@yielded/crypto 0.0.0-stage → 0.1.0-beta.20

package/src/internal/signature.ts

@@ -0,0 +1,188 @@
+import { Effect, Redacted, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+
+import { InvalidInput } from "../Errors";
+import {
+  type Algorithm,
+  PrivateKeyParameters,
+  PublicKeyParameters,
+  SignInput,
+  Signature,
+  VerifyInput,
+} from "../Signature";
+import { copy, decode, importError, nativeError, withSecret } from "./common";
+
+const derBytes = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(16384));
+
+const RsaAlgorithm = Schema.Struct({
+  modulusLength: Schema.Int.check(Schema.isGreaterThanOrEqualTo(2048)),
+});
+
+const importAlgorithm = (algorithm: Algorithm) => {
+  switch (algorithm) {
+    case "ECDSA-P256-SHA256":
+      return { name: "ECDSA", namedCurve: "P-256" };
+    case "RSA-PSS-SHA256":
+      return { name: "RSA-PSS", hash: "SHA-256" };
+    case "RSASSA-PKCS1-v1_5-SHA256":
+      return { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    case "Ed25519":
+      return { name: "Ed25519" };
+  }
+};
+
+const operationAlgorithm = (algorithm: Algorithm) => {
+  switch (algorithm) {
+    case "ECDSA-P256-SHA256":
+      return { name: "ECDSA", hash: "SHA-256" };
+    case "RSA-PSS-SHA256":
+      return { name: "RSA-PSS", saltLength: 32 };
+    case "RSASSA-PKCS1-v1_5-SHA256":
+      return { name: "RSASSA-PKCS1-v1_5" };
+    case "Ed25519":
+      return { name: "Ed25519" };
+  }
+};
+
+export const makeSignature = (subtle: SubtleCrypto): Signature["Service"] => {
+  // JOSE owns JWK metadata and policy. The adapter translates validated raw
+  // components through its platform key parser.
+  const importComponents = Effect.fnUntraced(function* (
+    parameters: PublicKeyParameters | PrivateKeyParameters,
+    usage: "sign" | "verify",
+  ) {
+    let jwk: JsonWebKey;
+
+    switch (parameters.algorithm) {
+      case "ECDSA-P256-SHA256":
+        jwk = {
+          kty: "EC",
+          crv: "P-256",
+          x: Base64Url.encode(parameters.x),
+          y: Base64Url.encode(parameters.y),
+        };
+        break;
+      case "Ed25519":
+        jwk = { kty: "OKP", crv: "Ed25519", x: Base64Url.encode(parameters.x) };
+        break;
+      case "RSASSA-PKCS1-v1_5-SHA256":
+      case "RSA-PSS-SHA256":
+        jwk = { kty: "RSA", n: Base64Url.encode(parameters.n), e: Base64Url.encode(parameters.e) };
+        if ("p" in parameters) {
+          jwk.p = Base64Url.encode(parameters.p);
+          jwk.q = Base64Url.encode(parameters.q);
+          jwk.dp = Base64Url.encode(parameters.dp);
+          jwk.dq = Base64Url.encode(parameters.dq);
+          jwk.qi = Base64Url.encode(parameters.qi);
+        }
+    }
+    if ("d" in parameters) jwk.d = Base64Url.encode(parameters.d);
+
+    const key = yield* Effect.tryPromise({
+      try: () => subtle.importKey("jwk", jwk, importAlgorithm(parameters.algorithm), true, [usage]),
+      catch: importError,
+    });
+
+    if (
+      parameters.algorithm === "RSA-PSS-SHA256" ||
+      parameters.algorithm === "RSASSA-PKCS1-v1_5-SHA256"
+    ) {
+      yield* Schema.decodeUnknownEffect(RsaAlgorithm)(key.algorithm).pipe(
+        Effect.mapError(() => InvalidInput.make({ reason: "key" })),
+      );
+    }
+
+    return key;
+  });
+
+  const importKey = Effect.fnUntraced(function* (
+    algorithm: Algorithm,
+    format: "pkcs8" | "spki",
+    material: Uint8Array<ArrayBuffer>,
+  ) {
+    yield* decode(derBytes, material, "key");
+
+    const key = yield* Effect.tryPromise({
+      try: () =>
+        subtle.importKey(format, material, importAlgorithm(algorithm), false, [
+          format === "pkcs8" ? "sign" : "verify",
+        ]),
+      catch: importError,
+    });
+
+    if (algorithm === "RSA-PSS-SHA256" || algorithm === "RSASSA-PKCS1-v1_5-SHA256") {
+      // The platform parsed this DER key. Validate its actual modulus, not caller metadata.
+      yield* Schema.decodeUnknownEffect(RsaAlgorithm)(key.algorithm).pipe(
+        Effect.mapError(() => InvalidInput.make({ reason: "key" })),
+      );
+    }
+
+    return key;
+  });
+
+  return Signature.of({
+    encodePublicKey: Effect.fnUntraced(function* (input) {
+      const parameters = yield* decode(PublicKeyParameters, input, "key");
+      const key = yield* importComponents(parameters, "verify");
+
+      const encoded = yield* Effect.tryPromise({
+        try: () => subtle.exportKey("spki", key),
+        catch: nativeError,
+      });
+
+      return new Uint8Array(encoded);
+    }),
+    encodePrivateKey: Effect.fnUntraced(function* (input) {
+      const wrapped = yield* decode(
+        Schema.Redacted(PrivateKeyParameters, { disallowJsonEncode: true }),
+        input,
+        "key",
+      );
+
+      const parameters = Redacted.value(wrapped);
+      const key = yield* importComponents(parameters, "sign");
+
+      const encoded = yield* Effect.tryPromise({
+        try: () => subtle.exportKey("pkcs8", key),
+        catch: nativeError,
+      });
+
+      return Redacted.make(new Uint8Array(encoded));
+    }),
+    sign: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(SignInput, input, "data");
+      const data = yield* copy(value.data);
+
+      return yield* withSecret(value.privateKey, (material) =>
+        Effect.gen(function* () {
+          const key = yield* importKey(value.algorithm, "pkcs8", material);
+
+          const result = yield* Effect.tryPromise({
+            try: () => subtle.sign(operationAlgorithm(value.algorithm), key, data),
+            catch: nativeError,
+          });
+
+          return new Uint8Array(result);
+        }).pipe(Effect.uninterruptible),
+      );
+    }),
+    verify: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(VerifyInput, input, "data");
+      const material = yield* copy(value.publicKey);
+      const data = yield* copy(value.data);
+      const signature = yield* copy(value.signature);
+      const key = yield* importKey(value.algorithm, "spki", material);
+
+      if (
+        (value.algorithm === "ECDSA-P256-SHA256" || value.algorithm === "Ed25519") &&
+        signature.length !== 64
+      )
+        return false;
+
+      return yield* Effect.tryPromise({
+        try: () => subtle.verify(operationAlgorithm(value.algorithm), key, signature, data),
+        catch: nativeError,
+      });
+    }),
+  });
+};

package/src/internal/word64.ts

@@ -0,0 +1,48 @@
+/**
+ * Adapted from noble-hashes, Copyright (c) 2022 Paul Miller.
+ * MIT; source revision 8060cc83bbab6681d23c9eed071db3f3a6b442da.
+ * See ../../THIRD_PARTY_NOTICES.md for source mapping and license.
+ */
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+export const rotrSH = (h: number, l: number, s: number): number => (h >>> s) | (l << (32 - s));
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+export const rotrSL = (h: number, l: number, s: number): number => (h << (32 - s)) | (l >>> s);
+
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+export const rotrBH = (h: number, l: number, s: number): number =>
+  (h << (64 - s)) | (l >>> (s - 32));
+
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+export const rotrBL = (h: number, l: number, s: number): number =>
+  (h >>> (s - 32)) | (l << (64 - s));
+
+// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
+export const rotr32H = (_h: number, l: number): number => l;
+// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
+export const rotr32L = (h: number, _l: number): number => h;
+
+// Add two split 64-bit words and return the split `{ h, l }` sum.
+// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
+// of the low sum and instead use division.
+export function add(
+  Ah: number,
+  Al: number,
+  Bh: number,
+  Bl: number,
+): {
+  h: number;
+  l: number;
+} {
+  const l = (Al >>> 0) + (Bl >>> 0);
+
+  return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
+}
+
+// Addition with more than 2 elements
+// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
+export const add3L = (Al: number, Bl: number, Cl: number): number =>
+  (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+
+// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
+export const add3H = (low: number, Ah: number, Bh: number, Ch: number): number =>
+  (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;

package/src/internal/xchacha-core.ts

@@ -0,0 +1,397 @@
+/**
+ * Adapted from noble-ciphers, Copyright (c) 2022 Paul Miller.
+ * MIT; source revision 785181b0772ba84afbe812025714163e4e48262f.
+ * Poly1305 arithmetic derives from the public-domain poly1305-donna implementation.
+ * See ../../THIRD_PARTY_NOTICES.md for source mapping and licenses.
+ */
+import { Poly1305 } from "./poly1305";
+
+const rotl = (word: number, shift: number): number => (word << shift) | (word >>> (32 - shift));
+
+function chachaCore(
+  s: Uint32Array,
+  k: Uint32Array,
+  n: Uint32Array,
+  out: Uint32Array,
+  cnt: number,
+  rounds = 20,
+): void {
+  let y00 = s[0],
+    y01 = s[1],
+    y02 = s[2],
+    y03 = s[3], // "expa"   "nd 3"  "2-by"  "te k"
+    y04 = k[0],
+    y05 = k[1],
+    y06 = k[2],
+    y07 = k[3], // Key      Key     Key     Key
+    y08 = k[4],
+    y09 = k[5],
+    y10 = k[6],
+    y11 = k[7], // Key      Key     Key     Key
+    y12 = cnt,
+    y13 = n[0],
+    y14 = n[1],
+    y15 = n[2]; // Counter  Counter	Nonce   Nonce
+
+  // Save state to temporary variables
+  let x00 = y00,
+    x01 = y01,
+    x02 = y02,
+    x03 = y03,
+    x04 = y04,
+    x05 = y05,
+    x06 = y06,
+    x07 = y07,
+    x08 = y08,
+    x09 = y09,
+    x10 = y10,
+    x11 = y11,
+    x12 = y12,
+    x13 = y13,
+    x14 = y14,
+    x15 = y15;
+
+  for (let r = 0; r < rounds; r += 2) {
+    x00 = (x00 + x04) | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = (x08 + x12) | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = (x00 + x04) | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = (x08 + x12) | 0;
+    x04 = rotl(x04 ^ x08, 7);
+
+    x01 = (x01 + x05) | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = (x09 + x13) | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = (x01 + x05) | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = (x09 + x13) | 0;
+    x05 = rotl(x05 ^ x09, 7);
+
+    x02 = (x02 + x06) | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = (x10 + x14) | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = (x02 + x06) | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = (x10 + x14) | 0;
+    x06 = rotl(x06 ^ x10, 7);
+
+    x03 = (x03 + x07) | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = (x11 + x15) | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = (x03 + x07) | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = (x11 + x15) | 0;
+    x07 = rotl(x07 ^ x11, 7);
+
+    x00 = (x00 + x05) | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = (x10 + x15) | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = (x00 + x05) | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = (x10 + x15) | 0;
+    x05 = rotl(x05 ^ x10, 7);
+
+    x01 = (x01 + x06) | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = (x11 + x12) | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = (x01 + x06) | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = (x11 + x12) | 0;
+    x06 = rotl(x06 ^ x11, 7);
+
+    x02 = (x02 + x07) | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = (x08 + x13) | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = (x02 + x07) | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = (x08 + x13) | 0;
+    x07 = rotl(x07 ^ x08, 7);
+
+    x03 = (x03 + x04) | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = (x09 + x14) | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = (x03 + x04) | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = (x09 + x14) | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  // Write output
+  let oi = 0;
+
+  out[oi++] = (y00 + x00) | 0;
+  out[oi++] = (y01 + x01) | 0;
+  out[oi++] = (y02 + x02) | 0;
+  out[oi++] = (y03 + x03) | 0;
+  out[oi++] = (y04 + x04) | 0;
+  out[oi++] = (y05 + x05) | 0;
+  out[oi++] = (y06 + x06) | 0;
+  out[oi++] = (y07 + x07) | 0;
+  out[oi++] = (y08 + x08) | 0;
+  out[oi++] = (y09 + x09) | 0;
+  out[oi++] = (y10 + x10) | 0;
+  out[oi++] = (y11 + x11) | 0;
+  out[oi++] = (y12 + x12) | 0;
+  out[oi++] = (y13 + x13) | 0;
+  out[oi++] = (y14 + x14) | 0;
+  out[oi++] = (y15 + x15) | 0;
+}
+/**
+ * hchacha hashes key and nonce into key' and nonce' for xchacha20.
+ */
+function hchacha(s: Uint32Array, k: Uint32Array, i: Uint32Array, out: Uint32Array): void {
+  let x00 = s[0],
+    x01 = s[1],
+    x02 = s[2],
+    x03 = s[3],
+    x04 = k[0],
+    x05 = k[1],
+    x06 = k[2],
+    x07 = k[3],
+    x08 = k[4],
+    x09 = k[5],
+    x10 = k[6],
+    x11 = k[7],
+    x12 = i[0],
+    x13 = i[1],
+    x14 = i[2],
+    x15 = i[3];
+
+  for (let r = 0; r < 20; r += 2) {
+    x00 = (x00 + x04) | 0;
+    x12 = rotl(x12 ^ x00, 16);
+    x08 = (x08 + x12) | 0;
+    x04 = rotl(x04 ^ x08, 12);
+    x00 = (x00 + x04) | 0;
+    x12 = rotl(x12 ^ x00, 8);
+    x08 = (x08 + x12) | 0;
+    x04 = rotl(x04 ^ x08, 7);
+
+    x01 = (x01 + x05) | 0;
+    x13 = rotl(x13 ^ x01, 16);
+    x09 = (x09 + x13) | 0;
+    x05 = rotl(x05 ^ x09, 12);
+    x01 = (x01 + x05) | 0;
+    x13 = rotl(x13 ^ x01, 8);
+    x09 = (x09 + x13) | 0;
+    x05 = rotl(x05 ^ x09, 7);
+
+    x02 = (x02 + x06) | 0;
+    x14 = rotl(x14 ^ x02, 16);
+    x10 = (x10 + x14) | 0;
+    x06 = rotl(x06 ^ x10, 12);
+    x02 = (x02 + x06) | 0;
+    x14 = rotl(x14 ^ x02, 8);
+    x10 = (x10 + x14) | 0;
+    x06 = rotl(x06 ^ x10, 7);
+
+    x03 = (x03 + x07) | 0;
+    x15 = rotl(x15 ^ x03, 16);
+    x11 = (x11 + x15) | 0;
+    x07 = rotl(x07 ^ x11, 12);
+    x03 = (x03 + x07) | 0;
+    x15 = rotl(x15 ^ x03, 8);
+    x11 = (x11 + x15) | 0;
+    x07 = rotl(x07 ^ x11, 7);
+
+    x00 = (x00 + x05) | 0;
+    x15 = rotl(x15 ^ x00, 16);
+    x10 = (x10 + x15) | 0;
+    x05 = rotl(x05 ^ x10, 12);
+    x00 = (x00 + x05) | 0;
+    x15 = rotl(x15 ^ x00, 8);
+    x10 = (x10 + x15) | 0;
+    x05 = rotl(x05 ^ x10, 7);
+
+    x01 = (x01 + x06) | 0;
+    x12 = rotl(x12 ^ x01, 16);
+    x11 = (x11 + x12) | 0;
+    x06 = rotl(x06 ^ x11, 12);
+    x01 = (x01 + x06) | 0;
+    x12 = rotl(x12 ^ x01, 8);
+    x11 = (x11 + x12) | 0;
+    x06 = rotl(x06 ^ x11, 7);
+
+    x02 = (x02 + x07) | 0;
+    x13 = rotl(x13 ^ x02, 16);
+    x08 = (x08 + x13) | 0;
+    x07 = rotl(x07 ^ x08, 12);
+    x02 = (x02 + x07) | 0;
+    x13 = rotl(x13 ^ x02, 8);
+    x08 = (x08 + x13) | 0;
+    x07 = rotl(x07 ^ x08, 7);
+
+    x03 = (x03 + x04) | 0;
+    x14 = rotl(x14 ^ x03, 16);
+    x09 = (x09 + x14) | 0;
+    x04 = rotl(x04 ^ x09, 12);
+    x03 = (x03 + x04) | 0;
+    x14 = rotl(x14 ^ x03, 8);
+    x09 = (x09 + x14) | 0;
+    x04 = rotl(x04 ^ x09, 7);
+  }
+  let oi = 0;
+
+  out[oi++] = x00;
+  out[oi++] = x01;
+  out[oi++] = x02;
+  out[oi++] = x03;
+  out[oi++] = x12;
+  out[oi++] = x13;
+  out[oi++] = x14;
+  out[oi++] = x15;
+}
+
+const sigma = Uint32Array.from([0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]);
+const padding = new Uint8Array(16);
+
+interface State {
+  readonly key: Uint32Array;
+  readonly nonce: Uint32Array;
+  readonly words: Uint32Array;
+  readonly stream: Uint8Array;
+}
+
+const readWords = (data: Uint8Array, words: Uint32Array): void => {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+
+  for (let i = 0; i < words.length; i++) words[i] = view.getUint32(i * 4, true);
+};
+
+function withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: State) => A): A {
+  const original = new Uint32Array(8);
+  const extendedNonce = new Uint32Array(4);
+
+  const state: State = {
+    key: new Uint32Array(8),
+    nonce: new Uint32Array(3),
+    words: new Uint32Array(16),
+    stream: new Uint8Array(64),
+  };
+
+  try {
+    readWords(key, original);
+    readWords(nonce.subarray(0, 16), extendedNonce);
+    hchacha(sigma, original, extendedNonce, state.key);
+    // XChaCha uses HChaCha(key, nonce[0..16]), then 0 || nonce[16..24].
+    const view = new DataView(nonce.buffer, nonce.byteOffset, nonce.byteLength);
+
+    state.nonce[1] = view.getUint32(16, true);
+    state.nonce[2] = view.getUint32(20, true);
+
+    return operation(state);
+  } finally {
+    original.fill(0);
+    extendedNonce.fill(0);
+    state.key.fill(0);
+    state.nonce.fill(0);
+    state.words.fill(0);
+    state.stream.fill(0);
+  }
+}
+
+const blockAt = (state: State, counter: number): void => {
+  chachaCore(sigma, state.key, state.nonce, state.words, counter);
+  const view = new DataView(state.stream.buffer, state.stream.byteOffset, state.stream.byteLength);
+
+  for (let i = 0; i < 16; i++) view.setUint32(i * 4, state.words[i], true);
+};
+
+const xor = (state: State, data: Uint8Array, out: Uint8Array): void => {
+  for (let offset = 0, counter = 1; offset < data.length; offset += 64, counter++) {
+    blockAt(state, counter);
+    const length = Math.min(64, data.length - offset);
+
+    for (let i = 0; i < length; i++) out[offset + i] = data[offset + i] ^ state.stream[i];
+  }
+};
+
+const padded = (mac: Poly1305, data: Uint8Array): void => {
+  mac.update(data);
+  const remainder = data.length % 16;
+
+  if (remainder !== 0) mac.update(padding.subarray(remainder));
+};
+
+const tag = (state: State, ciphertext: Uint8Array, additionalData: Uint8Array): Uint8Array => {
+  const lengths = new Uint8Array(16);
+  const view = new DataView(lengths.buffer);
+
+  // RFC 8439 authenticates little-endian 64-bit byte lengths, AAD first.
+  view.setUint32(0, additionalData.length >>> 0, true);
+  view.setUint32(4, Math.floor(additionalData.length / 0x100000000), true);
+  view.setUint32(8, ciphertext.length >>> 0, true);
+  view.setUint32(12, Math.floor(ciphertext.length / 0x100000000), true);
+  blockAt(state, 0);
+  const mac = new Poly1305(state.stream.subarray(0, 32));
+
+  try {
+    padded(mac, additionalData);
+    padded(mac, ciphertext);
+
+    return mac.update(lengths).digest();
+  } finally {
+    mac.destroy();
+    lengths.fill(0);
+    state.stream.fill(0);
+  }
+};
+
+export const encrypt = (
+  key: Uint8Array,
+  nonce: Uint8Array,
+  additionalData: Uint8Array,
+  plaintext: Uint8Array,
+): Uint8Array =>
+  withState(key, nonce, (state) => {
+    const out = new Uint8Array(plaintext.length + 16);
+    const ciphertext = out.subarray(0, plaintext.length);
+
+    try {
+      xor(state, plaintext, ciphertext);
+      const authentication = tag(state, ciphertext, additionalData);
+
+      out.set(authentication, plaintext.length);
+      authentication.fill(0);
+
+      return out;
+    } catch (error) {
+      out.fill(0);
+      throw error;
+    }
+  });
+
+/** Authenticate the complete input before allocating or producing plaintext. */
+export const decrypt = (
+  key: Uint8Array,
+  nonce: Uint8Array,
+  additionalData: Uint8Array,
+  sealed: Uint8Array,
+): Uint8Array | undefined =>
+  withState(key, nonce, (state) => {
+    const ciphertext = sealed.subarray(0, -16);
+    const authentication = tag(state, ciphertext, additionalData);
+    let difference = 0;
+
+    for (let i = 0; i < 16; i++) difference |= authentication[i] ^ sealed[ciphertext.length + i];
+    authentication.fill(0);
+    if (difference !== 0) return undefined;
+    const out = new Uint8Array(ciphertext.length);
+
+    try {
+      xor(state, ciphertext, out);
+
+      return out;
+    } catch (error) {
+      out.fill(0);
+      throw error;
+    }
+  });

package/src/internal/xchacha.ts

@@ -0,0 +1,26 @@
+import { Effect } from "effect";
+
+import { AuthenticationFailed, InvalidInput } from "../Errors";
+import type { XChaCha } from "./aead";
+import { decrypt, encrypt } from "./xchacha-core";
+
+// Counter zero derives the MAC key; payload blocks use the remaining uint32 values.
+const maximumPlaintextBytes = 0xffffffff * 64;
+
+export const xchacha: XChaCha = {
+  encrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {
+    if (data.length > maximumPlaintextBytes) return yield* InvalidInput.make({ reason: "data" });
+
+    return encrypt(key, nonce, additionalData, data);
+  }),
+  decrypt: Effect.fnUntraced(function* ({ key, nonce, additionalData, data }) {
+    if (data.length - 16 > maximumPlaintextBytes)
+      return yield* InvalidInput.make({ reason: "data" });
+
+    const plaintext = decrypt(key, nonce, additionalData, data);
+
+    if (plaintext === undefined) return yield* AuthenticationFailed.make({});
+
+    return plaintext;
+  }),
+};

package/src/platform-bun.ts

@@ -0,0 +1,2 @@
+/** Cryptography for Bun through its Node-compatible native APIs. */
+export { layer } from "./internal/node";

package/src/platform-node.ts

@@ -0,0 +1,2 @@
+/** Cryptography for Node.js. Requires a shared KdfAdmission Layer. */
+export { layer } from "./internal/node";