Port SPHINCS+-SHA256 to sha256ctx struct

crypto_sign/sphincs-sha256-128f-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-128f-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-128f-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-128f-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-128f-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-128f-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-128f-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-128f-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256128FSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }
 

crypto_sign/sphincs-sha256-128s-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-128s-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-128s-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-128s-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-128s-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-128s-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-128s-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-128s-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256128SSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }
 

crypto_sign/sphincs-sha256-192f-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-192f-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-192f-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-192f-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-192f-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-192f-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-192f-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-192f-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256192FSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }
 

crypto_sign/sphincs-sha256-192s-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-192s-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-192s-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-192s-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-192s-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-192s-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-192s-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-192s-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256192SSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }
 

crypto_sign/sphincs-sha256-256f-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-256f-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-256f-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-256f-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-256f-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-256f-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-256f-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-256f-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256256FSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }
 

crypto_sign/sphincs-sha256-256s-robust/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-256s-robust/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-256s-robust/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-256s-robust/clean/thash_sha256_robust.c

@@ -18,7 +18,7 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash(
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
     unsigned char *bitmask = buf + SPX_N + SPX_SHA256_ADDR_BYTES + 4;
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
     unsigned int i;
 
     memcpy(buf, pub_seed, SPX_N);
@@ -27,13 +27,13 @@ static void PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_thash(
     PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_mgf1(bitmask, inblocks * SPX_N, buf, SPX_N + SPX_SHA256_ADDR_BYTES);
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SROBUST_CLEAN_state_seeded, sizeof(sha256ctx));
 
     for (i = 0; i < inblocks * SPX_N; i++) {
         buf[SPX_N + SPX_SHA256_ADDR_BYTES + i] = in[i] ^ bitmask[i];
     }
 
-    sha256_inc_finalize(outbuf, sha2_state, buf + SPX_N,
+    sha256_inc_finalize(outbuf, &sha2_state, buf + SPX_N,
                         SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }

crypto_sign/sphincs-sha256-256s-simple/clean/hash_sha256.c

@@ -45,7 +45,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random(
     const unsigned char *sk_prf, const unsigned char *optrand,
     const unsigned char *m, size_t mlen) {
     unsigned char buf[SPX_SHA256_BLOCK_BYTES + SPX_SHA256_OUTPUT_BYTES];
-    uint8_t state[40];
+    sha256ctx state;
     int i;
 
     /* This implements HMAC-SHA256 */
@@ -54,25 +54,25 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_gen_message_random(
     }
     memset(buf + SPX_N, 0x36, SPX_SHA256_BLOCK_BYTES - SPX_N);
 
-    sha256_inc_init(state);
-    sha256_inc_blocks(state, buf, 1);
+    sha256_inc_init(&state);
+    sha256_inc_blocks(&state, buf, 1);
 
     memcpy(buf, optrand, SPX_N);
 
     /* If optrand + message cannot fill up an entire block */
     if (SPX_N + mlen < SPX_SHA256_BLOCK_BYTES) {
         memcpy(buf + SPX_N, m, mlen);
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state,
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state,
                             buf, mlen + SPX_N);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(buf + SPX_N, m, SPX_SHA256_BLOCK_BYTES - SPX_N);
-        sha256_inc_blocks(state, buf, 1);
+        sha256_inc_blocks(&state, buf, 1);
 
         m += SPX_SHA256_BLOCK_BYTES - SPX_N;
         mlen -= SPX_SHA256_BLOCK_BYTES - SPX_N;
-        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, state, m, mlen);
+        sha256_inc_finalize(buf + SPX_SHA256_BLOCK_BYTES, &state, m, mlen);
     }
 
     for (i = 0; i < SPX_N; i++) {
@@ -108,9 +108,9 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message(
 
     unsigned char buf[SPX_DGST_BYTES];
     unsigned char *bufp = buf;
-    uint8_t state[40];
+    sha256ctx state;
 
-    sha256_inc_init(state);
+    sha256_inc_init(&state);
 
     memcpy(inbuf, R, SPX_N);
     memcpy(inbuf + SPX_N, pk, SPX_PK_BYTES);
@@ -118,17 +118,17 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_hash_message(
     /* If R + pk + message cannot fill up an entire block */
     if (SPX_N + SPX_PK_BYTES + mlen < SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES) {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m, mlen);
-        sha256_inc_finalize(seed, state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
+        sha256_inc_finalize(seed, &state, inbuf, SPX_N + SPX_PK_BYTES + mlen);
     }
     /* Otherwise first fill a block, so that finalize only uses the message */
     else {
         memcpy(inbuf + SPX_N + SPX_PK_BYTES, m,
                SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES);
-        sha256_inc_blocks(state, inbuf, SPX_INBLOCKS);
+        sha256_inc_blocks(&state, inbuf, SPX_INBLOCKS);
 
         m += SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
         mlen -= SPX_INBLOCKS * SPX_SHA256_BLOCK_BYTES - SPX_N - SPX_PK_BYTES;
-        sha256_inc_finalize(seed, state, m, mlen);
+        sha256_inc_finalize(seed, &state, m, mlen);
     }
 
     /* By doing this in two steps, we prevent hashing the message twice;

crypto_sign/sphincs-sha256-256s-simple/clean/sha256.c

@@ -50,7 +50,7 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1(
     }
 }
 
-uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40];
+sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded;
 
 /**
  * Absorb the constant pub_seed using one round of the compression function
@@ -67,6 +67,6 @@ void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_s
         block[i] = 0;
     }
 
-    sha256_inc_init(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded);
-    sha256_inc_blocks(PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1);
+    sha256_inc_init(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded);
+    sha256_inc_blocks(&PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, block, 1);
 }

crypto_sign/sphincs-sha256-256s-simple/clean/sha256.h

@@ -8,13 +8,15 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "sha2.h"
+
 void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(unsigned char *out, const uint32_t addr[8]);
 
 void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_mgf1(
     unsigned char *out, unsigned long outlen,
     unsigned char *input_plus_four_bytes, unsigned long inlen);
 
-extern uint8_t PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded[40];
+extern sha256ctx PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded;
 
 void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_seed_state(const unsigned char *pub_seed);
 

crypto_sign/sphincs-sha256-256s-simple/clean/thash_sha256_simple.c

@@ -17,17 +17,17 @@ static void PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_thash(
     const unsigned char *pub_seed, uint32_t addr[8]) {
 
     unsigned char outbuf[SPX_SHA256_OUTPUT_BYTES];
-    uint8_t sha2_state[40];
+    sha256ctx sha2_state;
 
     (void)pub_seed; /* Suppress an 'unused parameter' warning. */
 
     /* Retrieve precomputed state containing pub_seed */
-    memcpy(sha2_state, PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, 40 * sizeof(uint8_t));
+    memcpy(&sha2_state, &PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_state_seeded, sizeof(sha256ctx));
 
     PQCLEAN_SPHINCSSHA256256SSIMPLE_CLEAN_compress_address(buf, addr);
     memcpy(buf + SPX_SHA256_ADDR_BYTES, in, inblocks * SPX_N);
 
-    sha256_inc_finalize(outbuf, sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
+    sha256_inc_finalize(outbuf, &sha2_state, buf, SPX_SHA256_ADDR_BYTES + inblocks * SPX_N);
     memcpy(out, outbuf, SPX_N);
 }