Add BLAKE2X

Signed-off-by: Mattias Andrée <maandree@kth.se>

25 files changed, 428 insertions, 124 deletions

diff --git a/Makefile b/Makefile
index 0bd3b94..df52ffe 100644
--- a/Makefile
+++ b/Makefile
@@ -51,8 +51,22 @@ OBJ_BLAKE2 =\
 	libblake_blake2s_init.o\
 	libblake_blake2b_update.o\
 	libblake_blake2s_update.o\
+	libblake_blake2xb_digest.o\
+	libblake_blake2xs_digest.o\
+	libblake_blake2xb_init.o\
+	libblake_blake2xs_init.o\
+	libblake_blake2xb_predigest.o\
+	libblake_blake2xs_predigest.o\
+	libblake_blake2xb_predigest_get_required_input_size.o\
+	libblake_blake2xs_predigest_get_required_input_size.o\
+	libblake_blake2xb_update.o\
+	libblake_blake2xs_update.o\
 	libblake_internal_blake2b_compress.o\
-	libblake_internal_blake2s_compress.o
+	libblake_internal_blake2s_compress.o\
+	libblake_internal_blake2s_output_digest.o\
+	libblake_internal_blake2b_output_digest.o\
+	libblake_internal_blake2xb_init0.o\
+	libblake_internal_blake2xs_init0.o
 
 OBJ =\
 	libblake_encode_hex.o\
@@ -61,7 +75,8 @@ OBJ =\
 	$(OBJ_BLAKE2)
 
 HDR =\
-	libblake.h
+	libblake.h\
+	common.h
 
 LOBJ = $(OBJ:.o=.lo)
 
@@ -69,6 +84,7 @@ LOBJ = $(OBJ:.o=.lo)
 all: libblake.a libblake.$(LIBEXT) test
 $(OBJ): $(HDR)
 $(LOBJ): $(HDR)
+test.o: $(HDR)
 
 .c.o:
 	$(CC) -c -o $@ $< $(CFLAGS) $(CPPFLAGS)
diff --git a/common.h b/common.h
index 740d37e..b1920dc 100644
--- a/common.h
+++ b/common.h
@@ -5,12 +5,22 @@
 #include <inttypes.h>
 #include <string.h>
 
+#if !defined(UINT_LEAST64_C) && defined(UINT64_C)
+# define UINT_LEAST64_C(X) UINT64_C(X)
+#elif !defined(UINT_LEAST64_C)
+# define UINT_LEAST64_C(X) X##ULL
+#endif
+
 #if !defined(UINT_LEAST32_C) && defined(UINT32_C)
 # define UINT_LEAST32_C(X) UINT32_C(X)
+#elif !defined(UINT_LEAST32_C)
+# define UINT_LEAST32_C(X) X##UL
 #endif
 
-#if !defined(UINT_LEAST64_C) && defined(UINT64_C)
-# define UINT_LEAST64_C(X) UINT64_C(X)
+#if !defined(UINT_LEAST16_C) && defined(UINT16_C)
+# define UINT_LEAST16_C(X) UINT16_C(X)
+#elif !defined(UINT_LEAST16_C)
+# define UINT_LEAST16_C(X) X##U
 #endif
 
 #if defined(__GNUC__)
@@ -19,6 +29,13 @@
 # define HIDDEN
 #endif
 
+#define A 10
+#define B 11
+#define C 12
+#define D 13
+#define E 14
+#define F 15
+
 HIDDEN size_t libblake_internal_blakes_update(struct libblake_blakes_state *state, const unsigned char *data, size_t len);
 HIDDEN size_t libblake_internal_blakeb_update(struct libblake_blakeb_state *state, const unsigned char *data, size_t len);
 
@@ -29,3 +46,9 @@ HIDDEN void libblake_internal_blakeb_digest(struct libblake_blakeb_state *state,
 
 HIDDEN void libblake_internal_blake2s_compress(struct libblake_blake2s_state *state, const unsigned char *data);
 HIDDEN void libblake_internal_blake2b_compress(struct libblake_blake2b_state *state, const unsigned char *data);
+
+HIDDEN void libblake_internal_blake2xs_init0(struct libblake_blake2xs_state *state, const struct libblake_blake2xs_params *params);
+HIDDEN void libblake_internal_blake2xb_init0(struct libblake_blake2xb_state *state, const struct libblake_blake2xb_params *params);
+
+HIDDEN void libblake_internal_blake2s_output_digest(struct libblake_blake2s_state *state, size_t output_len, unsigned char *output);
+HIDDEN void libblake_internal_blake2b_output_digest(struct libblake_blake2b_state *state, size_t output_len, unsigned char *output);
diff --git a/libblake.h b/libblake.h
index 5e49726..7dc11a4 100644
--- a/libblake.h
+++ b/libblake.h
@@ -75,8 +75,7 @@ struct libblake_blake2s_params {
 	uint_least8_t fanout; /* normally 1 */
 	uint_least8_t depth; /* normally 1 */
 	uint_least32_t leaf_len; /* normally 0 */
-	uint_least32_t node_offset; /* normally 0 */
-	uint_least16_t xof_len; /* normally 0 */
+	uint_least64_t node_offset; /* (48-bits) normally 0 */
 	uint_least8_t node_depth; /* normally 0 */
 	uint_least8_t inner_len; /* normally 0 */
 	uint_least8_t salt[8];
@@ -89,8 +88,35 @@ struct libblake_blake2b_params {
 	uint_least8_t fanout; /* normally 1 */
 	uint_least8_t depth; /* normally 1 */
 	uint_least32_t leaf_len; /* normally 0 */
+	uint_least64_t node_offset; /* normally 0 */
+	uint_least8_t node_depth; /* normally 0 */
+	uint_least8_t inner_len; /* normally 0 */
+	uint_least8_t salt[16];
+	uint_least8_t pepper[16];
+};
+
+struct libblake_blake2xs_params {
+	uint_least8_t digest_len; /* in bytes, [1, 32] */
+	uint_least8_t key_len; /* in bytes, [0, 32] */
+	uint_least8_t fanout; /* normally 1 */
+	uint_least8_t depth; /* normally 1 */
+	uint_least32_t leaf_len; /* normally 0 */
 	uint_least32_t node_offset; /* normally 0 */
-	uint_least32_t xof_len; /* normally 0 */
+	uint_least16_t xof_len; /* max if not known in advance */
+	uint_least8_t node_depth; /* normally 0 */
+	uint_least8_t inner_len; /* normally 0 */
+	uint_least8_t salt[8];
+	uint_least8_t pepper[8];
+};
+
+struct libblake_blake2xb_params {
+	uint_least8_t digest_len; /* in bytes, [1, 64] */
+	uint_least8_t key_len; /* in bytes, [0, 64] */
+	uint_least8_t fanout; /* normally 1 */
+	uint_least8_t depth; /* normally 1 */
+	uint_least32_t leaf_len; /* normally 0 */
+	uint_least32_t node_offset; /* normally 0 */
+	uint_least32_t xof_len; /* max if not known in advance */
 	uint_least8_t node_depth; /* normally 0 */
 	uint_least8_t inner_len; /* normally 0 */
 	uint_least8_t salt[16];
@@ -109,6 +135,18 @@ struct libblake_blake2b_state {
 	uint_least64_t f[2];
 };
 
+struct libblake_blake2xs_state {
+	struct libblake_blake2s_state b2s;
+	struct libblake_blake2xs_params xof_params;
+	unsigned char intermediate[64];
+};
+
+struct libblake_blake2xb_state {
+	struct libblake_blake2b_state b2b;
+	struct libblake_blake2xb_params xof_params;
+	unsigned char intermediate[128];
+};
+
 void libblake_blake2s_init(struct libblake_blake2s_state *state, const struct libblake_blake2s_params *params,
                            const unsigned char *key /* append null bytes until 64 bytes; if key is used */);
 size_t libblake_blake2s_update(struct libblake_blake2s_state *state, const void *data, size_t len);
@@ -123,4 +161,36 @@ void libblake_blake2b_digest(struct libblake_blake2b_state *state, void *data, s
                              size_t output_len, unsigned char output[static output_len]);
 LIBBLAKE_CONST__ size_t libblake_blake2b_digest_get_required_input_size(size_t len);
 
+void libblake_blake2xs_init(struct libblake_blake2xs_state *state, const struct libblake_blake2xs_params *params,
+                            const unsigned char *key /* append null bytes until 64 bytes; if key is used */);
+inline size_t libblake_blake2xs_update(struct libblake_blake2xs_state *state, const void *data, size_t len) {
+	return libblake_blake2s_update(&state->b2s, data, len);
+}
+inline void libblake_blake2xs_predigest(struct libblake_blake2xs_state *state, void *data, size_t len, int last_node) {
+	libblake_blake2s_digest(&state->b2s, data, len, last_node, (size_t)state->xof_params.digest_len, state->intermediate);
+}
+LIBBLAKE_PURE__ inline size_t libblake_blake2xs_predigest_get_required_input_size(const struct libblake_blake2xs_state *state) {
+	return libblake_blake2s_digest_get_required_input_size((size_t)state->xof_params.digest_len);
+}
+void libblake_blake2xs_digest(const struct libblake_blake2xs_state *state,
+                              uint_least32_t i /* start 0, increase by 1 until i * 32 >= desired hash length */,
+                              uint_least8_t len /* desired hash MIN(length - i * 32, 32) */,
+                              unsigned char output[static len]  /* output for hash offset by i * 32 */);
+
+void libblake_blake2xb_init(struct libblake_blake2xb_state *state, const struct libblake_blake2xb_params *params,
+                            const unsigned char *key /* append null bytes until 128 bytes; if key is used */);
+inline size_t libblake_blake2xb_update(struct libblake_blake2xb_state *state, const void *data, size_t len) {
+	return libblake_blake2b_update(&state->b2b, data, len);
+}
+inline void libblake_blake2xb_predigest(struct libblake_blake2xb_state *state, void *data, size_t len, int last_node) {
+	libblake_blake2b_digest(&state->b2b, data, len, last_node, state->xof_params.digest_len, state->intermediate);
+}
+LIBBLAKE_PURE__ inline size_t libblake_blake2xb_predigest_get_required_input_size(const struct libblake_blake2xb_state *state) {
+	return libblake_blake2b_digest_get_required_input_size((size_t)state->xof_params.digest_len);
+}
+void libblake_blake2xb_digest(const struct libblake_blake2xb_state *state,
+                              uint_least32_t i /* start 0, increase by 1 until i * 64 >= desired hash length */,
+                              uint_least8_t len /* desired hash MIN(length - i * 64, 64) */,
+                              unsigned char output[static len] /* output for hash offset by i * 64 */);
+
 #endif
diff --git a/libblake_blake2b_digest.c b/libblake_blake2b_digest.c
index 016282d..08b2d75 100644
--- a/libblake_blake2b_digest.c
+++ b/libblake_blake2b_digest.c
@@ -1,45 +1,12 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-static void
-encode_uint64_le(unsigned char *out, uint_least64_t value, size_t bytes)
-{
-	switch (bytes) {
-	default:
-		out[7] = (unsigned char)((value >> 56) & 255);
-		/* fall through */
-	case 7:
-		out[6] = (unsigned char)((value >> 48) & 255);
-		/* fall through */
-	case 6:
-		out[5] = (unsigned char)((value >> 40) & 255);
-		/* fall through */
-	case 5:
-		out[4] = (unsigned char)((value >> 32) & 255);
-		/* fall through */
-	case 4:
-		out[3] = (unsigned char)((value >> 24) & 255);
-		/* fall through */
-	case 3:
-		out[2] = (unsigned char)((value >> 16) & 255);
-		/* fall through */
-	case 2:
-		out[1] = (unsigned char)((value >>  8) & 255);
-		/* fall through */
-	case 1:
-		out[0] = (unsigned char)((value >>  0) & 255);
-		/* fall through */
-	case 0:
-		break;
-	}
-}
-
 void
 libblake_blake2b_digest(struct libblake_blake2b_state *state, void *data_, size_t len, int last_node,
                         size_t output_len, unsigned char output[static output_len])
 {
 	unsigned char *data = data_;
-	size_t r, i, j;
+	size_t r;
 
 	r = libblake_blake2b_update(state, data, len);
 	data = &data[r];
@@ -57,6 +24,5 @@ libblake_blake2b_digest(struct libblake_blake2b_state *state, void *data_, size_
 
 	libblake_internal_blake2b_compress(state, data);
 
-	for (i = 0, j = 0; i < output_len; i += 8, j += 1)
-		encode_uint64_le(&output[i], state->h[j], output_len - i);
+	libblake_internal_blake2b_output_digest(state, output_len, output);
 }
diff --git a/libblake_blake2b_init.c b/libblake_blake2b_init.c
index 7de9bb2..b520a87 100644
--- a/libblake_blake2b_init.c
+++ b/libblake_blake2b_init.c
@@ -1,13 +1,6 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-#define A 10
-#define B 11
-#define C 12
-#define D 13
-#define E 14
-#define F 15
-
 void
 libblake_blake2b_init(struct libblake_blake2b_state *state, const struct libblake_blake2b_params *params, const unsigned char *key)
 {
@@ -29,18 +22,8 @@ libblake_blake2b_init(struct libblake_blake2b_state *state, const struct libblak
 	state->h[0] ^= ((uint_least64_t)params->key_len & 255) << 8;
 	state->h[0] ^= ((uint_least64_t)params->fanout & 255) << 16;
 	state->h[0] ^= ((uint_least64_t)params->depth & 255) << 24;
-	state->h[0] ^= ((uint_least64_t)(params->leaf_len >> 0) & 255) << 32;
-	state->h[0] ^= ((uint_least64_t)(params->leaf_len >> 8) & 255) << 40;
-	state->h[0] ^= ((uint_least64_t)(params->leaf_len >> 16) & 255) << 48;
-	state->h[0] ^= ((uint_least64_t)(params->leaf_len >> 24) & 255) << 56;
-	state->h[1] ^= ((uint_least64_t)(params->node_offset >> 0) & 255) << 0;
-	state->h[1] ^= ((uint_least64_t)(params->node_offset >> 8) & 255) << 8;
-	state->h[1] ^= ((uint_least64_t)(params->node_offset >> 16) & 255) << 16;
-	state->h[1] ^= ((uint_least64_t)(params->node_offset >> 24) & 255) << 24;
-	state->h[1] ^= ((uint_least64_t)(params->xof_len >> 0) & 255) << 32;
-	state->h[1] ^= ((uint_least64_t)(params->xof_len >> 8) & 255) << 40;
-	state->h[1] ^= ((uint_least64_t)(params->xof_len >> 16) & 255) << 48;
-	state->h[1] ^= ((uint_least64_t)(params->xof_len >> 24) & 255) << 56;
+	state->h[0] ^= (uint_least64_t)(params->leaf_len & UINT_LEAST32_C(0xFFFFffff)) << 32;
+	state->h[1] ^= params->node_offset & UINT_LEAST64_C(0xFFFFffffFFFFffff);
 	state->h[2] ^= ((uint_least64_t)params->node_depth & 255) << 0;
 	state->h[2] ^= ((uint_least64_t)params->inner_len & 255) << 8;
 	state->h[4] ^= ((uint_least64_t)params->salt[0] & 255) << 0;
diff --git a/libblake_blake2s_digest.c b/libblake_blake2s_digest.c
index 29a31a6..2ee45ed 100644
--- a/libblake_blake2s_digest.c
+++ b/libblake_blake2s_digest.c
@@ -1,33 +1,12 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-static void
-encode_uint32_le(unsigned char *out, uint_least32_t value, size_t bytes)
-{
-	switch (bytes) {
-	default:
-		out[3] = (unsigned char)((value >> 24) & 255);
-		/* fall through */
-	case 3:
-		out[2] = (unsigned char)((value >> 16) & 255);
-		/* fall through */
-	case 2:
-		out[1] = (unsigned char)((value >>  8) & 255);
-		/* fall through */
-	case 1:
-		out[0] = (unsigned char)((value >>  0) & 255);
-		/* fall through */
-	case 0:
-		break;
-	}
-}
-
 void
 libblake_blake2s_digest(struct libblake_blake2s_state *state, void *data_, size_t len, int last_node,
                         size_t output_len, unsigned char output[static output_len])
 {
 	unsigned char *data = data_;
-	size_t r, i, j;
+	size_t r;
 
 	r = libblake_blake2s_update(state, data, len);
 	data = &data[r];
@@ -45,6 +24,5 @@ libblake_blake2s_digest(struct libblake_blake2s_state *state, void *data_, size_
 
 	libblake_internal_blake2s_compress(state, data);
 
-	for (i = 0, j = 0; i < output_len; i += 4, j += 1)
-		encode_uint32_le(&output[i], state->h[j], output_len - i);
+	libblake_internal_blake2s_output_digest(state, output_len, output);
 }
diff --git a/libblake_blake2s_init.c b/libblake_blake2s_init.c
index d33ce5c..c4b126c 100644
--- a/libblake_blake2s_init.c
+++ b/libblake_blake2s_init.c
@@ -22,16 +22,9 @@ libblake_blake2s_init(struct libblake_blake2s_state *state, const struct libblak
 	state->h[0] ^= ((uint_least32_t)params->key_len & 255) << 8;
 	state->h[0] ^= ((uint_least32_t)params->fanout & 255) << 16;
 	state->h[0] ^= ((uint_least32_t)params->depth & 255) << 24;
-	state->h[1] ^= ((uint_least32_t)(params->leaf_len >> 0) & 255) << 0;
-	state->h[1] ^= ((uint_least32_t)(params->leaf_len >> 8) & 255) << 8;
-	state->h[1] ^= ((uint_least32_t)(params->leaf_len >> 16) & 255) << 16;
-	state->h[1] ^= ((uint_least32_t)(params->leaf_len >> 24) & 255) << 24;
-	state->h[2] ^= ((uint_least32_t)(params->node_offset >> 0) & 255) << 0;
-	state->h[2] ^= ((uint_least32_t)(params->node_offset >> 8) & 255) << 8;
-	state->h[2] ^= ((uint_least32_t)(params->node_offset >> 16) & 255) << 16;
-	state->h[2] ^= ((uint_least32_t)(params->node_offset >> 24) & 255) << 24;
-	state->h[3] ^= ((uint_least32_t)(params->xof_len >> 0) & 255) << 0;
-	state->h[3] ^= ((uint_least32_t)(params->xof_len >> 8) & 255) << 8;
+	state->h[1] ^= params->leaf_len & UINT_LEAST32_C(0xFFFFffff);
+	state->h[2] ^= (uint_least32_t)((params->node_offset >> 0) & UINT_LEAST64_C(0xFFFFffff));
+	state->h[3] ^= (uint_least32_t)((params->node_offset >> 32) & UINT_LEAST64_C(0xFFFF)) << 0;
 	state->h[3] ^= ((uint_least32_t)params->node_depth & 255) << 16;
 	state->h[3] ^= ((uint_least32_t)params->inner_len & 255) << 24;
 	state->h[4] ^= ((uint_least32_t)params->salt[0] & 255) << 0;
diff --git a/libblake_blake2xb_digest.c b/libblake_blake2xb_digest.c
new file mode 100644
index 0000000..b9a65ec
--- /dev/null
+++ b/libblake_blake2xb_digest.c
@@ -0,0 +1,23 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_blake2xb_digest(const struct libblake_blake2xb_state *state,
+                         uint_least32_t i /* start 0, increase by 1 until i * 64 >= desired hash length */,
+                         uint_least8_t len /* desired hash MIN(length - i * 64, 64) */,
+                         unsigned char output[static len] /* output for hash offset by i * 64 */)
+{
+	struct libblake_blake2xb_state xstate;
+	struct libblake_blake2xb_params xparams;
+
+	xparams = state->xof_params;
+	xparams.node_offset = i;
+	xparams.digest_len = len;
+
+	libblake_internal_blake2xb_init0(&xstate, &xparams);
+
+	xstate.b2b.f[0] = UINT_LEAST64_C(0xFFFFffffFFFFffff);
+	xstate.b2b.t[0] = (uint_least64_t)state->xof_params.digest_len & UINT_LEAST64_C(0xFFFFffffFFFFffff);
+	libblake_internal_blake2b_compress(&xstate.b2b, state->intermediate);
+	libblake_internal_blake2b_output_digest(&xstate.b2b, (size_t)len, output);
+}
diff --git a/libblake_blake2xb_init.c b/libblake_blake2xb_init.c
new file mode 100644
index 0000000..1064bae
--- /dev/null
+++ b/libblake_blake2xb_init.c
@@ -0,0 +1,24 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_blake2xb_init(struct libblake_blake2xb_state *state, const struct libblake_blake2xb_params *params, const unsigned char *key)
+{
+	libblake_internal_blake2xb_init0(state, params);
+
+	memcpy(&state->xof_params, params, sizeof(state->xof_params));
+	state->xof_params.key_len = 0;
+	state->xof_params.fanout = 0;
+	state->xof_params.depth = 0;
+	state->xof_params.leaf_len = 64;
+	state->xof_params.xof_len = params->xof_len;
+	state->xof_params.node_depth = 0;
+	state->xof_params.inner_len = 64;
+
+	memset(&state->intermediate, 0, sizeof(state->intermediate));
+
+	if (params->key_len) {
+		state->b2b.t[0] = 128;
+		libblake_internal_blake2b_compress(&state->b2b, key);
+	}
+}
diff --git a/libblake_blake2xb_predigest.c b/libblake_blake2xb_predigest.c
new file mode 100644
index 0000000..c49b46c
--- /dev/null
+++ b/libblake_blake2xb_predigest.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline void libblake_blake2xb_predigest(struct libblake_blake2xb_state *state, void *data, size_t len, int last_node);
diff --git a/libblake_blake2xb_predigest_get_required_input_size.c b/libblake_blake2xb_predigest_get_required_input_size.c
new file mode 100644
index 0000000..0ee18c2
--- /dev/null
+++ b/libblake_blake2xb_predigest_get_required_input_size.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline size_t libblake_blake2xb_predigest_get_required_input_size(const struct libblake_blake2xb_state *state);
diff --git a/libblake_blake2xb_update.c b/libblake_blake2xb_update.c
new file mode 100644
index 0000000..3f4099c
--- /dev/null
+++ b/libblake_blake2xb_update.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline size_t libblake_blake2xb_update(struct libblake_blake2xb_state *state, const void *data, size_t len);
diff --git a/libblake_blake2xs_digest.c b/libblake_blake2xs_digest.c
new file mode 100644
index 0000000..0d4ffea
--- /dev/null
+++ b/libblake_blake2xs_digest.c
@@ -0,0 +1,23 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_blake2xs_digest(const struct libblake_blake2xs_state *state,
+                         uint_least32_t i /* start 0, increase by 1 until i * 32 >= desired hash length */,
+                         uint_least8_t len /* desired hash MIN(length - i * 32, 32) */,
+                         unsigned char output[static len]  /* output for hash offset by i * 32 */)
+{
+	struct libblake_blake2xs_state xstate;
+	struct libblake_blake2xs_params xparams;
+
+	xparams = state->xof_params;
+	xparams.node_offset = i;
+	xparams.digest_len = len;
+
+	libblake_internal_blake2xs_init0(&xstate, &xparams);
+
+	xstate.b2s.f[0] = UINT_LEAST32_C(0xFFFFffff);
+	xstate.b2s.t[0] = (uint_least32_t)state->xof_params.digest_len & UINT_LEAST32_C(0xFFFFffff);
+	libblake_internal_blake2s_compress(&xstate.b2s, state->intermediate);
+	libblake_internal_blake2s_output_digest(&xstate.b2s, (size_t)len, output);
+}
diff --git a/libblake_blake2xs_init.c b/libblake_blake2xs_init.c
new file mode 100644
index 0000000..d2d5834
--- /dev/null
+++ b/libblake_blake2xs_init.c
@@ -0,0 +1,25 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_blake2xs_init(struct libblake_blake2xs_state *state, const struct libblake_blake2xs_params *params, const unsigned char *key)
+{
+	libblake_internal_blake2xs_init0(state, params);
+
+	memcpy(&state->xof_params, params, sizeof(state->xof_params));
+	state->xof_params.digest_len = 32;
+	state->xof_params.key_len = 0;
+	state->xof_params.fanout = 0;
+	state->xof_params.depth = 0;
+	state->xof_params.leaf_len = 32;
+	state->xof_params.xof_len = params->xof_len;
+	state->xof_params.node_depth = 0;
+	state->xof_params.inner_len = 32;
+
+	memset(&state->intermediate, 0, sizeof(state->intermediate));
+
+	if (params->key_len) {
+		state->b2s.t[0] = 32;
+		libblake_internal_blake2s_compress(&state->b2s, key);
+	}
+}
diff --git a/libblake_blake2xs_predigest.c b/libblake_blake2xs_predigest.c
new file mode 100644
index 0000000..87e8c31
--- /dev/null
+++ b/libblake_blake2xs_predigest.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline void libblake_blake2xs_predigest(struct libblake_blake2xs_state *state, void *data, size_t len, int last_node);
diff --git a/libblake_blake2xs_predigest_get_required_input_size.c b/libblake_blake2xs_predigest_get_required_input_size.c
new file mode 100644
index 0000000..d53e2ca
--- /dev/null
+++ b/libblake_blake2xs_predigest_get_required_input_size.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline size_t libblake_blake2xs_predigest_get_required_input_size(const struct libblake_blake2xs_state *state);
diff --git a/libblake_blake2xs_update.c b/libblake_blake2xs_update.c
new file mode 100644
index 0000000..ba8d62f
--- /dev/null
+++ b/libblake_blake2xs_update.c
@@ -0,0 +1,4 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+extern inline size_t libblake_blake2xs_update(struct libblake_blake2xs_state *state, const void *data, size_t len);
diff --git a/libblake_internal_blake2b_compress.c b/libblake_internal_blake2b_compress.c
index eab4b44..e844180 100644
--- a/libblake_internal_blake2b_compress.c
+++ b/libblake_internal_blake2b_compress.c
@@ -1,13 +1,6 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-#define A 10
-#define B 11
-#define C 12
-#define D 13
-#define E 14
-#define F 15
-
 static uint_least64_t
 decode_uint64_le(const unsigned char *data)
 {
diff --git a/libblake_internal_blake2b_output_digest.c b/libblake_internal_blake2b_output_digest.c
new file mode 100644
index 0000000..bc5b407
--- /dev/null
+++ b/libblake_internal_blake2b_output_digest.c
@@ -0,0 +1,44 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+static void
+encode_uint64_le(unsigned char *out, uint_least64_t value, size_t bytes)
+{
+	switch (bytes) {
+	default:
+		out[7] = (unsigned char)((value >> 56) & 255);
+		/* fall through */
+	case 7:
+		out[6] = (unsigned char)((value >> 48) & 255);
+		/* fall through */
+	case 6:
+		out[5] = (unsigned char)((value >> 40) & 255);
+		/* fall through */
+	case 5:
+		out[4] = (unsigned char)((value >> 32) & 255);
+		/* fall through */
+	case 4:
+		out[3] = (unsigned char)((value >> 24) & 255);
+		/* fall through */
+	case 3:
+		out[2] = (unsigned char)((value >> 16) & 255);
+		/* fall through */
+	case 2:
+		out[1] = (unsigned char)((value >>  8) & 255);
+		/* fall through */
+	case 1:
+		out[0] = (unsigned char)((value >>  0) & 255);
+		/* fall through */
+	case 0:
+		break;
+	}
+}
+
+void
+libblake_internal_blake2b_output_digest(struct libblake_blake2b_state *state, size_t output_len, unsigned char *output)
+{
+	size_t i, j;
+
+	for (i = 0, j = 0; i < output_len; i += 8, j += 1)
+		encode_uint64_le(&output[i], state->h[j], output_len - i);
+}
diff --git a/libblake_internal_blake2s_compress.c b/libblake_internal_blake2s_compress.c
index d3c4066..37a61eb 100644
--- a/libblake_internal_blake2s_compress.c
+++ b/libblake_internal_blake2s_compress.c
@@ -1,13 +1,6 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-#define A 10
-#define B 11
-#define C 12
-#define D 13
-#define E 14
-#define F 15
-
 static uint_least32_t
 decode_uint32_le(const unsigned char *data)
 {
diff --git a/libblake_internal_blake2s_output_digest.c b/libblake_internal_blake2s_output_digest.c
new file mode 100644
index 0000000..d7b891c
--- /dev/null
+++ b/libblake_internal_blake2s_output_digest.c
@@ -0,0 +1,32 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+static void
+encode_uint32_le(unsigned char *out, uint_least32_t value, size_t bytes)
+{
+	switch (bytes) {
+	default:
+		out[3] = (unsigned char)((value >> 24) & 255);
+		/* fall through */
+	case 3:
+		out[2] = (unsigned char)((value >> 16) & 255);
+		/* fall through */
+	case 2:
+		out[1] = (unsigned char)((value >>  8) & 255);
+		/* fall through */
+	case 1:
+		out[0] = (unsigned char)((value >>  0) & 255);
+		/* fall through */
+	case 0:
+		break;
+	}
+}
+
+void
+libblake_internal_blake2s_output_digest(struct libblake_blake2s_state *state, size_t output_len, unsigned char *output)
+{
+	size_t i, j;
+
+	for (i = 0, j = 0; i < output_len; i += 4, j += 1)
+		encode_uint32_le(&output[i], state->h[j], output_len - i);
+}
diff --git a/libblake_internal_blake2xb_init0.c b/libblake_internal_blake2xb_init0.c
new file mode 100644
index 0000000..d6063dc
--- /dev/null
+++ b/libblake_internal_blake2xb_init0.c
@@ -0,0 +1,62 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_internal_blake2xb_init0(struct libblake_blake2xb_state *state, const struct libblake_blake2xb_params *params)
+{
+	state->b2b.h[0] = UINT_LEAST64_C(0x6A09E667F3BCC908);
+	state->b2b.h[1] = UINT_LEAST64_C(0xBB67AE8584CAA73B);
+	state->b2b.h[2] = UINT_LEAST64_C(0x3C6EF372FE94F82B);
+	state->b2b.h[3] = UINT_LEAST64_C(0xA54FF53A5F1D36F1);
+	state->b2b.h[4] = UINT_LEAST64_C(0x510E527FADE682D1);
+	state->b2b.h[5] = UINT_LEAST64_C(0x9B05688C2B3E6C1F);
+	state->b2b.h[6] = UINT_LEAST64_C(0x1F83D9ABFB41BD6B);
+	state->b2b.h[7] = UINT_LEAST64_C(0x5BE0CD19137E2179);
+
+	state->b2b.t[0] = 0;
+	state->b2b.t[1] = 0;
+	state->b2b.f[0] = 0;
+	state->b2b.f[1] = 0;
+
+	state->b2b.h[0] ^= ((uint_least64_t)params->digest_len & 255) << 0;
+	state->b2b.h[0] ^= ((uint_least64_t)params->key_len & 255) << 8;
+	state->b2b.h[0] ^= ((uint_least64_t)params->fanout & 255) << 16;
+	state->b2b.h[0] ^= ((uint_least64_t)params->depth & 255) << 24;
+	state->b2b.h[0] ^= (uint_least64_t)(params->leaf_len & UINT_LEAST32_C(0xFFFFffff)) << 32;
+	state->b2b.h[1] ^= (uint_least64_t)(params->node_offset & UINT_LEAST32_C(0xFFFFffff)) << 0;
+	state->b2b.h[1] ^= (uint_least64_t)(params->xof_len & UINT_LEAST32_C(0xFFFFffff)) << 32;
+	state->b2b.h[2] ^= ((uint_least64_t)params->node_depth & 255) << 0;
+	state->b2b.h[2] ^= ((uint_least64_t)params->inner_len & 255) << 8;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[0] & 255) << 0;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[1] & 255) << 8;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[2] & 255) << 16;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[3] & 255) << 24;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[4] & 255) << 32;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[5] & 255) << 40;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[6] & 255) << 48;
+	state->b2b.h[4] ^= ((uint_least64_t)params->salt[7] & 255) << 56;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[8] & 255) << 0;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[9] & 255) << 8;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[A] & 255) << 16;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[B] & 255) << 24;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[C] & 255) << 32;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[D] & 255) << 40;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[E] & 255) << 48;
+	state->b2b.h[5] ^= ((uint_least64_t)params->salt[F] & 255) << 56;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[0] & 255) << 0;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[1] & 255) << 8;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[2] & 255) << 16;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[3] & 255) << 24;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[4] & 255) << 32;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[5] & 255) << 40;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[6] & 255) << 48;
+	state->b2b.h[6] ^= ((uint_least64_t)params->pepper[7] & 255) << 56;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[8] & 255) << 0;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[9] & 255) << 8;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[A] & 255) << 16;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[B] & 255) << 24;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[C] & 255) << 32;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[D] & 255) << 40;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[E] & 255) << 48;
+	state->b2b.h[7] ^= ((uint_least64_t)params->pepper[F] & 255) << 56;
+}
diff --git a/libblake_internal_blake2xs_init0.c b/libblake_internal_blake2xs_init0.c
new file mode 100644
index 0000000..92cb7bf
--- /dev/null
+++ b/libblake_internal_blake2xs_init0.c
@@ -0,0 +1,46 @@
+/* See LICENSE file for copyright and license details. */
+#include "common.h"
+
+void
+libblake_internal_blake2xs_init0(struct libblake_blake2xs_state *state, const struct libblake_blake2xs_params *params)
+{
+	state->b2s.h[0] = UINT_LEAST32_C(0x6A09E667);
+	state->b2s.h[1] = UINT_LEAST32_C(0xBB67AE85);
+	state->b2s.h[2] = UINT_LEAST32_C(0x3C6EF372);
+	state->b2s.h[3] = UINT_LEAST32_C(0xA54FF53A);
+	state->b2s.h[4] = UINT_LEAST32_C(0x510E527F);
+	state->b2s.h[5] = UINT_LEAST32_C(0x9B05688C);
+	state->b2s.h[6] = UINT_LEAST32_C(0x1F83D9AB);
+	state->b2s.h[7] = UINT_LEAST32_C(0x5BE0CD19);
+
+	state->b2s.t[0] = 0;
+	state->b2s.t[1] = 0;
+	state->b2s.f[0] = 0;
+	state->b2s.f[1] = 0;
+
+	state->b2s.h[0] ^= ((uint_least32_t)params->digest_len & 255) << 0;
+	state->b2s.h[0] ^= ((uint_least32_t)params->key_len & 255) << 8;
+	state->b2s.h[0] ^= ((uint_least32_t)params->fanout & 255) << 16;
+	state->b2s.h[0] ^= ((uint_least32_t)params->depth & 255) << 24;
+	state->b2s.h[1] ^= params->leaf_len & UINT_LEAST32_C(0xFFFFffff);
+	state->b2s.h[2] ^= params->node_offset & UINT_LEAST32_C(0xFFFFffff);
+	state->b2s.h[3] ^= (uint_least32_t)(params->xof_len & UINT_LEAST16_C(0xFFFF)) << 0;
+	state->b2s.h[3] ^= ((uint_least32_t)params->node_depth & 255) << 16;
+	state->b2s.h[3] ^= ((uint_least32_t)params->inner_len & 255) << 24;
+	state->b2s.h[4] ^= ((uint_least32_t)params->salt[0] & 255) << 0;
+	state->b2s.h[4] ^= ((uint_least32_t)params->salt[1] & 255) << 8;
+	state->b2s.h[4] ^= ((uint_least32_t)params->salt[2] & 255) << 16;
+	state->b2s.h[4] ^= ((uint_least32_t)params->salt[3] & 255) << 24;
+	state->b2s.h[5] ^= ((uint_least32_t)params->salt[4] & 255) << 0;
+	state->b2s.h[5] ^= ((uint_least32_t)params->salt[5] & 255) << 8;
+	state->b2s.h[5] ^= ((uint_least32_t)params->salt[6] & 255) << 16;
+	state->b2s.h[5] ^= ((uint_least32_t)params->salt[7] & 255) << 24;
+	state->b2s.h[6] ^= ((uint_least32_t)params->pepper[0] & 255) << 0;
+	state->b2s.h[6] ^= ((uint_least32_t)params->pepper[1] & 255) << 8;
+	state->b2s.h[6] ^= ((uint_least32_t)params->pepper[2] & 255) << 16;
+	state->b2s.h[6] ^= ((uint_least32_t)params->pepper[3] & 255) << 24;
+	state->b2s.h[7] ^= ((uint_least32_t)params->pepper[4] & 255) << 0;
+	state->b2s.h[7] ^= ((uint_least32_t)params->pepper[5] & 255) << 8;
+	state->b2s.h[7] ^= ((uint_least32_t)params->pepper[6] & 255) << 16;
+	state->b2s.h[7] ^= ((uint_least32_t)params->pepper[7] & 255) << 24;
+}
diff --git a/libblake_internal_blakeb_update.c b/libblake_internal_blakeb_update.c
index a1a88d6..69dcaa1 100644
--- a/libblake_internal_blakeb_update.c
+++ b/libblake_internal_blakeb_update.c
@@ -1,13 +1,6 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-#define A 10
-#define B 11
-#define C 12
-#define D 13
-#define E 14
-#define F 15
-
 #define CB0 UINT_LEAST64_C(0x243F6A8885A308D3)
 #define CB1 UINT_LEAST64_C(0x13198A2E03707344)
 #define CB2 UINT_LEAST64_C(0xA4093822299F31D0)
diff --git a/libblake_internal_blakes_update.c b/libblake_internal_blakes_update.c
index 525600a..dadc5a8 100644
--- a/libblake_internal_blakes_update.c
+++ b/libblake_internal_blakes_update.c
@@ -1,13 +1,6 @@
 /* See LICENSE file for copyright and license details. */
 #include "common.h"
 
-#define A 10
-#define B 11
-#define C 12
-#define D 13
-#define E 14
-#define F 15
-
 #define CS0 UINT_LEAST32_C(0x243F6A88)
 #define CS1 UINT_LEAST32_C(0x85A308D3)
 #define CS2 UINT_LEAST32_C(0x13198A2E)