From 4d6ff99acf290174417a8e1424aa533abab6461a Mon Sep 17 00:00:00 2001
From: Hein Dauven <heindauven@gmail.com>
Date: Fri, 11 Sep 2026 17:54:00 +0200
Subject: [PATCH] Remove secret-state equality from Sponge

Remove derived PartialEq while retaining Clone and the separate backend authentication contract. Drop the otherwise-unused stored domain separator; initialization still binds the separator into the tag.

Document migration away from whole-sponge comparisons and guard the API with a compile-fail doctest.

Fixes #39
---
 CHANGELOG.md  |  5 +++++
 src/sponge.rs | 25 ++++++++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a46acf1..9b23d06 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Simplify sponge finalization and IO-pattern validation
 - Raise the MSRV to Rust 1.96.1 [#32]
 
+### Removed
+
+- Remove `PartialEq` from `Sponge` [#39]
+
 ## [0.3.0] - 2025-02-06
 
 ### Changed
@@ -65,6 +69,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Add documentation
 
 <!-- ISSUES -->
+[#39]: https://github.com/dusk-network/safe/issues/39
 [#37]: https://github.com/dusk-network/safe/issues/37
 [#35]: https://github.com/dusk-network/safe/issues/35
 [#32]: https://github.com/dusk-network/safe/issues/32
diff --git a/src/sponge.rs b/src/sponge.rs
index 50a5bde..9f5a433 100644
--- a/src/sponge.rs
+++ b/src/sponge.rs
@@ -77,7 +77,28 @@ where
 /// elements. Widths below two are rejected. Operation errors and explicit
 /// zeroization permanently invalidate the instance, including subsequent
 /// clones of that failed instance; construct a new sponge to start again.
-#[derive(Clone, PartialEq)]
+///
+/// Whole-sponge equality is intentionally unsupported: ordinary comparisons
+/// of secret state and buffered output have no constant-time guarantee.
+/// This is separate from a backend's authentication equality check.
+/// When upgrading, remove whole-sponge comparisons and `Sponge: PartialEq`
+/// requirements.
+///
+/// ```compile_fail,E0369
+/// use dusk_safe::{Safe, Sponge};
+///
+/// fn compare<S, T, const W: usize>(
+///     left: &Sponge<S, T, W>,
+///     right: &Sponge<S, T, W>,
+/// ) -> bool
+/// where
+///     S: Safe<T, W> + PartialEq,
+///     T: Default + Copy + zeroize::Zeroize + PartialEq,
+/// {
+///     left == right
+/// }
+/// ```
+#[derive(Clone)]
 pub struct Sponge<S, T, const W: usize>
 where
     S: Safe<T, W>,
@@ -90,7 +111,6 @@ where
     io_count: usize,
     failed: bool,
     iopattern: Vec<Call>,
-    domain_sep: u64,
     pub(crate) output: Vec<T>,
 }
 
@@ -142,7 +162,6 @@ where
             io_count: 0,
             failed: false,
             iopattern,
-            domain_sep,
             output: Vec::new(),
         })
     }