sha3: add support for Keccak-512

Keccak uses a different domain separation byte as the NIST-
standardized SHA-3 hashing function. A previous commit to
this package added support for Keccak-256, but did not do
so for Keccak-512. The reasoning was to support use cases
like Ethereum, however Ethereum also uses Keccak-512 for
the Ethash PoW, so this second method is also needed.

Prev CL: https://go-review.googlesource.com/c/crypto/+/106462

Fixes golang/go#29533

Change-Id: I9d92b1f121657f631c157e5e309771db1cd91c82
Reviewed-on: https://go-review.googlesource.com/c/125795
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

sha3/hashes.go

@@ -58,6 +58,12 @@ func New512() hash.Hash {
 // that uses non-standard padding. All other users should use New256 instead.
 func NewLegacyKeccak256() hash.Hash { return &state{rate: 136, outputLen: 32, dsbyte: 0x01} }
 
+// NewLegacyKeccak512 creates a new Keccak-512 hash.
+//
+// Only use this function if you require compatibility with an existing cryptosystem
+// that uses non-standard padding. All other users should use New512 instead.
+func NewLegacyKeccak512() hash.Hash { return &state{rate: 72, outputLen: 64, dsbyte: 0x01} }
+
 // Sum224 returns the SHA3-224 digest of the data.
 func Sum224(data []byte) (digest [28]byte) {
 	h := New224()

sha3/sha3_test.go

@@ -44,6 +44,7 @@ var testDigests = map[string]func() hash.Hash{
 	"SHA3-384":   New384,
 	"SHA3-512":   New512,
 	"Keccak-256": NewLegacyKeccak256,
+	"Keccak-512": NewLegacyKeccak512,
 	"SHAKE128":   newHashShake128,
 	"SHAKE256":   newHashShake256,
 }
@@ -137,6 +138,11 @@ func TestKeccak(t *testing.T) {
 			[]byte("abc"),
 			"4e03657aea45a94fc7d47ba826c8d667c0d1e6e33a64a036ec44f58fa12d6c45",
 		},
+		{
+			NewLegacyKeccak512,
+			[]byte("abc"),
+			"18587dc2ea106b9a1563e32b3312421ca164c7f1f07bc922a9c83d77cea3a1e5d0c69910739025372dc14ac9642629379540c17e2a65b19d77aa511a9d00bb96",
+		},
 	}
 
 	for _, u := range tests {