From 07b2b42713467006426b90e319a6d1a567b6edd0 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Tue, 9 Dec 2025 01:59:02 +0100
Subject: [PATCH] sha3: permute at rate boundary

Not triggered in this context, but correctness doesn't hurt
---
 src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
index 5574b3e7..ec3a749a 100644
--- a/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
+++ b/src/libsodium/crypto_kem/mlkem768/ref/kem_mlkem768_ref.c
@@ -235,7 +235,10 @@ sha3_512(unsigned char out[64], const unsigned char *in, size_t inlen)
         offset += chunk_size;
         consumed += chunk_size;
     }
-
+    if (offset == SHA3_512_RATE) {
+        crypto_core_keccak1600_permute_24(state);
+        offset = 0;
+    }
     if (offset == SHA3_512_RATE - 1) {
         pad = SHA3_DOMAIN | 0x80;
         crypto_core_keccak1600_xor_bytes(state, &pad, offset, 1);