Merge pull request #6528 from oasisprotocol/peternose/trivial/migrate-to-crypto-sha3

go: Replace golang.org/x/crypto/sha3 with crypto/sha3

Author: peternose

.changelog/6528.trivial.md

@@ -2,18 +2,17 @@
 package tuplehash
 
 import (
+	"crypto/sha3"
 	"encoding/binary"
 	"math"
 	"math/bits"
-
-	"golang.org/x/crypto/sha3"
 )
 
 var constN = []byte("TupleHash")
 
 // Hasher is a TupleHash instance.
 type Hasher struct {
-	cShake     sha3.ShakeHash
+	cShake     *sha3.SHAKE
 	outputSize uint64
 }
 
@@ -33,24 +32,14 @@ func (h *Hasher) Write(b []byte) (int, error) {
 }
 
 // Sum appends the current hash to b and returns the resulting slice.
-// It does not change the underlying hash state.
+// The underlying hash state is changed.
 func (h *Hasher) Sum(b []byte) []byte {
-	cShake := h.cShake.Clone()
-
-	_, _ = cShake.Write(rightEncode(h.outputSize * 8)) // in bits
+	_, _ = h.cShake.Write(rightEncode(h.outputSize * 8)) // in bits
 	digest := make([]byte, int(h.outputSize))
-	_, _ = cShake.Read(digest)
+	_, _ = h.cShake.Read(digest)
 	return append(b, digest...)
 }
 
-// Clone creates a copy of an existing TupleHash instance.
-func (h *Hasher) Clone() *Hasher {
-	return &Hasher{
-		cShake:     h.cShake.Clone(),
-		outputSize: h.outputSize,
-	}
-}
-
 // New128 creates a new TupleHash128 instance with the specified output size
 // (in bytes) and customization string.
 func New128(outputSize int, customizationString []byte) *Hasher {
@@ -70,12 +59,12 @@ func doNew(securityStrength, outputSize int, customizationString []byte) *Hasher
 		panic("common/crypto/tuplehash: invalid output size")
 	}
 
-	var cShake sha3.ShakeHash
+	var cShake *sha3.SHAKE
 	switch securityStrength {
 	case 128:
-		cShake = sha3.NewCShake128(constN, customizationString)
+		cShake = sha3.NewCSHAKE128(constN, customizationString)
 	case 256:
-		cShake = sha3.NewCShake256(constN, customizationString)
+		cShake = sha3.NewCSHAKE256(constN, customizationString)
 	default:
 		panic("common/crypto/tuplehash: invalid security strength")
 	}

go/common/crypto/tuplehash/tuplehash.go

@@ -3,11 +3,11 @@
 package beacon
 
 import (
+	"crypto/sha3"
 	"encoding/binary"
 	"fmt"
 
 	"github.com/cometbft/cometbft/abci/types"
-	"golang.org/x/crypto/sha3"
 
 	beacon "github.com/oasisprotocol/oasis-core/go/beacon/api"
 	consensus "github.com/oasisprotocol/oasis-core/go/consensus/api"

go/consensus/cometbft/apps/beacon/beacon.go

@@ -2,11 +2,10 @@ package secrets
 
 import (
 	"bytes"
+	"crypto/sha3"
 	"fmt"
 	"time"
 
-	"golang.org/x/crypto/sha3"
-
 	beacon "github.com/oasisprotocol/oasis-core/go/beacon/api"
 	"github.com/oasisprotocol/oasis-core/go/common/cbor"
 	"github.com/oasisprotocol/oasis-core/go/common/crypto/signature"

go/consensus/cometbft/apps/keymanager/secrets/status.go

@@ -1,10 +1,10 @@
 package secrets
 
 import (
+	"crypto/sha3"
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/sha3"
 
 	beacon "github.com/oasisprotocol/oasis-core/go/beacon/api"
 	"github.com/oasisprotocol/oasis-core/go/common"

go/consensus/cometbft/apps/keymanager/secrets/status_test.go

@@ -66,11 +66,13 @@ func shuffleValidators(
 			"num_proofs", len(vrf.Pi),
 		)
 
-		baseHasher := newBetaHasher(
-			[]byte("oasis-core:vrf/validator"),
-			tmBeacon.MustGetChainContext(ctx),
-			epoch,
-		)
+		baseHasher := func() *tuplehash.Hasher {
+			return newBetaHasher(
+				[]byte("oasis-core:vrf/validator"),
+				tmBeacon.MustGetChainContext(ctx),
+				epoch,
+			)
+		}
 
 		// Do the cryptographic sortition.
 		ret := sortNodesByHashedBeta(
@@ -426,13 +428,15 @@ func electCommitteeMembers( //nolint: gocyclo
 			idxs = rng.Perm(nrNodes)
 		case true:
 			// Use the VRF proofs to do the elections.
-			baseHasher := newCommitteeBetaHasher(
-				tmBeacon.MustGetChainContext(ctx),
-				epoch,
-				rt.ID,
-				kind,
-				role,
-			)
+			baseHasher := func() *tuplehash.Hasher {
+				return newCommitteeBetaHasher(
+					tmBeacon.MustGetChainContext(ctx),
+					epoch,
+					rt.ID,
+					kind,
+					role,
+				)
+			}
 
 			idxs = committeeVRFBetaIndexes(
 				vrf,
@@ -521,7 +525,7 @@ func electCommitteeMembers( //nolint: gocyclo
 
 func committeeVRFBetaIndexes(
 	vrf *beacon.PrevVRFState,
-	baseHasher *tuplehash.Hasher,
+	baseHasher func() *tuplehash.Hasher,
 	nodes []*node.Node,
 ) []int {
 	indexByNode := make(map[signature.PublicKey]int)
@@ -545,7 +549,7 @@ func committeeVRFBetaIndexes(
 
 func sortNodesByHashedBeta(
 	vrf *beacon.PrevVRFState,
-	baseHasher *tuplehash.Hasher,
+	baseHasher func() *tuplehash.Hasher,
 	nodes []*node.Node,
 ) []*node.Node {
 	// Accumulate the hashed betas.
@@ -584,12 +588,12 @@ func sortNodesByHashedBeta(
 type hashedBeta [32]byte
 
 func hashBeta(
-	h *tuplehash.Hasher,
+	baseHasher func() *tuplehash.Hasher,
 	beta []byte,
 ) hashedBeta {
-	hh := h.Clone()
-	_, _ = hh.Write(beta)
-	digest := hh.Sum(nil)
+	h := baseHasher()
+	_, _ = h.Write(beta)
+	digest := h.Sum(nil)
 
 	var ret hashedBeta
 	copy(ret[:], digest)
@@ -658,13 +662,15 @@ func dedupEntityNodesByHashedBeta(
 		return nodes
 	}
 
-	baseHasher := newCommitteeDedupBetaHasher(
-		chainContext,
-		epoch,
-		runtimeID,
-		kind,
-		role,
-	)
+	baseHasher := func() *tuplehash.Hasher {
+		return newCommitteeDedupBetaHasher(
+			chainContext,
+			epoch,
+			runtimeID,
+			kind,
+			role,
+		)
+	}
 
 	// Do the cryptographic sortition.
 	shuffled := sortNodesByHashedBeta(

go/consensus/cometbft/apps/scheduler/shuffle.go

@@ -57,7 +57,6 @@ require (
 	github.com/tidwall/btree v1.6.0
 	github.com/tyler-smith/go-bip39 v1.1.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.49.0
 	golang.org/x/exp v0.0.0-20250606033433-dcc06ee1d476
 	golang.org/x/net v0.52.0
 	golang.org/x/sync v0.20.0
@@ -206,6 +205,7 @@ require (
 	go.uber.org/fx v1.24.0 // indirect
 	go.uber.org/mock v0.5.2 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
 	golang.org/x/mod v0.33.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4 // indirect