Commit 636308a17d8f8118ab34e9d4b217baa5878416c4 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2024-11-22 10:00:49+01:00
committer	GitHub <noreply@github.com> 2024-11-22 10:00:49+01:00
log	636308a17d8f8118ab34e9d4b217baa5878416c4
tree	d686f3b2cb237c0f6d4a75cf3b22760ae113ac16
parent	f845fa04a0dce3104efe129c73a6ad792b1712b6
signature	Signed by PGP key B5690EEEBB952194

std.crypto.aes: introduce AES block vectors (#22023)

* std.crypto.aes: introduce AES block vectors

Modern Intel CPUs with the VAES extension can handle more than a
single AES block per instruction.

So can some ARM and RISC-V CPUs. Software implementations with
bitslicing can also greatly benefit from this.

Implement low-level operations on AES block vectors, and the
parallel AEGIS variants on top of them.

AMD Zen4:

      aegis-128x4:      73225 MiB/s
      aegis-128x2:      51571 MiB/s
       aegis-128l:      25806 MiB/s
      aegis-256x4:      46742 MiB/s
      aegis-256x2:      30227 MiB/s
        aegis-256:       8436 MiB/s
       aes128-gcm:       5926 MiB/s
       aes256-gcm:       5085 MiB/s

AES-GCM, and anything based on AES-CTR are also going to benefit
from this later.

* Make AEGIS-MAC twice a fast

7 files changed, 949 insertions(+), 324 deletions(-)

lib
- std
  - crypto.zig
  - crypto
    aegis.zig
    aes.zig
    aes
    aesni.zig
    armcrypto.zig
    soft.zig
    benchmark.zig

lib/std/crypto.zig+33-8

...	...	@@ -7,10 +7,23 @@ pub const timing_safe = @import("crypto/timing_safe.zig");
7	7	/// Authenticated Encryption with Associated Data
8	8	pub const aead = struct {
9	9	pub const aegis = struct {
10		pub const Aegis128L = @import("crypto/aegis.zig").Aegis128L;
11		pub const Aegis128L_256 = @import("crypto/aegis.zig").Aegis128L_256;
12		pub const Aegis256 = @import("crypto/aegis.zig").Aegis256;
13		pub const Aegis256_256 = @import("crypto/aegis.zig").Aegis256_256;
	10	const variants = @import("crypto/aegis.zig");
	11
	12	pub const Aegis128X4 = variants.Aegis128X4;
	13	pub const Aegis128X2 = variants.Aegis128X2;
	14	pub const Aegis128L = variants.Aegis128L;
	15
	16	pub const Aegis256X4 = variants.Aegis256X4;
	17	pub const Aegis256X2 = variants.Aegis256X2;
	18	pub const Aegis256 = variants.Aegis256;
	19
	20	pub const Aegis128X4_256 = variants.Aegis128X4_256;
	21	pub const Aegis128X2_256 = variants.Aegis128X2_256;
	22	pub const Aegis128L_256 = variants.Aegis128L_256;
	23
	24	pub const Aegis256X4_256 = variants.Aegis256X4_256;
	25	pub const Aegis256X2_256 = variants.Aegis256X2_256;
	26	pub const Aegis256_256 = variants.Aegis256_256;
14	27	};
15	28
16	29	pub const aes_gcm = struct {
...	...	@@ -44,10 +57,22 @@ pub const auth = struct {
44	57	pub const hmac = @import("crypto/hmac.zig");
45	58	pub const siphash = @import("crypto/siphash.zig");
46	59	pub const aegis = struct {
47		pub const Aegis128LMac = @import("crypto/aegis.zig").Aegis128LMac;
48		pub const Aegis128LMac_128 = @import("crypto/aegis.zig").Aegis128LMac_128;
49		pub const Aegis256Mac = @import("crypto/aegis.zig").Aegis256Mac;
50		pub const Aegis256Mac_128 = @import("crypto/aegis.zig").Aegis256Mac_128;
	60	const variants = @import("crypto/aegis.zig");
	61	pub const Aegis128X4Mac = variants.Aegis128X4Mac;
	62	pub const Aegis128X2Mac = variants.Aegis128X2Mac;
	63	pub const Aegis128LMac = variants.Aegis128LMac;
	64
	65	pub const Aegis256X4Mac = variants.Aegis256X4Mac;
	66	pub const Aegis256X2Mac = variants.Aegis256X2Mac;
	67	pub const Aegis256Mac = variants.Aegis256Mac;
	68
	69	pub const Aegis128X4Mac_128 = variants.Aegis128X4Mac_128;
	70	pub const Aegis128X2Mac_128 = variants.Aegis128X2Mac_128;
	71	pub const Aegis128LMac_128 = variants.Aegis128LMac_128;
	72
	73	pub const Aegis256X4Mac_128 = variants.Aegis256X4Mac_128;
	74	pub const Aegis256X2Mac_128 = variants.Aegis256X2Mac_128;
	75	pub const Aegis256Mac_128 = variants.Aegis256Mac_128;
51	76	};
52	77	pub const cmac = @import("crypto/cmac.zig");
53	78	};

lib/std/crypto/aegis.zig+482-265

...	...	@@ -1,16 +1,21 @@
1	1	//! AEGIS is a very fast authenticated encryption system built on top of the core AES function.
2	2	//!
3		//! The AEGIS-128L variant has a 128 bit key, a 128 bit nonce, and processes 256 bit message blocks.
4		//! The AEGIS-256 variant has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.
	3	//! The AEGIS-128* variants have a 128 bit key and a 128 bit nonce.
	4	//! The AEGIS-256* variants have a 256 bit key and a 256 bit nonce.
	5	//! All of them can compute 128 and 256 bit authentication tags.
5	6	//!
6	7	//! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with
7	8	//! hardware support for parallelizable AES block encryption.
8	9	//!
9		//! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256.
10		//! AEGIS-128L also allows for more messages to be safely encrypted when using random nonces.
	10	//! On high-end Intel CPUs with AVX-512 support, AEGIS-128X4 and AEGIS-256X4 are the fastest options.
	11	//! On other modern server, desktop and mobile CPUs, AEGIS-128X2 and AEGIS-256X2 are usually the fastest options.
	12	//! AEGIS-128L and AEGIS-256 perform well on a broad range of platforms, including WebAssembly.
11	13	//!
12		//! AEGIS is believed to be key-committing, making it a safer choice than most other AEADs
13		//! when the key has low entropy, or can be controlled by an attacker.
	14	//! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256*.
	15	//! AEGIS-128* also allows for more messages to be safely encrypted when using random nonces.
	16	//!
	17	//! Unless the associated data can be fully controled by an adversary, AEGIS is believed to be key-committing,
	18	//! making it a safer choice than most other AEADs when the key has low entropy, or can be controlled by an attacker.
14	19	//!
15	20	//! Finally, leaking the state does not leak the key.
16	21	//!
...	...	@@ -20,122 +25,202 @@ const std = @import("std");
20	25	const crypto = std.crypto;
21	26	const mem = std.mem;
22	27	const assert = std.debug.assert;
23		const AesBlock = crypto.core.aes.Block;
24	28	const AuthenticationError = crypto.errors.AuthenticationError;
25	29
26		/// AEGIS-128L with a 128-bit authentication tag.
27		pub const Aegis128L = Aegis128LGeneric(128);
28
29		/// AEGIS-128L with a 256-bit authentication tag.
30		pub const Aegis128L_256 = Aegis128LGeneric(256);
31
32		/// AEGIS-256 with a 128-bit authentication tag.
33		pub const Aegis256 = Aegis256Generic(128);
34
35		/// AEGIS-256 with a 256-bit authentication tag.
36		pub const Aegis256_256 = Aegis256Generic(256);
37
38		const State128L = struct {
39		blocks: [8]AesBlock,
40
41		fn init(key: [16]u8, nonce: [16]u8) State128L {
42		const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
43		const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
44		const key_block = AesBlock.fromBytes(&key);
45		const nonce_block = AesBlock.fromBytes(&nonce);
46		const blocks = [8]AesBlock{
47		key_block.xorBlocks(nonce_block),
48		c1,
49		c2,
50		c1,
51		key_block.xorBlocks(nonce_block),
52		key_block.xorBlocks(c2),
53		key_block.xorBlocks(c1),
54		key_block.xorBlocks(c2),
55		};
56		var state = State128L{ .blocks = blocks };
57		var i: usize = 0;
58		while (i < 10) : (i += 1) {
59		state.update(nonce_block, key_block);
	30	/// AEGIS-128X4 with a 128 bit tag
	31	pub const Aegis128X4 = Aegis128XGeneric(4, 128);
	32	/// AEGIS-128X2 with a 128 bit tag
	33	pub const Aegis128X2 = Aegis128XGeneric(2, 128);
	34	/// AEGIS-128L with a 128 bit tag
	35	pub const Aegis128L = Aegis128XGeneric(1, 128);
	36
	37	/// AEGIS-256X4 with a 128 bit tag
	38	pub const Aegis256X4 = Aegis256XGeneric(4, 128);
	39	/// AEGIS-256X2 with a 128 bit tag
	40	pub const Aegis256X2 = Aegis256XGeneric(2, 128);
	41	/// AEGIS-256 with a 128 bit tag
	42	pub const Aegis256 = Aegis256XGeneric(1, 128);
	43
	44	/// AEGIS-128X4 with a 256 bit tag
	45	pub const Aegis128X4_256 = Aegis128XGeneric(4, 256);
	46	/// AEGIS-128X2 with a 256 bit tag
	47	pub const Aegis128X2_256 = Aegis128XGeneric(2, 256);
	48	/// AEGIS-128L with a 256 bit tag
	49	pub const Aegis128L_256 = Aegis128XGeneric(1, 256);
	50
	51	/// AEGIS-256X4 with a 256 bit tag
	52	pub const Aegis256X4_256 = Aegis256XGeneric(4, 256);
	53	/// AEGIS-256X2 with a 256 bit tag
	54	pub const Aegis256X2_256 = Aegis256XGeneric(2, 256);
	55	/// AEGIS-256 with a 256 bit tag
	56	pub const Aegis256_256 = Aegis256XGeneric(1, 256);
	57
	58	fn State128X(comptime degree: u7) type {
	59	return struct {
	60	const AesBlockVec = crypto.core.aes.BlockVec(degree);
	61	const State = @This();
	62
	63	blocks: [8]AesBlockVec,
	64
	65	const aes_block_length = AesBlockVec.block_length;
	66	const rate = aes_block_length * 2;
	67	const alignment = AesBlockVec.native_word_size;
	68
	69	fn init(key: [16]u8, nonce: [16]u8) State {
	70	const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree);
	71	const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree);
	72	const key_block = AesBlockVec.fromBytes(&(key ** degree));
	73	const nonce_block = AesBlockVec.fromBytes(&(nonce ** degree));
	74	const blocks = [8]AesBlockVec{
	75	key_block.xorBlocks(nonce_block),
	76	c1,
	77	c2,
	78	c1,
	79	key_block.xorBlocks(nonce_block),
	80	key_block.xorBlocks(c2),
	81	key_block.xorBlocks(c1),
	82	key_block.xorBlocks(c2),
	83	};
	84	var state = State{ .blocks = blocks };
	85	if (degree > 1) {
	86	const context_block = ctx: {
	87	var contexts_bytes = [_]u8{0} ** aes_block_length;
	88	for (0..degree) \|i\| {
	89	contexts_bytes[i * 16] = @intCast(i);
	90	contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
	91	}
	92	break :ctx AesBlockVec.fromBytes(&contexts_bytes);
	93	};
	94	for (0..10) \|_\| {
	95	state.blocks[3] = state.blocks[3].xorBlocks(context_block);
	96	state.blocks[7] = state.blocks[7].xorBlocks(context_block);
	97	state.update(nonce_block, key_block);
	98	}
	99	} else {
	100	for (0..10) \|_\| {
	101	state.update(nonce_block, key_block);
	102	}
	103	}
	104	return state;
60	105	}
61		return state;
62		}
63	106
64		inline fn update(state: *State128L, d1: AesBlock, d2: AesBlock) void {
65		const blocks = &state.blocks;
66		const tmp = blocks[7];
67		comptime var i: usize = 7;
68		inline while (i > 0) : (i -= 1) {
69		blocks[i] = blocks[i - 1].encrypt(blocks[i]);
	107	inline fn update(state: *State, d1: AesBlockVec, d2: AesBlockVec) void {
	108	const blocks = &state.blocks;
	109	const tmp = blocks[7];
	110	comptime var i: usize = 7;
	111	inline while (i > 0) : (i -= 1) {
	112	blocks[i] = blocks[i - 1].encrypt(blocks[i]);
	113	}
	114	blocks[0] = tmp.encrypt(blocks[0]);
	115	blocks[0] = blocks[0].xorBlocks(d1);
	116	blocks[4] = blocks[4].xorBlocks(d2);
70	117	}
71		blocks[0] = tmp.encrypt(blocks[0]);
72		blocks[0] = blocks[0].xorBlocks(d1);
73		blocks[4] = blocks[4].xorBlocks(d2);
74		}
75	118
76		fn absorb(state: State128L, src: const [32]u8) void {
77		const msg0 = AesBlock.fromBytes(src[0..16]);
78		const msg1 = AesBlock.fromBytes(src[16..32]);
79		state.update(msg0, msg1);
80		}
	119	fn absorb(state: State, src: const [rate]u8) void {
	120	const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
	121	const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
	122	state.update(msg0, msg1);
	123	}
81	124
82		fn enc(state: State128L, dst: [32]u8, src: *const [32]u8) void {
83		const blocks = &state.blocks;
84		const msg0 = AesBlock.fromBytes(src[0..16]);
85		const msg1 = AesBlock.fromBytes(src[16..32]);
86		var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);
87		var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);
88		tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));
89		tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7]));
90		dst[0..16].* = tmp0.toBytes();
91		dst[16..32].* = tmp1.toBytes();
92		state.update(msg0, msg1);
93		}
	125	fn enc(state: State, dst: [rate]u8, src: *const [rate]u8) void {
	126	const blocks = &state.blocks;
	127	const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
	128	const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
	129	var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);
	130	var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);
	131	tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));
	132	tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7]));
	133	dst[0..aes_block_length].* = tmp0.toBytes();
	134	dst[aes_block_length..rate].* = tmp1.toBytes();
	135	state.update(msg0, msg1);
	136	}
94	137
95		fn dec(state: State128L, dst: [32]u8, src: *const [32]u8) void {
96		const blocks = &state.blocks;
97		var msg0 = AesBlock.fromBytes(src[0..16]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
98		var msg1 = AesBlock.fromBytes(src[16..32]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
99		msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));
100		msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));
101		dst[0..16].* = msg0.toBytes();
102		dst[16..32].* = msg1.toBytes();
103		state.update(msg0, msg1);
104		}
	138	fn dec(state: State, dst: [rate]u8, src: *const [rate]u8) void {
	139	const blocks = &state.blocks;
	140	var msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
	141	var msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
	142	msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));
	143	msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));
	144	dst[0..aes_block_length].* = msg0.toBytes();
	145	dst[aes_block_length..rate].* = msg1.toBytes();
	146	state.update(msg0, msg1);
	147	}
105	148
106		fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
107		const blocks = &state.blocks;
108		var sizes: [16]u8 = undefined;
109		mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
110		mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
111		const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);
112		var i: usize = 0;
113		while (i < 7) : (i += 1) {
114		state.update(tmp, tmp);
	149	fn decLast(state: *State, dst: []u8, src: []const u8) void {
	150	const blocks = &state.blocks;
	151	const z0 = blocks[6].xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
	152	const z1 = blocks[2].xorBlocks(blocks[5]).xorBlocks(blocks[6].andBlocks(blocks[7]));
	153	var pad = [_]u8{0} ** rate;
	154	pad[0..aes_block_length].* = z0.toBytes();
	155	pad[aes_block_length..].* = z1.toBytes();
	156	for (pad[0..src.len], src) \|p, x\| p. ^= x;
	157	@memcpy(dst, pad[0..src.len]);
	158	@memset(pad[src.len..], 0);
	159	const msg0 = AesBlockVec.fromBytes(pad[0..aes_block_length]);
	160	const msg1 = AesBlockVec.fromBytes(pad[aes_block_length..rate]);
	161	state.update(msg0, msg1);
115	162	}
116		return switch (tag_bits) {
117		128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3])
118		.xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes(),
119		256 => tag: {
120		const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]);
121		const t2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]);
122		break :tag t1.toBytes() ++ t2.toBytes();
123		},
124		else => unreachable,
125		};
126		}
127		};
128	163
129		fn Aegis128LGeneric(comptime tag_bits: u9) type {
	164	fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
	165	const blocks = &state.blocks;
	166	var sizes: [aes_block_length]u8 = undefined;
	167	mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
	168	mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
	169	for (1..degree) \|i\| {
	170	@memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
	171	}
	172	const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[2]);
	173	for (0..7) \|_\| {
	174	state.update(tmp, tmp);
	175	}
	176	switch (tag_bits) {
	177	128 => {
	178	var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
	179	var tag = tag_multi[0..16].*;
	180	@memcpy(tag[0..], tag_multi[0..16]);
	181	for (1..degree) \|d\| {
	182	for (0..16) \|i\| {
	183	tag[i] ^= tag_multi[d * 16 + i];
	184	}
	185	}
	186	return tag;
	187	},
	188	256 => {
	189	const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
	190	const tag_multi_2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
	191	var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
	192	for (1..degree) \|d\| {
	193	for (0..16) \|i\| {
	194	tag[i] ^= tag_multi_1[d * 16 + i];
	195	tag[i + 16] ^= tag_multi_2[d * 16 + i];
	196	}
	197	}
	198	return tag;
	199	},
	200	else => unreachable,
	201	}
	202	}
	203	};
	204	}
	205
	206	/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
	207	///
	208	/// The 128 bits variants of AEGIS have a 128 bit key and a 128 bit nonce.
	209	///
	210	/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
	211	fn Aegis128XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
	212	comptime assert(degree > 0); // degree must be greater than 0
130	213	comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
131	214
132	215	return struct {
	216	const State = State128X(degree);
	217
133	218	pub const tag_length = tag_bits / 8;
134	219	pub const nonce_length = 16;
135	220	pub const key_length = 16;
136		pub const block_length = 32;
	221	pub const block_length = State.rate;
137	222
138		const State = State128L;
	223	const alignment = State.alignment;
139	224
140	225	/// c: ciphertext: output buffer should be of size m.len
141	226	/// tag: authentication tag: output MAC
...	...	@@ -145,27 +230,27 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
145	230	/// k: private key
146	231	pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
147	232	assert(c.len == m.len);
148		var state = State128L.init(key, npub);
149		var src: [32]u8 align(16) = undefined;
150		var dst: [32]u8 align(16) = undefined;
	233	var state = State.init(key, npub);
	234	var src: [block_length]u8 align(alignment) = undefined;
	235	var dst: [block_length]u8 align(alignment) = undefined;
151	236	var i: usize = 0;
152		while (i + 32 <= ad.len) : (i += 32) {
153		state.absorb(ad[i..][0..32]);
	237	while (i + block_length <= ad.len) : (i += block_length) {
	238	state.absorb(ad[i..][0..block_length]);
154	239	}
155		if (ad.len % 32 != 0) {
	240	if (ad.len % block_length != 0) {
156	241	@memset(src[0..], 0);
157		@memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]);
	242	@memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
158	243	state.absorb(&src);
159	244	}
160	245	i = 0;
161		while (i + 32 <= m.len) : (i += 32) {
162		state.enc(c[i..][0..32], m[i..][0..32]);
	246	while (i + block_length <= m.len) : (i += block_length) {
	247	state.enc(c[i..][0..block_length], m[i..][0..block_length]);
163	248	}
164		if (m.len % 32 != 0) {
	249	if (m.len % block_length != 0) {
165	250	@memset(src[0..], 0);
166		@memcpy(src[0 .. m.len % 32], m[i..][0 .. m.len % 32]);
	251	@memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
167	252	state.enc(&dst, &src);
168		@memcpy(c[i..][0 .. m.len % 32], dst[0 .. m.len % 32]);
	253	@memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
169	254	}
170	255	tag.* = state.mac(tag_bits, ad.len, m.len);
171	256	}
...	...	@@ -181,31 +266,23 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
181	266	/// Contents of `m` are undefined if an error is returned.
182	267	pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
183	268	assert(c.len == m.len);
184		var state = State128L.init(key, npub);
185		var src: [32]u8 align(16) = undefined;
186		var dst: [32]u8 align(16) = undefined;
	269	var state = State.init(key, npub);
	270	var src: [block_length]u8 align(alignment) = undefined;
187	271	var i: usize = 0;
188		while (i + 32 <= ad.len) : (i += 32) {
189		state.absorb(ad[i..][0..32]);
	272	while (i + block_length <= ad.len) : (i += block_length) {
	273	state.absorb(ad[i..][0..block_length]);
190	274	}
191		if (ad.len % 32 != 0) {
	275	if (ad.len % block_length != 0) {
192	276	@memset(src[0..], 0);
193		@memcpy(src[0 .. ad.len % 32], ad[i..][0 .. ad.len % 32]);
	277	@memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
194	278	state.absorb(&src);
195	279	}
196	280	i = 0;
197		while (i + 32 <= m.len) : (i += 32) {
198		state.dec(m[i..][0..32], c[i..][0..32]);
	281	while (i + block_length <= m.len) : (i += block_length) {
	282	state.dec(m[i..][0..block_length], c[i..][0..block_length]);
199	283	}
200		if (m.len % 32 != 0) {
201		@memset(src[0..], 0);
202		@memcpy(src[0 .. m.len % 32], c[i..][0 .. m.len % 32]);
203		state.dec(&dst, &src);
204		@memcpy(m[i..][0 .. m.len % 32], dst[0 .. m.len % 32]);
205		@memset(dst[0 .. m.len % 32], 0);
206		const blocks = &state.blocks;
207		blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(dst[0..16]));
208		blocks[4] = blocks[4].xorBlocks(AesBlock.fromBytes(dst[16..32]));
	284	if (m.len % block_length != 0) {
	285	state.decLast(m[i..], c[i..]);
209	286	}
210	287	var computed_tag = state.mac(tag_bits, ad.len, m.len);
211	288	const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
...	...	@@ -218,107 +295,172 @@ fn Aegis128LGeneric(comptime tag_bits: u9) type {
218	295	};
219	296	}
220	297
221		const State256 = struct {
222		blocks: [6]AesBlock,
223
224		fn init(key: [32]u8, nonce: [32]u8) State256 {
225		const c1 = AesBlock.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd });
226		const c2 = AesBlock.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 });
227		const key_block1 = AesBlock.fromBytes(key[0..16]);
228		const key_block2 = AesBlock.fromBytes(key[16..32]);
229		const nonce_block1 = AesBlock.fromBytes(nonce[0..16]);
230		const nonce_block2 = AesBlock.fromBytes(nonce[16..32]);
231		const kxn1 = key_block1.xorBlocks(nonce_block1);
232		const kxn2 = key_block2.xorBlocks(nonce_block2);
233		const blocks = [6]AesBlock{
234		kxn1,
235		kxn2,
236		c1,
237		c2,
238		key_block1.xorBlocks(c2),
239		key_block2.xorBlocks(c1),
240		};
241		var state = State256{ .blocks = blocks };
242		var i: usize = 0;
243		while (i < 4) : (i += 1) {
244		state.update(key_block1);
245		state.update(key_block2);
246		state.update(kxn1);
247		state.update(kxn2);
	298	fn State256X(comptime degree: u7) type {
	299	return struct {
	300	const AesBlockVec = crypto.core.aes.BlockVec(degree);
	301	const State = @This();
	302
	303	blocks: [6]AesBlockVec,
	304
	305	const aes_block_length = AesBlockVec.block_length;
	306	const rate = aes_block_length;
	307	const alignment = AesBlockVec.native_word_size;
	308
	309	fn init(key: [32]u8, nonce: [32]u8) State {
	310	const c1 = AesBlockVec.fromBytes(&[16]u8{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd } ** degree);
	311	const c2 = AesBlockVec.fromBytes(&[16]u8{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 } ** degree);
	312	const key_block1 = AesBlockVec.fromBytes(key[0..16] ** degree);
	313	const key_block2 = AesBlockVec.fromBytes(key[16..32] ** degree);
	314	const nonce_block1 = AesBlockVec.fromBytes(nonce[0..16] ** degree);
	315	const nonce_block2 = AesBlockVec.fromBytes(nonce[16..32] ** degree);
	316	const kxn1 = key_block1.xorBlocks(nonce_block1);
	317	const kxn2 = key_block2.xorBlocks(nonce_block2);
	318	const blocks = [6]AesBlockVec{
	319	kxn1,
	320	kxn2,
	321	c1,
	322	c2,
	323	key_block1.xorBlocks(c2),
	324	key_block2.xorBlocks(c1),
	325	};
	326	var state = State{ .blocks = blocks };
	327	if (degree > 1) {
	328	const context_block = ctx: {
	329	var contexts_bytes = [_]u8{0} ** aes_block_length;
	330	for (0..degree) \|i\| {
	331	contexts_bytes[i * 16] = @intCast(i);
	332	contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
	333	}
	334	break :ctx AesBlockVec.fromBytes(&contexts_bytes);
	335	};
	336	for (0..4) \|_\| {
	337	state.blocks[3] = state.blocks[3].xorBlocks(context_block);
	338	state.blocks[5] = state.blocks[5].xorBlocks(context_block);
	339	state.update(key_block1);
	340	state.blocks[3] = state.blocks[3].xorBlocks(context_block);
	341	state.blocks[5] = state.blocks[5].xorBlocks(context_block);
	342	state.update(key_block2);
	343	state.blocks[3] = state.blocks[3].xorBlocks(context_block);
	344	state.blocks[5] = state.blocks[5].xorBlocks(context_block);
	345	state.update(kxn1);
	346	state.blocks[3] = state.blocks[3].xorBlocks(context_block);
	347	state.blocks[5] = state.blocks[5].xorBlocks(context_block);
	348	state.update(kxn2);
	349	}
	350	} else {
	351	for (0..4) \|_\| {
	352	state.update(key_block1);
	353	state.update(key_block2);
	354	state.update(kxn1);
	355	state.update(kxn2);
	356	}
	357	}
	358	return state;
248	359	}
249		return state;
250		}
251	360
252		inline fn update(state: *State256, d: AesBlock) void {
253		const blocks = &state.blocks;
254		const tmp = blocks[5].encrypt(blocks[0]);
255		comptime var i: usize = 5;
256		inline while (i > 0) : (i -= 1) {
257		blocks[i] = blocks[i - 1].encrypt(blocks[i]);
	361	inline fn update(state: *State, d: AesBlockVec) void {
	362	const blocks = &state.blocks;
	363	const tmp = blocks[5].encrypt(blocks[0]);
	364	comptime var i: usize = 5;
	365	inline while (i > 0) : (i -= 1) {
	366	blocks[i] = blocks[i - 1].encrypt(blocks[i]);
	367	}
	368	blocks[0] = tmp.xorBlocks(d);
258	369	}
259		blocks[0] = tmp.xorBlocks(d);
260		}
261	370
262		fn absorb(state: State256, src: const [16]u8) void {
263		const msg = AesBlock.fromBytes(src);
264		state.update(msg);
265		}
	371	fn absorb(state: State, src: const [rate]u8) void {
	372	const msg = AesBlockVec.fromBytes(src);
	373	state.update(msg);
	374	}
266	375
267		fn enc(state: State256, dst: [16]u8, src: *const [16]u8) void {
268		const blocks = &state.blocks;
269		const msg = AesBlock.fromBytes(src);
270		var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
271		tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
272		dst.* = tmp.toBytes();
273		state.update(msg);
274		}
	376	fn enc(state: State, dst: [rate]u8, src: *const [rate]u8) void {
	377	const blocks = &state.blocks;
	378	const msg = AesBlockVec.fromBytes(src);
	379	var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
	380	tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
	381	dst.* = tmp.toBytes();
	382	state.update(msg);
	383	}
275	384
276		fn dec(state: State256, dst: [16]u8, src: *const [16]u8) void {
277		const blocks = &state.blocks;
278		var msg = AesBlock.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
279		msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
280		dst.* = msg.toBytes();
281		state.update(msg);
282		}
	385	fn dec(state: State, dst: [rate]u8, src: *const [rate]u8) void {
	386	const blocks = &state.blocks;
	387	var msg = AesBlockVec.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
	388	msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
	389	dst.* = msg.toBytes();
	390	state.update(msg);
	391	}
283	392
284		fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
285		const blocks = &state.blocks;
286		var sizes: [16]u8 = undefined;
287		mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
288		mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
289		const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
290		var i: usize = 0;
291		while (i < 7) : (i += 1) {
292		state.update(tmp);
	393	fn decLast(state: *State, dst: []u8, src: []const u8) void {
	394	const blocks = &state.blocks;
	395	const z = blocks[5].xorBlocks(blocks[4]).xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
	396	var pad = z.toBytes();
	397	for (pad[0..src.len], src) \|p, x\| p. ^= x;
	398	@memcpy(dst, pad[0..src.len]);
	399	@memset(pad[src.len..], 0);
	400	const msg = AesBlockVec.fromBytes(pad[0..]);
	401	state.update(msg);
293	402	}
294		return switch (tag_bits) {
295		128 => blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3])
296		.xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes(),
297		256 => tag: {
298		const t1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]);
299		const t2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]);
300		break :tag t1.toBytes() ++ t2.toBytes();
301		},
302		else => unreachable,
303		};
304		}
305		};
	403
	404	fn mac(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
	405	const blocks = &state.blocks;
	406	var sizes: [aes_block_length]u8 = undefined;
	407	mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
	408	mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
	409	for (1..degree) \|i\| {
	410	@memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
	411	}
	412	const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[3]);
	413	for (0..7) \|_\| {
	414	state.update(tmp);
	415	}
	416	switch (tag_bits) {
	417	128 => {
	418	var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
	419	var tag = tag_multi[0..16].*;
	420	@memcpy(tag[0..], tag_multi[0..16]);
	421	for (1..degree) \|d\| {
	422	for (0..16) \|i\| {
	423	tag[i] ^= tag_multi[d * 16 + i];
	424	}
	425	}
	426	return tag;
	427	},
	428	256 => {
	429	const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes();
	430	const tag_multi_2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
	431	var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
	432	for (1..degree) \|d\| {
	433	for (0..16) \|i\| {
	434	tag[i] ^= tag_multi_1[d * 16 + i];
	435	tag[i + 16] ^= tag_multi_2[d * 16 + i];
	436	}
	437	}
	438	return tag;
	439	},
	440	else => unreachable,
	441	}
	442	}
	443	};
	444	}
306	445
307	446	/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
308	447	///
309		/// The 256 bit variant of AEGIS has a 256 bit key, a 256 bit nonce, and processes 128 bit message blocks.
	448	/// The 256 bits variants of AEGIS have a 256 bit key and a 256 bit nonce.
310	449	///
311	450	/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
312		fn Aegis256Generic(comptime tag_bits: u9) type {
	451	fn Aegis256XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
	452	comptime assert(degree > 0); // degree must be greater than 0
313	453	comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
314	454
315	455	return struct {
	456	const State = State256X(degree);
	457
316	458	pub const tag_length = tag_bits / 8;
317	459	pub const nonce_length = 32;
318	460	pub const key_length = 32;
319		pub const block_length = 16;
	461	pub const block_length = State.rate;
320	462
321		const State = State256;
	463	const alignment = State.alignment;
322	464
323	465	/// c: ciphertext: output buffer should be of size m.len
324	466	/// tag: authentication tag: output MAC
...	...	@@ -328,27 +470,27 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
328	470	/// k: private key
329	471	pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
330	472	assert(c.len == m.len);
331		var state = State256.init(key, npub);
332		var src: [16]u8 align(16) = undefined;
333		var dst: [16]u8 align(16) = undefined;
	473	var state = State.init(key, npub);
	474	var src: [block_length]u8 align(alignment) = undefined;
	475	var dst: [block_length]u8 align(alignment) = undefined;
334	476	var i: usize = 0;
335		while (i + 16 <= ad.len) : (i += 16) {
336		state.enc(&dst, ad[i..][0..16]);
	477	while (i + block_length <= ad.len) : (i += block_length) {
	478	state.enc(&dst, ad[i..][0..block_length]);
337	479	}
338		if (ad.len % 16 != 0) {
	480	if (ad.len % block_length != 0) {
339	481	@memset(src[0..], 0);
340		@memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]);
	482	@memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
341	483	state.enc(&dst, &src);
342	484	}
343	485	i = 0;
344		while (i + 16 <= m.len) : (i += 16) {
345		state.enc(c[i..][0..16], m[i..][0..16]);
	486	while (i + block_length <= m.len) : (i += block_length) {
	487	state.enc(c[i..][0..block_length], m[i..][0..block_length]);
346	488	}
347		if (m.len % 16 != 0) {
	489	if (m.len % block_length != 0) {
348	490	@memset(src[0..], 0);
349		@memcpy(src[0 .. m.len % 16], m[i..][0 .. m.len % 16]);
	491	@memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
350	492	state.enc(&dst, &src);
351		@memcpy(c[i..][0 .. m.len % 16], dst[0 .. m.len % 16]);
	493	@memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
352	494	}
353	495	tag.* = state.mac(tag_bits, ad.len, m.len);
354	496	}
...	...	@@ -364,30 +506,23 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
364	506	/// Contents of `m` are undefined if an error is returned.
365	507	pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
366	508	assert(c.len == m.len);
367		var state = State256.init(key, npub);
368		var src: [16]u8 align(16) = undefined;
369		var dst: [16]u8 align(16) = undefined;
	509	var state = State.init(key, npub);
	510	var src: [block_length]u8 align(alignment) = undefined;
370	511	var i: usize = 0;
371		while (i + 16 <= ad.len) : (i += 16) {
372		state.enc(&dst, ad[i..][0..16]);
	512	while (i + block_length <= ad.len) : (i += block_length) {
	513	state.absorb(ad[i..][0..block_length]);
373	514	}
374		if (ad.len % 16 != 0) {
	515	if (ad.len % block_length != 0) {
375	516	@memset(src[0..], 0);
376		@memcpy(src[0 .. ad.len % 16], ad[i..][0 .. ad.len % 16]);
377		state.enc(&dst, &src);
	517	@memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
	518	state.absorb(&src);
378	519	}
379	520	i = 0;
380		while (i + 16 <= m.len) : (i += 16) {
381		state.dec(m[i..][0..16], c[i..][0..16]);
	521	while (i + block_length <= m.len) : (i += block_length) {
	522	state.dec(m[i..][0..block_length], c[i..][0..block_length]);
382	523	}
383		if (m.len % 16 != 0) {
384		@memset(src[0..], 0);
385		@memcpy(src[0 .. m.len % 16], c[i..][0 .. m.len % 16]);
386		state.dec(&dst, &src);
387		@memcpy(m[i..][0 .. m.len % 16], dst[0 .. m.len % 16]);
388		@memset(dst[0 .. m.len % 16], 0);
389		const blocks = &state.blocks;
390		blocks[0] = blocks[0].xorBlocks(AesBlock.fromBytes(&dst));
	524	if (m.len % block_length != 0) {
	525	state.decLast(m[i..], c[i..]);
391	526	}
392	527	var computed_tag = state.mac(tag_bits, ad.len, m.len);
393	528	const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
...	...	@@ -400,6 +535,24 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
400	535	};
401	536	}
402	537
	538	/// The `Aegis128X4Mac` message authentication function outputs 256 bit tags.
	539	/// In addition to being extremely fast, its large state, non-linearity
	540	/// and non-invertibility provides the following properties:
	541	/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
	542	/// - Recovering the secret key from the state would require ~2^128 attempts,
	543	/// which is infeasible for any practical adversary.
	544	/// - It has a large security margin against internal collisions.
	545	pub const Aegis128X4Mac = AegisMac(Aegis128X4_256);
	546
	547	/// The `Aegis128X2Mac` message authentication function outputs 256 bit tags.
	548	/// In addition to being extremely fast, its large state, non-linearity
	549	/// and non-invertibility provides the following properties:
	550	/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
	551	/// - Recovering the secret key from the state would require ~2^128 attempts,
	552	/// which is infeasible for any practical adversary.
	553	/// - It has a large security margin against internal collisions.
	554	pub const Aegis128X2Mac = AegisMac(Aegis128X2_256);
	555
403	556	/// The `Aegis128LMac` message authentication function outputs 256 bit tags.
404	557	/// In addition to being extremely fast, its large state, non-linearity
405	558	/// and non-invertibility provides the following properties:
...	...	@@ -409,34 +562,60 @@ fn Aegis256Generic(comptime tag_bits: u9) type {
409	562	/// - It has a large security margin against internal collisions.
410	563	pub const Aegis128LMac = AegisMac(Aegis128L_256);
411	564
	565	/// The `Aegis256X4Mac` message authentication function has a 256-bit key size,
	566	/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
	567	/// concern, the AEGIS-128L variant should be preferred.
	568	/// AEGIS' large state, non-linearity and non-invertibility provides the
	569	/// following properties:
	570	/// - 256 bit security against forgery.
	571	/// - Recovering the secret key from the state would require ~2^256 attempts,
	572	/// which is infeasible for any practical adversary.
	573	/// - It has a large security margin against internal collisions.
	574	pub const Aegis256X4Mac = AegisMac(Aegis256X4_256);
	575
	576	/// The `Aegis256X2Mac` message authentication function has a 256-bit key size,
	577	/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
	578	/// concern, the AEGIS-128L variant should be preferred.
	579	/// AEGIS' large state, non-linearity and non-invertibility provides the
	580	/// following properties:
	581	/// - 256 bit security against forgery.
	582	/// - Recovering the secret key from the state would require ~2^256 attempts,
	583	/// which is infeasible for any practical adversary.
	584	/// - It has a large security margin against internal collisions.
	585	pub const Aegis256X2Mac = AegisMac(Aegis256X2_256);
	586
412	587	/// The `Aegis256Mac` message authentication function has a 256-bit key size,
413	588	/// and outputs 256 bit tags. Unless theoretical multi-target attacks are a
414	589	/// concern, the AEGIS-128L variant should be preferred.
415	590	/// AEGIS' large state, non-linearity and non-invertibility provides the
416	591	/// following properties:
417		/// - More than 128 bit security against forgery.
	592	/// - 256 bit security against forgery.
418	593	/// - Recovering the secret key from the state would require ~2^256 attempts,
419	594	/// which is infeasible for any practical adversary.
420	595	/// - It has a large security margin against internal collisions.
421	596	pub const Aegis256Mac = AegisMac(Aegis256_256);
422	597
423		/// Aegis128L MAC with a 128-bit output.
424		/// A MAC with a 128-bit output is not safe unless the number of messages
425		/// authenticated with the same key remains small.
426		/// After 2^48 messages, the probability of a collision is already ~ 2^-33.
427		/// If unsure, use the Aegis128LMac type, that has a 256 bit output.
	598	/// AEGIS-128X4 MAC with 128-bit tags
	599	pub const Aegis128X4Mac_128 = AegisMac(Aegis128X4);
	600
	601	/// AEGIS-128X2 MAC with 128-bit tags
	602	pub const Aegis128X2Mac_128 = AegisMac(Aegis128X2);
	603
	604	/// AEGIS-128L MAC with 128-bit tags
428	605	pub const Aegis128LMac_128 = AegisMac(Aegis128L);
429	606
430		/// Aegis256 MAC with a 128-bit output.
431		/// A MAC with a 128-bit output is not safe unless the number of messages
432		/// authenticated with the same key remains small.
433		/// After 2^48 messages, the probability of a collision is already ~ 2^-33.
434		/// If unsure, use the Aegis256Mac type, that has a 256 bit output.
	607	/// AEGIS-256X4 MAC with 128-bit tags
	608	pub const Aegis256X4Mac_128 = AegisMac(Aegis256X4);
	609
	610	/// AEGIS-256X2 MAC with 128-bit tags
	611	pub const Aegis256X2Mac_128 = AegisMac(Aegis256X2);
	612
	613	/// AEGIS-256 MAC with 128-bit tags
435	614	pub const Aegis256Mac_128 = AegisMac(Aegis256);
436	615
437	616	fn AegisMac(comptime T: type) type {
438	617	return struct {
439		const Self = @This();
	618	const Mac = @This();
440	619
441	620	pub const mac_length = T.tag_length;
442	621	pub const key_length = T.key_length;
...	...	@@ -448,15 +627,15 @@ fn AegisMac(comptime T: type) type {
448	627	msg_len: usize = 0,
449	628
450	629	/// Initialize a state for the MAC function
451		pub fn init(key: *const [key_length]u8) Self {
	630	pub fn init(key: *const [key_length]u8) Mac {
452	631	const nonce = [_]u8{0} ** T.nonce_length;
453		return Self{
	632	return Mac{
454	633	.state = T.State.init(key.*, nonce),
455	634	};
456	635	}
457	636
458	637	/// Add data to the state
459		pub fn update(self: *Self, b: []const u8) void {
	638	pub fn update(self: *Mac, b: []const u8) void {
460	639	self.msg_len += b.len;
461	640
462	641	const len_partial = @min(b.len, block_length - self.off);
...	...	@@ -469,6 +648,10 @@ fn AegisMac(comptime T: type) type {
469	648
470	649	var i = len_partial;
471	650	self.off = 0;
	651	while (i + block_length * 2 <= b.len) : (i += block_length * 2) {
	652	self.state.absorb(b[i..][0..block_length]);
	653	self.state.absorb(b[i..][block_length .. block_length * 2]);
	654	}
472	655	while (i + block_length <= b.len) : (i += block_length) {
473	656	self.state.absorb(b[i..][0..block_length]);
474	657	}
...	...	@@ -479,7 +662,7 @@ fn AegisMac(comptime T: type) type {
479	662	}
480	663
481	664	/// Return an authentication tag for the current state
482		pub fn final(self: Self, out: [mac_length]u8) void {
	665	pub fn final(self: Mac, out: [mac_length]u8) void {
483	666	if (self.off > 0) {
484	667	var pad = [_]u8{0} ** block_length;
485	668	@memcpy(pad[0..self.off], self.buf[0..self.off]);
...	...	@@ -490,20 +673,20 @@ fn AegisMac(comptime T: type) type {
490	673
491	674	/// Return an authentication tag for a message and a key
492	675	pub fn create(out: [mac_length]u8, msg: []const u8, key: const [key_length]u8) void {
493		var ctx = Self.init(key);
	676	var ctx = Mac.init(key);
494	677	ctx.update(msg);
495	678	ctx.final(out);
496	679	}
497	680
498	681	pub const Error = error{};
499		pub const Writer = std.io.Writer(*Self, Error, write);
	682	pub const Writer = std.io.Writer(*Mac, Error, write);
500	683
501		fn write(self: *Self, bytes: []const u8) Error!usize {
	684	fn write(self: *Mac, bytes: []const u8) Error!usize {
502	685	self.update(bytes);
503	686	return bytes.len;
504	687	}
505	688
506		pub fn writer(self: *Self) Writer {
	689	pub fn writer(self: *Mac) Writer {
507	690	return .{ .context = self };
508	691	}
509	692	};
...	...	@@ -568,6 +751,23 @@ test "Aegis128L test vector 3" {
568	751	try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag);
569	752	}
570	753
	754	test "Aegis128X2 test vector 1" {
	755	const key: [Aegis128X2.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
	756	const nonce: [Aegis128X2.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
	757	var empty = [_]u8{};
	758	var tag: [Aegis128X2.tag_length]u8 = undefined;
	759	var tag256: [Aegis128X2_256.tag_length]u8 = undefined;
	760
	761	Aegis128X2.encrypt(&empty, &tag, &empty, &empty, nonce, key);
	762	Aegis128X2_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
	763	try htest.assertEqual("63117dc57756e402819a82e13eca8379", &tag);
	764	try htest.assertEqual("b92c71fdbd358b8a4de70b27631ace90cffd9b9cfba82028412bac41b4f53759", &tag256);
	765	tag[0] +%= 1;
	766	try testing.expectError(error.AuthenticationFailed, Aegis128X2.decrypt(&empty, &empty, tag, &empty, nonce, key));
	767	tag256[0] +%= 1;
	768	try testing.expectError(error.AuthenticationFailed, Aegis128X2_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
	769	}
	770
571	771	test "Aegis256 test vector 1" {
572	772	const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ [_]u8{0x00} ** 30;
573	773	const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ [_]u8{0x00} ** 29;
...	...	@@ -624,6 +824,23 @@ test "Aegis256 test vector 3" {
624	824	try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag);
625	825	}
626	826
	827	test "Aegis256X4 test vector 1" {
	828	const key: [Aegis256X4.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
	829	const nonce: [Aegis256X4.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
	830	var empty = [_]u8{};
	831	var tag: [Aegis256X4.tag_length]u8 = undefined;
	832	var tag256: [Aegis256X4_256.tag_length]u8 = undefined;
	833
	834	Aegis256X4.encrypt(&empty, &tag, &empty, &empty, nonce, key);
	835	Aegis256X4_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
	836	try htest.assertEqual("3b7fee6cee7bf17888ad11ed2397beb4", &tag);
	837	try htest.assertEqual("6093a1a8aab20ec635dc1ca71745b01b5bec4fc444c9ffbebd710d4a34d20eaf", &tag256);
	838	tag[0] +%= 1;
	839	try testing.expectError(error.AuthenticationFailed, Aegis256X4.decrypt(&empty, &empty, tag, &empty, nonce, key));
	840	tag256[0] +%= 1;
	841	try testing.expectError(error.AuthenticationFailed, Aegis256X4_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
	842	}
	843
627	844	test "Aegis MAC" {
628	845	const key = [_]u8{0x00} ** Aegis128LMac.key_length;
629	846	var msg: [64]u8 = undefined;

lib/std/crypto/aes.zig+1

...	...	@@ -22,6 +22,7 @@ pub const has_hardware_support =
22	22	(builtin.cpu.arch == .aarch64 and has_armaes);
23	23
24	24	pub const Block = impl.Block;
	25	pub const BlockVec = impl.BlockVec;
25	26	pub const AesEncryptCtx = impl.AesEncryptCtx;
26	27	pub const AesDecryptCtx = impl.AesDecryptCtx;
27	28	pub const Aes128 = impl.Aes128;

lib/std/crypto/aes/aesni.zig+158-12

...	...	@@ -2,18 +2,23 @@ const std = @import("../../std.zig");
2	2	const builtin = @import("builtin");
3	3	const mem = std.mem;
4	4	const debug = std.debug;
5		const BlockVec = @Vector(2, u64);
	5
	6	const has_vaes = builtin.cpu.arch == .x86_64 and std.Target.x86.featureSetHas(builtin.cpu.features, .vaes);
	7	const has_avx512f = builtin.cpu.arch == .x86_64 and std.Target.x86.featureSetHas(builtin.cpu.features, .avx512f);
6	8
7	9	/// A single AES block.
8	10	pub const Block = struct {
	11	const Repr = @Vector(2, u64);
	12
	13	/// The length of an AES block in bytes.
9	14	pub const block_length: usize = 16;
10	15
11	16	/// Internal representation of a block.
12		repr: BlockVec,
	17	repr: Repr,
13	18
14	19	/// Convert a byte sequence into an internal representation.
15	20	pub inline fn fromBytes(bytes: *const [16]u8) Block {
16		const repr = mem.bytesToValue(BlockVec, bytes);
	21	const repr = mem.bytesToValue(Repr, bytes);
17	22	return Block{ .repr = repr };
18	23	}
19	24
...	...	@@ -33,7 +38,7 @@ pub const Block = struct {
33	38	return Block{
34	39	.repr = asm (
35	40	\\ vaesenc %[rk], %[in], %[out]
36		: [out] "=x" (-> BlockVec),
	41	: [out] "=x" (-> Repr),
37	42	: [in] "x" (block.repr),
38	43	[rk] "x" (round_key.repr),
39	44	),
...	...	@@ -45,7 +50,7 @@ pub const Block = struct {
45	50	return Block{
46	51	.repr = asm (
47	52	\\ vaesenclast %[rk], %[in], %[out]
48		: [out] "=x" (-> BlockVec),
	53	: [out] "=x" (-> Repr),
49	54	: [in] "x" (block.repr),
50	55	[rk] "x" (round_key.repr),
51	56	),
...	...	@@ -57,7 +62,7 @@ pub const Block = struct {
57	62	return Block{
58	63	.repr = asm (
59	64	\\ vaesdec %[rk], %[in], %[out]
60		: [out] "=x" (-> BlockVec),
	65	: [out] "=x" (-> Repr),
61	66	: [in] "x" (block.repr),
62	67	[rk] "x" (inv_round_key.repr),
63	68	),
...	...	@@ -69,7 +74,7 @@ pub const Block = struct {
69	74	return Block{
70	75	.repr = asm (
71	76	\\ vaesdeclast %[rk], %[in], %[out]
72		: [out] "=x" (-> BlockVec),
	77	: [out] "=x" (-> Repr),
73	78	: [in] "x" (block.repr),
74	79	[rk] "x" (inv_round_key.repr),
75	80	),
...	...	@@ -168,17 +173,158 @@ pub const Block = struct {
168	173	};
169	174	};
170	175
	176	/// A fixed-size vector of AES blocks.
	177	/// All operations are performed in parallel, using SIMD instructions when available.
	178	pub fn BlockVec(comptime blocks_count: comptime_int) type {
	179	return struct {
	180	const Self = @This();
	181
	182	/// The number of AES blocks the target architecture can process with a single instruction.
	183	pub const native_vector_size = w: {
	184	if (has_avx512f and blocks_count % 4 == 0) break :w 4;
	185	if (has_vaes and blocks_count % 2 == 0) break :w 2;
	186	break :w 1;
	187	};
	188
	189	/// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
	190	pub const native_word_size = native_vector_size * 16;
	191
	192	const native_words = blocks_count / native_vector_size;
	193
	194	const Repr = @Vector(native_vector_size * 2, u64);
	195
	196	/// Internal representation of a block vector.
	197	repr: [native_words]Repr,
	198
	199	/// Length of the block vector in bytes.
	200	pub const block_length: usize = blocks_count * 16;
	201
	202	/// Convert a byte sequence into an internal representation.
	203	pub inline fn fromBytes(bytes: const [blocks_count 16]u8) Self {
	204	var out: Self = undefined;
	205	inline for (0..native_words) \|i\| {
	206	out.repr[i] = mem.bytesToValue(Repr, bytes[i * native_word_size ..][0..native_word_size]);
	207	}
	208	return out;
	209	}
	210
	211	/// Convert the internal representation of a block vector into a byte sequence.
	212	pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
	213	var out: [blocks_count * 16]u8 = undefined;
	214	inline for (0..native_words) \|i\| {
	215	out[i * native_word_size ..][0..native_word_size].* = mem.toBytes(block_vec.repr[i]);
	216	}
	217	return out;
	218	}
	219
	220	/// XOR the block vector with a byte sequence.
	221	pub inline fn xorBytes(block_vec: Self, bytes: const [blocks_count 16]u8) [blocks_count * 16]u8 {
	222	var x: Self = undefined;
	223	inline for (0..native_words) \|i\| {
	224	x.repr[i] = block_vec.repr[i] ^ mem.bytesToValue(Repr, bytes[i * native_word_size ..][0..native_word_size]);
	225	}
	226	return x.toBytes();
	227	}
	228
	229	/// Apply the forward AES operation to the block vector with a vector of round keys.
	230	pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
	231	var out: Self = undefined;
	232	inline for (0..native_words) \|i\| {
	233	out.repr[i] = asm (
	234	\\ vaesenc %[rk], %[in], %[out]
	235	: [out] "=x" (-> Repr),
	236	: [in] "x" (block_vec.repr[i]),
	237	[rk] "x" (round_key_vec.repr[i]),
	238	);
	239	}
	240	return out;
	241	}
	242
	243	/// Apply the forward AES operation to the block vector with a vector of last round keys.
	244	pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
	245	var out: Self = undefined;
	246	inline for (0..native_words) \|i\| {
	247	out.repr[i] = asm (
	248	\\ vaesenclast %[rk], %[in], %[out]
	249	: [out] "=x" (-> Repr),
	250	: [in] "x" (block_vec.repr[i]),
	251	[rk] "x" (round_key_vec.repr[i]),
	252	);
	253	}
	254	return out;
	255	}
	256
	257	/// Apply the inverse AES operation to the block vector with a vector of round keys.
	258	pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
	259	var out: Self = undefined;
	260	inline for (0..native_words) \|i\| {
	261	out.repr[i] = asm (
	262	\\ vaesdec %[rk], %[in], %[out]
	263	: [out] "=x" (-> Repr),
	264	: [in] "x" (block_vec.repr[i]),
	265	[rk] "x" (inv_round_key_vec.repr[i]),
	266	);
	267	}
	268	return out;
	269	}
	270
	271	/// Apply the inverse AES operation to the block vector with a vector of last round keys.
	272	pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
	273	var out: Self = undefined;
	274	inline for (0..native_words) \|i\| {
	275	out.repr[i] = asm (
	276	\\ vaesdeclast %[rk], %[in], %[out]
	277	: [out] "=x" (-> Repr),
	278	: [in] "x" (block_vec.repr[i]),
	279	[rk] "x" (inv_round_key_vec.repr[i]),
	280	);
	281	}
	282	return out;
	283	}
	284
	285	/// Apply the bitwise XOR operation to the content of two block vectors.
	286	pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
	287	var out: Self = undefined;
	288	inline for (0..native_words) \|i\| {
	289	out.repr[i] = block_vec1.repr[i] ^ block_vec2.repr[i];
	290	}
	291	return out;
	292	}
	293
	294	/// Apply the bitwise AND operation to the content of two block vectors.
	295	pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
	296	var out: Self = undefined;
	297	inline for (0..native_words) \|i\| {
	298	out.repr[i] = block_vec1.repr[i] & block_vec2.repr[i];
	299	}
	300	return out;
	301	}
	302
	303	/// Apply the bitwise OR operation to the content of two block vectors.
	304	pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
	305	var out: Self = undefined;
	306	inline for (0..native_words) \|i\| {
	307	out.repr[i] = block_vec1.repr[i] \| block_vec2.repr[i];
	308	}
	309	return out;
	310	}
	311	};
	312	}
	313
171	314	fn KeySchedule(comptime Aes: type) type {
172	315	std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
173	316	const rounds = Aes.rounds;
174	317
175	318	return struct {
176	319	const Self = @This();
	320
	321	const Repr = Aes.block.Repr;
	322
177	323	round_keys: [rounds + 1]Block,
178	324
179		fn drc(comptime second: bool, comptime rc: u8, t: BlockVec, tx: BlockVec) BlockVec {
180		var s: BlockVec = undefined;
181		var ts: BlockVec = undefined;
	325	fn drc(comptime second: bool, comptime rc: u8, t: Repr, tx: Repr) Repr {
	326	var s: Repr = undefined;
	327	var ts: Repr = undefined;
182	328	return asm (
183	329	\\ vaeskeygenassist %[rc], %[t], %[s]
184	330	\\ vpslldq $4, %[tx], %[ts]
...	...	@@ -187,7 +333,7 @@ fn KeySchedule(comptime Aes: type) type {
187	333	\\ vpxor %[ts], %[r], %[r]
188	334	\\ vpshufd %[mask], %[s], %[ts]
189	335	\\ vpxor %[ts], %[r], %[r]
190		: [r] "=&x" (-> BlockVec),
	336	: [r] "=&x" (-> Repr),
191	337	[s] "=&x" (s),
192	338	[ts] "=&x" (ts),
193	339	: [rc] "n" (rc),
...	...	@@ -234,7 +380,7 @@ fn KeySchedule(comptime Aes: type) type {
234	380	inv_round_keys[i] = Block{
235	381	.repr = asm (
236	382	\\ vaesimc %[rk], %[inv_rk]
237		: [inv_rk] "=x" (-> BlockVec),
	383	: [inv_rk] "=x" (-> Repr),
238	384	: [rk] "x" (round_keys[rounds - i].repr),
239	385	),
240	386	};

lib/std/crypto/aes/armcrypto.zig+135-20

...	...	@@ -1,18 +1,19 @@
1	1	const std = @import("../../std.zig");
2	2	const mem = std.mem;
3	3	const debug = std.debug;
4		const BlockVec = @Vector(2, u64);
5	4
6	5	/// A single AES block.
7	6	pub const Block = struct {
	7	const Repr = @Vector(2, u64);
	8
8	9	pub const block_length: usize = 16;
9	10
10	11	/// Internal representation of a block.
11		repr: BlockVec,
	12	repr: Repr,
12	13
13	14	/// Convert a byte sequence into an internal representation.
14	15	pub inline fn fromBytes(bytes: *const [16]u8) Block {
15		const repr = mem.bytesToValue(BlockVec, bytes);
	16	const repr = mem.bytesToValue(Repr, bytes);
16	17	return Block{ .repr = repr };
17	18	}
18	19
...	...	@@ -36,7 +37,7 @@ pub const Block = struct {
36	37	\\ mov %[out].16b, %[in].16b
37	38	\\ aese %[out].16b, %[zero].16b
38	39	\\ aesmc %[out].16b, %[out].16b
39		: [out] "=&x" (-> BlockVec),
	40	: [out] "=&x" (-> Repr),
40	41	: [in] "x" (block.repr),
41	42	[zero] "x" (zero),
42	43	)) ^ round_key.repr,
...	...	@@ -49,7 +50,7 @@ pub const Block = struct {
49	50	.repr = (asm (
50	51	\\ mov %[out].16b, %[in].16b
51	52	\\ aese %[out].16b, %[zero].16b
52		: [out] "=&x" (-> BlockVec),
	53	: [out] "=&x" (-> Repr),
53	54	: [in] "x" (block.repr),
54	55	[zero] "x" (zero),
55	56	)) ^ round_key.repr,
...	...	@@ -63,7 +64,7 @@ pub const Block = struct {
63	64	\\ mov %[out].16b, %[in].16b
64	65	\\ aesd %[out].16b, %[zero].16b
65	66	\\ aesimc %[out].16b, %[out].16b
66		: [out] "=&x" (-> BlockVec),
	67	: [out] "=&x" (-> Repr),
67	68	: [in] "x" (block.repr),
68	69	[zero] "x" (zero),
69	70	)) ^ inv_round_key.repr,
...	...	@@ -76,7 +77,7 @@ pub const Block = struct {
76	77	.repr = (asm (
77	78	\\ mov %[out].16b, %[in].16b
78	79	\\ aesd %[out].16b, %[zero].16b
79		: [out] "=&x" (-> BlockVec),
	80	: [out] "=&x" (-> Repr),
80	81	: [in] "x" (block.repr),
81	82	[zero] "x" (zero),
82	83	)) ^ inv_round_key.repr,
...	...	@@ -165,6 +166,118 @@ pub const Block = struct {
165	166	};
166	167	};
167	168
	169	/// A fixed-size vector of AES blocks.
	170	/// All operations are performed in parallel, using SIMD instructions when available.
	171	pub fn BlockVec(comptime blocks_count: comptime_int) type {
	172	return struct {
	173	const Self = @This();
	174
	175	/// The number of AES blocks the target architecture can process with a single instruction.
	176	pub const native_vector_size = 1;
	177
	178	/// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
	179	pub const native_word_size = native_vector_size * 16;
	180
	181	const native_words = blocks_count;
	182
	183	/// Internal representation of a block vector.
	184	repr: [native_words]Block,
	185
	186	/// Length of the block vector in bytes.
	187	pub const block_length: usize = blocks_count * 16;
	188
	189	/// Convert a byte sequence into an internal representation.
	190	pub inline fn fromBytes(bytes: const [blocks_count 16]u8) Self {
	191	var out: Self = undefined;
	192	inline for (0..native_words) \|i\| {
	193	out.repr[i] = Block.fromBytes(bytes[i * native_word_size ..][0..native_word_size]);
	194	}
	195	return out;
	196	}
	197
	198	/// Convert the internal representation of a block vector into a byte sequence.
	199	pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
	200	var out: [blocks_count * 16]u8 = undefined;
	201	inline for (0..native_words) \|i\| {
	202	out[i * native_word_size ..][0..native_word_size].* = block_vec.repr[i].toBytes();
	203	}
	204	return out;
	205	}
	206
	207	/// XOR the block vector with a byte sequence.
	208	pub inline fn xorBytes(block_vec: Self, bytes: const [blocks_count 16]u8) [32]u8 {
	209	var out: Self = undefined;
	210	inline for (0..native_words) \|i\| {
	211	out.repr[i] = block_vec.repr[i].xorBytes(bytes[i * native_word_size ..][0..native_word_size]);
	212	}
	213	return out;
	214	}
	215
	216	/// Apply the forward AES operation to the block vector with a vector of round keys.
	217	pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
	218	var out: Self = undefined;
	219	inline for (0..native_words) \|i\| {
	220	out.repr[i] = block_vec.repr[i].encrypt(round_key_vec.repr[i]);
	221	}
	222	return out;
	223	}
	224
	225	/// Apply the forward AES operation to the block vector with a vector of last round keys.
	226	pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
	227	var out: Self = undefined;
	228	inline for (0..native_words) \|i\| {
	229	out.repr[i] = block_vec.repr[i].encryptLast(round_key_vec.repr[i]);
	230	}
	231	return out;
	232	}
	233
	234	/// Apply the inverse AES operation to the block vector with a vector of round keys.
	235	pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
	236	var out: Self = undefined;
	237	inline for (0..native_words) \|i\| {
	238	out.repr[i] = block_vec.repr[i].decrypt(inv_round_key_vec.repr[i]);
	239	}
	240	return out;
	241	}
	242
	243	/// Apply the inverse AES operation to the block vector with a vector of last round keys.
	244	pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
	245	var out: Self = undefined;
	246	inline for (0..native_words) \|i\| {
	247	out.repr[i] = block_vec.repr[i].decryptLast(inv_round_key_vec.repr[i]);
	248	}
	249	return out;
	250	}
	251
	252	/// Apply the bitwise XOR operation to the content of two block vectors.
	253	pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
	254	var out: Self = undefined;
	255	inline for (0..native_words) \|i\| {
	256	out.repr[i] = block_vec1.repr[i].xorBlocks(block_vec2.repr[i]);
	257	}
	258	return out;
	259	}
	260
	261	/// Apply the bitwise AND operation to the content of two block vectors.
	262	pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
	263	var out: Self = undefined;
	264	inline for (0..native_words) \|i\| {
	265	out.repr[i] = block_vec1.repr[i].andBlocks(block_vec2.repr[i]);
	266	}
	267	return out;
	268	}
	269
	270	/// Apply the bitwise OR operation to the content of two block vectors.
	271	pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
	272	var out: Self = undefined;
	273	inline for (0..native_words) \|i\| {
	274	out.repr[i] = block_vec1.repr[i].orBlocks(block_vec2.repr[i]);
	275	}
	276	return out;
	277	}
	278	};
	279	}
	280
168	281	fn KeySchedule(comptime Aes: type) type {
169	282	std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
170	283	const rounds = Aes.rounds;
...	...	@@ -172,17 +285,19 @@ fn KeySchedule(comptime Aes: type) type {
172	285	return struct {
173	286	const Self = @This();
174	287
	288	const Repr = Aes.block.Repr;
	289
175	290	const zero = @Vector(2, u64){ 0, 0 };
176	291	const mask1 = @Vector(16, u8){ 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12 };
177	292	const mask2 = @Vector(16, u8){ 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15, 12, 13, 14, 15 };
178	293
179	294	round_keys: [rounds + 1]Block,
180	295
181		fn drc128(comptime rc: u8, t: BlockVec) BlockVec {
182		var v1: BlockVec = undefined;
183		var v2: BlockVec = undefined;
184		var v3: BlockVec = undefined;
185		var v4: BlockVec = undefined;
	296	fn drc128(comptime rc: u8, t: Repr) Repr {
	297	var v1: Repr = undefined;
	298	var v2: Repr = undefined;
	299	var v3: Repr = undefined;
	300	var v4: Repr = undefined;
186	301
187	302	return asm (
188	303	\\ movi %[v2].4s, %[rc]
...	...	@@ -196,7 +311,7 @@ fn KeySchedule(comptime Aes: type) type {
196	311	\\ eor %[v1].16b, %[v1].16b, %[r].16b
197	312	\\ eor %[r].16b, %[v1].16b, %[v3].16b
198	313	\\ eor %[r].16b, %[r].16b, %[v4].16b
199		: [r] "=&x" (-> BlockVec),
	314	: [r] "=&x" (-> Repr),
200	315	[v1] "=&x" (v1),
201	316	[v2] "=&x" (v2),
202	317	[v3] "=&x" (v3),
...	...	@@ -208,11 +323,11 @@ fn KeySchedule(comptime Aes: type) type {
208	323	);
209	324	}
210	325
211		fn drc256(comptime second: bool, comptime rc: u8, t: BlockVec, tx: BlockVec) BlockVec {
212		var v1: BlockVec = undefined;
213		var v2: BlockVec = undefined;
214		var v3: BlockVec = undefined;
215		var v4: BlockVec = undefined;
	326	fn drc256(comptime second: bool, comptime rc: u8, t: Repr, tx: Repr) Repr {
	327	var v1: Repr = undefined;
	328	var v2: Repr = undefined;
	329	var v3: Repr = undefined;
	330	var v4: Repr = undefined;
216	331
217	332	return asm (
218	333	\\ movi %[v2].4s, %[rc]
...	...	@@ -226,7 +341,7 @@ fn KeySchedule(comptime Aes: type) type {
226	341	\\ eor %[v1].16b, %[v1].16b, %[v2].16b
227	342	\\ eor %[v1].16b, %[v1].16b, %[v3].16b
228	343	\\ eor %[r].16b, %[v1].16b, %[v4].16b
229		: [r] "=&x" (-> BlockVec),
	344	: [r] "=&x" (-> Repr),
230	345	[v1] "=&x" (v1),
231	346	[v2] "=&x" (v2),
232	347	[v3] "=&x" (v3),
...	...	@@ -276,7 +391,7 @@ fn KeySchedule(comptime Aes: type) type {
276	391	inv_round_keys[i] = Block{
277	392	.repr = asm (
278	393	\\ aesimc %[inv_rk].16b, %[rk].16b
279		: [inv_rk] "=x" (-> BlockVec),
	394	: [inv_rk] "=x" (-> Repr),
280	395	: [rk] "x" (round_keys[rounds - i].repr),
281	396	),
282	397	};

lib/std/crypto/aes/soft.zig+132-19

...	...	@@ -2,16 +2,16 @@ const std = @import("../../std.zig");
2	2	const math = std.math;
3	3	const mem = std.mem;
4	4
5		const BlockVec = [4]u32;
6
7	5	const side_channels_mitigations = std.options.side_channels_mitigations;
8	6
9	7	/// A single AES block.
10	8	pub const Block = struct {
	9	const Repr = [4]u32;
	10
11	11	pub const block_length: usize = 16;
12	12
13	13	/// Internal representation of a block.
14		repr: BlockVec align(16),
	14	repr: Repr align(16),
15	15
16	16	/// Convert a byte sequence into an internal representation.
17	17	pub inline fn fromBytes(bytes: *const [16]u8) Block {
...	...	@@ -19,7 +19,7 @@ pub const Block = struct {
19	19	const s1 = mem.readInt(u32, bytes[4..8], .little);
20	20	const s2 = mem.readInt(u32, bytes[8..12], .little);
21	21	const s3 = mem.readInt(u32, bytes[12..16], .little);
22		return Block{ .repr = BlockVec{ s0, s1, s2, s3 } };
	22	return Block{ .repr = Repr{ s0, s1, s2, s3 } };
23	23	}
24	24
25	25	/// Convert the internal representation of a block into a byte sequence.
...	...	@@ -65,7 +65,7 @@ pub const Block = struct {
65	65	t2 ^= round_key.repr[2];
66	66	t3 ^= round_key.repr[3];
67	67
68		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	68	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
69	69	}
70	70
71	71	/// Encrypt a block with a round key WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS
...	...	@@ -110,7 +110,7 @@ pub const Block = struct {
110	110	t2 ^= round_key.repr[2];
111	111	t3 ^= round_key.repr[3];
112	112
113		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	113	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
114	114	}
115	115
116	116	/// Encrypt a block with the last round key.
...	...	@@ -136,7 +136,7 @@ pub const Block = struct {
136	136	t2 ^= round_key.repr[2];
137	137	t3 ^= round_key.repr[3];
138	138
139		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	139	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
140	140	}
141	141
142	142	/// Decrypt a block with a round key.
...	...	@@ -161,7 +161,7 @@ pub const Block = struct {
161	161	t2 ^= round_key.repr[2];
162	162	t3 ^= round_key.repr[3];
163	163
164		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	164	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
165	165	}
166	166
167	167	/// Decrypt a block with a round key WITHOUT ANY PROTECTION AGAINST SIDE CHANNELS
...	...	@@ -206,7 +206,7 @@ pub const Block = struct {
206	206	t2 ^= round_key.repr[2];
207	207	t3 ^= round_key.repr[3];
208	208
209		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	209	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
210	210	}
211	211
212	212	/// Decrypt a block with the last round key.
...	...	@@ -232,12 +232,12 @@ pub const Block = struct {
232	232	t2 ^= round_key.repr[2];
233	233	t3 ^= round_key.repr[3];
234	234
235		return Block{ .repr = BlockVec{ t0, t1, t2, t3 } };
	235	return Block{ .repr = Repr{ t0, t1, t2, t3 } };
236	236	}
237	237
238	238	/// Apply the bitwise XOR operation to the content of two blocks.
239	239	pub inline fn xorBlocks(block1: Block, block2: Block) Block {
240		var x: BlockVec = undefined;
	240	var x: Repr = undefined;
241	241	comptime var i = 0;
242	242	inline while (i < 4) : (i += 1) {
243	243	x[i] = block1.repr[i] ^ block2.repr[i];
...	...	@@ -247,7 +247,7 @@ pub const Block = struct {
247	247
248	248	/// Apply the bitwise AND operation to the content of two blocks.
249	249	pub inline fn andBlocks(block1: Block, block2: Block) Block {
250		var x: BlockVec = undefined;
	250	var x: Repr = undefined;
251	251	comptime var i = 0;
252	252	inline while (i < 4) : (i += 1) {
253	253	x[i] = block1.repr[i] & block2.repr[i];
...	...	@@ -257,7 +257,7 @@ pub const Block = struct {
257	257
258	258	/// Apply the bitwise OR operation to the content of two blocks.
259	259	pub inline fn orBlocks(block1: Block, block2: Block) Block {
260		var x: BlockVec = undefined;
	260	var x: Repr = undefined;
261	261	comptime var i = 0;
262	262	inline while (i < 4) : (i += 1) {
263	263	x[i] = block1.repr[i] \| block2.repr[i];
...	...	@@ -332,6 +332,118 @@ pub const Block = struct {
332	332	};
333	333	};
334	334
	335	/// A fixed-size vector of AES blocks.
	336	/// All operations are performed in parallel, using SIMD instructions when available.
	337	pub fn BlockVec(comptime blocks_count: comptime_int) type {
	338	return struct {
	339	const Self = @This();
	340
	341	/// The number of AES blocks the target architecture can process with a single instruction.
	342	pub const native_vector_size = 1;
	343
	344	/// The size of the AES block vector that the target architecture can process with a single instruction, in bytes.
	345	pub const native_word_size = native_vector_size * 16;
	346
	347	const native_words = blocks_count;
	348
	349	/// Internal representation of a block vector.
	350	repr: [native_words]Block,
	351
	352	/// Length of the block vector in bytes.
	353	pub const block_length: usize = blocks_count * 16;
	354
	355	/// Convert a byte sequence into an internal representation.
	356	pub inline fn fromBytes(bytes: const [blocks_count 16]u8) Self {
	357	var out: Self = undefined;
	358	for (0..native_words) \|i\| {
	359	out.repr[i] = Block.fromBytes(bytes[i * native_word_size ..][0..native_word_size]);
	360	}
	361	return out;
	362	}
	363
	364	/// Convert the internal representation of a block vector into a byte sequence.
	365	pub inline fn toBytes(block_vec: Self) [blocks_count * 16]u8 {
	366	var out: [blocks_count * 16]u8 = undefined;
	367	for (0..native_words) \|i\| {
	368	out[i * native_word_size ..][0..native_word_size].* = block_vec.repr[i].toBytes();
	369	}
	370	return out;
	371	}
	372
	373	/// XOR the block vector with a byte sequence.
	374	pub inline fn xorBytes(block_vec: Self, bytes: const [blocks_count 16]u8) [32]u8 {
	375	var out: Self = undefined;
	376	for (0..native_words) \|i\| {
	377	out.repr[i] = block_vec.repr[i].xorBytes(bytes[i * native_word_size ..][0..native_word_size]);
	378	}
	379	return out;
	380	}
	381
	382	/// Apply the forward AES operation to the block vector with a vector of round keys.
	383	pub inline fn encrypt(block_vec: Self, round_key_vec: Self) Self {
	384	var out: Self = undefined;
	385	for (0..native_words) \|i\| {
	386	out.repr[i] = block_vec.repr[i].encrypt(round_key_vec.repr[i]);
	387	}
	388	return out;
	389	}
	390
	391	/// Apply the forward AES operation to the block vector with a vector of last round keys.
	392	pub inline fn encryptLast(block_vec: Self, round_key_vec: Self) Self {
	393	var out: Self = undefined;
	394	for (0..native_words) \|i\| {
	395	out.repr[i] = block_vec.repr[i].encryptLast(round_key_vec.repr[i]);
	396	}
	397	return out;
	398	}
	399
	400	/// Apply the inverse AES operation to the block vector with a vector of round keys.
	401	pub inline fn decrypt(block_vec: Self, inv_round_key_vec: Self) Self {
	402	var out: Self = undefined;
	403	for (0..native_words) \|i\| {
	404	out.repr[i] = block_vec.repr[i].decrypt(inv_round_key_vec.repr[i]);
	405	}
	406	return out;
	407	}
	408
	409	/// Apply the inverse AES operation to the block vector with a vector of last round keys.
	410	pub inline fn decryptLast(block_vec: Self, inv_round_key_vec: Self) Self {
	411	var out: Self = undefined;
	412	for (0..native_words) \|i\| {
	413	out.repr[i] = block_vec.repr[i].decryptLast(inv_round_key_vec.repr[i]);
	414	}
	415	return out;
	416	}
	417
	418	/// Apply the bitwise XOR operation to the content of two block vectors.
	419	pub inline fn xorBlocks(block_vec1: Self, block_vec2: Self) Self {
	420	var out: Self = undefined;
	421	for (0..native_words) \|i\| {
	422	out.repr[i] = block_vec1.repr[i].xorBlocks(block_vec2.repr[i]);
	423	}
	424	return out;
	425	}
	426
	427	/// Apply the bitwise AND operation to the content of two block vectors.
	428	pub inline fn andBlocks(block_vec1: Self, block_vec2: Self) Self {
	429	var out: Self = undefined;
	430	for (0..native_words) \|i\| {
	431	out.repr[i] = block_vec1.repr[i].andBlocks(block_vec2.repr[i]);
	432	}
	433	return out;
	434	}
	435
	436	/// Apply the bitwise OR operation to the content of two block vectors.
	437	pub inline fn orBlocks(block_vec1: Self, block_vec2: Block) Self {
	438	var out: Self = undefined;
	439	for (0..native_words) \|i\| {
	440	out.repr[i] = block_vec1.repr[i].orBlocks(block_vec2.repr[i]);
	441	}
	442	return out;
	443	}
	444	};
	445	}
	446
335	447	fn KeySchedule(comptime Aes: type) type {
336	448	std.debug.assert(Aes.rounds == 10 or Aes.rounds == 14);
337	449	const key_length = Aes.key_bits / 8;
...	...	@@ -671,7 +783,7 @@ fn mul(a: u8, b: u8) u8 {
671	783
672	784	const cache_line_bytes = std.atomic.cache_line;
673	785
674		inline fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u8 {
	786	fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u8 {
675	787	if (side_channels_mitigations == .none) {
676	788	return [4]u8{
677	789	sbox[idx0],
...	...	@@ -709,7 +821,7 @@ inline fn sbox_lookup(sbox: *align(64) const [256]u8, idx0: u8, idx1: u8, idx2:
709	821	}
710	822	}
711	823
712		inline fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u32 {
	824	fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8, idx2: u8, idx3: u8) [4]u32 {
713	825	if (side_channels_mitigations == .none) {
714	826	return [4]u32{
715	827	table[0][idx0],
...	...	@@ -718,17 +830,18 @@ inline fn table_lookup(table: *align(64) const [4][256]u32, idx0: u8, idx1: u8,
718	830	table[3][idx3],
719	831	};
720	832	} else {
	833	const table_len: usize = 256;
721	834	const stride = switch (side_channels_mitigations) {
722	835	.none => unreachable,
723		.basic => table[0].len / 4,
724		.medium => @max(1, @min(table[0].len, 2 * cache_line_bytes / 4)),
725		.full => @max(1, @min(table[0].len, cache_line_bytes / 4)),
	836	.basic => table_len / 4,
	837	.medium => @max(1, @min(table_len, 2 * cache_line_bytes / 4)),
	838	.full => @max(1, @min(table_len, cache_line_bytes / 4)),
726	839	};
727	840	const of0 = idx0 % stride;
728	841	const of1 = idx1 % stride;
729	842	const of2 = idx2 % stride;
730	843	const of3 = idx3 % stride;
731		var t: [4][table[0].len / stride]u32 align(64) = undefined;
	844	var t: [4][table_len / stride]u32 align(64) = undefined;
732	845	var i: usize = 0;
733	846	while (i < t[0].len) : (i += 1) {
734	847	const tx = table[0][i * stride ..];

lib/std/crypto/benchmark.zig+8

...	...	@@ -72,6 +72,10 @@ const macs = [_]Crypto{
72	72	Crypto{ .ty = crypto.auth.siphash.SipHash64(1, 3), .name = "siphash-1-3" },
73	73	Crypto{ .ty = crypto.auth.siphash.SipHash128(2, 4), .name = "siphash128-2-4" },
74	74	Crypto{ .ty = crypto.auth.siphash.SipHash128(1, 3), .name = "siphash128-1-3" },
	75	Crypto{ .ty = crypto.auth.aegis.Aegis128X4Mac, .name = "aegis-128x4 mac" },
	76	Crypto{ .ty = crypto.auth.aegis.Aegis256X4Mac, .name = "aegis-256x4 mac" },
	77	Crypto{ .ty = crypto.auth.aegis.Aegis128X2Mac, .name = "aegis-128x2 mac" },
	78	Crypto{ .ty = crypto.auth.aegis.Aegis256X2Mac, .name = "aegis-256x2 mac" },
75	79	Crypto{ .ty = crypto.auth.aegis.Aegis128LMac, .name = "aegis-128l mac" },
76	80	Crypto{ .ty = crypto.auth.aegis.Aegis256Mac, .name = "aegis-256 mac" },
77	81	Crypto{ .ty = crypto.auth.cmac.CmacAes128, .name = "aes-cmac" },
...	...	@@ -283,7 +287,11 @@ const aeads = [_]Crypto{
283	287	Crypto{ .ty = crypto.aead.chacha_poly.XChaCha20Poly1305, .name = "xchacha20Poly1305" },
284	288	Crypto{ .ty = crypto.aead.chacha_poly.XChaCha8Poly1305, .name = "xchacha8Poly1305" },
285	289	Crypto{ .ty = crypto.aead.salsa_poly.XSalsa20Poly1305, .name = "xsalsa20Poly1305" },
	290	Crypto{ .ty = crypto.aead.aegis.Aegis128X4, .name = "aegis-128x4" },
	291	Crypto{ .ty = crypto.aead.aegis.Aegis128X2, .name = "aegis-128x2" },
286	292	Crypto{ .ty = crypto.aead.aegis.Aegis128L, .name = "aegis-128l" },
	293	Crypto{ .ty = crypto.aead.aegis.Aegis256X4, .name = "aegis-256x4" },
	294	Crypto{ .ty = crypto.aead.aegis.Aegis256X2, .name = "aegis-256x2" },
287	295	Crypto{ .ty = crypto.aead.aegis.Aegis256, .name = "aegis-256" },
288	296	Crypto{ .ty = crypto.aead.aes_gcm.Aes128Gcm, .name = "aes128-gcm" },
289	297	Crypto{ .ty = crypto.aead.aes_gcm.Aes256Gcm, .name = "aes256-gcm" },