aegis-aead 0.1.1 → 0.2.0

package/src/aegis128l.ts

@@ -8,6 +8,7 @@ import {
 	xorBlocksTo,
 	zeroPad,
 } from "./aes.js";
+import { randomBytes } from "./random.js";
 
 /**
  * AEGIS-128L cipher state.
@@ -285,15 +286,15 @@ export class Aegis128LState {
 }
 
 /**
- * Encrypts a message using AEGIS-128L.
+ * Encrypts a message using AEGIS-128L (detached mode).
  * @param msg - Plaintext message
  * @param ad - Associated data (authenticated but not encrypted)
  * @param key - 16-byte encryption key
  * @param nonce - 16-byte nonce (must be unique per message with the same key)
  * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Object containing ciphertext and authentication tag
+ * @returns Object containing ciphertext and authentication tag separately
  */
-export function aegis128LEncrypt(
+export function aegis128LEncryptDetached(
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
@@ -325,7 +326,7 @@ export function aegis128LEncrypt(
 }
 
 /**
- * Decrypts a message using AEGIS-128L.
+ * Decrypts a message using AEGIS-128L (detached mode).
  * @param ct - Ciphertext
  * @param tag - Authentication tag (16 or 32 bytes)
  * @param ad - Associated data (must match what was used during encryption)
@@ -333,7 +334,7 @@ export function aegis128LEncrypt(
  * @param nonce - 16-byte nonce (must match what was used during encryption)
  * @returns Decrypted plaintext, or null if authentication fails
  */
-export function aegis128LDecrypt(
+export function aegis128LDecryptDetached(
 	ct: Uint8Array,
 	tag: Uint8Array,
 	ad: Uint8Array,
@@ -375,6 +376,94 @@ export function aegis128LDecrypt(
 	return msg;
 }
 
+/** Nonce size for AEGIS-128L in bytes. */
+export const AEGIS_128L_NONCE_SIZE = 16;
+
+/** Key size for AEGIS-128L in bytes. */
+export const AEGIS_128L_KEY_SIZE = 16;
+
+/**
+ * Encrypts a message using AEGIS-128L.
+ * Returns a single buffer containing nonce || ciphertext || tag.
+ * @param msg - Plaintext message
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 16-byte encryption key
+ * @param nonce - 16-byte nonce (optional, generates random nonce if not provided)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Concatenated nonce || ciphertext || tag
+ */
+export function aegis128LEncrypt(
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array | null = null,
+	tagLen: 16 | 32 = 16,
+): Uint8Array {
+	const actualNonce = nonce ?? randomBytes(AEGIS_128L_NONCE_SIZE);
+	const state = new Aegis128LState();
+	state.init(key, actualNonce);
+
+	const adPadded = zeroPad(ad, 32);
+	for (let i = 0; i + 32 <= adPadded.length; i += 32) {
+		state.absorb(adPadded.subarray(i, i + 32));
+	}
+
+	const nonceSize = AEGIS_128L_NONCE_SIZE;
+	const result = new Uint8Array(nonceSize + msg.length + tagLen);
+	result.set(actualNonce, 0);
+
+	const fullBlocks = Math.floor(msg.length / 32) * 32;
+	for (let i = 0; i < fullBlocks; i += 32) {
+		state.encTo(
+			msg.subarray(i, i + 32),
+			result.subarray(nonceSize + i, nonceSize + i + 32),
+		);
+	}
+
+	if (msg.length > fullBlocks) {
+		const lastBlock = zeroPad(msg.subarray(fullBlocks), 32);
+		const encBlock = state.enc(lastBlock);
+		result.set(
+			encBlock.subarray(0, msg.length - fullBlocks),
+			nonceSize + fullBlocks,
+		);
+	}
+
+	const tag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msg.length * 8),
+		tagLen,
+	);
+	result.set(tag, nonceSize + msg.length);
+
+	return result;
+}
+
+/**
+ * Decrypts a message using AEGIS-128L.
+ * Expects input as nonce || ciphertext || tag.
+ * @param sealed - Concatenated nonce || ciphertext || tag
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 16-byte encryption key
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Decrypted plaintext, or null if authentication fails
+ */
+export function aegis128LDecrypt(
+	sealed: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	tagLen: 16 | 32 = 16,
+): Uint8Array | null {
+	const nonceSize = AEGIS_128L_NONCE_SIZE;
+	if (sealed.length < nonceSize + tagLen) {
+		return null;
+	}
+	const nonce = sealed.subarray(0, nonceSize);
+	const ct = sealed.subarray(nonceSize, sealed.length - tagLen);
+	const tag = sealed.subarray(sealed.length - tagLen);
+	return aegis128LDecryptDetached(ct, tag, ad, key, nonce);
+}
+
 /**
  * Computes a MAC (Message Authentication Code) using AEGIS-128L.
  * @param data - Data to authenticate
@@ -418,3 +507,21 @@ export function aegis128LMacVerify(
 	const expectedTag = aegis128LMac(data, key, nonce, tagLen);
 	return constantTimeEqual(tag, expectedTag);
 }
+
+/**
+ * Generates a random 16-byte key for AEGIS-128L.
+ * @returns 16-byte encryption key
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128LCreateKey(): Uint8Array {
+	return randomBytes(AEGIS_128L_KEY_SIZE);
+}
+
+/**
+ * Generates a random 16-byte nonce for AEGIS-128L.
+ * @returns 16-byte nonce
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128LCreateNonce(): Uint8Array {
+	return randomBytes(AEGIS_128L_NONCE_SIZE);
+}

package/src/aegis128x.ts

@@ -10,6 +10,7 @@ import {
 	xorBlocksTo,
 	zeroPad,
 } from "./aes.js";
+import { randomBytes } from "./random.js";
 
 /**
  * AEGIS-128X cipher state with configurable parallelism degree.
@@ -385,16 +386,16 @@ export class Aegis128XState {
 }
 
 /**
- * Encrypts a message using AEGIS-128X.
+ * Encrypts a message using AEGIS-128X (detached mode).
  * @param msg - Plaintext message
  * @param ad - Associated data (authenticated but not encrypted)
  * @param key - 16-byte encryption key
  * @param nonce - 16-byte nonce (must be unique per message with the same key)
  * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
  * @param degree - Parallelism degree (default: 2)
- * @returns Object containing ciphertext and authentication tag
+ * @returns Object containing ciphertext and authentication tag separately
  */
-export function aegis128XEncrypt(
+export function aegis128XEncryptDetached(
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
@@ -432,7 +433,7 @@ export function aegis128XEncrypt(
 }
 
 /**
- * Decrypts a message using AEGIS-128X.
+ * Decrypts a message using AEGIS-128X (detached mode).
  * @param ct - Ciphertext
  * @param tag - Authentication tag (16 or 32 bytes)
  * @param ad - Associated data (must match what was used during encryption)
@@ -441,7 +442,7 @@ export function aegis128XEncrypt(
  * @param degree - Parallelism degree (default: 2)
  * @returns Decrypted plaintext, or null if authentication fails
  */
-export function aegis128XDecrypt(
+export function aegis128XDecryptDetached(
 	ct: Uint8Array,
 	tag: Uint8Array,
 	ad: Uint8Array,
@@ -486,41 +487,169 @@ export function aegis128XDecrypt(
 	return msg;
 }
 
+/** Nonce size for AEGIS-128X in bytes. */
+export const AEGIS_128X_NONCE_SIZE = 16;
+
+/** Key size for AEGIS-128X in bytes. */
+export const AEGIS_128X_KEY_SIZE = 16;
+
+/**
+ * Encrypts a message using AEGIS-128X.
+ * Returns a single buffer containing nonce || ciphertext || tag.
+ * @param msg - Plaintext message
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 16-byte encryption key
+ * @param nonce - 16-byte nonce (optional, generates random nonce if not provided)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns Concatenated nonce || ciphertext || tag
+ */
+export function aegis128XEncrypt(
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array | null = null,
+	tagLen: 16 | 32 = 16,
+	degree: number = 2,
+): Uint8Array {
+	const actualNonce = nonce ?? randomBytes(AEGIS_128X_NONCE_SIZE);
+	const state = new Aegis128XState(degree);
+	const rateBytes = (256 * degree) / 8;
+
+	state.init(key, actualNonce);
+
+	const adPadded = zeroPad(ad, rateBytes);
+	for (let i = 0; i + rateBytes <= adPadded.length; i += rateBytes) {
+		state.absorb(adPadded.subarray(i, i + rateBytes));
+	}
+
+	const nonceSize = AEGIS_128X_NONCE_SIZE;
+	const result = new Uint8Array(nonceSize + msg.length + tagLen);
+	result.set(actualNonce, 0);
+
+	const fullBlocks = Math.floor(msg.length / rateBytes) * rateBytes;
+	for (let i = 0; i < fullBlocks; i += rateBytes) {
+		state.encTo(
+			msg.subarray(i, i + rateBytes),
+			result.subarray(nonceSize + i, nonceSize + i + rateBytes),
+		);
+	}
+
+	if (msg.length > fullBlocks) {
+		const lastBlock = zeroPad(msg.subarray(fullBlocks), rateBytes);
+		const encBlock = state.enc(lastBlock);
+		result.set(
+			encBlock.subarray(0, msg.length - fullBlocks),
+			nonceSize + fullBlocks,
+		);
+	}
+
+	const tag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msg.length * 8),
+		tagLen,
+	);
+	result.set(tag, nonceSize + msg.length);
+
+	return result;
+}
+
+/**
+ * Decrypts a message using AEGIS-128X.
+ * Expects input as nonce || ciphertext || tag.
+ * @param sealed - Concatenated nonce || ciphertext || tag
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 16-byte encryption key
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns Decrypted plaintext, or null if authentication fails
+ */
+export function aegis128XDecrypt(
+	sealed: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	tagLen: 16 | 32 = 16,
+	degree: number = 2,
+): Uint8Array | null {
+	const nonceSize = AEGIS_128X_NONCE_SIZE;
+	if (sealed.length < nonceSize + tagLen) {
+		return null;
+	}
+	const nonce = sealed.subarray(0, nonceSize);
+	const ct = sealed.subarray(nonceSize, sealed.length - tagLen);
+	const tag = sealed.subarray(sealed.length - tagLen);
+	return aegis128XDecryptDetached(ct, tag, ad, key, nonce, degree);
+}
+
+/** AEGIS-128X2 encryption - detached mode (degree=2). */
+export const aegis128X2EncryptDetached = (
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis128XEncryptDetached(msg, ad, key, nonce, tagLen, 2);
+
+/** AEGIS-128X2 decryption - detached mode (degree=2). */
+export const aegis128X2DecryptDetached = (
+	ct: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis128XDecryptDetached(ct, tag, ad, key, nonce, 2);
+
+/** AEGIS-128X4 encryption - detached mode (degree=4). */
+export const aegis128X4EncryptDetached = (
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis128XEncryptDetached(msg, ad, key, nonce, tagLen, 4);
+
+/** AEGIS-128X4 decryption - detached mode (degree=4). */
+export const aegis128X4DecryptDetached = (
+	ct: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis128XDecryptDetached(ct, tag, ad, key, nonce, 4);
+
 /** AEGIS-128X2 encryption (degree=2). */
 export const aegis128X2Encrypt = (
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
+	nonce: Uint8Array | null = null,
 	tagLen: 16 | 32 = 16,
 ) => aegis128XEncrypt(msg, ad, key, nonce, tagLen, 2);
 
 /** AEGIS-128X2 decryption (degree=2). */
 export const aegis128X2Decrypt = (
-	ct: Uint8Array,
-	tag: Uint8Array,
+	sealed: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
-) => aegis128XDecrypt(ct, tag, ad, key, nonce, 2);
+	tagLen: 16 | 32 = 16,
+) => aegis128XDecrypt(sealed, ad, key, tagLen, 2);
 
 /** AEGIS-128X4 encryption (degree=4). */
 export const aegis128X4Encrypt = (
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
+	nonce: Uint8Array | null = null,
 	tagLen: 16 | 32 = 16,
 ) => aegis128XEncrypt(msg, ad, key, nonce, tagLen, 4);
 
 /** AEGIS-128X4 decryption (degree=4). */
 export const aegis128X4Decrypt = (
-	ct: Uint8Array,
-	tag: Uint8Array,
+	sealed: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
-) => aegis128XDecrypt(ct, tag, ad, key, nonce, 4);
+	tagLen: 16 | 32 = 16,
+) => aegis128XDecrypt(sealed, ad, key, tagLen, 4);
 
 /**
  * Computes a MAC (Message Authentication Code) using AEGIS-128X.
@@ -603,3 +732,33 @@ export const aegis128X4MacVerify = (
 	key: Uint8Array,
 	nonce: Uint8Array | null = null,
 ) => aegis128XMacVerify(data, tag, key, nonce, 4);
+
+/**
+ * Generates a random 16-byte key for AEGIS-128X.
+ * @returns 16-byte encryption key
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128XCreateKey(): Uint8Array {
+	return randomBytes(AEGIS_128X_KEY_SIZE);
+}
+
+/**
+ * Generates a random 16-byte nonce for AEGIS-128X.
+ * @returns 16-byte nonce
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128XCreateNonce(): Uint8Array {
+	return randomBytes(AEGIS_128X_NONCE_SIZE);
+}
+
+/** AEGIS-128X2 key generation (degree=2). */
+export const aegis128X2CreateKey = aegis128XCreateKey;
+
+/** AEGIS-128X2 nonce generation (degree=2). */
+export const aegis128X2CreateNonce = aegis128XCreateNonce;
+
+/** AEGIS-128X4 key generation (degree=4). */
+export const aegis128X4CreateKey = aegis128XCreateKey;
+
+/** AEGIS-128X4 nonce generation (degree=4). */
+export const aegis128X4CreateNonce = aegis128XCreateNonce;