crypto/sha3 — validation proof

Go’s own crypto/sha3 test suite, converted to C# by go2cs, built against the converted standard library, run under the Go-semantics test host, and compared verdict for verdict against a clean go test -json baseline of the same sources. This page is generated by the converter from that comparison — it is the evidence behind the crypto/sha3 row in Validated Test Packages.

Validated 2026-09-23 · converter f95f88866

18 matched · 5 disclosed — Go 1.24.13, windows/amd64, converted package src/core/crypto/sha3.

Measured at Release (tiered JIT off), oracle go version go1.24.13 windows/amd64.

Verdicts

Test go test go2cs
TestAllocations pass fail (disclosed)
TestAllocations/New pass fail (disclosed)
TestAllocations/NewSHAKE pass fail (disclosed)
TestAllocations/Sum pass fail (disclosed)
TestAllocations/SumSHAKE pass fail (disclosed)
TestAppend pass pass
TestAppendNoRealloc pass pass
TestCSHAKEAccumulated pass pass
TestCSHAKEAccumulated/cSHAKE128 pass pass
TestCSHAKEAccumulated/cSHAKE256 pass pass
TestCSHAKELargeS pass pass
TestMarshalUnmarshal pass pass
TestMarshalUnmarshal/SHA3-224 pass pass
TestMarshalUnmarshal/SHA3-256 pass pass
TestMarshalUnmarshal/SHA3-384 pass pass
TestMarshalUnmarshal/SHA3-512 pass pass
TestMarshalUnmarshal/SHAKE128 pass pass
TestMarshalUnmarshal/SHAKE256 pass pass
TestMarshalUnmarshal/cSHAKE128 pass pass
TestMarshalUnmarshal/cSHAKE256 pass pass
TestReset pass pass
TestSqueezing pass pass
TestUnalignedWrite pass pass

Disclosed divergences

A disclosed divergence is a specific Go assertion this conversion does not satisfy — not a skipped test and not a tolerance. Each one is pinned by exact failure signature in the package’s hand-owned go2cs_test_disclosures.json; a disclosed test that fails any other way is still a hard mismatch.

The Class column says which kind each one is: a deferred entry is an assertion the managed CLR can meet, pinned against the named plan that will retire it; every other class is one it provably cannot satisfy.

Test Class Pinned reason
TestAllocations aggregate no failure text of its own — the roll-up of this test’s disclosed subtests
TestAllocations/New deferred want-zero AllocsPerRun assert over New256() plus a 3-byte input slice, a 32-byte output buffer and h.Sum(out) (sha3_test.go:223’s family, under cryptotest.SkipTestAllocations). Go’s escape analysis proves the state object and every byte slice in the closure non-escaping, so it asserts zero; the converted path allocates 18 per run. DEFERRED rather than alloc-count-semantics, and the discriminator is the run’s own unit note rather than a source read: the host reports counted 180 go2cs-runtime object allocations over 10 run(s), an allocation COUNT per run in Go’s own units, so the counter SAW them. DEFERRED rather than structural, and this is the call worth stating: a mechanism can be NAMED – the SHA-3 sponge state object that New256()/NewSHAKE128() returns and the non-escaping byte slices around it, none of which the CLR’s object model requires an allocation for – so the excess is reducible bridge work and a floor claim here would be one the census could not falsify. Contrast TestXAESAllocations in crypto/internal/fips140test, classed STRUCTURAL on a 199-per-run LOWER BOUND over a whole AEAD round trip: what separates them is whether a removable mechanism can be named, not the size of the number. If a later measurement establishes a floor here, the entry moves deferred -> structural, which by the ladder never re-opens.
TestAllocations/NewSHAKE deferred want-zero AllocsPerRun assert over NewSHAKE128() plus a 3-byte input slice, a 32-byte output buffer and h.Read(out) (sha3_test.go:223’s family, under cryptotest.SkipTestAllocations). Go’s escape analysis proves the state object and every byte slice in the closure non-escaping, so it asserts zero; the converted path allocates 16 per run. DEFERRED rather than alloc-count-semantics, and the discriminator is the run’s own unit note rather than a source read: the host reports counted 160 go2cs-runtime object allocations over 10 run(s), an allocation COUNT per run in Go’s own units, so the counter SAW them. DEFERRED rather than structural, and this is the call worth stating: a mechanism can be NAMED – the SHA-3 sponge state object that New256()/NewSHAKE128() returns and the non-escaping byte slices around it, none of which the CLR’s object model requires an allocation for – so the excess is reducible bridge work and a floor claim here would be one the census could not falsify. Contrast TestXAESAllocations in crypto/internal/fips140test, classed STRUCTURAL on a 199-per-run LOWER BOUND over a whole AEAD round trip: what separates them is whether a removable mechanism can be named, not the size of the number. If a later measurement establishes a floor here, the entry moves deferred -> structural, which by the ladder never re-opens.
TestAllocations/Sum deferred want-zero AllocsPerRun assert over a 3-byte input slice and Sum256(b), whose [32]byte result Go returns by value (sha3_test.go:223’s family, under cryptotest.SkipTestAllocations). Go’s escape analysis proves the state object and every byte slice in the closure non-escaping, so it asserts zero; the converted path allocates 16 per run. DEFERRED rather than alloc-count-semantics, and the discriminator is the run’s own unit note rather than a source read: the host reports counted 160 go2cs-runtime object allocations over 10 run(s), an allocation COUNT per run in Go’s own units, so the counter SAW them. DEFERRED rather than structural, and this is the call worth stating: a mechanism can be NAMED – the SHA-3 sponge state object that New256()/NewSHAKE128() returns and the non-escaping byte slices around it, none of which the CLR’s object model requires an allocation for – so the excess is reducible bridge work and a floor claim here would be one the census could not falsify. Contrast TestXAESAllocations in crypto/internal/fips140test, classed STRUCTURAL on a 199-per-run LOWER BOUND over a whole AEAD round trip: what separates them is whether a removable mechanism can be named, not the size of the number. If a later measurement establishes a floor here, the entry moves deferred -> structural, which by the ladder never re-opens.
TestAllocations/SumSHAKE deferred want-zero AllocsPerRun assert over a 3-byte input slice and SumSHAKE128(b, 10), whose []byte result Go keeps on the stack (sha3_test.go:223’s family, under cryptotest.SkipTestAllocations). Go’s escape analysis proves the state object and every byte slice in the closure non-escaping, so it asserts zero; the converted path allocates 13 per run. DEFERRED rather than alloc-count-semantics, and the discriminator is the run’s own unit note rather than a source read: the host reports counted 130 go2cs-runtime object allocations over 10 run(s), an allocation COUNT per run in Go’s own units, so the counter SAW them. DEFERRED rather than structural, and this is the call worth stating: a mechanism can be NAMED – the SHA-3 sponge state object that New256()/NewSHAKE128() returns and the non-escaping byte slices around it, none of which the CLR’s object model requires an allocation for – so the excess is reducible bridge work and a floor claim here would be one the census could not falsify. Contrast TestXAESAllocations in crypto/internal/fips140test, classed STRUCTURAL on a 199-per-run LOWER BOUND over a whole AEAD round trip: what separates them is whether a removable mechanism can be named, not the size of the number. If a later measurement establishes a floor here, the entry moves deferred -> structural, which by the ladder never re-opens.

Excluded declarations

Declarations filtered from both sides of the comparison, and therefore not claimed above: Benchmark, Fuzz and Example declarations the converted host does not execute, plus any test requiring a capability the managed runtime does not provide — a testing member the host has not implemented, or a platform behavior it provably cannot reproduce. Each is named with the capability it needs.