From 32f787a79b4aaa7e66a6366a7f24abc9bade52eb Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Tue, 30 Dec 2025 00:25:39 +0100
Subject: [PATCH] SHAKE: a custom domain byte may have its MSB set, so xor the
 padding

---
 src/libsodium/crypto_xof/shake128/ref/shake128_ref.c           | 2 +-
 src/libsodium/crypto_xof/shake256/ref/shake256_ref.c           | 2 +-
 src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c | 2 +-
 src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c
index a973618e..fb0366e1 100644
--- a/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c
+++ b/src/libsodium/crypto_xof/shake128/ref/shake128_ref.c
@@ -65,7 +65,7 @@ shake128_finalize(shake128_state_internal *state)
     /* Apply padding: domain byte at current position, 0x80 at last byte */
     if (state->offset == SHAKE128_RATE - 1) {
         /* Special case: padding fits in one byte */
-        pad = state->domain | 0x80;
+        pad = (unsigned char) (state->domain ^ 0x80);
         crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1);
     } else {
         /* Normal case: domain and 0x80 at different positions */
diff --git a/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c
index af15e774..7fe50a93 100644
--- a/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c
+++ b/src/libsodium/crypto_xof/shake256/ref/shake256_ref.c
@@ -65,7 +65,7 @@ shake256_finalize(shake256_state_internal *state)
     /* Apply padding: domain byte at current position, 0x80 at last byte */
     if (state->offset == SHAKE256_RATE - 1) {
         /* Special case: padding fits in one byte */
-        pad = state->domain | 0x80;
+        pad = (unsigned char) (state->domain ^ 0x80);
         crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1);
     } else {
         /* Normal case: domain and 0x80 at different positions */
diff --git a/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c
index d16fc727..9d4dab27 100644
--- a/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c
+++ b/src/libsodium/crypto_xof/turboshake128/ref/turboshake128_ref.c
@@ -65,7 +65,7 @@ turboshake128_finalize(turboshake128_state_internal *state)
     /* Apply padding: domain byte at current position, 0x80 at last byte */
     if (state->offset == TURBOSHAKE128_RATE - 1) {
         /* Special case: padding fits in one byte */
-        pad = state->domain | 0x80;
+        pad = (unsigned char) (state->domain ^ 0x80);
         crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1);
     } else {
         /* Normal case: domain and 0x80 at different positions */
diff --git a/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c
index b50fbf41..f648a7fa 100644
--- a/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c
+++ b/src/libsodium/crypto_xof/turboshake256/ref/turboshake256_ref.c
@@ -65,7 +65,7 @@ turboshake256_finalize(turboshake256_state_internal *state)
     /* Apply padding: domain byte at current position, 0x80 at last byte */
     if (state->offset == TURBOSHAKE256_RATE - 1) {
         /* Special case: padding fits in one byte */
-        pad = state->domain | 0x80;
+        pad = (unsigned char) (state->domain ^ 0x80);
         crypto_core_keccak1600_xor_bytes(state->state, &pad, state->offset, 1);
     } else {
         /* Normal case: domain and 0x80 at different positions */