sha3.nx

sha3.nx -- FIPS 202 SHA3-256 (Keccak-f[1600], rate=1088 bits). Quantum-safe companion to sha256.nx. Under Grover's algorithm both SHA-256 and SHA3-256 have ~128-bit collision resistance on a quantum adversary, which remains secure -- but SHA-3 is the primitive used internally by NIST post-quantum schemes (ML-KEM FIPS 203, ML-DSA FIPS 204, SLH-DSA FIPS 205), so shipping it here is the prerequisite for every quantum-safe KEM/signature we'll add later. Design: - State: 25 * u64 = 1600 bits, laid out as a 5x5 lane grid A[x,y] - Permutation: 24 rounds of theta, rho, pi, chi, iota - Padding: SHA-3 domain separation byte 0x06, trailing 0x80 - Rate for SHA3-256: r = 1088 bits = 136 bytes; capacity c = 512 - Output: 32 bytes (first 256 bits of the state after finalisation) Reference: FIPS PUB 202, sections 3.2-3.3. Known answer: sha3_256("abc") = 3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532 This implementation: - Pure NishiLang; no C interop; no libc. - Uses only arithmetic + bit ops (XOR, AND, NOT, rotate-left) defined on i64; 1600-bit state lives in a 25-entry i64 array. - Sequential round loop; no table lookups on secret data. Timing-side-channel stance: Keccak-f is naturally constant-time when compiled straight from the spec. The only operations are XOR, AND, NOT, and rotate-left -- all secret-independent in time. No S-box table, no conditional on state bits. Safe to handle secret data directly.