aegis-aead 0.1.1 → 0.2.1

package/src/aegis256.ts

@@ -8,6 +8,7 @@ import {
 	xorBlocksTo,
 	zeroPad,
 } from "./aes.js";
+import { randomBytes } from "./random.js";
 
 /**
  * AEGIS-256 cipher state.
@@ -172,6 +173,22 @@ export class Aegis256State {
 		return out;
 	}
 
+	/**
+	 * Encrypts a 16-byte plaintext block in-place.
+	 * @param block - 16-byte buffer (plaintext in, ciphertext out)
+	 */
+	encInPlace(block: Uint8Array): void {
+		this.encTo(block, block);
+	}
+
+	/**
+	 * Decrypts a 16-byte ciphertext block in-place.
+	 * @param block - 16-byte buffer (ciphertext in, plaintext out)
+	 */
+	decInPlace(block: Uint8Array): void {
+		this.decTo(block, block);
+	}
+
 	/**
 	 * Decrypts a partial (final) ciphertext block smaller than 16 bytes.
 	 * @param cn - Partial ciphertext block (1-15 bytes)
@@ -244,15 +261,15 @@ export class Aegis256State {
 }
 
 /**
- * Encrypts a message using AEGIS-256.
+ * Encrypts a message using AEGIS-256 (detached mode).
  * @param msg - Plaintext message
  * @param ad - Associated data (authenticated but not encrypted)
  * @param key - 32-byte encryption key
  * @param nonce - 32-byte nonce (must be unique per message with the same key)
  * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Object containing ciphertext and authentication tag
+ * @returns Object containing ciphertext and authentication tag separately
  */
-export function aegis256Encrypt(
+export function aegis256EncryptDetached(
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
@@ -284,7 +301,7 @@ export function aegis256Encrypt(
 }
 
 /**
- * Decrypts a message using AEGIS-256.
+ * Decrypts a message using AEGIS-256 (detached mode).
  * @param ct - Ciphertext
  * @param tag - Authentication tag (16 or 32 bytes)
  * @param ad - Associated data (must match what was used during encryption)
@@ -292,7 +309,7 @@ export function aegis256Encrypt(
  * @param nonce - 32-byte nonce (must match what was used during encryption)
  * @returns Decrypted plaintext, or null if authentication fails
  */
-export function aegis256Decrypt(
+export function aegis256DecryptDetached(
 	ct: Uint8Array,
 	tag: Uint8Array,
 	ad: Uint8Array,
@@ -334,6 +351,189 @@ export function aegis256Decrypt(
 	return msg;
 }
 
+/**
+ * Encrypts a message in-place using AEGIS-256 (detached mode).
+ * The input buffer is modified to contain the ciphertext.
+ * @param data - Buffer containing plaintext (will be overwritten with ciphertext)
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (must be unique per message with the same key)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Authentication tag
+ */
+export function aegis256EncryptDetachedInPlace(
+	data: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+): Uint8Array {
+	const state = new Aegis256State();
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, 16);
+	for (let i = 0; i + 16 <= adPadded.length; i += 16) {
+		state.absorb(adPadded.subarray(i, i + 16));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / 16) * 16;
+
+	for (let i = 0; i < fullBlocksLen; i += 16) {
+		state.encInPlace(data.subarray(i, i + 16));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const lastBlock = zeroPad(lastPartial, 16);
+		const encBlock = state.enc(lastBlock);
+		lastPartial.set(encBlock.subarray(0, lastPartial.length));
+	}
+
+	return state.finalize(BigInt(ad.length * 8), BigInt(msgLen * 8), tagLen);
+}
+
+/**
+ * Decrypts a message in-place using AEGIS-256 (detached mode).
+ * The input buffer is modified to contain the plaintext (or zeroed on failure).
+ * @param data - Buffer containing ciphertext (will be overwritten with plaintext)
+ * @param tag - Authentication tag (16 or 32 bytes)
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (must match what was used during encryption)
+ * @returns True if authentication succeeds, false otherwise
+ */
+export function aegis256DecryptDetachedInPlace(
+	data: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+): boolean {
+	const tagLen = tag.length as 16 | 32;
+	const state = new Aegis256State();
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, 16);
+	for (let i = 0; i + 16 <= adPadded.length; i += 16) {
+		state.absorb(adPadded.subarray(i, i + 16));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / 16) * 16;
+
+	for (let i = 0; i < fullBlocksLen; i += 16) {
+		state.decInPlace(data.subarray(i, i + 16));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const decrypted = state.decPartial(lastPartial);
+		lastPartial.set(decrypted);
+	}
+
+	const expectedTag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msgLen * 8),
+		tagLen,
+	);
+
+	if (!constantTimeEqual(tag, expectedTag)) {
+		data.fill(0);
+		return false;
+	}
+
+	return true;
+}
+
+/** Nonce size for AEGIS-256 in bytes. */
+export const AEGIS_256_NONCE_SIZE = 32;
+
+/** Key size for AEGIS-256 in bytes. */
+export const AEGIS_256_KEY_SIZE = 32;
+
+/**
+ * Encrypts a message using AEGIS-256.
+ * Returns a single buffer containing nonce || ciphertext || tag.
+ * @param msg - Plaintext message
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (optional, generates random nonce if not provided)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Concatenated nonce || ciphertext || tag
+ */
+export function aegis256Encrypt(
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array | null = null,
+	tagLen: 16 | 32 = 16,
+): Uint8Array {
+	const actualNonce = nonce ?? randomBytes(AEGIS_256_NONCE_SIZE);
+	const state = new Aegis256State();
+	state.init(key, actualNonce);
+
+	const adPadded = zeroPad(ad, 16);
+	for (let i = 0; i + 16 <= adPadded.length; i += 16) {
+		state.absorb(adPadded.subarray(i, i + 16));
+	}
+
+	const nonceSize = AEGIS_256_NONCE_SIZE;
+	const result = new Uint8Array(nonceSize + msg.length + tagLen);
+	result.set(actualNonce, 0);
+
+	const fullBlocks = Math.floor(msg.length / 16) * 16;
+	for (let i = 0; i < fullBlocks; i += 16) {
+		state.encTo(
+			msg.subarray(i, i + 16),
+			result.subarray(nonceSize + i, nonceSize + i + 16),
+		);
+	}
+
+	if (msg.length > fullBlocks) {
+		const lastBlock = zeroPad(msg.subarray(fullBlocks), 16);
+		const encBlock = state.enc(lastBlock);
+		result.set(
+			encBlock.subarray(0, msg.length - fullBlocks),
+			nonceSize + fullBlocks,
+		);
+	}
+
+	const tag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msg.length * 8),
+		tagLen,
+	);
+	result.set(tag, nonceSize + msg.length);
+
+	return result;
+}
+
+/**
+ * Decrypts a message using AEGIS-256.
+ * Expects input as nonce || ciphertext || tag.
+ * @param sealed - Concatenated nonce || ciphertext || tag
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 32-byte encryption key
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @returns Decrypted plaintext, or null if authentication fails
+ */
+export function aegis256Decrypt(
+	sealed: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	tagLen: 16 | 32 = 16,
+): Uint8Array | null {
+	const nonceSize = AEGIS_256_NONCE_SIZE;
+	if (sealed.length < nonceSize + tagLen) {
+		return null;
+	}
+	const nonce = sealed.subarray(0, nonceSize);
+	const ct = sealed.subarray(nonceSize, sealed.length - tagLen);
+	const tag = sealed.subarray(sealed.length - tagLen);
+	return aegis256DecryptDetached(ct, tag, ad, key, nonce);
+}
+
 /**
  * Computes a MAC (Message Authentication Code) using AEGIS-256.
  * @param data - Data to authenticate
@@ -377,3 +577,21 @@ export function aegis256MacVerify(
 	const expectedTag = aegis256Mac(data, key, nonce, tagLen);
 	return constantTimeEqual(tag, expectedTag);
 }
+
+/**
+ * Generates a random 32-byte key for AEGIS-256.
+ * @returns 32-byte encryption key
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis256CreateKey(): Uint8Array {
+	return randomBytes(AEGIS_256_KEY_SIZE);
+}
+
+/**
+ * Generates a random 32-byte nonce for AEGIS-256.
+ * @returns 32-byte nonce
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis256CreateNonce(): Uint8Array {
+	return randomBytes(AEGIS_256_NONCE_SIZE);
+}

package/src/aegis256x.ts

@@ -10,6 +10,7 @@ import {
 	xorBlocksTo,
 	zeroPad,
 } from "./aes.js";
+import { randomBytes } from "./random.js";
 
 /**
  * AEGIS-256X cipher state with configurable parallelism degree.
@@ -219,6 +220,22 @@ export class Aegis256XState {
 		return out;
 	}
 
+	/**
+	 * Encrypts a plaintext block in-place.
+	 * @param block - Buffer (plaintext in, ciphertext out), size 16*degree bytes
+	 */
+	encInPlace(block: Uint8Array): void {
+		this.encTo(block, block);
+	}
+
+	/**
+	 * Decrypts a ciphertext block in-place.
+	 * @param block - Buffer (ciphertext in, plaintext out), size 16*degree bytes
+	 */
+	decInPlace(block: Uint8Array): void {
+		this.decTo(block, block);
+	}
+
 	/**
 	 * Decrypts a partial (final) ciphertext block.
 	 * @param cn - Partial ciphertext block (smaller than 16*degree bytes)
@@ -359,16 +376,16 @@ export class Aegis256XState {
 }
 
 /**
- * Encrypts a message using AEGIS-256X.
+ * Encrypts a message using AEGIS-256X (detached mode).
  * @param msg - Plaintext message
  * @param ad - Associated data (authenticated but not encrypted)
  * @param key - 32-byte encryption key
  * @param nonce - 32-byte nonce (must be unique per message with the same key)
  * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
  * @param degree - Parallelism degree (default: 2)
- * @returns Object containing ciphertext and authentication tag
+ * @returns Object containing ciphertext and authentication tag separately
  */
-export function aegis256XEncrypt(
+export function aegis256XEncryptDetached(
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
@@ -406,7 +423,7 @@ export function aegis256XEncrypt(
 }
 
 /**
- * Decrypts a message using AEGIS-256X.
+ * Decrypts a message using AEGIS-256X (detached mode).
  * @param ct - Ciphertext
  * @param tag - Authentication tag (16 or 32 bytes)
  * @param ad - Associated data (must match what was used during encryption)
@@ -415,7 +432,7 @@ export function aegis256XEncrypt(
  * @param degree - Parallelism degree (default: 2)
  * @returns Decrypted plaintext, or null if authentication fails
  */
-export function aegis256XDecrypt(
+export function aegis256XDecryptDetached(
 	ct: Uint8Array,
 	tag: Uint8Array,
 	ad: Uint8Array,
@@ -460,41 +477,308 @@ export function aegis256XDecrypt(
 	return msg;
 }
 
+/**
+ * Encrypts a message in-place using AEGIS-256X (detached mode).
+ * The input buffer is modified to contain the ciphertext.
+ * @param data - Buffer containing plaintext (will be overwritten with ciphertext)
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (must be unique per message with the same key)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns Authentication tag
+ */
+export function aegis256XEncryptDetachedInPlace(
+	data: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+	degree: number = 2,
+): Uint8Array {
+	const state = new Aegis256XState(degree);
+	const rateBytes = (128 * degree) / 8;
+
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, rateBytes);
+	for (let i = 0; i + rateBytes <= adPadded.length; i += rateBytes) {
+		state.absorb(adPadded.subarray(i, i + rateBytes));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / rateBytes) * rateBytes;
+
+	for (let i = 0; i < fullBlocksLen; i += rateBytes) {
+		state.encInPlace(data.subarray(i, i + rateBytes));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const lastBlock = zeroPad(lastPartial, rateBytes);
+		const encBlock = state.enc(lastBlock);
+		lastPartial.set(encBlock.subarray(0, lastPartial.length));
+	}
+
+	return state.finalize(BigInt(ad.length * 8), BigInt(msgLen * 8), tagLen);
+}
+
+/**
+ * Decrypts a message in-place using AEGIS-256X (detached mode).
+ * The input buffer is modified to contain the plaintext (or zeroed on failure).
+ * @param data - Buffer containing ciphertext (will be overwritten with plaintext)
+ * @param tag - Authentication tag (16 or 32 bytes)
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (must match what was used during encryption)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns True if authentication succeeds, false otherwise
+ */
+export function aegis256XDecryptDetachedInPlace(
+	data: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	degree: number = 2,
+): boolean {
+	const tagLen = tag.length as 16 | 32;
+	const state = new Aegis256XState(degree);
+	const rateBytes = (128 * degree) / 8;
+
+	state.init(key, nonce);
+
+	const adPadded = zeroPad(ad, rateBytes);
+	for (let i = 0; i + rateBytes <= adPadded.length; i += rateBytes) {
+		state.absorb(adPadded.subarray(i, i + rateBytes));
+	}
+
+	const msgLen = data.length;
+	const fullBlocksLen = Math.floor(msgLen / rateBytes) * rateBytes;
+
+	for (let i = 0; i < fullBlocksLen; i += rateBytes) {
+		state.decInPlace(data.subarray(i, i + rateBytes));
+	}
+
+	if (msgLen > fullBlocksLen) {
+		const lastPartial = data.subarray(fullBlocksLen);
+		const decrypted = state.decPartial(lastPartial);
+		lastPartial.set(decrypted);
+	}
+
+	const expectedTag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msgLen * 8),
+		tagLen,
+	);
+
+	if (!constantTimeEqual(tag, expectedTag)) {
+		data.fill(0);
+		return false;
+	}
+
+	return true;
+}
+
+/** AEGIS-256X2 in-place encryption - detached mode (degree=2). */
+export const aegis256X2EncryptDetachedInPlace = (
+	data: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis256XEncryptDetachedInPlace(data, ad, key, nonce, tagLen, 2);
+
+/** AEGIS-256X2 in-place decryption - detached mode (degree=2). */
+export const aegis256X2DecryptDetachedInPlace = (
+	data: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis256XDecryptDetachedInPlace(data, tag, ad, key, nonce, 2);
+
+/** AEGIS-256X4 in-place encryption - detached mode (degree=4). */
+export const aegis256X4EncryptDetachedInPlace = (
+	data: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis256XEncryptDetachedInPlace(data, ad, key, nonce, tagLen, 4);
+
+/** AEGIS-256X4 in-place decryption - detached mode (degree=4). */
+export const aegis256X4DecryptDetachedInPlace = (
+	data: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis256XDecryptDetachedInPlace(data, tag, ad, key, nonce, 4);
+
+/** Nonce size for AEGIS-256X in bytes. */
+export const AEGIS_256X_NONCE_SIZE = 32;
+
+/** Key size for AEGIS-256X in bytes. */
+export const AEGIS_256X_KEY_SIZE = 32;
+
+/**
+ * Encrypts a message using AEGIS-256X.
+ * Returns a single buffer containing nonce || ciphertext || tag.
+ * @param msg - Plaintext message
+ * @param ad - Associated data (authenticated but not encrypted)
+ * @param key - 32-byte encryption key
+ * @param nonce - 32-byte nonce (optional, generates random nonce if not provided)
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns Concatenated nonce || ciphertext || tag
+ */
+export function aegis256XEncrypt(
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array | null = null,
+	tagLen: 16 | 32 = 16,
+	degree: number = 2,
+): Uint8Array {
+	const actualNonce = nonce ?? randomBytes(AEGIS_256X_NONCE_SIZE);
+	const state = new Aegis256XState(degree);
+	const rateBytes = (128 * degree) / 8;
+
+	state.init(key, actualNonce);
+
+	const adPadded = zeroPad(ad, rateBytes);
+	for (let i = 0; i + rateBytes <= adPadded.length; i += rateBytes) {
+		state.absorb(adPadded.subarray(i, i + rateBytes));
+	}
+
+	const nonceSize = AEGIS_256X_NONCE_SIZE;
+	const result = new Uint8Array(nonceSize + msg.length + tagLen);
+	result.set(actualNonce, 0);
+
+	const fullBlocks = Math.floor(msg.length / rateBytes) * rateBytes;
+	for (let i = 0; i < fullBlocks; i += rateBytes) {
+		state.encTo(
+			msg.subarray(i, i + rateBytes),
+			result.subarray(nonceSize + i, nonceSize + i + rateBytes),
+		);
+	}
+
+	if (msg.length > fullBlocks) {
+		const lastBlock = zeroPad(msg.subarray(fullBlocks), rateBytes);
+		const encBlock = state.enc(lastBlock);
+		result.set(
+			encBlock.subarray(0, msg.length - fullBlocks),
+			nonceSize + fullBlocks,
+		);
+	}
+
+	const tag = state.finalize(
+		BigInt(ad.length * 8),
+		BigInt(msg.length * 8),
+		tagLen,
+	);
+	result.set(tag, nonceSize + msg.length);
+
+	return result;
+}
+
+/**
+ * Decrypts a message using AEGIS-256X.
+ * Expects input as nonce || ciphertext || tag.
+ * @param sealed - Concatenated nonce || ciphertext || tag
+ * @param ad - Associated data (must match what was used during encryption)
+ * @param key - 32-byte encryption key
+ * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
+ * @param degree - Parallelism degree (default: 2)
+ * @returns Decrypted plaintext, or null if authentication fails
+ */
+export function aegis256XDecrypt(
+	sealed: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	tagLen: 16 | 32 = 16,
+	degree: number = 2,
+): Uint8Array | null {
+	const nonceSize = AEGIS_256X_NONCE_SIZE;
+	if (sealed.length < nonceSize + tagLen) {
+		return null;
+	}
+	const nonce = sealed.subarray(0, nonceSize);
+	const ct = sealed.subarray(nonceSize, sealed.length - tagLen);
+	const tag = sealed.subarray(sealed.length - tagLen);
+	return aegis256XDecryptDetached(ct, tag, ad, key, nonce, degree);
+}
+
+/** AEGIS-256X2 encryption - detached mode (degree=2). */
+export const aegis256X2EncryptDetached = (
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis256XEncryptDetached(msg, ad, key, nonce, tagLen, 2);
+
+/** AEGIS-256X2 decryption - detached mode (degree=2). */
+export const aegis256X2DecryptDetached = (
+	ct: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis256XDecryptDetached(ct, tag, ad, key, nonce, 2);
+
+/** AEGIS-256X4 encryption - detached mode (degree=4). */
+export const aegis256X4EncryptDetached = (
+	msg: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+	tagLen: 16 | 32 = 16,
+) => aegis256XEncryptDetached(msg, ad, key, nonce, tagLen, 4);
+
+/** AEGIS-256X4 decryption - detached mode (degree=4). */
+export const aegis256X4DecryptDetached = (
+	ct: Uint8Array,
+	tag: Uint8Array,
+	ad: Uint8Array,
+	key: Uint8Array,
+	nonce: Uint8Array,
+) => aegis256XDecryptDetached(ct, tag, ad, key, nonce, 4);
+
 /** AEGIS-256X2 encryption (degree=2). */
 export const aegis256X2Encrypt = (
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
+	nonce: Uint8Array | null = null,
 	tagLen: 16 | 32 = 16,
 ) => aegis256XEncrypt(msg, ad, key, nonce, tagLen, 2);
 
 /** AEGIS-256X2 decryption (degree=2). */
 export const aegis256X2Decrypt = (
-	ct: Uint8Array,
-	tag: Uint8Array,
+	sealed: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
-) => aegis256XDecrypt(ct, tag, ad, key, nonce, 2);
+	tagLen: 16 | 32 = 16,
+) => aegis256XDecrypt(sealed, ad, key, tagLen, 2);
 
 /** AEGIS-256X4 encryption (degree=4). */
 export const aegis256X4Encrypt = (
 	msg: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
+	nonce: Uint8Array | null = null,
 	tagLen: 16 | 32 = 16,
 ) => aegis256XEncrypt(msg, ad, key, nonce, tagLen, 4);
 
 /** AEGIS-256X4 decryption (degree=4). */
 export const aegis256X4Decrypt = (
-	ct: Uint8Array,
-	tag: Uint8Array,
+	sealed: Uint8Array,
 	ad: Uint8Array,
 	key: Uint8Array,
-	nonce: Uint8Array,
-) => aegis256XDecrypt(ct, tag, ad, key, nonce, 4);
+	tagLen: 16 | 32 = 16,
+) => aegis256XDecrypt(sealed, ad, key, tagLen, 4);
 
 /**
  * Computes a MAC (Message Authentication Code) using AEGIS-256X.
@@ -577,3 +861,33 @@ export const aegis256X4MacVerify = (
 	key: Uint8Array,
 	nonce: Uint8Array | null = null,
 ) => aegis256XMacVerify(data, tag, key, nonce, 4);
+
+/**
+ * Generates a random 32-byte key for AEGIS-256X.
+ * @returns 32-byte encryption key
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis256XCreateKey(): Uint8Array {
+	return randomBytes(AEGIS_256X_KEY_SIZE);
+}
+
+/**
+ * Generates a random 32-byte nonce for AEGIS-256X.
+ * @returns 32-byte nonce
+ * @throws Error if no cryptographic random source is available
+ */
+export function aegis256XCreateNonce(): Uint8Array {
+	return randomBytes(AEGIS_256X_NONCE_SIZE);
+}
+
+/** AEGIS-256X2 key generation (degree=2). */
+export const aegis256X2CreateKey = aegis256XCreateKey;
+
+/** AEGIS-256X2 nonce generation (degree=2). */
+export const aegis256X2CreateNonce = aegis256XCreateNonce;
+
+/** AEGIS-256X4 key generation (degree=4). */
+export const aegis256X4CreateKey = aegis256XCreateKey;
+
+/** AEGIS-256X4 nonce generation (degree=4). */
+export const aegis256X4CreateNonce = aegis256XCreateNonce;