xe6\x1a"
+                       "\x53\x00\xee\xe4\x6d\x96\x13\x76"
+                       "\x03\x5f\xe8\x35\x49\xad\xa2\xb8"
+                       "\x62\x0f\xcd\x7c\x49\x6c\xe5\xb3"
+                       "\x3f\x0c\xb9\xdd\xdc\x2b\x64\x60"
+                       "\x14\x3b\x03\xda\xba\xc9\xfb\x28",
+       },
+};
+
+/* Two HMAC-Streebog test vectors from R 50.1.113-2016 A */
+static const struct hash_testvec hmac_sb256_tv_template[] = {
+       {
+               .key =  "\x00\x01\x02\x03\x04\x05\x06\x07"
+                       "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+                       "\x10\x11\x12\x13\x14\x15\x16\x17"
+                       "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+               .ksize  = 32,
+               .plaintext =
+                       "\x01\x26\xbd\xb8\x78\x00\xaf\x21"
+                       "\x43\x41\x45\x65\x63\x78\x01\x00",
+               .psize  = 16,
+               .digest =
+                       "\xa1\xaa\x5f\x7d\xe4\x02\xd7\xb3"
+                       "\xd3\x23\xf2\x99\x1c\x8d\x45\x34"
+                       "\x01\x31\x37\x01\x0a\x83\x75\x4f"
+                       "\xd0\xaf\x6d\x7c\xd4\x92\x2e\xd9",
+       },
+};
+
+static const struct hash_testvec hmac_sb512_tv_template[] = {
+       {
+               .key =  "\x00\x01\x02\x03\x04\x05\x06\x07"
+                       "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+                       "\x10\x11\x12\x13\x14\x15\x16\x17"
+                       "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+               .ksize  = 32,
+               .plaintext =
+                       "\x01\x26\xbd\xb8\x78\x00\xaf\x21"
+                       "\x43\x41\x45\x65\x63\x78\x01\x00",
+               .psize  = 16,
+               .digest =
+                       "\xa5\x9b\xab\x22\xec\xae\x19\xc6"
+                       "\x5f\xbd\xe6\xe5\xf4\xe9\xf5\xd8"
+                       "\x54\x9d\x31\xf0\x37\xf9\xdf\x9b"
+                       "\x90\x55\x00\xe1\x71\x92\x3a\x77"
+                       "\x3d\x5f\x15\x30\xf2\xed\x7e\x96"
+                       "\x4c\xb2\xee\xdc\x29\xe9\xad\x2f"
+                       "\x3a\xfe\x93\xb2\x81\x4f\x79\xf5"
+                       "\x00\x0f\xfc\x03\x66\xc2\x51\xe6",
+       },
+};
+
 /* Example vectors below taken from
  * http://www.oscca.gov.cn/UpFile/20101222141857786.pdf
  *
--

2.11.0