pq_crypto-seal 0.1.0

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_neon_aes.c

@@ -0,0 +1,77 @@
+#if defined(__aarch64__) || defined(_M_ARM64)
+
+#    include <stddef.h>
+#    include <stdint.h>
+
+#    include "../common/common.h"
+#    include "aegis128l.h"
+#    include "aegis128l_neon_aes.h"
+
+#    ifndef __ARM_FEATURE_CRYPTO
+#        define __ARM_FEATURE_CRYPTO 1
+#    endif
+#    ifndef __ARM_FEATURE_AES
+#        define __ARM_FEATURE_AES 1
+#    endif
+
+#    include <arm_neon.h>
+
+#    ifdef __clang__
+#        pragma clang attribute push(__attribute__((target("neon,crypto,aes"))), \
+                                     apply_to = function)
+#    elif defined(__GNUC__)
+#        pragma GCC target("+simd+crypto")
+#    endif
+
+#    define AES_BLOCK_LENGTH 16
+
+typedef uint8x16_t aes_block_t;
+
+#    define AES_BLOCK_XOR(A, B)       veorq_u8((A), (B))
+#    define AES_BLOCK_AND(A, B)       vandq_u8((A), (B))
+#    define AES_BLOCK_LOAD(A)         vld1q_u8(A)
+#    define AES_BLOCK_LOAD_64x2(A, B) vreinterpretq_u8_u64(vsetq_lane_u64((A), vmovq_n_u64(B), 1))
+#    define AES_BLOCK_STORE(A, B)     vst1q_u8((A), (B))
+#    define AES_ENC(A, B)             veorq_u8(vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), (A))), (B))
+
+static inline void
+aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2)
+{
+    aes_block_t tmp;
+
+    tmp      = state[7];
+    state[7] = AES_ENC(state[6], state[7]);
+    state[6] = AES_ENC(state[5], state[6]);
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_BLOCK_XOR(AES_ENC(state[3], state[4]), d2);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_BLOCK_XOR(AES_ENC(tmp, state[0]), d1);
+}
+
+#    include "aegis128l_common.h"
+
+struct aegis128l_implementation aegis128l_neon_aes_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#    ifdef __clang__
+#        pragma clang attribute pop
+#    endif
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_neon_aes.h

@@ -0,0 +1,9 @@
+#ifndef aegis128l_neon_aes_H
+#define aegis128l_neon_aes_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis128l_implementation aegis128l_neon_aes_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_neon_sha3.c

@@ -0,0 +1,86 @@
+#if defined(__aarch64__) || defined(_M_ARM64)
+
+#    include <stddef.h>
+#    include <stdint.h>
+
+#    include "../common/common.h"
+#    include "aegis128l.h"
+#    include "aegis128l_neon_sha3.h"
+
+#    ifndef __ARM_FEATURE_CRYPTO
+#        define __ARM_FEATURE_CRYPTO 1
+#    endif
+#    ifndef __ARM_FEATURE_AES
+#        define __ARM_FEATURE_AES 1
+#    endif
+#    ifndef __ARM_FEATURE_SHA3
+#        define __ARM_FEATURE_SHA3 1
+#    endif
+
+#    include <arm_neon.h>
+
+#    ifdef __clang__
+#        pragma clang attribute push(__attribute__((target("neon,crypto,aes,sha3"))), \
+                                     apply_to = function)
+#    elif defined(__GNUC__)
+#        if __GNUC__ < 14
+#            pragma GCC target("arch=armv8.2-a+simd+crypto+sha3")
+#        else
+#            pragma GCC target("+simd+crypto+sha3")
+#        endif
+#    endif
+
+#    define AES_BLOCK_LENGTH 16
+
+typedef uint8x16_t aes_block_t;
+
+#    define AES_BLOCK_XOR(A, B)       veorq_u8((A), (B))
+#    define AES_BLOCK_XOR3(A, B, C)   veor3q_u8((A), (B), (C))
+#    define AES_BLOCK_AND(A, B)       vandq_u8((A), (B))
+#    define AES_BLOCK_LOAD(A)         vld1q_u8(A)
+#    define AES_BLOCK_LOAD_64x2(A, B) vreinterpretq_u8_u64(vsetq_lane_u64((A), vmovq_n_u64(B), 1))
+#    define AES_BLOCK_STORE(A, B)     vst1q_u8((A), (B))
+#    define AES_ENC0(A)               vaesmcq_u8(vaeseq_u8(vmovq_n_u8(0), (A)))
+#    define AES_ENC(A, B)             AES_BLOCK_XOR(AES_ENC0(A), (B))
+
+static inline void
+aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2)
+{
+    aes_block_t tmp;
+
+    tmp      = state[7];
+    state[7] = AES_ENC(state[6], state[7]);
+    state[6] = AES_ENC(state[5], state[6]);
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_BLOCK_XOR3(state[4], AES_ENC0(state[3]), d2);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_BLOCK_XOR3(state[0], AES_ENC0(tmp), d1);
+}
+
+#    include "aegis128l_common.h"
+
+struct aegis128l_implementation aegis128l_neon_sha3_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#    ifdef __clang__
+#        pragma clang attribute pop
+#    endif
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_neon_sha3.h

@@ -0,0 +1,9 @@
+#ifndef aegis128l_neon_sha3_H
+#define aegis128l_neon_sha3_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis128l_implementation aegis128l_neon_sha3_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_soft.c

@@ -0,0 +1,63 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../common/common.h"
+#include "../common/cpu.h"
+
+#ifndef HAS_HW_AES
+
+#    include "../common/softaes.h"
+#    include "aegis128l.h"
+#    include "aegis128l_soft.h"
+
+#    define AES_BLOCK_LENGTH 16
+
+typedef SoftAesBlock aes_block_t;
+
+#    define AES_BLOCK_XOR(A, B)       softaes_block_xor((A), (B))
+#    define AES_BLOCK_AND(A, B)       softaes_block_and((A), (B))
+#    define AES_BLOCK_LOAD(A)         softaes_block_load(A)
+#    define AES_BLOCK_LOAD_64x2(A, B) softaes_block_load64x2((A), (B))
+#    define AES_BLOCK_STORE(A, B)     softaes_block_store((A), (B))
+#    define AES_ENC(A, B)             softaes_block_encrypt((A), (B))
+
+static inline void
+aegis128l_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2)
+{
+    aes_block_t tmp;
+
+    tmp      = state[7];
+    state[7] = AES_ENC(state[6], state[7]);
+    state[6] = AES_ENC(state[5], state[6]);
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_ENC(state[3], state[4]);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_ENC(tmp, state[0]);
+
+    state[0] = AES_BLOCK_XOR(state[0], d1);
+    state[4] = AES_BLOCK_XOR(state[4], d2);
+}
+
+#    include "aegis128l_common.h"
+
+struct aegis128l_implementation aegis128l_soft_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/aegis128l_soft.h

@@ -0,0 +1,9 @@
+#ifndef aegis128l_soft_H
+#define aegis128l_soft_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis128l_implementation aegis128l_soft_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128l/implementations.h

@@ -0,0 +1,40 @@
+#ifndef aegis128l_implementations_H
+#define aegis128l_implementations_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "aegis128l.h"
+
+/* Namespacing to avoid conflicts with libsodium */
+#define aegis128l_soft_implementation      libaegis_aegis128l_soft_implementation
+#define aegis128l_aesni_implementation     libaegis_aegis128l_aesni_implementation
+#define aegis128l_neon_aes_implementation  libaegis_aegis128l_neon_aes_implementation
+#define aegis128l_neon_sha3_implementation libaegis_aegis128l_neon_sha3_implementation
+#define aegis128l_altivec_implementation   libaegis_aegis128l_altivec_implementation
+
+typedef struct aegis128l_implementation {
+    int (*encrypt_detached)(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen,
+                            const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k);
+    int (*decrypt_detached)(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
+                            size_t maclen, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                            const uint8_t *k);
+    void (*stream)(uint8_t *out, size_t len, const uint8_t *npub, const uint8_t *k);
+    void (*encrypt_unauthenticated)(uint8_t *c, const uint8_t *m, size_t mlen, const uint8_t *npub,
+                                    const uint8_t *k);
+    void (*decrypt_unauthenticated)(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *npub,
+                                    const uint8_t *k);
+    void (*state_init)(aegis128l_state *st_, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                       const uint8_t *k);
+    int (*state_encrypt_update)(aegis128l_state *st_, uint8_t *c, const uint8_t *m, size_t mlen);
+    int (*state_encrypt_final)(aegis128l_state *st_, uint8_t *mac, size_t maclen);
+    int (*state_decrypt_update)(aegis128l_state *st_, uint8_t *m, const uint8_t *c, size_t clen);
+    int (*state_decrypt_final)(aegis128l_state *st_, const uint8_t *mac, size_t maclen);
+    void (*state_mac_init)(aegis128l_mac_state *st_, const uint8_t *npub, const uint8_t *k);
+    int (*state_mac_update)(aegis128l_mac_state *st_, const uint8_t *ad, size_t adlen);
+    int (*state_mac_final)(aegis128l_mac_state *st_, uint8_t *mac, size_t maclen);
+    void (*state_mac_reset)(aegis128l_mac_state *st);
+    void (*state_mac_clone)(aegis128l_mac_state *dst, const aegis128l_mac_state *src);
+} aegis128l_implementation;
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128x2/aegis128x2.c

@@ -0,0 +1,247 @@
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../common/common.h"
+#include "../common/cpu.h"
+#include "aegis128x2.h"
+#include "aegis128x2_aesni.h"
+#include "aegis128x2_altivec.h"
+#include "aegis128x2_avx2.h"
+#include "aegis128x2_neon_aes.h"
+
+#ifndef HAS_HW_AES
+#    include "aegis128x2_soft.h"
+static const aegis128x2_implementation *implementation = &aegis128x2_soft_implementation;
+#else
+#    if defined(__aarch64__) || defined(_M_ARM64)
+static const aegis128x2_implementation *implementation = &aegis128x2_neon_aes_implementation;
+#    elif defined(__x86_64__) || defined(__i386__)
+static const aegis128x2_implementation *implementation = &aegis128x2_aesni_implementation;
+#    elif defined(__ALTIVEC__) && defined(__CRYPTO__)
+static const aegis128x2_implementation *implementation = &aegis128x2_altivec_implementation;
+#    else
+#        error "Unsupported architecture"
+#    endif
+#endif
+
+size_t
+aegis128x2_keybytes(void)
+{
+    return aegis128x2_KEYBYTES;
+}
+
+size_t
+aegis128x2_npubbytes(void)
+{
+    return aegis128x2_NPUBBYTES;
+}
+
+size_t
+aegis128x2_abytes_min(void)
+{
+    return aegis128x2_ABYTES_MIN;
+}
+
+size_t
+aegis128x2_abytes_max(void)
+{
+    return aegis128x2_ABYTES_MAX;
+}
+
+size_t
+aegis128x2_tailbytes_max(void)
+{
+    return aegis128x2_TAILBYTES_MAX;
+}
+
+int
+aegis128x2_encrypt_detached(uint8_t *c, uint8_t *mac, size_t maclen, const uint8_t *m, size_t mlen,
+                            const uint8_t *ad, size_t adlen, const uint8_t *npub, const uint8_t *k)
+{
+    if (maclen != 16 && maclen != 32) {
+        errno = EINVAL;
+        return -1;
+    }
+    return implementation->encrypt_detached(c, mac, maclen, m, mlen, ad, adlen, npub, k);
+}
+
+int
+aegis128x2_decrypt_detached(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *mac,
+                            size_t maclen, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                            const uint8_t *k)
+{
+    if (maclen != 16 && maclen != 32) {
+        errno = EINVAL;
+        return -1;
+    }
+    return implementation->decrypt_detached(m, c, clen, mac, maclen, ad, adlen, npub, k);
+}
+
+int
+aegis128x2_encrypt(uint8_t *c, size_t maclen, const uint8_t *m, size_t mlen, const uint8_t *ad,
+                   size_t adlen, const uint8_t *npub, const uint8_t *k)
+{
+    return aegis128x2_encrypt_detached(c, c + mlen, maclen, m, mlen, ad, adlen, npub, k);
+}
+
+int
+aegis128x2_decrypt(uint8_t *m, const uint8_t *c, size_t clen, size_t maclen, const uint8_t *ad,
+                   size_t adlen, const uint8_t *npub, const uint8_t *k)
+{
+    int ret = -1;
+
+    if (clen >= maclen) {
+        ret = aegis128x2_decrypt_detached(m, c, clen - maclen, c + clen - maclen, maclen, ad, adlen,
+                                          npub, k);
+    }
+    return ret;
+}
+
+void
+aegis128x2_state_init(aegis128x2_state *st_, const uint8_t *ad, size_t adlen, const uint8_t *npub,
+                      const uint8_t *k)
+{
+    memset(st_, 0, sizeof *st_);
+    implementation->state_init(st_, ad, adlen, npub, k);
+}
+
+int
+aegis128x2_state_encrypt_update(aegis128x2_state *st_, uint8_t *c, const uint8_t *m, size_t mlen)
+{
+    return implementation->state_encrypt_update(st_, c, m, mlen);
+}
+
+int
+aegis128x2_state_encrypt_final(aegis128x2_state *st_, uint8_t *mac, size_t maclen)
+{
+    if (maclen != 16 && maclen != 32) {
+        errno = EINVAL;
+        return -1;
+    }
+    return implementation->state_encrypt_final(st_, mac, maclen);
+}
+
+int
+aegis128x2_state_decrypt_update(aegis128x2_state *st_, uint8_t *m, const uint8_t *c, size_t clen)
+{
+    return implementation->state_decrypt_update(st_, m, c, clen);
+}
+
+int
+aegis128x2_state_decrypt_final(aegis128x2_state *st_, const uint8_t *mac, size_t maclen)
+{
+    if (maclen != 16 && maclen != 32) {
+        errno = EINVAL;
+        return -1;
+    }
+    return implementation->state_decrypt_final(st_, mac, maclen);
+}
+
+void
+aegis128x2_stream(uint8_t *out, size_t len, const uint8_t *npub, const uint8_t *k)
+{
+    implementation->stream(out, len, npub, k);
+}
+
+void
+aegis128x2_encrypt_unauthenticated(uint8_t *c, const uint8_t *m, size_t mlen, const uint8_t *npub,
+                                   const uint8_t *k)
+{
+    implementation->encrypt_unauthenticated(c, m, mlen, npub, k);
+}
+
+void
+aegis128x2_decrypt_unauthenticated(uint8_t *m, const uint8_t *c, size_t clen, const uint8_t *npub,
+                                   const uint8_t *k)
+{
+    implementation->decrypt_unauthenticated(m, c, clen, npub, k);
+}
+
+void
+aegis128x2_mac_init(aegis128x2_mac_state *st_, const uint8_t *k, const uint8_t *npub)
+{
+    implementation->state_mac_init(st_, npub, k);
+}
+
+int
+aegis128x2_mac_update(aegis128x2_mac_state *st_, const uint8_t *m, size_t mlen)
+{
+    return implementation->state_mac_update(st_, m, mlen);
+}
+
+int
+aegis128x2_mac_final(aegis128x2_mac_state *st_, uint8_t *mac, size_t maclen)
+{
+    if (maclen != 16 && maclen != 32) {
+        errno = EINVAL;
+        return -1;
+    }
+    return implementation->state_mac_final(st_, mac, maclen);
+}
+
+int
+aegis128x2_mac_verify(aegis128x2_mac_state *st_, const uint8_t *mac, size_t maclen)
+{
+    uint8_t expected_mac[32];
+
+    switch (maclen) {
+    case 16:
+        implementation->state_mac_final(st_, expected_mac, maclen);
+        return aegis_verify_16(expected_mac, mac);
+    case 32:
+        implementation->state_mac_final(st_, expected_mac, maclen);
+        return aegis_verify_32(expected_mac, mac);
+    default:
+        errno = EINVAL;
+        return -1;
+    }
+}
+
+void
+aegis128x2_mac_reset(aegis128x2_mac_state *st_)
+{
+    implementation->state_mac_reset(st_);
+}
+
+void
+aegis128x2_mac_state_clone(aegis128x2_mac_state *dst, const aegis128x2_mac_state *src)
+{
+    implementation->state_mac_clone(dst, src);
+}
+
+int
+aegis128x2_pick_best_implementation(void)
+{
+#ifndef HAS_HW_AES
+    implementation = &aegis128x2_soft_implementation;
+#endif
+
+#if defined(__aarch64__) || defined(_M_ARM64)
+    if (aegis_runtime_has_neon_aes()) {
+        implementation = &aegis128x2_neon_aes_implementation;
+        return 0;
+    }
+#endif
+
+#if defined(__x86_64__) || defined(_M_AMD64) || defined(__i386__) || defined(_M_IX86)
+#    ifdef HAVE_VAESINTRIN_H
+    if (aegis_runtime_has_vaes() && aegis_runtime_has_avx2()) {
+        implementation = &aegis128x2_avx2_implementation;
+        return 0;
+    }
+#    endif
+    if (aegis_runtime_has_aesni() && aegis_runtime_has_avx()) {
+        implementation = &aegis128x2_aesni_implementation;
+        return 0;
+    }
+#endif
+
+#if defined(__ALTIVEC__) && defined(__CRYPTO__)
+    if (aegis_runtime_has_altivec()) {
+        implementation = &aegis128x2_altivec_implementation;
+        return 0;
+    }
+#endif
+
+    return 0; /* LCOV_EXCL_LINE */
+}

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128x2/aegis128x2_aesni.c

@@ -0,0 +1,108 @@
+#if defined(__i386__) || defined(_M_IX86) || defined(__x86_64__) || defined(_M_AMD64)
+
+#    include <stddef.h>
+#    include <stdint.h>
+
+#    include "../common/common.h"
+#    include "aegis128x2.h"
+#    include "aegis128x2_aesni.h"
+
+#    ifdef __clang__
+#        pragma clang attribute push(__attribute__((target("aes,avx"))), apply_to = function)
+#    elif defined(__GNUC__)
+#        pragma GCC target("aes,avx")
+#    endif
+
+#    include <immintrin.h>
+#    include <wmmintrin.h>
+
+#    define AES_BLOCK_LENGTH 32
+
+typedef struct {
+    __m128i b0;
+    __m128i b1;
+} aes_block_t;
+
+static inline aes_block_t
+AES_BLOCK_XOR(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { _mm_xor_si128(a.b0, b.b0), _mm_xor_si128(a.b1, b.b1) };
+}
+
+static inline aes_block_t
+AES_BLOCK_AND(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { _mm_and_si128(a.b0, b.b0), _mm_and_si128(a.b1, b.b1) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD(const uint8_t *a)
+{
+    return (aes_block_t) { _mm_loadu_si128((const __m128i *) (const void *) a),
+                           _mm_loadu_si128((const __m128i *) (const void *) (a + 16)) };
+}
+
+static inline aes_block_t
+AES_BLOCK_LOAD_64x2(uint64_t a, uint64_t b)
+{
+    const __m128i t = _mm_set_epi64x((long long) a, (long long) b);
+    return (aes_block_t) { t, t };
+}
+
+static inline void
+AES_BLOCK_STORE(uint8_t *a, const aes_block_t b)
+{
+    _mm_storeu_si128((__m128i *) (void *) a, b.b0);
+    _mm_storeu_si128((__m128i *) (void *) (a + 16), b.b1);
+}
+
+static inline aes_block_t
+AES_ENC(const aes_block_t a, const aes_block_t b)
+{
+    return (aes_block_t) { _mm_aesenc_si128(a.b0, b.b0), _mm_aesenc_si128(a.b1, b.b1) };
+}
+
+static inline void
+aegis128x2_update(aes_block_t *const state, const aes_block_t d1, const aes_block_t d2)
+{
+    aes_block_t tmp;
+
+    tmp      = state[7];
+    state[7] = AES_ENC(state[6], state[7]);
+    state[6] = AES_ENC(state[5], state[6]);
+    state[5] = AES_ENC(state[4], state[5]);
+    state[4] = AES_ENC(state[3], state[4]);
+    state[3] = AES_ENC(state[2], state[3]);
+    state[2] = AES_ENC(state[1], state[2]);
+    state[1] = AES_ENC(state[0], state[1]);
+    state[0] = AES_ENC(tmp, state[0]);
+
+    state[0] = AES_BLOCK_XOR(state[0], d1);
+    state[4] = AES_BLOCK_XOR(state[4], d2);
+}
+
+#    include "aegis128x2_common.h"
+
+struct aegis128x2_implementation aegis128x2_aesni_implementation = {
+    .encrypt_detached        = encrypt_detached,
+    .decrypt_detached        = decrypt_detached,
+    .encrypt_unauthenticated = encrypt_unauthenticated,
+    .decrypt_unauthenticated = decrypt_unauthenticated,
+    .stream                  = stream,
+    .state_init              = state_init,
+    .state_encrypt_update    = state_encrypt_update,
+    .state_encrypt_final     = state_encrypt_final,
+    .state_decrypt_update    = state_decrypt_update,
+    .state_decrypt_final     = state_decrypt_final,
+    .state_mac_init          = state_mac_init,
+    .state_mac_update        = state_mac_update,
+    .state_mac_final         = state_mac_final,
+    .state_mac_reset         = state_mac_reset,
+    .state_mac_clone         = state_mac_clone,
+};
+
+#    ifdef __clang__
+#        pragma clang attribute pop
+#    endif
+
+#endif

data/ext/pq_crypto_seal/vendor/libaegis/src/aegis128x2/aegis128x2_aesni.h

@@ -0,0 +1,9 @@
+#ifndef aegis128x2_aesni_H
+#define aegis128x2_aesni_H
+
+#include "../common/common.h"
+#include "implementations.h"
+
+extern struct aegis128x2_implementation aegis128x2_aesni_implementation;
+
+#endif