sleeping_kangaroo12 0.0.1

data/ext/xkcp/lib/high/Kravatte/KravatteModes.c

@@ -0,0 +1,557 @@
+/*
+The eXtended Keccak Code Package (XKCP)
+https://github.com/XKCP/XKCP
+
+Kravatte, designed by Guido Bertoni, Joan Daemen, Seth Hoffert, Michaël Peeters, Gilles Van Assche and Ronny Van Keer.
+
+Implementation by Ronny Van Keer, hereby denoted as "the implementer".
+
+For more information, feedback or questions, please refer to the Keccak Team website:
+https://keccak.team/
+
+To the extent possible under law, the implementer has waived all copyright
+and related or neighboring rights to the source code in this file.
+http://creativecommons.org/publicdomain/zero/1.0/
+*/
+
+#include <string.h>
+#include "brg_endian.h"
+#include "Kravatte.h"
+#include "KravatteModes.h"
+
+/* #define    DEBUG_DUMP */
+
+/*
+ * Uncomment this define if your CPU can not handle misaligned memory accesses.
+#define NO_MISALIGNED_ACCESSES
+ */
+
+#define laneSize        8
+#define width           1600
+#define widthInBytes    (width/8)
+#define widthInLanes    (widthInBytes/laneSize)
+#define rate            (width-64)
+#define rateInBytes     (rate/8)
+#define rateInLanes     (rateInBytes/laneSize)
+
+#define MyMin(a, b)     (((a) < (b)) ? (a) : (b))
+
+#if defined(DEBUG_DUMP)
+static void DUMP( const unsigned char * pText, const unsigned char * pData, unsigned int size )
+{
+    unsigned int i;
+    printf("%s (%u bytes):", pText, size);
+    for(i=0; i<size; i++)
+        printf(" %02x", (int)pData[i]);
+    printf("\n");
+}
+#else
+#define DUMP(pText, pData, size )
+#endif
+
+static void memxoris(BitSequence *target, const BitSequence *source, BitLength bitLen)
+{
+    size_t  byteLen = bitLen / 8;
+
+    #if !defined(NO_MISALIGNED_ACCESSES)
+    while ( byteLen >= 32 ) {
+        *((uint64_t*)(target+0)) ^= *((uint64_t*)(source+0));
+        *((uint64_t*)(target+8)) ^= *((uint64_t*)(source+8));
+        *((uint64_t*)(target+16)) ^= *((uint64_t*)(source+16));
+        *((uint64_t*)(target+24)) ^= *((uint64_t*)(source+24));
+        source += 32;
+        target += 32;
+        byteLen -= 32;
+    }
+    while ( byteLen >= 8 ) {
+        *((uint64_t*)target) ^= *((uint64_t*)source);
+        source += 8;
+        target += 8;
+        byteLen -= 8;
+    }
+    #endif
+
+    while ( byteLen-- != 0 )
+    {
+        *target++ ^= *source++;
+    }
+
+    bitLen &= 7;
+    if (bitLen != 0)
+    {
+        *target ^= *source;
+        *target &= (1 << bitLen) - 1;
+    }
+}
+
+#if 0 /* no longer used */
+static void memxor(BitSequence *target, const BitSequence *source1, const BitSequence *source2, BitLength bitLen)
+{
+    size_t    byteLen = bitLen / 8;
+
+    #if !defined(NO_MISALIGNED_ACCESSES)
+    while ( byteLen >= 32 ) {
+        *((uint64_t*)(target+0))  = *((uint64_t*)(source1+0))  ^ *((uint64_t*)(source2+0));
+        *((uint64_t*)(target+8))  = *((uint64_t*)(source1+8))  ^ *((uint64_t*)(source2+8));
+        *((uint64_t*)(target+16)) = *((uint64_t*)(source1+16)) ^ *((uint64_t*)(source2+16));
+        *((uint64_t*)(target+24)) = *((uint64_t*)(source1+24)) ^ *((uint64_t*)(source2+24));
+        source1 += 32;
+        source2 += 32;
+        target += 32;
+        byteLen -= 32;
+    }
+    while ( byteLen >= 8 ) {
+        *((uint64_t*)target)  = *((uint64_t*)source1) ^ *((uint64_t*)source2);
+        source1 += 8;
+        source2 += 8;
+        target += 8;
+        byteLen -= 8;
+    }
+    #endif
+
+    while ( byteLen-- != 0 )
+    {
+        *target++ = *source1++ ^ *source2++;
+    }
+
+    bitLen &= 7;
+    if (bitLen != 0)
+    {
+        *target = *source1 ^ *source2;
+        *target &= (1 << bitLen) - 1;
+    }
+
+}
+#endif
+
+/* ------------------------------------------------------------------------- */
+
+int Kravatte_SANE_Initialize(Kravatte_SANE_Instance *kp, const BitSequence *Key, BitLength KeyBitLen, 
+                            const BitSequence *Nonce, BitLength NonceBitLen, unsigned char *tag)
+{
+    kp->e = 0;
+    if (Kravatte_MaskDerivation(&kp->kravatte, Key, KeyBitLen) != 0)
+        return 1;
+    if (Kra(&kp->kravatte, Nonce, NonceBitLen, KRAVATTE_FLAG_INIT | KRAVATTE_FLAG_LAST_PART) != 0)
+        return 1;
+    return Vatte(&kp->kravatte, tag, Kravatte_SANE_TagLength * 8, KRAVATTE_FLAG_NONE);
+}
+
+static int Kravatte_SANE_AddToHistory(Kravatte_SANE_Instance *kp, const BitSequence *data, BitLength dataBitLen, unsigned char appendix)
+{
+    BitSequence lastByte[1];
+
+    if (Kra(&kp->kravatte, data, dataBitLen & ~7, KRAVATTE_FLAG_NONE) != 0) /* Do all except last byte if incomplete */
+        return 1;
+
+    data += dataBitLen >> 3; /* move pointer to last incomplete byte (if no incomplete last byte, it will point beyond the buffer, but pointer won't be dereferenced) */
+    dataBitLen &= 7; /* dataBitLen is now number of bits in last possible incomplete byte */
+    if (dataBitLen == 0) {
+        lastByte[0] = (BitSequence)(appendix | (kp->e << 1));
+        dataBitLen = 2;
+    }
+    else if (dataBitLen <= 6) {
+        lastByte[0] = (BitSequence)(*data | (appendix << dataBitLen) | (kp->e << (dataBitLen + 1)));
+        dataBitLen += 2;
+    }
+    else { /* dataBitLen == 7 */
+        lastByte[0] = (BitSequence)(*data | (appendix << 7));
+        if ( Kra(&kp->kravatte, lastByte, 8, KRAVATTE_FLAG_NONE) != 0) {
+            return 1;
+        }
+        lastByte[0] = (BitSequence)kp->e;
+        dataBitLen = 1;
+    }
+    return Kra(&kp->kravatte, lastByte, dataBitLen, KRAVATTE_FLAG_LAST_PART);
+}
+
+
+int Kravatte_SANE_Wrap(Kravatte_SANE_Instance *kp, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen, unsigned char *tag)
+{
+
+    if (dataBitLen != 0) {
+        /* C = P ^ Fk(history) << offset */
+        if (Vatte(&kp->kravatte, ciphertext, dataBitLen, KRAVATTE_FLAG_LAST_PART) != 0)
+            return 1;
+        memxoris(ciphertext, plaintext, dataBitLen);
+    }
+    if ((ADBitLen != 0) || (dataBitLen == 0)) {
+        /* history <- A || 0 || e ° history */
+        if (Kravatte_SANE_AddToHistory(kp, AD, ADBitLen, 0 ) != 0)
+            return 1;
+    }
+    if (dataBitLen != 0) {
+        /* history <- C || 1 || e ° history */
+        if (Kravatte_SANE_AddToHistory(kp, ciphertext, dataBitLen, 1 ) != 0)
+            return 1;
+    }
+    kp->e ^= 1;
+
+    /* T = Fk(history) */
+    return Vatte(&kp->kravatte, tag, Kravatte_SANE_TagLength * 8, KRAVATTE_FLAG_NONE);
+}
+
+int Kravatte_SANE_Unwrap(Kravatte_SANE_Instance *kp, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                            const BitSequence *AD, BitLength ADBitLen, const unsigned char *tag)
+{
+    unsigned char tagPrime[Kravatte_SANE_TagLength];
+
+    if (dataBitLen != 0) {
+        /*    P = C ^ Fk(history) << offset */
+        if (Vatte(&kp->kravatte, plaintext, dataBitLen, KRAVATTE_FLAG_LAST_PART) != 0)
+            return 1;
+        memxoris(plaintext, ciphertext, dataBitLen);
+    }
+    if ((ADBitLen != 0) || (dataBitLen == 0)) {
+        /* history <- A || 0 || e ° history */
+        if (Kravatte_SANE_AddToHistory(kp, AD, ADBitLen, 0 ) != 0)
+            return 1;
+    }
+    if (dataBitLen != 0) {
+        /* history <- C || 1 || e  ° history */
+        if (Kravatte_SANE_AddToHistory(kp, ciphertext, dataBitLen, 1 ) != 0)
+            return 1;
+    }
+    /* Tprime = Fk(history) */
+    if (Vatte(&kp->kravatte, tagPrime, Kravatte_SANE_TagLength * 8, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    kp->e ^= 1;
+     /* Wipe plaintext on tag difference */
+    if ( memcmp( tagPrime, tag, Kravatte_SANE_TagLength) != 0) {
+        memset(plaintext, 0, (dataBitLen + 7) / 8);
+        return 1;
+    }
+    return 0;
+}
+
+/* ------------------------------------------------------------------------- */
+
+int Kravatte_SANSE_Initialize(Kravatte_SANSE_Instance *kp, const BitSequence *Key, BitLength KeyBitLen)
+{
+    kp->e = 0;
+    return Kravatte_MaskDerivation(&kp->kravatte, Key, KeyBitLen);
+}
+
+static int Kravatte_SANSE_AddToHistory(Kravatte_SANSE_Instance *kp, const BitSequence *data, BitLength dataBitLen, unsigned char appendix, unsigned int appendixLen)
+{
+    BitSequence lastByte[1];
+
+    if (Kra(&kp->kravatte, data, dataBitLen & ~7, KRAVATTE_FLAG_NONE) != 0) /* Do all except last byte if incomplete */
+        return 1;
+    data += dataBitLen >> 3; /* move pointer to last incomplete byte (if no incomplete last byte, it will point beyond the buffer, but pointer won't be dereferenced) */
+    dataBitLen &= 7; /* dataBitLen is now number of bits in last possible incomplete byte */
+    if (dataBitLen == 0) {
+        lastByte[0] = (BitSequence)(appendix | (kp->e << appendixLen));
+        dataBitLen = appendixLen + 1;
+    }
+    else if (dataBitLen <= (8 - (appendixLen + 1))) {
+        lastByte[0] = (BitSequence)((*data & ((1 << dataBitLen) - 1)) | (appendix << dataBitLen) | (kp->e << (dataBitLen + appendixLen)));
+        dataBitLen += appendixLen + 1;
+    }
+    else { /* dataBitLen too big to hold everything in last byte */
+        unsigned int bitsLeft;
+
+        bitsLeft = 8 - (unsigned int)dataBitLen;
+        lastByte[0] = (BitSequence)((*data & ((1 << dataBitLen) - 1)) | ((appendix & ((1 << bitsLeft) - 1)) << dataBitLen));
+        appendixLen -= bitsLeft;
+        appendix >>= bitsLeft;
+        if ( Kra(&kp->kravatte, lastByte, 8, KRAVATTE_FLAG_NONE) != 0) {
+            return 1;
+        }
+        lastByte[0] = (BitSequence)(appendix | (kp->e << appendixLen));
+        dataBitLen = appendixLen + 1;
+    }
+    return Kra(&kp->kravatte, lastByte, dataBitLen, KRAVATTE_FLAG_LAST_PART);
+}
+
+int Kravatte_SANSE_Wrap(Kravatte_SANSE_Instance *kp, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen, 
+                        const BitSequence *AD, BitLength ADBitLen, unsigned char *tag)
+{
+
+    /* if |A| > 0 OR |P| = 0 then */
+    if ((ADBitLen != 0) || (dataBitLen == 0)) {
+        /* history <- A || 0 || e . history */
+        if (Kravatte_SANSE_AddToHistory(kp, AD, ADBitLen, 0, 1 ) != 0)
+            return 1;
+    }
+    /* if |P| > 0 then */
+    if (dataBitLen != 0) {
+        Kravatte_Instance initialHistory = kp->kravatte;
+        Kravatte_Instance newHistory;
+
+        /* T = 0t + FK (P || 01 || e . history) */
+        if (Kravatte_SANSE_AddToHistory(kp, plaintext, dataBitLen, 2, 2 ) != 0)
+            return 1;
+        newHistory = kp->kravatte;
+        if ( Vatte(&kp->kravatte, tag, Kravatte_SANSE_TagLength * 8, KRAVATTE_FLAG_NONE) != 0)
+            return 1;
+
+        /* C = P + FK (T || 11 || e . history) */
+        kp->kravatte = initialHistory;
+        if (Kravatte_SANSE_AddToHistory(kp, tag, Kravatte_SANSE_TagLength * 8, 3, 2 ) != 0)
+            return 1;
+        if (Vatte(&kp->kravatte, ciphertext, dataBitLen, KRAVATTE_FLAG_LAST_PART) != 0)
+            return 1;
+        memxoris(ciphertext, plaintext, dataBitLen);
+
+        /* history = P || 01 || e . history */
+        kp->kravatte = newHistory;
+    }
+    else {
+        /* T = 0t + FK (history)  */
+        if ( Vatte(&kp->kravatte, tag, Kravatte_SANSE_TagLength * 8, KRAVATTE_FLAG_NONE) != 0)
+            return 1;
+    }
+    /* e = e + 1 */
+    kp->e ^= 1;
+
+    return 0;
+}
+
+int Kravatte_SANSE_Unwrap(Kravatte_SANSE_Instance *kp, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen, 
+                            const BitSequence *AD, BitLength ADBitLen, const unsigned char *tag)
+{
+    unsigned char tagPrime[Kravatte_SANSE_TagLength];
+
+    /* if |A| > 0 OR |C| = 0 then */
+    if ((ADBitLen != 0) || (dataBitLen == 0)) {
+        /* history = A || 0 || e . history */
+        if (Kravatte_SANSE_AddToHistory(kp, AD, ADBitLen, 0, 1 ) != 0)
+            return 1;
+    }
+
+    /* if |C| > 0 then */
+    if (dataBitLen != 0) {
+        Kravatte_Instance initialHistory = kp->kravatte;
+
+        /* P = C + FK (T || 11 || e . history) */
+        if (Kravatte_SANSE_AddToHistory(kp, tag, Kravatte_SANSE_TagLength * 8, 3, 2 ) != 0)
+            return 1;
+        if (Vatte(&kp->kravatte, plaintext, dataBitLen, KRAVATTE_FLAG_LAST_PART) != 0)
+            return 1;
+        memxoris(plaintext, ciphertext, dataBitLen);
+
+        /* history = P || 01 || e . history */
+        kp->kravatte = initialHistory;
+        if (Kravatte_SANSE_AddToHistory(kp, plaintext, dataBitLen, 2, 2 ) != 0)
+            return 1;
+    }
+
+    /* T' = 0t + FK (history) */
+    if ( Vatte(&kp->kravatte, tagPrime, sizeof(tagPrime) * 8, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+
+    /* e = e + 1 */
+    kp->e ^= 1;
+
+    /* if T' != T then */
+    if ( memcmp( tagPrime, tag, sizeof(tagPrime)) != 0) {
+        /* wipe P, return error! */
+        memset(plaintext, 0, (dataBitLen + 7) / 8);
+        return 1;
+    }
+    /* else return P */
+    return 0;
+}
+
+/* ------------------------------------------------------------------------- */
+
+static BitLength Kravatte_WBC_Split(BitLength n)
+{
+    BitLength   nL;
+    BitLength   q, x;
+
+    if (n <= (2 * Kravatte_WBC_b - (Kravatte_WBC_l + 2)))
+        nL = Kravatte_WBC_l * ((n + Kravatte_WBC_l) / (2*Kravatte_WBC_l));
+    else {
+        q = (n + Kravatte_WBC_l + 2 + (Kravatte_WBC_b - 1)) / Kravatte_WBC_b;
+        for (x = 1; (BitLength)(1 << x) < q; ++x)
+            ; /* empty */
+        --x;
+        nL = (q - (BitLength)(1 << x)) * Kravatte_WBC_b - Kravatte_WBC_l;
+    }
+    return nL;
+}
+
+#define Lp  plaintext
+#define Rp  (plaintext + nL / 8)
+#define Lc  ciphertext
+#define Rc  (ciphertext + nL / 8)
+
+int Kravatte_WBC_Encipher(Kravatte_Instance *kv, const BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen,
+                        const BitSequence *W, BitLength WBitLen)
+{
+    size_t nL = Kravatte_WBC_Split(dataBitLen);
+    size_t nR = dataBitLen - nL;
+    size_t nL0 = MyMin(width, nL);
+    size_t nR0 = MyMin(width, nR);
+    unsigned char R0[SnP_widthInBytes];
+    unsigned char HkW[SnP_widthInBytes];
+    unsigned char kRollAfterHkW[Kravatte_RollcSizeInBytes];
+    unsigned int numberOfBitsInLastByte;
+    BitSequence lastByte[1];
+
+    /* R0 = R0 + Hk(L || 0) */
+    if (Kra(kv, Lp, nL, KRAVATTE_FLAG_INIT) != 0) /* Do complete L, is always a multiple of 8 bits */
+        return 1;
+    lastByte[0] = 0;
+    if (Kravatte(kv, lastByte, 1, R0, nR0, KRAVATTE_FLAG_SHORT) != 0)
+        return 1;
+    memxoris(R0, Rp, nR0);
+
+    /* L = L + Fk(R || 1 . W) */
+    if (Kra(kv, W, WBitLen, KRAVATTE_FLAG_INIT | KRAVATTE_FLAG_LAST_PART) != 0)
+        return 1;
+    memcpy(HkW, kv->xAccu.a, SnP_widthInBytes);
+    memcpy(kRollAfterHkW, kv->kRoll.a+Kravatte_RollcOffset, Kravatte_RollcSizeInBytes);
+    numberOfBitsInLastByte = nR & 7;
+    lastByte[0] = (numberOfBitsInLastByte != 0) ? Rp[nR/8] : 0;
+    if (nR0 == nR) {
+        if (Kra(kv, R0, nR0 - numberOfBitsInLastByte, KRAVATTE_FLAG_NONE) != 0)  /* Compress R0 except last byte if incomplete */
+            return 1;
+        lastByte[0] = (numberOfBitsInLastByte != 0) ? R0[nR/8] : 0;
+    }
+    else {
+        if (Kra(kv, R0, nR0, KRAVATTE_FLAG_NONE) != 0) /* compress R0 */
+            return 1;
+        if (Kra(kv, Rp + nR0 / 8, nR - nR0 - numberOfBitsInLastByte, KRAVATTE_FLAG_NONE) != 0)  /* rest of R except last byte if incomplete */
+            return 1;
+        lastByte[0] = (numberOfBitsInLastByte != 0) ? Rp[nR/8] : 0;
+    }
+    lastByte[0] &= (1 << numberOfBitsInLastByte) - 1;
+    lastByte[0] |= 1 << numberOfBitsInLastByte;
+    if (Kravatte(kv, lastByte, numberOfBitsInLastByte + 1, Lc, nL, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    memxoris(Lc, Lp, nL);
+
+    /* R = R + Fk(L || 0 . W) */
+    memcpy(kv->kRoll.a+Kravatte_RollcOffset, kRollAfterHkW, Kravatte_RollcSizeInBytes);
+    memcpy(kv->xAccu.a, HkW, SnP_widthInBytes);
+    if (Kra(kv, Lc, nL, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    lastByte[0] = 0;
+    if (Kravatte(kv, lastByte, 1, Rc, nR, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    memxoris(Rc, R0, nR0);
+    memxoris(Rc + nR0 / 8, Rp + nR0 / 8, nR - nR0);
+
+    /* L0 = L0 + Hk(R || 1) */
+    if (Kra(kv, Rc, nR - numberOfBitsInLastByte, KRAVATTE_FLAG_INIT) != 0) /* Do all except last byte if incomplete */
+        return 1;
+    lastByte[0] = (numberOfBitsInLastByte != 0) ? Rc[nR/8] : 0;
+    lastByte[0] &= (1 << numberOfBitsInLastByte) - 1;
+    lastByte[0] |= 1 << numberOfBitsInLastByte;
+    if (Kravatte(kv, lastByte, numberOfBitsInLastByte + 1, R0, nL0, KRAVATTE_FLAG_SHORT) != 0)
+        return 1;
+    memxoris(Lc, R0, nL0);
+
+    return 0;
+}
+
+int Kravatte_WBC_Decipher(Kravatte_Instance *kv, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen,
+                        const BitSequence *W, BitLength WBitLen)
+{
+    size_t nL = Kravatte_WBC_Split(dataBitLen);
+    size_t nR = dataBitLen - nL;
+    size_t nL0 = MyMin(width, nL);
+    size_t nR0 = MyMin(width, nR);
+    unsigned char L0[SnP_widthInBytes];
+    unsigned char HkW[SnP_widthInBytes];
+    unsigned char kRollAfterHkW[Kravatte_RollcSizeInBytes];
+    unsigned int numberOfBitsInLastByte;
+    BitSequence lastByte[1];
+
+    /* L0 = L0 + Hk(R || 1) */
+    numberOfBitsInLastByte = nR & 7;
+    if (Kra(kv, Rc, nR - numberOfBitsInLastByte, KRAVATTE_FLAG_INIT) != 0) /* Do all except last byte if incomplete */
+        return 1;
+    lastByte[0] = (numberOfBitsInLastByte != 0) ? Rc[nR/8] : 0;
+    lastByte[0] &= (1 << numberOfBitsInLastByte) - 1;
+    lastByte[0] |= 1 << numberOfBitsInLastByte;
+    if (Kravatte(kv, lastByte, numberOfBitsInLastByte + 1, L0, nL0, KRAVATTE_FLAG_SHORT) != 0)
+        return 1;
+    memxoris( L0, Lc, nL0);
+
+    /* R = R + Fk(L || 0 . W) */
+    if (Kra(kv, W, WBitLen, KRAVATTE_FLAG_INIT | KRAVATTE_FLAG_LAST_PART) != 0)
+        return 1;
+    memcpy(HkW, kv->xAccu.a, SnP_widthInBytes);
+    memcpy(kRollAfterHkW, kv->kRoll.a+Kravatte_RollcOffset, Kravatte_RollcSizeInBytes);
+    if (Kra(kv, L0, nL0, KRAVATTE_FLAG_NONE) != 0) /* compress L0 */
+        return 1;
+    if (Kra(kv, Lc + nL0 / 8, nL - nL0, KRAVATTE_FLAG_NONE) != 0)  /* compress rest of L */
+        return 1;
+    lastByte[0] = 0;
+    if (Kravatte(kv, lastByte, 1, Rp, nR, KRAVATTE_FLAG_NONE) != 0)  /* last zero bit */
+        return 1;
+    memxoris(Rp, Rc, nR);
+
+    /* L = L + Fk(R || 1 . W) */
+    memcpy(kv->kRoll.a+Kravatte_RollcOffset, kRollAfterHkW, Kravatte_RollcSizeInBytes);
+    memcpy(kv->xAccu.a, HkW, SnP_widthInBytes);
+    if (Kra(kv, Rp, nR - numberOfBitsInLastByte, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    lastByte[0] = (numberOfBitsInLastByte != 0) ? Rp[nR/8] : 0;
+    lastByte[0] &= (1 << numberOfBitsInLastByte) - 1;
+    lastByte[0] |= 1 << numberOfBitsInLastByte;
+    if (Kravatte(kv, lastByte, numberOfBitsInLastByte + 1, Lp, nL, KRAVATTE_FLAG_NONE) != 0)
+        return 1;
+    memxoris(Lp, L0, nL0);
+    memxoris(Lp + nL0 / 8, Lc + nL0 / 8, nL - nL0);
+
+    /* R0 = R0 + Hk(L || 0) */
+    if (Kra(kv, Lp, nL, KRAVATTE_FLAG_INIT) != 0) /* Do all, L is always a multiple of 8 bits */
+        return 1;
+    lastByte[0] = 0;
+    if (Kravatte(kv, lastByte, 1, L0, nR0, KRAVATTE_FLAG_SHORT) != 0)
+        return 1;
+    memxoris(Rp, L0, nR0);
+
+    return 0;
+}
+
+int Kravatte_WBCAE_Encipher(Kravatte_Instance *kv, BitSequence *plaintext, BitSequence *ciphertext, BitLength dataBitLen,
+                        const BitSequence *AD, BitLength ADBitLen)
+{
+    size_t          databytelen = dataBitLen / 8;
+    unsigned int    nbitsInLastByte = dataBitLen & 7;
+    int             result;
+
+    if (nbitsInLastByte != 0) {
+        plaintext[databytelen] &= ((1 << nbitsInLastByte) - 1);
+        ++databytelen;
+    }
+    memset(plaintext + databytelen, 0, Kravatte_WBCAE_t/8);
+
+    result = Kravatte_WBC_Encipher(kv, plaintext, ciphertext, dataBitLen + Kravatte_WBCAE_t, AD, ADBitLen);
+
+    return(result);
+}
+
+const BitSequence Kravatte_WBCAE_Zero[Kravatte_WBCAE_t/8] = { 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 };
+
+int Kravatte_WBCAE_Decipher(Kravatte_Instance *kv, const BitSequence *ciphertext, BitSequence *plaintext, BitLength dataBitLen,
+                        const BitSequence *AD, BitLength ADBitLen)
+{
+    unsigned int nbitsInLastByte = dataBitLen & 7;
+
+    if ( Kravatte_WBC_Decipher(kv, ciphertext, plaintext, dataBitLen + Kravatte_WBCAE_t, AD, ADBitLen) != 0)
+        return 1;
+    if (nbitsInLastByte != 0) { /* check first bits of checkValue sitting in last byte of plaintext */
+        if ((plaintext[dataBitLen/8] & ~((1 << nbitsInLastByte) - 1)) != 0) {
+            memset( plaintext, 0, (dataBitLen + Kravatte_WBCAE_t + 7) / 8 );
+            return 1;
+        }
+    }
+    if (memcmp(plaintext + (dataBitLen+7)/8, Kravatte_WBCAE_Zero, Kravatte_WBCAE_t/8) != 0) {
+        memset( plaintext, 0, (dataBitLen + Kravatte_WBCAE_t + 7) / 8 );
+        return 1;
+    }
+    return 0;
+}
+
+#undef  Lp
+#undef  Rp
+#undef  Lc
+#undef  Rc