aegis-aead 0.2.1 → 0.2.2

package/README.md

@@ -1,15 +1,17 @@
-# aegis-aead
+# AEGIS for JavaScript
 
 [![npm](https://img.shields.io/npm/v/aegis-aead)](https://www.npmjs.com/package/aegis-aead)
 [![CI](https://github.com/jedisct1/js-aegis-aead/actions/workflows/ci.yml/badge.svg)](https://github.com/jedisct1/js-aegis-aead/actions/workflows/ci.yml)
 
+[View on npm](https://www.npmjs.com/package/aegis-aead)
+
 A compact, zero-dependency JavaScript/TypeScript implementation of [AEGIS](https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/), a family of fast, secure authenticated encryption algorithms.
 
 AEGIS provides both encryption with authentication and standalone MAC functionality, with a simple API that makes it hard to misuse.
 
 ## Table of Contents
 
-- [aegis-aead](#aegis-aead)
+- [AEGIS for JavaScript](#aegis-for-javascript)
   - [Table of Contents](#table-of-contents)
   - [Installation](#installation)
   - [Quick Start](#quick-start)

package/dist/aegis128l-bs.d.ts

@@ -4,37 +4,31 @@
  */
 /**
  * Bitsliced AEGIS-128L cipher state.
- * Uses 8 AES blocks (128 bytes) stored in bitsliced form (32 uint32 words).
+ * The state is kept in packed bitsliced form between operations so that
+ * pack/unpack does not need to be applied at every round.
  */
 export declare class Aegis128LBsState {
     private st;
     private st1;
+    private constantInput;
     private tmp0;
     private tmp1;
     private z0;
     private z1;
     constructor();
-    /**
-     * AEGIS round function: applies AES round to all blocks and rotates.
-     * st[i] = AES(st[i]) ^ st[(i-1) mod 8]
-     */
-    private aegisRound;
-    /**
-     * AEGIS round function with constant input (used in packed mode).
-     */
     private aegisRoundPacked;
-    /**
-     * Pack constant input for blocks 0 and 4.
-     */
     private packConstantInput;
     /**
-     * Absorb rate: XOR message blocks into state positions 0 and 4.
-     */
-    private absorbRate;
-    /**
-     * Update state with two message blocks.
+     * Extract the keystream blocks z0 and z1 directly from the packed state.
+     *
+     *   z0 = S6 ^ S1 ^ (S2 & S3)
+     *   z1 = S2 ^ S5 ^ (S6 & S7)
+     *
+     * The formula is evaluated lane-wise on the packed state, the result is
+     * placed in positions 0 (z0) and 4 (z1), then unpack04 extracts the two
+     * AES blocks.
      */
-    private update;
+    private keystreamPacked;
     /**
      * Initializes the state with a key and nonce.
      * @param key - 16-byte encryption key
@@ -70,15 +64,7 @@ export declare class Aegis128LBsState {
      * @returns 32-byte plaintext block
      */
     dec(ci: Uint8Array): Uint8Array;
-    /**
-     * Encrypts a 32-byte plaintext block in-place.
-     * @param block - 32-byte buffer (plaintext in, ciphertext out)
-     */
     encInPlace(block: Uint8Array): void;
-    /**
-     * Decrypts a 32-byte ciphertext block in-place.
-     * @param block - 32-byte buffer (ciphertext in, plaintext out)
-     */
     decInPlace(block: Uint8Array): void;
     /**
      * Decrypts a partial (final) ciphertext block smaller than 32 bytes.
@@ -120,24 +106,10 @@ export declare function aegis128LBsEncryptDetached(msg: Uint8Array, ad: Uint8Arr
 export declare function aegis128LBsDecryptDetached(ct: Uint8Array, tag: Uint8Array, ad: Uint8Array, key: Uint8Array, nonce: Uint8Array): Uint8Array | null;
 /**
  * Encrypts a message in-place using bitsliced AEGIS-128L (detached mode).
- * The input buffer is modified to contain the ciphertext.
- * @param data - Buffer containing plaintext (will be overwritten with ciphertext)
- * @param ad - Associated data (authenticated but not encrypted)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (must be unique per message with the same key)
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Authentication tag
  */
 export declare function aegis128LBsEncryptDetachedInPlace(data: Uint8Array, ad: Uint8Array, key: Uint8Array, nonce: Uint8Array, tagLen?: 16 | 32): Uint8Array;
 /**
  * Decrypts a message in-place using bitsliced AEGIS-128L (detached mode).
- * The input buffer is modified to contain the plaintext (or zeroed on failure).
- * @param data - Buffer containing ciphertext (will be overwritten with plaintext)
- * @param tag - Authentication tag (16 or 32 bytes)
- * @param ad - Associated data (must match what was used during encryption)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (must match what was used during encryption)
- * @returns True if authentication succeeds, false otherwise
  */
 export declare function aegis128LBsDecryptDetachedInPlace(data: Uint8Array, tag: Uint8Array, ad: Uint8Array, key: Uint8Array, nonce: Uint8Array): boolean;
 export declare const AEGIS_128L_BS_NONCE_SIZE = 16;
@@ -145,50 +117,21 @@ export declare const AEGIS_128L_BS_KEY_SIZE = 16;
 /**
  * Encrypts a message using bitsliced AEGIS-128L.
  * Returns a single buffer containing nonce || ciphertext || tag.
- * @param msg - Plaintext message
- * @param ad - Associated data (authenticated but not encrypted)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (optional, generates random nonce if not provided)
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Concatenated nonce || ciphertext || tag
  */
 export declare function aegis128LBsEncrypt(msg: Uint8Array, ad: Uint8Array, key: Uint8Array, nonce?: Uint8Array | null, tagLen?: 16 | 32): Uint8Array;
 /**
  * Decrypts a message using bitsliced AEGIS-128L.
  * Expects input as nonce || ciphertext || tag.
- * @param sealed - Concatenated nonce || ciphertext || tag
- * @param ad - Associated data (must match what was used during encryption)
- * @param key - 16-byte encryption key
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Decrypted plaintext, or null if authentication fails
  */
 export declare function aegis128LBsDecrypt(sealed: Uint8Array, ad: Uint8Array, key: Uint8Array, tagLen?: 16 | 32): Uint8Array | null;
 /**
- * Computes a MAC (Message Authentication Code) using bitsliced AEGIS-128L.
- * @param data - Data to authenticate
- * @param key - 16-byte key
- * @param nonce - 16-byte nonce (optional, uses zero nonce if null)
- * @param tagLen - Tag length: 16 or 32 bytes (default: 16)
- * @returns Authentication tag
+ * Computes a MAC using bitsliced AEGIS-128L.
  */
 export declare function aegis128LBsMac(data: Uint8Array, key: Uint8Array, nonce?: Uint8Array | null, tagLen?: 16 | 32): Uint8Array;
 /**
  * Verifies a MAC computed using bitsliced AEGIS-128L.
- * @param data - Data to verify
- * @param tag - Expected authentication tag (16 or 32 bytes)
- * @param key - 16-byte key
- * @param nonce - 16-byte nonce (optional, uses zero nonce if null)
- * @returns True if the tag is valid, false otherwise
  */
 export declare function aegis128LBsMacVerify(data: Uint8Array, tag: Uint8Array, key: Uint8Array, nonce?: Uint8Array | null): boolean;
-/**
- * Generates a random 16-byte key for bitsliced AEGIS-128L.
- * @returns 16-byte encryption key
- */
 export declare function aegis128LBsCreateKey(): Uint8Array;
-/**
- * Generates a random 16-byte nonce for bitsliced AEGIS-128L.
- * @returns 16-byte nonce
- */
 export declare function aegis128LBsCreateNonce(): Uint8Array;
 //# sourceMappingURL=aegis128l-bs.d.ts.map

package/dist/aegis128l-bs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aegis128l-bs.d.ts","sourceRoot":"","sources":["../src/aegis128l-bs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+BH;;;GAGG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,EAAE,CAAY;IACtB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,EAAE,CAAW;IACrB,OAAO,CAAC,EAAE,CAAW;;IAWrB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAkBlB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;OAEG;IACH,OAAO,CAAC,UAAU;IAalB;;OAEG;IACH,OAAO,CAAC,MAAM;IAKd;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IA+B9C;;;OAGG;IACH,MAAM,CAAC,EAAE,EAAE,UAAU,GAAG,IAAI;IAQ5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IAoC5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IAM/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IA+B5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IAM/B;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAInC;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAInC;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IA0CtC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,EAAE,GAAG,EAAO,GAAG,UAAU;CA+DzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACzC,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAyB7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACzC,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,GACf,UAAU,GAAG,IAAI,CA6BnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAwBZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,GACf,OAAO,CA+BT;AAED,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAkBZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,GAAG,IAAI,CASnB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC7B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAUZ;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,GAC7B,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,UAAU,CAEjD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,UAAU,CAEnD"}
+{"version":3,"file":"aegis128l-bs.d.ts","sourceRoot":"","sources":["../src/aegis128l-bs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgCH;;;;GAIG;AACH,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,EAAE,CAAY;IACtB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,aAAa,CAAY;IACjC,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,EAAE,CAAW;IACrB,OAAO,CAAC,EAAE,CAAW;;IAYrB,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,iBAAiB;IAQzB;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IAsBvB;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IA6B9C;;;OAGG;IACH,MAAM,CAAC,EAAE,EAAE,UAAU,GAAG,IAAI;IAS5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IAmB5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IAM/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IAkB5C;;;;OAIG;IACH,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IAM/B,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAInC,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAInC;;;;OAIG;IACH,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU;IA4BtC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,EAAE,GAAG,EAAO,GAAG,UAAU;CAiEzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACzC,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,CAyB7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACzC,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,GACf,UAAU,GAAG,IAAI,CA6BnB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAwBZ;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAChD,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,GACf,OAAO,CA+BT;AAED,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAkBZ;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,UAAU,EACd,GAAG,EAAE,UAAU,EACf,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,GAAG,IAAI,CASnB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC7B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,EAC/B,MAAM,GAAE,EAAE,GAAG,EAAO,GAClB,UAAU,CAUZ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,EACf,KAAK,GAAE,UAAU,GAAG,IAAW,GAC7B,OAAO,CAIT;AAED,wBAAgB,oBAAoB,IAAI,UAAU,CAEjD;AAED,wBAAgB,sBAAsB,IAAI,UAAU,CAEnD"}

package/dist/aegis128l-bs.js

@@ -3,7 +3,7 @@
  * Provides constant-time operation by processing all 8 state blocks simultaneously.
  */
 import { constantTimeEqual, zeroPad } from "./aes.js";
-import { aesRound, blockFromBytes, blocksPut, blocksRotr, blocksXor, blockToBytes, blockXor, createAesBlock, createAesBlocks, pack, pack04, unpack, wordIdx, } from "./aes-bs.js";
+import { aesRound, blockFromBytes, blocksPut, blocksRotr, blocksXor, blockToBytes, blockXor, createAesBlock, createAesBlocks, pack, pack04, unpack, unpack04, wordIdx, } from "./aes-bs.js";
 import { randomBytes } from "./random.js";
 const RATE = 32;
 const C0 = new Uint32Array([
@@ -14,77 +14,65 @@ const C1 = new Uint32Array([
 ]);
 /**
  * Bitsliced AEGIS-128L cipher state.
- * Uses 8 AES blocks (128 bytes) stored in bitsliced form (32 uint32 words).
+ * The state is kept in packed bitsliced form between operations so that
+ * pack/unpack does not need to be applied at every round.
  */
 export class Aegis128LBsState {
     constructor() {
         this.st = createAesBlocks();
         this.st1 = createAesBlocks();
+        this.constantInput = createAesBlocks();
         this.tmp0 = createAesBlock();
         this.tmp1 = createAesBlock();
         this.z0 = createAesBlock();
         this.z1 = createAesBlock();
     }
-    /**
-     * AEGIS round function: applies AES round to all blocks and rotates.
-     * st[i] = AES(st[i]) ^ st[(i-1) mod 8]
-     */
-    aegisRound() {
-        const st = this.st;
-        const st1 = this.st1;
-        st1.set(st);
-        pack(st1);
-        aesRound(st1);
-        unpack(st1);
-        for (let i = 0; i < 8; i++) {
-            const prev = (i + 7) % 8;
-            st[wordIdx(i, 0)] = (st[wordIdx(i, 0)] ^ st1[wordIdx(prev, 0)]) >>> 0;
-            st[wordIdx(i, 1)] = (st[wordIdx(i, 1)] ^ st1[wordIdx(prev, 1)]) >>> 0;
-            st[wordIdx(i, 2)] = (st[wordIdx(i, 2)] ^ st1[wordIdx(prev, 2)]) >>> 0;
-            st[wordIdx(i, 3)] = (st[wordIdx(i, 3)] ^ st1[wordIdx(prev, 3)]) >>> 0;
-        }
-    }
-    /**
-     * AEGIS round function with constant input (used in packed mode).
-     */
-    aegisRoundPacked(constantInput) {
+    aegisRoundPacked() {
         const st = this.st;
         const st1 = this.st1;
         st1.set(st);
         aesRound(st1);
         blocksRotr(st1);
         blocksXor(st, st1);
-        blocksXor(st, constantInput);
+        blocksXor(st, this.constantInput);
     }
-    /**
-     * Pack constant input for blocks 0 and 4.
-     */
-    packConstantInput(out, m0, m1) {
+    packConstantInput(m0, m1) {
+        const out = this.constantInput;
         out.fill(0);
         blocksPut(out, m0, 0);
         blocksPut(out, m1, 4);
         pack04(out);
     }
     /**
-     * Absorb rate: XOR message blocks into state positions 0 and 4.
+     * Extract the keystream blocks z0 and z1 directly from the packed state.
+     *
+     *   z0 = S6 ^ S1 ^ (S2 & S3)
+     *   z1 = S2 ^ S5 ^ (S6 & S7)
+     *
+     * The formula is evaluated lane-wise on the packed state, the result is
+     * placed in positions 0 (z0) and 4 (z1), then unpack04 extracts the two
+     * AES blocks.
      */
-    absorbRate(m0, m1) {
+    keystreamPacked() {
         const st = this.st;
-        st[wordIdx(0, 0)] = (st[wordIdx(0, 0)] ^ m0[0]) >>> 0;
-        st[wordIdx(0, 1)] = (st[wordIdx(0, 1)] ^ m0[1]) >>> 0;
-        st[wordIdx(0, 2)] = (st[wordIdx(0, 2)] ^ m0[2]) >>> 0;
-        st[wordIdx(0, 3)] = (st[wordIdx(0, 3)] ^ m0[3]) >>> 0;
-        st[wordIdx(4, 0)] = (st[wordIdx(4, 0)] ^ m1[0]) >>> 0;
-        st[wordIdx(4, 1)] = (st[wordIdx(4, 1)] ^ m1[1]) >>> 0;
-        st[wordIdx(4, 2)] = (st[wordIdx(4, 2)] ^ m1[2]) >>> 0;
-        st[wordIdx(4, 3)] = (st[wordIdx(4, 3)] ^ m1[3]) >>> 0;
-    }
-    /**
-     * Update state with two message blocks.
-     */
-    update(m0, m1) {
-        this.aegisRound();
-        this.absorbRate(m0, m1);
+        const z = this.st1;
+        for (let i = 0; i < 32; i++) {
+            const x = st[i];
+            z[i] =
+                ((x & 0x02020202) << 6) ^
+                    ((x & 0x40404040) << 1) ^
+                    ((x & (x >>> 1) & 0x10101010) << 3) ^
+                    ((x & 0x20202020) >>> 2) ^
+                    ((x & 0x04040404) << 1) ^
+                    ((x & (x >>> 1) & 0x01010101) << 3);
+        }
+        unpack04(z);
+        const z0 = this.z0;
+        const z1 = this.z1;
+        for (let i = 0; i < 4; i++) {
+            z0[i] = z[wordIdx(0, i)];
+            z1[i] = z[wordIdx(4, i)];
+        }
     }
     /**
      * Initializes the state with a key and nonce.
@@ -110,13 +98,11 @@ export class Aegis128LBsState {
         blocksPut(this.st, kc0, 5);
         blocksPut(this.st, kc1, 6);
         blocksPut(this.st, kc0, 7);
-        const constantInput = createAesBlocks();
-        this.packConstantInput(constantInput, n, k);
+        this.packConstantInput(n, k);
         pack(this.st);
         for (let i = 0; i < 10; i++) {
-            this.aegisRoundPacked(constantInput);
+            this.aegisRoundPacked();
         }
-        unpack(this.st);
     }
     /**
      * Absorbs a 32-byte associated data block into the state.
@@ -127,7 +113,8 @@ export class Aegis128LBsState {
         const msg1 = this.tmp1;
         blockFromBytes(msg0, ai.subarray(0, 16));
         blockFromBytes(msg1, ai.subarray(16, 32));
-        this.update(msg0, msg1);
+        this.packConstantInput(msg0, msg1);
+        this.aegisRoundPacked();
     }
     /**
      * Encrypts a 32-byte plaintext block and writes to output buffer.
@@ -135,34 +122,17 @@ export class Aegis128LBsState {
      * @param out - 32-byte output buffer
      */
     encTo(xi, out) {
-        const st = this.st;
-        const z0 = this.z0;
-        const z1 = this.z1;
         const t0 = this.tmp0;
         const t1 = this.tmp1;
-        for (let i = 0; i < 4; i++) {
-            z0[i] =
-                (st[wordIdx(6, i)] ^
-                    st[wordIdx(1, i)] ^
-                    (st[wordIdx(2, i)] & st[wordIdx(3, i)])) >>>
-                    0;
-        }
-        for (let i = 0; i < 4; i++) {
-            z1[i] =
-                (st[wordIdx(2, i)] ^
-                    st[wordIdx(5, i)] ^
-                    (st[wordIdx(6, i)] & st[wordIdx(7, i)])) >>>
-                    0;
-        }
+        this.keystreamPacked();
         blockFromBytes(t0, xi.subarray(0, 16));
         blockFromBytes(t1, xi.subarray(16, 32));
-        const out0 = createAesBlock();
-        const out1 = createAesBlock();
-        blockXor(out0, t0, z0);
-        blockXor(out1, t1, z1);
-        blockToBytes(out.subarray(0, 16), out0);
-        blockToBytes(out.subarray(16, 32), out1);
-        this.update(t0, t1);
+        this.packConstantInput(t0, t1);
+        this.aegisRoundPacked();
+        blockXor(t0, t0, this.z0);
+        blockXor(t1, t1, this.z1);
+        blockToBytes(out.subarray(0, 16), t0);
+        blockToBytes(out.subarray(16, 32), t1);
     }
     /**
      * Encrypts a 32-byte plaintext block.
@@ -180,28 +150,15 @@ export class Aegis128LBsState {
      * @param out - 32-byte output buffer
      */
     decTo(ci, out) {
-        const st = this.st;
         const msg0 = this.tmp0;
         const msg1 = this.tmp1;
         blockFromBytes(msg0, ci.subarray(0, 16));
         blockFromBytes(msg1, ci.subarray(16, 32));
-        for (let i = 0; i < 4; i++) {
-            msg0[i] =
-                (msg0[i] ^
-                    st[wordIdx(6, i)] ^
-                    st[wordIdx(1, i)] ^
-                    (st[wordIdx(2, i)] & st[wordIdx(3, i)])) >>>
-                    0;
-        }
-        for (let i = 0; i < 4; i++) {
-            msg1[i] =
-                (msg1[i] ^
-                    st[wordIdx(2, i)] ^
-                    st[wordIdx(5, i)] ^
-                    (st[wordIdx(6, i)] & st[wordIdx(7, i)])) >>>
-                    0;
-        }
-        this.update(msg0, msg1);
+        this.keystreamPacked();
+        blockXor(msg0, msg0, this.z0);
+        blockXor(msg1, msg1, this.z1);
+        this.packConstantInput(msg0, msg1);
+        this.aegisRoundPacked();
         blockToBytes(out.subarray(0, 16), msg0);
         blockToBytes(out.subarray(16, 32), msg1);
     }
@@ -215,17 +172,9 @@ export class Aegis128LBsState {
         this.decTo(ci, out);
         return out;
     }
-    /**
-     * Encrypts a 32-byte plaintext block in-place.
-     * @param block - 32-byte buffer (plaintext in, ciphertext out)
-     */
     encInPlace(block) {
         this.encTo(block, block);
     }
-    /**
-     * Decrypts a 32-byte ciphertext block in-place.
-     * @param block - 32-byte buffer (ciphertext in, plaintext out)
-     */
     decInPlace(block) {
         this.decTo(block, block);
     }
@@ -235,28 +184,14 @@ export class Aegis128LBsState {
      * @returns Decrypted plaintext of the same length
      */
     decPartial(cn) {
-        const st = this.st;
         const msg0 = this.tmp0;
         const msg1 = this.tmp1;
         const padded = zeroPad(cn, RATE);
         blockFromBytes(msg0, padded.subarray(0, 16));
         blockFromBytes(msg1, padded.subarray(16, 32));
-        for (let i = 0; i < 4; i++) {
-            msg0[i] =
-                (msg0[i] ^
-                    st[wordIdx(6, i)] ^
-                    st[wordIdx(1, i)] ^
-                    (st[wordIdx(2, i)] & st[wordIdx(3, i)])) >>>
-                    0;
-        }
-        for (let i = 0; i < 4; i++) {
-            msg1[i] =
-                (msg1[i] ^
-                    st[wordIdx(2, i)] ^
-                    st[wordIdx(5, i)] ^
-                    (st[wordIdx(6, i)] & st[wordIdx(7, i)])) >>>
-                    0;
-        }
+        this.keystreamPacked();
+        blockXor(msg0, msg0, this.z0);
+        blockXor(msg1, msg1, this.z1);
         const pad = new Uint8Array(RATE);
         blockToBytes(pad.subarray(0, 16), msg0);
         blockToBytes(pad.subarray(16, 32), msg1);
@@ -264,8 +199,8 @@ export class Aegis128LBsState {
         pad.fill(0, cn.length);
         blockFromBytes(msg0, pad.subarray(0, 16));
         blockFromBytes(msg1, pad.subarray(16, 32));
-        this.aegisRound();
-        this.absorbRate(msg0, msg1);
+        this.packConstantInput(msg0, msg1);
+        this.aegisRoundPacked();
         return xn;
     }
     /**
@@ -282,17 +217,18 @@ export class Aegis128LBsState {
         tmp[1] = Math.floor((adLen * 8) / 0x100000000) >>> 0;
         tmp[2] = ((msgLen * 8) & 0xffffffff) >>> 0;
         tmp[3] = Math.floor((msgLen * 8) / 0x100000000) >>> 0;
-        tmp[0] = (tmp[0] ^ st[wordIdx(2, 0)]) >>> 0;
-        tmp[1] = (tmp[1] ^ st[wordIdx(2, 1)]) >>> 0;
-        tmp[2] = (tmp[2] ^ st[wordIdx(2, 2)]) >>> 0;
-        tmp[3] = (tmp[3] ^ st[wordIdx(2, 3)]) >>> 0;
-        const constantInput = createAesBlocks();
-        this.packConstantInput(constantInput, tmp, tmp);
-        pack(this.st);
+        const unpacked = this.st1;
+        unpacked.set(st);
+        unpack(unpacked);
+        tmp[0] = (tmp[0] ^ unpacked[wordIdx(2, 0)]) >>> 0;
+        tmp[1] = (tmp[1] ^ unpacked[wordIdx(2, 1)]) >>> 0;
+        tmp[2] = (tmp[2] ^ unpacked[wordIdx(2, 2)]) >>> 0;
+        tmp[3] = (tmp[3] ^ unpacked[wordIdx(2, 3)]) >>> 0;
+        this.packConstantInput(tmp, tmp);
         for (let i = 0; i < 7; i++) {
-            this.aegisRoundPacked(constantInput);
+            this.aegisRoundPacked();
         }
-        unpack(this.st);
+        unpack(st);
         if (tagLen === 16) {
             const tag = new Uint8Array(16);
             const tagBlock = createAesBlock();
@@ -399,13 +335,6 @@ export function aegis128LBsDecryptDetached(ct, tag, ad, key, nonce) {
 }
 /**
  * Encrypts a message in-place using bitsliced AEGIS-128L (detached mode).
- * The input buffer is modified to contain the ciphertext.
- * @param data - Buffer containing plaintext (will be overwritten with ciphertext)
- * @param ad - Associated data (authenticated but not encrypted)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (must be unique per message with the same key)
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Authentication tag
  */
 export function aegis128LBsEncryptDetachedInPlace(data, ad, key, nonce, tagLen = 16) {
     const state = new Aegis128LBsState();
@@ -429,13 +358,6 @@ export function aegis128LBsEncryptDetachedInPlace(data, ad, key, nonce, tagLen =
 }
 /**
  * Decrypts a message in-place using bitsliced AEGIS-128L (detached mode).
- * The input buffer is modified to contain the plaintext (or zeroed on failure).
- * @param data - Buffer containing ciphertext (will be overwritten with plaintext)
- * @param tag - Authentication tag (16 or 32 bytes)
- * @param ad - Associated data (must match what was used during encryption)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (must match what was used during encryption)
- * @returns True if authentication succeeds, false otherwise
  */
 export function aegis128LBsDecryptDetachedInPlace(data, tag, ad, key, nonce) {
     const tagLen = tag.length;
@@ -467,12 +389,6 @@ export const AEGIS_128L_BS_KEY_SIZE = 16;
 /**
  * Encrypts a message using bitsliced AEGIS-128L.
  * Returns a single buffer containing nonce || ciphertext || tag.
- * @param msg - Plaintext message
- * @param ad - Associated data (authenticated but not encrypted)
- * @param key - 16-byte encryption key
- * @param nonce - 16-byte nonce (optional, generates random nonce if not provided)
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Concatenated nonce || ciphertext || tag
  */
 export function aegis128LBsEncrypt(msg, ad, key, nonce = null, tagLen = 16) {
     const actualNonce = nonce ?? randomBytes(AEGIS_128L_BS_NONCE_SIZE);
@@ -486,11 +402,6 @@ export function aegis128LBsEncrypt(msg, ad, key, nonce = null, tagLen = 16) {
 /**
  * Decrypts a message using bitsliced AEGIS-128L.
  * Expects input as nonce || ciphertext || tag.
- * @param sealed - Concatenated nonce || ciphertext || tag
- * @param ad - Associated data (must match what was used during encryption)
- * @param key - 16-byte encryption key
- * @param tagLen - Authentication tag length: 16 or 32 bytes (default: 16)
- * @returns Decrypted plaintext, or null if authentication fails
  */
 export function aegis128LBsDecrypt(sealed, ad, key, tagLen = 16) {
     const nonceSize = AEGIS_128L_BS_NONCE_SIZE;
@@ -503,12 +414,7 @@ export function aegis128LBsDecrypt(sealed, ad, key, tagLen = 16) {
     return aegis128LBsDecryptDetached(ct, tag, ad, key, nonce);
 }
 /**
- * Computes a MAC (Message Authentication Code) using bitsliced AEGIS-128L.
- * @param data - Data to authenticate
- * @param key - 16-byte key
- * @param nonce - 16-byte nonce (optional, uses zero nonce if null)
- * @param tagLen - Tag length: 16 or 32 bytes (default: 16)
- * @returns Authentication tag
+ * Computes a MAC using bitsliced AEGIS-128L.
  */
 export function aegis128LBsMac(data, key, nonce = null, tagLen = 16) {
     const state = new Aegis128LBsState();
@@ -521,28 +427,15 @@ export function aegis128LBsMac(data, key, nonce = null, tagLen = 16) {
 }
 /**
  * Verifies a MAC computed using bitsliced AEGIS-128L.
- * @param data - Data to verify
- * @param tag - Expected authentication tag (16 or 32 bytes)
- * @param key - 16-byte key
- * @param nonce - 16-byte nonce (optional, uses zero nonce if null)
- * @returns True if the tag is valid, false otherwise
  */
 export function aegis128LBsMacVerify(data, tag, key, nonce = null) {
     const tagLen = tag.length;
     const expectedTag = aegis128LBsMac(data, key, nonce, tagLen);
     return constantTimeEqual(tag, expectedTag);
 }
-/**
- * Generates a random 16-byte key for bitsliced AEGIS-128L.
- * @returns 16-byte encryption key
- */
 export function aegis128LBsCreateKey() {
     return randomBytes(AEGIS_128L_BS_KEY_SIZE);
 }
-/**
- * Generates a random 16-byte nonce for bitsliced AEGIS-128L.
- * @returns 16-byte nonce
- */
 export function aegis128LBsCreateNonce() {
     return randomBytes(AEGIS_128L_BS_NONCE_SIZE);
 }