aegis-aead 0.1.1 → 0.2.1

package/src/aegis128l.ts

@@ -8,6 +8,7 @@ import {
 	xorBlocksTo,
 	zeroPad,
 } from "./aes.js";
+import { randomBytes } from "./random.js";
 
 /**
  * AEGIS-128L cipher state.
@@ -203,6 +204,37 @@ export class Aegis128LState {
 		return out;
 	}
 
+	/**
+	 * Encrypts a 32-byte plaintext block in-place.
+	 * @param block - 32-byte buffer (plaintext in, ciphertext out)
+	 */
+	encInPlace(block: Uint8Array): void {
+		const z0 = this.z0;
+		const z1 = this.z1;
+		const tmp = this.tmp0;
+
+		xorBlocksTo(this.s1, this.s6, z0);
+		andBlocksTo(this.s2, this.s3, tmp);
+		for (let i = 0; i < 16; i++) z0[i] ^= tmp[i]!;
+
+		xorBlocksTo(this.s2, this.s5, z1);
+		andBlocksTo(this.s6, this.s7, tmp);
+		for (let i = 0; i < 16; i++) z1[i] ^= tmp[i]!;
+
+		this.update(block.subarray(0, 16), block.subarray(16, 32));
+
+		for (let i = 0; i < 16; i++) block[i] ^= z0[i]!;
+		for (let i = 0; i < 16; i++) block[16 + i] ^= z1[i]!;
+	}
+
+	/**
+	 * Decrypts a 32-byte ciphertext block in-place.
+	 * @param block - 32-byte buffer (ciphertext in, plaintext out)
+	 */
+	decInPlace(block: Uint8Array): void {
+		this.decTo(block, block);
+	}
+
 	/**
 	 * Decrypts a partial (final) ciphertext block smaller than 32 bytes.
 	 * @param cn - Partial ciphertext block (1-31 bytes)
@@ -285,15 +317,15 @@ export class Aegis128LState {
 }
 
 /**
- * Encrypts a message using AEGIS-128L.
+ * Encrypts a message using AEGIS-128L (detached mode).
  * @param msg - Plaintext message
  * @param ad - Associated data (authenticated but not encrypted)
  * @param key - 16-byte encryption key
  * @param nonce - 16-byte nonce (must be unique per message with the same key)
  * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Object containing ciphertext and authentication tag
+ * @returns Object containing ciphertext and authentication tag separately
  */
-export function aegis128LEncrypt(
+export function aegis128LEncryptDetached(
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
@@ -325,7 +357,7 @@ export function aegis128LEncrypt(
 }
 
 /**
- * Decrypts a message using AEGIS-128L.
+ * Decrypts a message using AEGIS-128L (detached mode).
  * @param ct - Ciphertext
  * @param tag - Authentication tag (16 or 32 bytes)
  * @param ad - Associated data (must match what was used during encryption)
@@ -333,7 +365,7 @@ export function aegis128LEncrypt(
  * @param nonce - 16-byte nonce (must match what was used during encryption)
  * @returns Decrypted plaintext, or null if authentication fails
  */
-export function aegis128LDecrypt(
+export function aegis128LDecryptDetached(
 	ct: Uint8Array,
 	tag: Uint8Array,
 	ad: Uint8Array,
@@ -375,6 +407,189 @@ export function aegis128LDecrypt(
 	return msg;
 }
 
+/**
+ * Encrypts a message in-place using AEGIS-128L (detached mode).
+ * The input buffer is modified to contain the ciphertext.
+ * @param data - Buffer containing plaintext (will be overwritten with ciphertext)
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 16-byte encryption key
+ * @param nonce - 16-byte nonce (must be unique per message with the same key)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Authentication tag
+ */
+export function aegis128LEncryptDetachedInPlace(
+	data: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+): Uint8Array {
+	const state = new Aegis128LState();
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, 32);
+	for (let i = 0; i + 32 <= adPadded.length; i += 32) {
+		state.absorb(adPadded.subarray(i, i + 32));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / 32) * 32;
+
+	for (let i = 0; i < fullBlocksLen; i += 32) {
+		state.encInPlace(data.subarray(i, i + 32));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const lastBlock = zeroPad(lastPartial, 32);
+		const encBlock = state.enc(lastBlock);
+		lastPartial.set(encBlock.subarray(0, lastPartial.length));
+	}
+
+	return state.finalize(BigInt(ad.length * 8), BigInt(msgLen * 8), tagLen);
+}
+
+/**
+ * Decrypts a message in-place using AEGIS-128L (detached mode).
+ * The input buffer is modified to contain the plaintext (or zeroed on failure).
+ * @param data - Buffer containing ciphertext (will be overwritten with plaintext)
+ * @param tag - Authentication tag (16 or 32 bytes)
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 16-byte encryption key
+ * @param nonce - 16-byte nonce (must match what was used during encryption)
+ * @returns True if authentication succeeds, false otherwise
+ */
+export function aegis128LDecryptDetachedInPlace(
+	data: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+): boolean {
+	const tagLen = tag.length as 16 | 32;
+	const state = new Aegis128LState();
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, 32);
+	for (let i = 0; i + 32 <= adPadded.length; i += 32) {
+		state.absorb(adPadded.subarray(i, i + 32));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / 32) * 32;
+
+	for (let i = 0; i < fullBlocksLen; i += 32) {
+		state.decInPlace(data.subarray(i, i + 32));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const decrypted = state.decPartial(lastPartial);
+		lastPartial.set(decrypted);
+	}
+
+	const expectedTag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msgLen * 8),
+		tagLen,
+	);
+
+	if (!constantTimeEqual(tag, expectedTag)) {
+		data.fill(0);
+		return false;
+	}
+
+	return true;
+}
+
+/** Nonce size for AEGIS-128L in bytes. */
+export const AEGIS_128L_NONCE_SIZE = 16;
+
+/** Key size for AEGIS-128L in bytes. */
+export const AEGIS_128L_KEY_SIZE = 16;
+
+/**
+ * Encrypts a message using AEGIS-128L.
+ * Returns a single buffer containing nonce || ciphertext || tag.
+ * @param msg - Plaintext message
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 16-byte encryption key
+ * @param nonce - 16-byte nonce (optional, generates random nonce if not provided)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Concatenated nonce || ciphertext || tag
+ */
+export function aegis128LEncrypt(
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array | null = null,
+	tagLen: 16 | 32 = 16,
+): Uint8Array {
+	const actualNonce = nonce ?? randomBytes(AEGIS_128L_NONCE_SIZE);
+	const state = new Aegis128LState();
+	state.init(key, actualNonce);
+
+	const adPadded = zeroPad(ad, 32);
+	for (let i = 0; i + 32 <= adPadded.length; i += 32) {
+		state.absorb(adPadded.subarray(i, i + 32));
+	}
+
+	const nonceSize = AEGIS_128L_NONCE_SIZE;
+	const result = new Uint8Array(nonceSize + msg.length + tagLen);
+	result.set(actualNonce, 0);
+
+	const fullBlocks = Math.floor(msg.length / 32) * 32;
+	for (let i = 0; i < fullBlocks; i += 32) {
+		state.encTo(
+			msg.subarray(i, i + 32),
+			result.subarray(nonceSize + i, nonceSize + i + 32),
+		);
+	}
+
+	if (msg.length > fullBlocks) {
+		const lastBlock = zeroPad(msg.subarray(fullBlocks), 32);
+		const encBlock = state.enc(lastBlock);
+		result.set(
+			encBlock.subarray(0, msg.length - fullBlocks),
+			nonceSize + fullBlocks,
+		);
+	}
+
+	const tag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msg.length * 8),
+		tagLen,
+	);
+	result.set(tag, nonceSize + msg.length);
+
+	return result;
+}
+
+/**
+ * Decrypts a message using AEGIS-128L.
+ * Expects input as nonce || ciphertext || tag.
+ * @param sealed - Concatenated nonce || ciphertext || tag
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 16-byte encryption key
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Decrypted plaintext, or null if authentication fails
+ */
+export function aegis128LDecrypt(
+	sealed: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	tagLen: 16 | 32 = 16,
+): Uint8Array | null {
+	const nonceSize = AEGIS_128L_NONCE_SIZE;
+	if (sealed.length < nonceSize + tagLen) {
+		return null;
+	}
+	const nonce = sealed.subarray(0, nonceSize);
+	const ct = sealed.subarray(nonceSize, sealed.length - tagLen);
+	const tag = sealed.subarray(sealed.length - tagLen);
+	return aegis128LDecryptDetached(ct, tag, ad, key, nonce);
+}
+
 /**
  * Computes a MAC (Message Authentication Code) using AEGIS-128L.
  * @param data - Data to authenticate
@@ -418,3 +633,21 @@ export function aegis128LMacVerify(
 	const expectedTag = aegis128LMac(data, key, nonce, tagLen);
 	return constantTimeEqual(tag, expectedTag);
 }
+
+/**
+ * Generates a random 16-byte key for AEGIS-128L.
+ * @returns 16-byte encryption key
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128LCreateKey(): Uint8Array {
+	return randomBytes(AEGIS_128L_KEY_SIZE);
+}
+
+/**
+ * Generates a random 16-byte nonce for AEGIS-128L.
+ * @returns 16-byte nonce
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis128LCreateNonce(): Uint8Array {
+	return randomBytes(AEGIS_128L_NONCE_SIZE);
+}