1//! AEGIS is a very fast authenticated encryption system built on top of the core AES function.
2//!
3//! The AEGIS-128* variants have a 128 bit key and a 128 bit nonce.
4//! The AEGIS-256* variants have a 256 bit key and a 256 bit nonce.
5//! All of them can compute 128 and 256 bit authentication tags.
6//!
7//! The AEGIS cipher family offers performance that significantly exceeds that of AES-GCM with
8//! hardware support for parallelizable AES block encryption.
9//!
10//! On high-end Intel CPUs with AVX-512 support, AEGIS-128X4 and AEGIS-256X4 are the fastest options.
11//! On other modern server, desktop and mobile CPUs, AEGIS-128X2 and AEGIS-256X2 are usually the fastest options.
12//! AEGIS-128L and AEGIS-256 perform well on a broad range of platforms, including WebAssembly.
13//!
14//! Unlike with AES-GCM, nonces can be safely chosen at random with no practical limit when using AEGIS-256*.
15//! AEGIS-128* also allows for more messages to be safely encrypted when using random nonces.
16//!
17//! Unless the associated data can be fully controled by an adversary, AEGIS is believed to be key-committing,
18//! making it a safer choice than most other AEADs when the key has low entropy, or can be controlled by an attacker.
19//!
20//! Finally, leaking the state does not leak the key.
21//!
22//! https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
23
24const std = @import("std");
25const crypto = std.crypto;
26const mem = std.mem;
27const assert = std.debug.assert;
28const AuthenticationError = crypto.errors.AuthenticationError;
29
30/// AEGIS-128X4 with a 128 bit tag
31pub const Aegis128X4 = Aegis128XGeneric(4, 128);
32/// AEGIS-128X2 with a 128 bit tag
33pub const Aegis128X2 = Aegis128XGeneric(2, 128);
34/// AEGIS-128L with a 128 bit tag
35pub const Aegis128L = Aegis128XGeneric(1, 128);
36
37/// AEGIS-256X4 with a 128 bit tag
38pub const Aegis256X4 = Aegis256XGeneric(4, 128);
39/// AEGIS-256X2 with a 128 bit tag
40pub const Aegis256X2 = Aegis256XGeneric(2, 128);
41/// AEGIS-256 with a 128 bit tag
42pub const Aegis256 = Aegis256XGeneric(1, 128);
43
44/// AEGIS-128X4 with a 256 bit tag
45pub const Aegis128X4_256 = Aegis128XGeneric(4, 256);
46/// AEGIS-128X2 with a 256 bit tag
47pub const Aegis128X2_256 = Aegis128XGeneric(2, 256);
48/// AEGIS-128L with a 256 bit tag
49pub const Aegis128L_256 = Aegis128XGeneric(1, 256);
50
51/// AEGIS-256X4 with a 256 bit tag
52pub const Aegis256X4_256 = Aegis256XGeneric(4, 256);
53/// AEGIS-256X2 with a 256 bit tag
54pub const Aegis256X2_256 = Aegis256XGeneric(2, 256);
55/// AEGIS-256 with a 256 bit tag
56pub const Aegis256_256 = Aegis256XGeneric(1, 256);
57
58/// `inline` to avoid needless binary bloat from generic instantiations since the arguments are
59/// usually comptime-known and the function is a trivial leaf function.
60inline fn repeat16u8(comptime count: usize, part: [16]u8) [16 * count]u8 {
61 const buf: [count][part.len]u8 = @splat(part);
62 const ptr: *const [16 * count]u8 = @ptrCast(&buf);
63 return ptr.*;
64}
65
66fn State128X(comptime degree: u7) type {
67 return struct {
68 const AesBlockVec = crypto.core.aes.BlockVec(degree);
69 const State = @This();
70
71 blocks: [8]AesBlockVec,
72
73 const aes_block_length = AesBlockVec.block_length;
74 const rate = aes_block_length * 2;
75 const alignment = AesBlockVec.native_word_size;
76
77 fn init(key: [16]u8, nonce: [16]u8) State {
78 const c1 = AesBlockVec.fromBytes(&repeat16u8(degree, .{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }));
79 const c2 = AesBlockVec.fromBytes(&repeat16u8(degree, .{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }));
80 const key_block = AesBlockVec.fromBytes(&repeat16u8(degree, key));
81 const nonce_block = AesBlockVec.fromBytes(&repeat16u8(degree, nonce));
82 const blocks = [8]AesBlockVec{
83 key_block.xorBlocks(nonce_block),
84 c1,
85 c2,
86 c1,
87 key_block.xorBlocks(nonce_block),
88 key_block.xorBlocks(c2),
89 key_block.xorBlocks(c1),
90 key_block.xorBlocks(c2),
91 };
92 var state = State{ .blocks = blocks };
93 if (degree > 1) {
94 const context_block = ctx: {
95 var contexts_bytes: [aes_block_length]u8 = @splat(0);
96 for (0..degree) |i| {
97 contexts_bytes[i * 16] = @intCast(i);
98 contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
99 }
100 break :ctx AesBlockVec.fromBytes(&contexts_bytes);
101 };
102 for (0..10) |_| {
103 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
104 state.blocks[7] = state.blocks[7].xorBlocks(context_block);
105 state.update(nonce_block, key_block);
106 }
107 } else {
108 for (0..10) |_| {
109 state.update(nonce_block, key_block);
110 }
111 }
112 return state;
113 }
114
115 fn update(state: *State, d1: AesBlockVec, d2: AesBlockVec) void {
116 const blocks = &state.blocks;
117 const tmp = blocks[7];
118 comptime var i: usize = 7;
119 inline while (i > 0) : (i -= 1) {
120 blocks[i] = blocks[i - 1].encrypt(blocks[i]);
121 }
122 blocks[0] = tmp.encrypt(blocks[0]);
123 blocks[0] = blocks[0].xorBlocks(d1);
124 blocks[4] = blocks[4].xorBlocks(d2);
125 }
126
127 fn absorb(state: *State, src: *const [rate]u8) void {
128 const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
129 const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
130 state.update(msg0, msg1);
131 }
132
133 fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
134 const blocks = &state.blocks;
135 const msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]);
136 const msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]);
137 var tmp0 = msg0.xorBlocks(blocks[6]).xorBlocks(blocks[1]);
138 var tmp1 = msg1.xorBlocks(blocks[2]).xorBlocks(blocks[5]);
139 tmp0 = tmp0.xorBlocks(blocks[2].andBlocks(blocks[3]));
140 tmp1 = tmp1.xorBlocks(blocks[6].andBlocks(blocks[7]));
141 dst[0..aes_block_length].* = tmp0.toBytes();
142 dst[aes_block_length..rate].* = tmp1.toBytes();
143 state.update(msg0, msg1);
144 }
145
146 fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
147 const blocks = &state.blocks;
148 var msg0 = AesBlockVec.fromBytes(src[0..aes_block_length]).xorBlocks(blocks[6]).xorBlocks(blocks[1]);
149 var msg1 = AesBlockVec.fromBytes(src[aes_block_length..rate]).xorBlocks(blocks[2]).xorBlocks(blocks[5]);
150 msg0 = msg0.xorBlocks(blocks[2].andBlocks(blocks[3]));
151 msg1 = msg1.xorBlocks(blocks[6].andBlocks(blocks[7]));
152 dst[0..aes_block_length].* = msg0.toBytes();
153 dst[aes_block_length..rate].* = msg1.toBytes();
154 state.update(msg0, msg1);
155 }
156
157 fn decLast(state: *State, dst: []u8, src: []const u8) void {
158 const blocks = &state.blocks;
159 const z0 = blocks[6].xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
160 const z1 = blocks[2].xorBlocks(blocks[5]).xorBlocks(blocks[6].andBlocks(blocks[7]));
161 var pad: [rate]u8 = @splat(0);
162 pad[0..aes_block_length].* = z0.toBytes();
163 pad[aes_block_length..].* = z1.toBytes();
164 for (pad[0..src.len], src) |*p, x| p.* ^= x;
165 @memcpy(dst, pad[0..src.len]);
166 @memset(pad[src.len..], 0);
167 const msg0 = AesBlockVec.fromBytes(pad[0..aes_block_length]);
168 const msg1 = AesBlockVec.fromBytes(pad[aes_block_length..rate]);
169 state.update(msg0, msg1);
170 }
171
172 fn finalize(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
173 const blocks = &state.blocks;
174 var sizes: [aes_block_length]u8 = undefined;
175 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
176 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
177 for (1..degree) |i| {
178 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
179 }
180 const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[2]);
181 for (0..7) |_| {
182 state.update(tmp, tmp);
183 }
184 switch (tag_bits) {
185 128 => {
186 var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
187 var tag = tag_multi[0..16].*;
188 @memcpy(tag[0..], tag_multi[0..16]);
189 for (1..degree) |d| {
190 for (0..16) |i| {
191 tag[i] ^= tag_multi[d * 16 + i];
192 }
193 }
194 return tag;
195 },
196 256 => {
197 const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
198 const tag_multi_2 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
199 var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
200 for (1..degree) |d| {
201 for (0..16) |i| {
202 tag[i] ^= tag_multi_1[d * 16 + i];
203 tag[i + 16] ^= tag_multi_2[d * 16 + i];
204 }
205 }
206 return tag;
207 },
208 else => unreachable,
209 }
210 }
211
212 fn finalizeMac(state: *State, comptime tag_bits: u9, datalen: usize) [tag_bits / 8]u8 {
213 const blocks = &state.blocks;
214 var sizes: [aes_block_length]u8 = undefined;
215 mem.writeInt(u64, sizes[0..8], @as(u64, datalen) * 8, .little);
216 mem.writeInt(u64, sizes[8..16], tag_bits, .little);
217 for (1..degree) |i| {
218 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
219 }
220 var t = blocks[2].xorBlocks(AesBlockVec.fromBytes(&sizes));
221 for (0..7) |_| {
222 state.update(t, t);
223 }
224 if (degree > 1) {
225 var v: [rate]u8 = @splat(0);
226 switch (tag_bits) {
227 128 => {
228 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
229 for (0..degree / 2) |d| {
230 v[0..16].* = tags[d * 32 ..][0..16].*;
231 v[rate / 2 ..][0..16].* = tags[d * 32 ..][16..32].*;
232 state.absorb(&v);
233 }
234 },
235 256 => {
236 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
237 const tags_1 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
238 for (1..degree) |d| {
239 v[0..16].* = tags_0[d * 16 ..][0..16].*;
240 v[rate / 2 ..][0..16].* = tags_1[d * 16 ..][0..16].*;
241 state.absorb(&v);
242 }
243 },
244 else => unreachable,
245 }
246 mem.writeInt(u64, sizes[0..8], degree, .little);
247 mem.writeInt(u64, sizes[8..16], tag_bits, .little);
248 t = blocks[2].xorBlocks(AesBlockVec.fromBytes(&sizes));
249 for (0..7) |_| {
250 state.update(t, t);
251 }
252 }
253 switch (tag_bits) {
254 128 => {
255 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
256 return tags[0..16].*;
257 },
258 256 => {
259 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
260 const tags_1 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
261 return tags_0[0..16].* ++ tags_1[0..16].*;
262 },
263 else => unreachable,
264 }
265 }
266 };
267}
268
269/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
270///
271/// The 128 bits variants of AEGIS have a 128 bit key and a 128 bit nonce.
272///
273/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
274fn Aegis128XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
275 comptime assert(degree > 0); // degree must be greater than 0
276 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
277
278 return struct {
279 const State = State128X(degree);
280
281 pub const tag_length = tag_bits / 8;
282 pub const nonce_length = 16;
283 pub const key_length = 16;
284 pub const block_length = State.rate;
285
286 const alignment = State.alignment;
287
288 /// c: ciphertext: output buffer should be of size m.len
289 /// tag: authentication tag: output MAC
290 /// m: message
291 /// ad: Associated Data
292 /// npub: public nonce
293 /// k: private key
294 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
295 assert(c.len == m.len);
296 var state = State.init(key, npub);
297 var src: [block_length]u8 align(alignment) = undefined;
298 var dst: [block_length]u8 align(alignment) = undefined;
299 var i: usize = 0;
300 while (i + block_length <= ad.len) : (i += block_length) {
301 state.absorb(ad[i..][0..block_length]);
302 }
303 if (ad.len % block_length != 0) {
304 @memset(src[0..], 0);
305 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
306 state.absorb(&src);
307 }
308 i = 0;
309 while (i + block_length <= m.len) : (i += block_length) {
310 state.enc(c[i..][0..block_length], m[i..][0..block_length]);
311 }
312 if (m.len % block_length != 0) {
313 @memset(src[0..], 0);
314 @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
315 state.enc(&dst, &src);
316 @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
317 }
318 tag.* = state.finalize(tag_bits, ad.len, m.len);
319 }
320
321 /// `m`: Message
322 /// `c`: Ciphertext
323 /// `tag`: Authentication tag
324 /// `ad`: Associated data
325 /// `npub`: Public nonce
326 /// `k`: Private key
327 /// Asserts `c.len == m.len`.
328 ///
329 /// Contents of `m` are undefined if an error is returned.
330 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
331 assert(c.len == m.len);
332 var state = State.init(key, npub);
333 var src: [block_length]u8 align(alignment) = undefined;
334 var i: usize = 0;
335 while (i + block_length <= ad.len) : (i += block_length) {
336 state.absorb(ad[i..][0..block_length]);
337 }
338 if (ad.len % block_length != 0) {
339 @memset(src[0..], 0);
340 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
341 state.absorb(&src);
342 }
343 i = 0;
344 while (i + block_length <= m.len) : (i += block_length) {
345 state.dec(m[i..][0..block_length], c[i..][0..block_length]);
346 }
347 if (m.len % block_length != 0) {
348 state.decLast(m[i..], c[i..]);
349 }
350 var computed_tag = state.finalize(tag_bits, ad.len, m.len);
351 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
352 if (!verify) {
353 crypto.secureZero(u8, &computed_tag);
354 @memset(m, undefined);
355 return error.AuthenticationFailed;
356 }
357 }
358 };
359}
360
361fn State256X(comptime degree: u7) type {
362 return struct {
363 const AesBlockVec = crypto.core.aes.BlockVec(degree);
364 const State = @This();
365
366 blocks: [6]AesBlockVec,
367
368 const aes_block_length = AesBlockVec.block_length;
369 const rate = aes_block_length;
370 const alignment = AesBlockVec.native_word_size;
371
372 fn init(key: [32]u8, nonce: [32]u8) State {
373 const c1 = AesBlockVec.fromBytes(&repeat16u8(degree, .{ 0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1, 0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd }));
374 const c2 = AesBlockVec.fromBytes(&repeat16u8(degree, .{ 0x0, 0x1, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d, 0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62 }));
375 const key_block1 = AesBlockVec.fromBytes(&repeat16u8(degree, key[0..16].*));
376 const key_block2 = AesBlockVec.fromBytes(&repeat16u8(degree, key[16..32].*));
377 const nonce_block1 = AesBlockVec.fromBytes(&repeat16u8(degree, nonce[0..16].*));
378 const nonce_block2 = AesBlockVec.fromBytes(&repeat16u8(degree, nonce[16..32].*));
379 const kxn1 = key_block1.xorBlocks(nonce_block1);
380 const kxn2 = key_block2.xorBlocks(nonce_block2);
381 const blocks = [6]AesBlockVec{
382 kxn1,
383 kxn2,
384 c1,
385 c2,
386 key_block1.xorBlocks(c2),
387 key_block2.xorBlocks(c1),
388 };
389 var state = State{ .blocks = blocks };
390 if (degree > 1) {
391 const context_block = ctx: {
392 var contexts_bytes: [aes_block_length]u8 = @splat(0);
393 for (0..degree) |i| {
394 contexts_bytes[i * 16] = @intCast(i);
395 contexts_bytes[i * 16 + 1] = @intCast(degree - 1);
396 }
397 break :ctx AesBlockVec.fromBytes(&contexts_bytes);
398 };
399 for (0..4) |_| {
400 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
401 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
402 state.update(key_block1);
403 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
404 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
405 state.update(key_block2);
406 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
407 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
408 state.update(kxn1);
409 state.blocks[3] = state.blocks[3].xorBlocks(context_block);
410 state.blocks[5] = state.blocks[5].xorBlocks(context_block);
411 state.update(kxn2);
412 }
413 } else {
414 for (0..4) |_| {
415 state.update(key_block1);
416 state.update(key_block2);
417 state.update(kxn1);
418 state.update(kxn2);
419 }
420 }
421 return state;
422 }
423
424 fn update(state: *State, d: AesBlockVec) void {
425 const blocks = &state.blocks;
426 const tmp = blocks[5].encrypt(blocks[0]);
427 comptime var i: usize = 5;
428 inline while (i > 0) : (i -= 1) {
429 blocks[i] = blocks[i - 1].encrypt(blocks[i]);
430 }
431 blocks[0] = tmp.xorBlocks(d);
432 }
433
434 fn absorb(state: *State, src: *const [rate]u8) void {
435 const msg = AesBlockVec.fromBytes(src);
436 state.update(msg);
437 }
438
439 fn enc(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
440 const blocks = &state.blocks;
441 const msg = AesBlockVec.fromBytes(src);
442 var tmp = msg.xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
443 tmp = tmp.xorBlocks(blocks[2].andBlocks(blocks[3]));
444 dst.* = tmp.toBytes();
445 state.update(msg);
446 }
447
448 fn dec(state: *State, dst: *[rate]u8, src: *const [rate]u8) void {
449 const blocks = &state.blocks;
450 var msg = AesBlockVec.fromBytes(src).xorBlocks(blocks[5]).xorBlocks(blocks[4]).xorBlocks(blocks[1]);
451 msg = msg.xorBlocks(blocks[2].andBlocks(blocks[3]));
452 dst.* = msg.toBytes();
453 state.update(msg);
454 }
455
456 fn decLast(state: *State, dst: []u8, src: []const u8) void {
457 const blocks = &state.blocks;
458 const z = blocks[5].xorBlocks(blocks[4]).xorBlocks(blocks[1]).xorBlocks(blocks[2].andBlocks(blocks[3]));
459 var pad = z.toBytes();
460 for (pad[0..src.len], src) |*p, x| p.* ^= x;
461 @memcpy(dst, pad[0..src.len]);
462 @memset(pad[src.len..], 0);
463 const msg = AesBlockVec.fromBytes(pad[0..]);
464 state.update(msg);
465 }
466
467 fn finalize(state: *State, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
468 const blocks = &state.blocks;
469 var sizes: [aes_block_length]u8 = undefined;
470 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
471 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
472 for (1..degree) |i| {
473 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
474 }
475 const tmp = AesBlockVec.fromBytes(&sizes).xorBlocks(blocks[3]);
476 for (0..7) |_| {
477 state.update(tmp);
478 }
479 switch (tag_bits) {
480 128 => {
481 var tag_multi = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
482 var tag = tag_multi[0..16].*;
483 @memcpy(tag[0..], tag_multi[0..16]);
484 for (1..degree) |d| {
485 for (0..16) |i| {
486 tag[i] ^= tag_multi[d * 16 + i];
487 }
488 }
489 return tag;
490 },
491 256 => {
492 const tag_multi_1 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes();
493 const tag_multi_2 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
494 var tag = tag_multi_1[0..16].* ++ tag_multi_2[0..16].*;
495 for (1..degree) |d| {
496 for (0..16) |i| {
497 tag[i] ^= tag_multi_1[d * 16 + i];
498 tag[i + 16] ^= tag_multi_2[d * 16 + i];
499 }
500 }
501 return tag;
502 },
503 else => unreachable,
504 }
505 }
506
507 fn finalizeMac(state: *State, comptime tag_bits: u9, datalen: usize) [tag_bits / 8]u8 {
508 const blocks = &state.blocks;
509 var sizes: [aes_block_length]u8 = undefined;
510 mem.writeInt(u64, sizes[0..8], @as(u64, datalen) * 8, .little);
511 mem.writeInt(u64, sizes[8..16], tag_bits, .little);
512 for (1..degree) |i| {
513 @memcpy(sizes[i * 16 ..][0..16], sizes[0..16]);
514 }
515 var t = blocks[3].xorBlocks(AesBlockVec.fromBytes(&sizes));
516 for (0..7) |_| {
517 state.update(t);
518 }
519 if (degree > 1) {
520 var v: [rate]u8 = @splat(0);
521 switch (tag_bits) {
522 128 => {
523 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
524 for (1..degree) |d| {
525 v[0..16].* = tags[d * 16 ..][0..16].*;
526 state.absorb(&v);
527 }
528 },
529 256 => {
530 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes();
531 const tags_1 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
532 for (1..degree) |d| {
533 v[0..16].* = tags_0[d * 16 ..][0..16].*;
534 state.absorb(&v);
535 v[0..16].* = tags_1[d * 16 ..][0..16].*;
536 state.absorb(&v);
537 }
538 },
539 else => unreachable,
540 }
541 mem.writeInt(u64, sizes[0..8], degree, .little);
542 mem.writeInt(u64, sizes[8..16], tag_bits, .little);
543 t = blocks[3].xorBlocks(AesBlockVec.fromBytes(&sizes));
544 for (0..7) |_| {
545 state.update(t);
546 }
547 }
548 switch (tag_bits) {
549 128 => {
550 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
551 return tags[0..16].*;
552 },
553 256 => {
554 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).toBytes();
555 const tags_1 = blocks[3].xorBlocks(blocks[4]).xorBlocks(blocks[5]).toBytes();
556 return tags_0[0..16].* ++ tags_1[0..16].*;
557 },
558 else => unreachable,
559 }
560 }
561 };
562}
563
564/// AEGIS is a very fast authenticated encryption system built on top of the core AES function.
565///
566/// The 256 bits variants of AEGIS have a 256 bit key and a 256 bit nonce.
567///
568/// https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
569fn Aegis256XGeneric(comptime degree: u7, comptime tag_bits: u9) type {
570 comptime assert(degree > 0); // degree must be greater than 0
571 comptime assert(tag_bits == 128 or tag_bits == 256); // tag must be 128 or 256 bits
572
573 return struct {
574 const State = State256X(degree);
575
576 pub const tag_length = tag_bits / 8;
577 pub const nonce_length = 32;
578 pub const key_length = 32;
579 pub const block_length = State.rate;
580
581 const alignment = State.alignment;
582
583 /// c: ciphertext: output buffer should be of size m.len
584 /// tag: authentication tag: output MAC
585 /// m: message
586 /// ad: Associated Data
587 /// npub: public nonce
588 /// k: private key
589 pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) void {
590 assert(c.len == m.len);
591 var state = State.init(key, npub);
592 var src: [block_length]u8 align(alignment) = undefined;
593 var dst: [block_length]u8 align(alignment) = undefined;
594 var i: usize = 0;
595 while (i + block_length <= ad.len) : (i += block_length) {
596 state.absorb(ad[i..][0..block_length]);
597 }
598 if (ad.len % block_length != 0) {
599 @memset(src[0..], 0);
600 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
601 state.absorb(&src);
602 }
603 i = 0;
604 while (i + block_length <= m.len) : (i += block_length) {
605 state.enc(c[i..][0..block_length], m[i..][0..block_length]);
606 }
607 if (m.len % block_length != 0) {
608 @memset(src[0..], 0);
609 @memcpy(src[0 .. m.len % block_length], m[i..][0 .. m.len % block_length]);
610 state.enc(&dst, &src);
611 @memcpy(c[i..][0 .. m.len % block_length], dst[0 .. m.len % block_length]);
612 }
613 tag.* = state.finalize(tag_bits, ad.len, m.len);
614 }
615
616 /// `m`: Message
617 /// `c`: Ciphertext
618 /// `tag`: Authentication tag
619 /// `ad`: Associated data
620 /// `npub`: Public nonce
621 /// `k`: Private key
622 /// Asserts `c.len == m.len`.
623 ///
624 /// Contents of `m` are undefined if an error is returned.
625 pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, key: [key_length]u8) AuthenticationError!void {
626 assert(c.len == m.len);
627 var state = State.init(key, npub);
628 var src: [block_length]u8 align(alignment) = undefined;
629 var i: usize = 0;
630 while (i + block_length <= ad.len) : (i += block_length) {
631 state.absorb(ad[i..][0..block_length]);
632 }
633 if (ad.len % block_length != 0) {
634 @memset(src[0..], 0);
635 @memcpy(src[0 .. ad.len % block_length], ad[i..][0 .. ad.len % block_length]);
636 state.absorb(&src);
637 }
638 i = 0;
639 while (i + block_length <= m.len) : (i += block_length) {
640 state.dec(m[i..][0..block_length], c[i..][0..block_length]);
641 }
642 if (m.len % block_length != 0) {
643 state.decLast(m[i..], c[i..]);
644 }
645 var computed_tag = state.finalize(tag_bits, ad.len, m.len);
646 const verify = crypto.timing_safe.eql([tag_length]u8, computed_tag, tag);
647 if (!verify) {
648 crypto.secureZero(u8, &computed_tag);
649 @memset(m, undefined);
650 return error.AuthenticationFailed;
651 }
652 }
653 };
654}
655
656/// The `Aegis128X4Mac` message authentication function outputs 256 bit tags.
657/// In addition to being extremely fast, its large state, non-linearity
658/// and non-invertibility provides the following properties:
659/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
660/// - Recovering the secret key from the state would require ~2^128 attempts,
661/// which is infeasible for any practical adversary.
662/// - It has a large security margin against internal collisions.
663pub const Aegis128X4Mac = AegisMac(Aegis128X4_256);
664
665/// The `Aegis128X2Mac` message authentication function outputs 256 bit tags.
666/// In addition to being extremely fast, its large state, non-linearity
667/// and non-invertibility provides the following properties:
668/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
669/// - Recovering the secret key from the state would require ~2^128 attempts,
670/// which is infeasible for any practical adversary.
671/// - It has a large security margin against internal collisions.
672pub const Aegis128X2Mac = AegisMac(Aegis128X2_256);
673
674/// The `Aegis128LMac` message authentication function outputs 256 bit tags.
675/// In addition to being extremely fast, its large state, non-linearity
676/// and non-invertibility provides the following properties:
677/// - 128 bit security, stronger than GHash/Polyval/Poly1305.
678/// - Recovering the secret key from the state would require ~2^128 attempts,
679/// which is infeasible for any practical adversary.
680/// - It has a large security margin against internal collisions.
681pub const Aegis128LMac = AegisMac(Aegis128L_256);
682
683/// The `Aegis256X4Mac` message authentication function has a 256-bit key size,
684/// and outputs 256 bit tags.
685/// The key size is the main practical difference with `Aegis128X4Mac`.
686/// AEGIS' large state, non-linearity and non-invertibility provides the
687/// following properties:
688/// - 256 bit security against forgery.
689/// - Recovering the secret key from the state would require ~2^256 attempts,
690/// which is infeasible for any practical adversary.
691/// - It has a large security margin against internal collisions.
692pub const Aegis256X4Mac = AegisMac(Aegis256X4_256);
693
694/// The `Aegis256X2Mac` message authentication function has a 256-bit key size,
695/// and outputs 256 bit tags.
696/// The key size is the main practical difference with `Aegis128X2Mac`.
697/// AEGIS' large state, non-linearity and non-invertibility provides the
698/// following properties:
699/// - 256 bit security against forgery.
700/// - Recovering the secret key from the state would require ~2^256 attempts,
701/// which is infeasible for any practical adversary.
702/// - It has a large security margin against internal collisions.
703pub const Aegis256X2Mac = AegisMac(Aegis256X2_256);
704
705/// The `Aegis256Mac` message authentication function has a 256-bit key size,
706/// and outputs 256 bit tags.
707/// The key size is the main practical difference with `Aegis128LMac`.
708/// AEGIS' large state, non-linearity and non-invertibility provides the
709/// following properties:
710/// - 256 bit security against forgery.
711/// - Recovering the secret key from the state would require ~2^256 attempts,
712/// which is infeasible for any practical adversary.
713/// - It has a large security margin against internal collisions.
714pub const Aegis256Mac = AegisMac(Aegis256_256);
715
716/// AEGIS-128X4 MAC with 128-bit tags
717pub const Aegis128X4Mac_128 = AegisMac(Aegis128X4);
718
719/// AEGIS-128X2 MAC with 128-bit tags
720pub const Aegis128X2Mac_128 = AegisMac(Aegis128X2);
721
722/// AEGIS-128L MAC with 128-bit tags
723pub const Aegis128LMac_128 = AegisMac(Aegis128L);
724
725/// AEGIS-256X4 MAC with 128-bit tags
726pub const Aegis256X4Mac_128 = AegisMac(Aegis256X4);
727
728/// AEGIS-256X2 MAC with 128-bit tags
729pub const Aegis256X2Mac_128 = AegisMac(Aegis256X2);
730
731/// AEGIS-256 MAC with 128-bit tags
732pub const Aegis256Mac_128 = AegisMac(Aegis256);
733
734fn AegisMac(comptime T: type) type {
735 return struct {
736 const Mac = @This();
737
738 pub const mac_length = T.tag_length;
739 pub const key_length = T.key_length;
740 pub const nonce_length = T.nonce_length;
741 pub const block_length = T.block_length;
742
743 state: T.State,
744 buf: [block_length]u8 = undefined,
745 off: usize = 0,
746 msg_len: usize = 0,
747
748 /// Initialize a state for the MAC function, with a key and a nonce
749 pub fn initWithNonce(key: *const [key_length]u8, nonce: *const [nonce_length]u8) Mac {
750 return Mac{
751 .state = T.State.init(key.*, nonce.*),
752 };
753 }
754
755 /// Initialize a state for the MAC function, with a default nonce
756 pub fn init(key: *const [key_length]u8) Mac {
757 return .{ .state = .init(key.*, @splat(0)) };
758 }
759
760 /// Add data to the state
761 pub fn update(self: *Mac, b: []const u8) void {
762 self.msg_len += b.len;
763
764 const len_partial = @min(b.len, block_length - self.off);
765 @memcpy(self.buf[self.off..][0..len_partial], b[0..len_partial]);
766 self.off += len_partial;
767 if (self.off < block_length) {
768 return;
769 }
770 self.state.absorb(&self.buf);
771
772 var i = len_partial;
773 self.off = 0;
774 while (i + block_length * 2 <= b.len) : (i += block_length * 2) {
775 self.state.absorb(b[i..][0..block_length]);
776 self.state.absorb(b[i..][block_length .. block_length * 2]);
777 }
778 while (i + block_length <= b.len) : (i += block_length) {
779 self.state.absorb(b[i..][0..block_length]);
780 }
781 if (i != b.len) {
782 self.off = b.len - i;
783 @memcpy(self.buf[0..self.off], b[i..]);
784 }
785 }
786
787 /// Return an authentication tag for the current state
788 pub fn final(self: *Mac, out: *[mac_length]u8) void {
789 if (self.off > 0) {
790 var pad: [block_length]u8 = @splat(0);
791 @memcpy(pad[0..self.off], self.buf[0..self.off]);
792 self.state.absorb(&pad);
793 }
794 out.* = self.state.finalizeMac(T.tag_length * 8, self.msg_len);
795 }
796
797 /// Return an authentication tag for a message, a key and a nonce
798 pub fn createWithNonce(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8, nonce: *const [nonce_length]u8) void {
799 var ctx = Mac.initWithNonce(key, nonce);
800 ctx.update(msg);
801 ctx.final(out);
802 }
803
804 /// Return an authentication tag for a message and a key
805 pub fn create(out: *[mac_length]u8, msg: []const u8, key: *const [key_length]u8) void {
806 var ctx = Mac.init(key);
807 ctx.update(msg);
808 ctx.final(out);
809 }
810 };
811}
812
813const htest = @import("test.zig");
814const testing = std.testing;
815
816test "Aegis128L test vector 1" {
817 const key: [Aegis128L.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ @as([14]u8, @splat(0x00));
818 const nonce: [Aegis128L.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ @as([13]u8, @splat(0x00));
819 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
820 const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
821 var c: [m.len]u8 = undefined;
822 var m2: [m.len]u8 = undefined;
823 var tag: [Aegis128L.tag_length]u8 = undefined;
824
825 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
826 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
827 try testing.expectEqualSlices(u8, &m, &m2);
828
829 try htest.assertEqual("79d94593d8c2119d7e8fd9b8fc77845c5c077a05b2528b6ac54b563aed8efe84", &c);
830 try htest.assertEqual("cc6f3372f6aa1bb82388d695c3962d9a", &tag);
831
832 c[0] +%= 1;
833 try testing.expectError(error.AuthenticationFailed, Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key));
834 c[0] -%= 1;
835 tag[0] +%= 1;
836 try testing.expectError(error.AuthenticationFailed, Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key));
837}
838
839test "Aegis128L test vector 2" {
840 const key: [Aegis128L.key_length]u8 = @splat(0x00);
841 const nonce: [Aegis128L.nonce_length]u8 = @splat(0x00);
842 const ad: [0]u8 = .{};
843 const m: [16]u8 = @splat(0x00);
844 var c: [m.len]u8 = undefined;
845 var m2: [m.len]u8 = undefined;
846 var tag: [Aegis128L.tag_length]u8 = undefined;
847
848 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
849 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
850 try testing.expectEqualSlices(u8, &m, &m2);
851
852 try htest.assertEqual("41de9000a7b5e40e2d68bb64d99ebb19", &c);
853 try htest.assertEqual("f4d997cc9b94227ada4fe4165422b1c8", &tag);
854}
855
856test "Aegis128L test vector 3" {
857 const key: [Aegis128L.key_length]u8 = @splat(0x00);
858 const nonce: [Aegis128L.nonce_length]u8 = @splat(0x00);
859 const ad = [_]u8{};
860 const m = [_]u8{};
861 var c: [m.len]u8 = undefined;
862 var m2: [m.len]u8 = undefined;
863 var tag: [Aegis128L.tag_length]u8 = undefined;
864
865 Aegis128L.encrypt(&c, &tag, &m, &ad, nonce, key);
866 try Aegis128L.decrypt(&m2, &c, tag, &ad, nonce, key);
867 try testing.expectEqualSlices(u8, &m, &m2);
868
869 try htest.assertEqual("83cc600dc4e3e7e62d4055826174f149", &tag);
870}
871
872test "Aegis128X2 test vector 1" {
873 const key: [Aegis128X2.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
874 const nonce: [Aegis128X2.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
875 var empty = [_]u8{};
876 var tag: [Aegis128X2.tag_length]u8 = undefined;
877 var tag256: [Aegis128X2_256.tag_length]u8 = undefined;
878
879 Aegis128X2.encrypt(&empty, &tag, &empty, &empty, nonce, key);
880 Aegis128X2_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
881 try htest.assertEqual("63117dc57756e402819a82e13eca8379", &tag);
882 try htest.assertEqual("b92c71fdbd358b8a4de70b27631ace90cffd9b9cfba82028412bac41b4f53759", &tag256);
883 tag[0] +%= 1;
884 try testing.expectError(error.AuthenticationFailed, Aegis128X2.decrypt(&empty, &empty, tag, &empty, nonce, key));
885 tag256[0] +%= 1;
886 try testing.expectError(error.AuthenticationFailed, Aegis128X2_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
887}
888
889test "Aegis256 test vector 1" {
890 const key: [Aegis256.key_length]u8 = [_]u8{ 0x10, 0x01 } ++ @as([30]u8, @splat(0x00));
891 const nonce: [Aegis256.nonce_length]u8 = [_]u8{ 0x10, 0x00, 0x02 } ++ @as([29]u8, @splat(0x00));
892 const ad = [8]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 };
893 const m = [32]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
894 var c: [m.len]u8 = undefined;
895 var m2: [m.len]u8 = undefined;
896 var tag: [Aegis256.tag_length]u8 = undefined;
897
898 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
899 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
900 try testing.expectEqualSlices(u8, &m, &m2);
901
902 try htest.assertEqual("f373079ed84b2709faee373584585d60accd191db310ef5d8b11833df9dec711", &c);
903 try htest.assertEqual("8d86f91ee606e9ff26a01b64ccbdd91d", &tag);
904
905 c[0] +%= 1;
906 try testing.expectError(error.AuthenticationFailed, Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key));
907 c[0] -%= 1;
908 tag[0] +%= 1;
909 try testing.expectError(error.AuthenticationFailed, Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key));
910}
911
912test "Aegis256 test vector 2" {
913 const key: [Aegis256.key_length]u8 = @splat(0x00);
914 const nonce: [Aegis256.nonce_length]u8 = @splat(0x00);
915 const ad = [_]u8{};
916 const m: [16]u8 = @splat(0x00);
917 var c: [m.len]u8 = undefined;
918 var m2: [m.len]u8 = undefined;
919 var tag: [Aegis256.tag_length]u8 = undefined;
920
921 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
922 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
923 try testing.expectEqualSlices(u8, &m, &m2);
924
925 try htest.assertEqual("b98f03a947807713d75a4fff9fc277a6", &c);
926 try htest.assertEqual("478f3b50dc478ef7d5cf2d0f7cc13180", &tag);
927}
928
929test "Aegis256 test vector 3" {
930 const key: [Aegis256.key_length]u8 = @splat(0x00);
931 const nonce: [Aegis256.nonce_length]u8 = @splat(0x00);
932 const ad = [_]u8{};
933 const m = [_]u8{};
934 var c: [m.len]u8 = undefined;
935 var m2: [m.len]u8 = undefined;
936 var tag: [Aegis256.tag_length]u8 = undefined;
937
938 Aegis256.encrypt(&c, &tag, &m, &ad, nonce, key);
939 try Aegis256.decrypt(&m2, &c, tag, &ad, nonce, key);
940 try testing.expectEqualSlices(u8, &m, &m2);
941
942 try htest.assertEqual("f7a0878f68bd083e8065354071fc27c3", &tag);
943}
944
945test "Aegis256X4 test vector 1" {
946 const key: [Aegis256X4.key_length]u8 = [_]u8{ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
947 const nonce: [Aegis256X4.nonce_length]u8 = [_]u8{ 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
948 var empty = [_]u8{};
949 var tag: [Aegis256X4.tag_length]u8 = undefined;
950 var tag256: [Aegis256X4_256.tag_length]u8 = undefined;
951
952 Aegis256X4.encrypt(&empty, &tag, &empty, &empty, nonce, key);
953 Aegis256X4_256.encrypt(&empty, &tag256, &empty, &empty, nonce, key);
954 try htest.assertEqual("3b7fee6cee7bf17888ad11ed2397beb4", &tag);
955 try htest.assertEqual("6093a1a8aab20ec635dc1ca71745b01b5bec4fc444c9ffbebd710d4a34d20eaf", &tag256);
956 tag[0] +%= 1;
957 try testing.expectError(error.AuthenticationFailed, Aegis256X4.decrypt(&empty, &empty, tag, &empty, nonce, key));
958 tag256[0] +%= 1;
959 try testing.expectError(error.AuthenticationFailed, Aegis256X4_256.decrypt(&empty, &empty, tag256, &empty, nonce, key));
960}
961
962test "Aegis MAC" {
963 const key: [Aegis128LMac.key_length]u8 = @splat(0x00);
964 var msg: [64]u8 = undefined;
965 for (&msg, 0..) |*m, i| {
966 m.* = @as(u8, @truncate(i));
967 }
968 const st_init = Aegis128LMac.init(&key);
969 var st = st_init;
970 var tag: [Aegis128LMac.mac_length]u8 = undefined;
971
972 st.update(msg[0..32]);
973 st.update(msg[32..]);
974 st.final(&tag);
975 try htest.assertEqual("f5eb88d90b7d31c9a679eb94ed1374cd14816b19cdb77930d1a5158f8595983b", &tag);
976
977 st = st_init;
978 st.update(msg[0..31]);
979 st.update(msg[31..]);
980 st.final(&tag);
981 try htest.assertEqual("f5eb88d90b7d31c9a679eb94ed1374cd14816b19cdb77930d1a5158f8595983b", &tag);
982
983 st = st_init;
984 st.update(msg[0..14]);
985 st.update(msg[14..30]);
986 st.update(msg[30..]);
987 st.final(&tag);
988 try htest.assertEqual("f5eb88d90b7d31c9a679eb94ed1374cd14816b19cdb77930d1a5158f8595983b", &tag);
989
990 // An update whose size is not a multiple of the block size
991 st = st_init;
992 st.update(msg[0..33]);
993 st.final(&tag);
994 try htest.assertEqual("07b3ba5ad9ceee5ef1906e3396f0fa540fbcd2f33833ef97c35bdc2ae9ae0535", &tag);
995}
996
997test "AEGISMAC-128* test vectors" {
998 const key = [_]u8{ 0x10, 0x01 } ++ @as([16 - 2]u8, @splat(0x00));
999 const nonce = [_]u8{ 0x10, 0x00, 0x02 } ++ @as([16 - 3]u8, @splat(0x00));
1000 var msg: [35]u8 = undefined;
1001 for (&msg, 0..) |*byte, i| byte.* = @truncate(i);
1002 var mac128: [16]u8 = undefined;
1003 var mac256: [32]u8 = undefined;
1004
1005 Aegis128LMac.createWithNonce(&mac256, &msg, &key, &nonce);
1006 Aegis128LMac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1007 try htest.assertEqual("d3f09b2842ad301687d6902c921d7818", &mac128);
1008 try htest.assertEqual("9490e7c89d420c9f37417fa625eb38e8cad53c5cbec55285e8499ea48377f2a3", &mac256);
1009
1010 Aegis128X2Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1011 Aegis128X2Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1012 try htest.assertEqual("6873ee34e6b5c59143b6d35c5e4f2c6e", &mac128);
1013 try htest.assertEqual("afcba3fc2d63c8d6c7f2d63f3ec8fbbbaf022e15ac120e78ffa7755abccd959c", &mac256);
1014
1015 Aegis128X4Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1016 Aegis128X4Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1017 try htest.assertEqual("c45a98fd9ab8956ce616eb008cfe4e53", &mac128);
1018 try htest.assertEqual("26fdc76f41b1da7aec7779f6e964beae8904e662f05aca8345ae3befb357412a", &mac256);
1019}
1020
1021test "AEGISMAC-256* test vectors" {
1022 const key = [_]u8{ 0x10, 0x01 } ++ @as([32 - 2]u8, @splat(0x00));
1023 const nonce = [_]u8{ 0x10, 0x00, 0x02 } ++ @as([32 - 3]u8, @splat(0x00));
1024 var msg: [35]u8 = undefined;
1025 for (&msg, 0..) |*byte, i| byte.* = @truncate(i);
1026 var mac128: [16]u8 = undefined;
1027 var mac256: [32]u8 = undefined;
1028
1029 Aegis256Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1030 Aegis256Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1031 try htest.assertEqual("c08e20cfc56f27195a46c9cef5c162d4", &mac128);
1032 try htest.assertEqual("a5c906ede3d69545c11e20afa360b221f936e946ed2dba3d7c75ad6dc2784126", &mac256);
1033
1034 Aegis256X2Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1035 Aegis256X2Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1036 try htest.assertEqual("fb319cb6dd728a764606fb14d37f2a5e", &mac128);
1037 try htest.assertEqual("0844b20ed5147ceae89c7a160263afd4b1382d6b154ecf560ce8a342cb6a8fd1", &mac256);
1038
1039 Aegis256X4Mac.createWithNonce(&mac256, &msg, &key, &nonce);
1040 Aegis256X4Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1041 try htest.assertEqual("a51f9bc5beae60cce77f0dbc60761edd", &mac128);
1042 try htest.assertEqual("b36a16ef07c36d75a91f437502f24f545b8dfa88648ed116943c29fead3bf10c", &mac256);
1043}