aegis-aead 0.2.1 → 0.2.3

package/dist/aegis256.js

@@ -1,32 +1,59 @@
-import { aesRoundTo, andBlocksTo, C0, C1, constantTimeEqual, le64To, xorBlocksTo, zeroPad, } from "./aes.js";
+/**
+ * AEGIS-256 implementation.
+ * Built on the constant-time bitsliced AES core, which processes the state
+ * blocks simultaneously without lookup tables.
+ */
+import { aegisRound256, blockFromBytes, blocksPut, blockToBytes, blockXor, createAesBlock, createAesBlocks, keystream256, pack, packConstantInput256, unpack, wordIdx, } from "./aes-bs.js";
 import { randomBytes } from "./random.js";
+import { constantTimeEqual, zeroPad } from "./utils.js";
+const RATE = 16;
+const C0 = new Uint32Array([
+    0x02010100, 0x0d080503, 0x59372215, 0x6279e990,
+]);
+const C1 = new Uint32Array([
+    0x55183ddb, 0xf12fc26d, 0x42311120, 0xdd28b573,
+]);
 /**
  * AEGIS-256 cipher state.
- * Uses 6 AES blocks (96 bytes) of internal state and processes 16-byte blocks.
+ * Uses 6 AES blocks stored in packed bitsliced form throughout the lifetime
+ * of the state.
  */
 export class Aegis256State {
     constructor() {
-        this.s0 = new Uint8Array(16);
-        this.s1 = new Uint8Array(16);
-        this.s2 = new Uint8Array(16);
-        this.s3 = new Uint8Array(16);
-        this.s4 = new Uint8Array(16);
-        this.s5 = new Uint8Array(16);
-        this.tmp = new Uint8Array(16);
-        this.z = new Uint8Array(16);
-        this.newS = Array.from({ length: 6 }, () => new Uint8Array(16));
-        this.tBuf = new Uint8Array(16);
+        this.st = createAesBlocks();
+        this.constantInput = createAesBlocks();
+        this.tmp = createAesBlock();
+        this.z = createAesBlock();
     }
+    /**
+     * Returns the 6 state blocks as byte arrays (for testing).
+     */
     get s() {
-        return [this.s0, this.s1, this.s2, this.s3, this.s4, this.s5];
+        const unpacked = createAesBlocks();
+        unpacked.set(this.st);
+        unpack(unpacked);
+        const blocks = [];
+        const w = createAesBlock();
+        for (let i = 0; i < 6; i++) {
+            for (let j = 0; j < 4; j++)
+                w[j] = unpacked[wordIdx(i, j)];
+            const bytes = new Uint8Array(16);
+            blockToBytes(bytes, w);
+            blocks.push(bytes);
+        }
+        return blocks;
     }
-    set s(states) {
-        this.s0.set(states[0]);
-        this.s1.set(states[1]);
-        this.s2.set(states[2]);
-        this.s3.set(states[3]);
-        this.s4.set(states[4]);
-        this.s5.set(states[5]);
+    /**
+     * Sets the 6 state blocks from byte arrays (for testing).
+     */
+    set s(blocks) {
+        this.st.fill(0);
+        const w = createAesBlock();
+        for (let i = 0; i < 6; i++) {
+            blockFromBytes(w, blocks[i]);
+            blocksPut(this.st, w, i);
+        }
+        pack(this.st);
     }
     /**
      * Initializes the state with a key and nonce.
@@ -34,184 +61,179 @@ export class Aegis256State {
      * @param nonce - 32-byte nonce (must be unique per message)
      */
     init(key, nonce) {
-        const k0 = key.subarray(0, 16);
-        const k1 = key.subarray(16, 32);
-        const n0 = nonce.subarray(0, 16);
-        const n1 = nonce.subarray(16, 32);
-        xorBlocksTo(k0, n0, this.s0);
-        xorBlocksTo(k1, n1, this.s1);
-        this.s2.set(C1);
-        this.s3.set(C0);
-        xorBlocksTo(k0, C0, this.s4);
-        xorBlocksTo(k1, C1, this.s5);
-        const k0Xorn0 = new Uint8Array(16);
-        const k1Xorn1 = new Uint8Array(16);
-        xorBlocksTo(k0, n0, k0Xorn0);
-        xorBlocksTo(k1, n1, k1Xorn1);
+        const k0 = createAesBlock();
+        const k1 = createAesBlock();
+        const n0 = createAesBlock();
+        const n1 = createAesBlock();
+        const k0n0 = createAesBlock();
+        const k1n1 = createAesBlock();
+        const k0c0 = createAesBlock();
+        const k1c1 = createAesBlock();
+        blockFromBytes(k0, key);
+        blockFromBytes(k1, key, 16);
+        blockFromBytes(n0, nonce);
+        blockFromBytes(n1, nonce, 16);
+        blockXor(k0n0, k0, n0);
+        blockXor(k1n1, k1, n1);
+        blockXor(k0c0, k0, C0);
+        blockXor(k1c1, k1, C1);
+        this.st.fill(0);
+        blocksPut(this.st, k0n0, 0);
+        blocksPut(this.st, k1n1, 1);
+        blocksPut(this.st, C1, 2);
+        blocksPut(this.st, C0, 3);
+        blocksPut(this.st, k0c0, 4);
+        blocksPut(this.st, k1c1, 5);
+        const ciK0 = createAesBlocks();
+        const ciK1 = createAesBlocks();
+        const ciK0N0 = createAesBlocks();
+        const ciK1N1 = createAesBlocks();
+        packConstantInput256(ciK0, k0);
+        packConstantInput256(ciK1, k1);
+        packConstantInput256(ciK0N0, k0n0);
+        packConstantInput256(ciK1N1, k1n1);
+        pack(this.st);
         for (let i = 0; i < 4; i++) {
-            this.update(k0);
-            this.update(k1);
-            this.update(k0Xorn0);
-            this.update(k1Xorn1);
+            aegisRound256(this.st, ciK0);
+            aegisRound256(this.st, ciK1);
+            aegisRound256(this.st, ciK0N0);
+            aegisRound256(this.st, ciK1N1);
         }
     }
     /**
      * Updates the state with a 16-byte message block.
-     * @param m - ArrayLike<number> - 16-byte message block
+     * @param m - 16-byte message block
      */
     update(m) {
-        const newS = this.newS;
-        xorBlocksTo(this.s0, m, this.tmp);
-        aesRoundTo(this.s5, this.tmp, newS[0]);
-        aesRoundTo(this.s0, this.s1, newS[1]);
-        aesRoundTo(this.s1, this.s2, newS[2]);
-        aesRoundTo(this.s2, this.s3, newS[3]);
-        aesRoundTo(this.s3, this.s4, newS[4]);
-        aesRoundTo(this.s4, this.s5, newS[5]);
-        this.s0.set(newS[0]);
-        this.s1.set(newS[1]);
-        this.s2.set(newS[2]);
-        this.s3.set(newS[3]);
-        this.s4.set(newS[4]);
-        this.s5.set(newS[5]);
+        blockFromBytes(this.tmp, m);
+        packConstantInput256(this.constantInput, this.tmp);
+        aegisRound256(this.st, this.constantInput);
     }
     /**
      * Absorbs a 16-byte associated data block into the state.
-     * @param ai - 16-byte associated data block
+     * @param ai - Buffer holding the 16-byte associated data block
+     * @param off - Offset of the block within the buffer
      */
-    absorb(ai) {
-        this.update(ai);
+    absorb(ai, off = 0) {
+        const msg = this.tmp;
+        blockFromBytes(msg, ai, off);
+        packConstantInput256(this.constantInput, msg);
+        aegisRound256(this.st, this.constantInput);
     }
     /**
-     * Encrypts a 16-byte plaintext block and writes to output.
-     * @param xi - 16-byte plaintext block
-     * @param out - 16-byte output buffer
+     * Encrypts a 16-byte plaintext block and writes to output buffer.
+     * @param xi - Buffer holding the 16-byte plaintext block
+     * @param out - Output buffer receiving the 16-byte ciphertext block
+     * @param inOff - Offset of the plaintext block within xi
+     * @param outOff - Offset of the ciphertext block within out
      */
-    encTo(xi, out) {
-        const z = this.z;
-        const tmp = this.tmp;
-        xorBlocksTo(this.s1, this.s4, z);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= this.s5[i];
-        andBlocksTo(this.s2, this.s3, tmp);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= tmp[i];
-        this.update(xi);
-        for (let i = 0; i < 16; i++)
-            out[i] = xi[i] ^ z[i];
+    encTo(xi, out, inOff = 0, outOff = 0) {
+        const t = this.tmp;
+        keystream256(this.st, this.z);
+        blockFromBytes(t, xi, inOff);
+        packConstantInput256(this.constantInput, t);
+        aegisRound256(this.st, this.constantInput);
+        blockXor(t, t, this.z);
+        blockToBytes(out, t, outOff);
     }
-    /**
-     * Encrypts a 16-byte plaintext block.
-     * @param xi - 16-byte plaintext block
-     * @returns 16-byte ciphertext block
-     */
     enc(xi) {
         const out = new Uint8Array(16);
         this.encTo(xi, out);
         return out;
     }
     /**
-     * Decrypts a 16-byte ciphertext block and writes to output.
-     * @param ci - 16-byte ciphertext block
-     * @param out - 16-byte output buffer
+     * Decrypts a 16-byte ciphertext block and writes to output buffer.
+     * @param ci - Buffer holding the 16-byte ciphertext block
+     * @param out - Output buffer receiving the 16-byte plaintext block
+     * @param inOff - Offset of the ciphertext block within ci
+     * @param outOff - Offset of the plaintext block within out
      */
-    decTo(ci, out) {
-        const z = this.z;
-        const tmp = this.tmp;
-        xorBlocksTo(this.s1, this.s4, z);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= this.s5[i];
-        andBlocksTo(this.s2, this.s3, tmp);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= tmp[i];
-        for (let i = 0; i < 16; i++)
-            out[i] = ci[i] ^ z[i];
-        this.update(out);
+    decTo(ci, out, inOff = 0, outOff = 0) {
+        const msg = this.tmp;
+        blockFromBytes(msg, ci, inOff);
+        keystream256(this.st, this.z);
+        blockXor(msg, msg, this.z);
+        packConstantInput256(this.constantInput, msg);
+        aegisRound256(this.st, this.constantInput);
+        blockToBytes(out, msg, outOff);
     }
-    /**
-     * Decrypts a 16-byte ciphertext block.
-     * @param ci - 16-byte ciphertext block
-     * @returns 16-byte plaintext block
-     */
     dec(ci) {
         const out = new Uint8Array(16);
         this.decTo(ci, out);
         return out;
     }
-    /**
-     * Encrypts a 16-byte plaintext block in-place.
-     * @param block - 16-byte buffer (plaintext in, ciphertext out)
-     */
     encInPlace(block) {
         this.encTo(block, block);
     }
-    /**
-     * Decrypts a 16-byte ciphertext block in-place.
-     * @param block - 16-byte buffer (ciphertext in, plaintext out)
-     */
     decInPlace(block) {
         this.decTo(block, block);
     }
-    /**
-     * Decrypts a partial (final) ciphertext block smaller than 16 bytes.
-     * @param cn - Partial ciphertext block (1-15 bytes)
-     * @returns Decrypted plaintext of the same length
-     */
     decPartial(cn) {
-        const z = this.z;
-        const tmp = this.tmp;
-        xorBlocksTo(this.s1, this.s4, z);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= this.s5[i];
-        andBlocksTo(this.s2, this.s3, tmp);
-        for (let i = 0; i < 16; i++)
-            z[i] ^= tmp[i];
-        const t = zeroPad(cn, 16);
-        const out = new Uint8Array(16);
-        for (let i = 0; i < 16; i++)
-            out[i] = t[i] ^ z[i];
-        const xn = new Uint8Array(out.subarray(0, cn.length));
-        const v = zeroPad(xn, 16);
-        this.update(v);
+        const msg = this.tmp;
+        const padded = zeroPad(cn, RATE);
+        blockFromBytes(msg, padded);
+        keystream256(this.st, this.z);
+        blockXor(msg, msg, this.z);
+        const pad = new Uint8Array(RATE);
+        blockToBytes(pad, msg);
+        const xn = new Uint8Array(pad.subarray(0, cn.length));
+        pad.fill(0, cn.length);
+        blockFromBytes(msg, pad);
+        packConstantInput256(this.constantInput, msg);
+        aegisRound256(this.st, this.constantInput);
         return xn;
     }
     /**
      * Finalizes encryption/decryption and produces an authentication tag.
-     * @param adLenBits - Associated data length in bits
-     * @param msgLenBits - Message length in bits
-     * @param tagLen - Tag length (16 or 32 bytes)
-     * @returns Authentication tag
      */
-    finalize(adLenBits, msgLenBits, tagLen = 16) {
-        const t = this.tBuf;
-        le64To(adLenBits, t, 0);
-        le64To(msgLenBits, t, 8);
-        for (let i = 0; i < 16; i++)
-            t[i] ^= this.s3[i];
+    finalize(adLen, msgLen, tagLen = 16) {
+        const st = this.st;
+        const tmp = this.tmp;
+        tmp[0] = (adLen * 8) & 0xffffffff;
+        tmp[1] = Math.floor((adLen * 8) / 0x100000000);
+        tmp[2] = (msgLen * 8) & 0xffffffff;
+        tmp[3] = Math.floor((msgLen * 8) / 0x100000000);
+        const unpacked = createAesBlocks();
+        unpacked.set(st);
+        unpack(unpacked);
+        tmp[0] = tmp[0] ^ unpacked[wordIdx(3, 0)];
+        tmp[1] = tmp[1] ^ unpacked[wordIdx(3, 1)];
+        tmp[2] = tmp[2] ^ unpacked[wordIdx(3, 2)];
+        tmp[3] = tmp[3] ^ unpacked[wordIdx(3, 3)];
+        packConstantInput256(this.constantInput, tmp);
         for (let i = 0; i < 7; i++) {
-            this.update(t);
+            aegisRound256(st, this.constantInput);
         }
+        unpack(st);
         if (tagLen === 16) {
             const tag = new Uint8Array(16);
-            for (let i = 0; i < 16; i++) {
-                tag[i] =
-                    this.s0[i] ^
-                        this.s1[i] ^
-                        this.s2[i] ^
-                        this.s3[i] ^
-                        this.s4[i] ^
-                        this.s5[i];
+            const tagBlock = createAesBlock();
+            for (let i = 0; i < 4; i++) {
+                tagBlock[i] =
+                    st[wordIdx(0, i)] ^
+                        st[wordIdx(1, i)] ^
+                        st[wordIdx(2, i)] ^
+                        st[wordIdx(3, i)] ^
+                        st[wordIdx(4, i)] ^
+                        st[wordIdx(5, i)];
             }
+            blockToBytes(tag, tagBlock);
             return tag;
         }
         else {
             const tag = new Uint8Array(32);
-            for (let i = 0; i < 16; i++) {
-                tag[i] = this.s0[i] ^ this.s1[i] ^ this.s2[i];
+            const tagBlock0 = createAesBlock();
+            const tagBlock1 = createAesBlock();
+            for (let i = 0; i < 4; i++) {
+                tagBlock0[i] =
+                    st[wordIdx(0, i)] ^ st[wordIdx(1, i)] ^ st[wordIdx(2, i)];
             }
-            for (let i = 0; i < 16; i++) {
-                tag[16 + i] = this.s3[i] ^ this.s4[i] ^ this.s5[i];
+            for (let i = 0; i < 4; i++) {
+                tagBlock1[i] =
+                    st[wordIdx(3, i)] ^ st[wordIdx(4, i)] ^ st[wordIdx(5, i)];
             }
+            blockToBytes(tag, tagBlock0);
+            blockToBytes(tag, tagBlock1, 16);
             return tag;
         }
     }
@@ -228,17 +250,21 @@ export class Aegis256State {
 export function aegis256EncryptDetached(msg, ad, key, nonce, tagLen = 16) {
     const state = new Aegis256State();
     state.init(key, nonce);
-    const adPadded = zeroPad(ad, 16);
-    for (let i = 0; i + 16 <= adPadded.length; i += 16) {
-        state.absorb(adPadded.subarray(i, i + 16));
+    const adPadded = zeroPad(ad, RATE);
+    for (let i = 0; i + RATE <= adPadded.length; i += RATE) {
+        state.absorb(adPadded, i);
     }
-    const msgPadded = zeroPad(msg, 16);
-    const ct = new Uint8Array(msgPadded.length);
-    for (let i = 0; i + 16 <= msgPadded.length; i += 16) {
-        state.encTo(msgPadded.subarray(i, i + 16), ct.subarray(i, i + 16));
+    const ciphertext = new Uint8Array(msg.length);
+    const fullBlocks = Math.floor(msg.length / RATE) * RATE;
+    for (let i = 0; i < fullBlocks; i += RATE) {
+        state.encTo(msg, ciphertext, i, i);
+    }
+    if (msg.length > fullBlocks) {
+        const lastBlock = zeroPad(msg.subarray(fullBlocks), RATE);
+        const encBlock = state.enc(lastBlock);
+        ciphertext.set(encBlock.subarray(0, msg.length - fullBlocks), fullBlocks);
     }
-    const tag = state.finalize(BigInt(ad.length * 8), BigInt(msg.length * 8), tagLen);
-    const ciphertext = new Uint8Array(ct.subarray(0, msg.length));
+    const tag = state.finalize(ad.length, msg.length, tagLen);
     return { ciphertext, tag };
 }
 /**
@@ -254,20 +280,19 @@ export function aegis256DecryptDetached(ct, tag, ad, key, nonce) {
     const tagLen = tag.length;
     const state = new Aegis256State();
     state.init(key, nonce);
-    const adPadded = zeroPad(ad, 16);
-    for (let i = 0; i + 16 <= adPadded.length; i += 16) {
-        state.absorb(adPadded.subarray(i, i + 16));
+    const adPadded = zeroPad(ad, RATE);
+    for (let i = 0; i + RATE <= adPadded.length; i += RATE) {
+        state.absorb(adPadded, i);
     }
-    const fullBlocksLen = Math.floor(ct.length / 16) * 16;
-    const cn = ct.subarray(fullBlocksLen);
-    const msg = new Uint8Array(fullBlocksLen + (cn.length > 0 ? cn.length : 0));
-    for (let i = 0; i + 16 <= ct.length; i += 16) {
-        state.decTo(ct.subarray(i, i + 16), msg.subarray(i, i + 16));
+    const msg = new Uint8Array(ct.length);
+    const fullBlocks = Math.floor(ct.length / RATE) * RATE;
+    for (let i = 0; i < fullBlocks; i += RATE) {
+        state.decTo(ct, msg, i, i);
     }
-    if (cn.length > 0) {
-        msg.set(state.decPartial(cn), fullBlocksLen);
+    if (ct.length > fullBlocks) {
+        msg.set(state.decPartial(ct.subarray(fullBlocks)), fullBlocks);
     }
-    const expectedTag = state.finalize(BigInt(ad.length * 8), BigInt(msg.length * 8), tagLen);
+    const expectedTag = state.finalize(ad.length, msg.length, tagLen);
     if (!constantTimeEqual(tag, expectedTag)) {
         msg.fill(0);
         return null;
@@ -287,22 +312,22 @@ export function aegis256DecryptDetached(ct, tag, ad, key, nonce) {
 export function aegis256EncryptDetachedInPlace(data, ad, key, nonce, tagLen = 16) {
     const state = new Aegis256State();
     state.init(key, nonce);
-    const adPadded = zeroPad(ad, 16);
-    for (let i = 0; i + 16 <= adPadded.length; i += 16) {
-        state.absorb(adPadded.subarray(i, i + 16));
+    const adPadded = zeroPad(ad, RATE);
+    for (let i = 0; i + RATE <= adPadded.length; i += RATE) {
+        state.absorb(adPadded, i);
     }
     const msgLen = data.length;
-    const fullBlocksLen = Math.floor(msgLen / 16) * 16;
-    for (let i = 0; i < fullBlocksLen; i += 16) {
-        state.encInPlace(data.subarray(i, i + 16));
+    const fullBlocksLen = Math.floor(msgLen / RATE) * RATE;
+    for (let i = 0; i < fullBlocksLen; i += RATE) {
+        state.encTo(data, data, i, i);
     }
     if (msgLen > fullBlocksLen) {
         const lastPartial = data.subarray(fullBlocksLen);
-        const lastBlock = zeroPad(lastPartial, 16);
+        const lastBlock = zeroPad(lastPartial, RATE);
         const encBlock = state.enc(lastBlock);
         lastPartial.set(encBlock.subarray(0, lastPartial.length));
     }
-    return state.finalize(BigInt(ad.length * 8), BigInt(msgLen * 8), tagLen);
+    return state.finalize(ad.length, msgLen, tagLen);
 }
 /**
  * Decrypts a message in-place using AEGIS-256 (detached mode).
@@ -318,21 +343,21 @@ export function aegis256DecryptDetachedInPlace(data, tag, ad, key, nonce) {
     const tagLen = tag.length;
     const state = new Aegis256State();
     state.init(key, nonce);
-    const adPadded = zeroPad(ad, 16);
-    for (let i = 0; i + 16 <= adPadded.length; i += 16) {
-        state.absorb(adPadded.subarray(i, i + 16));
+    const adPadded = zeroPad(ad, RATE);
+    for (let i = 0; i + RATE <= adPadded.length; i += RATE) {
+        state.absorb(adPadded, i);
     }
     const msgLen = data.length;
-    const fullBlocksLen = Math.floor(msgLen / 16) * 16;
-    for (let i = 0; i < fullBlocksLen; i += 16) {
-        state.decInPlace(data.subarray(i, i + 16));
+    const fullBlocksLen = Math.floor(msgLen / RATE) * RATE;
+    for (let i = 0; i < fullBlocksLen; i += RATE) {
+        state.decTo(data, data, i, i);
     }
     if (msgLen > fullBlocksLen) {
         const lastPartial = data.subarray(fullBlocksLen);
         const decrypted = state.decPartial(lastPartial);
         lastPartial.set(decrypted);
     }
-    const expectedTag = state.finalize(BigInt(ad.length * 8), BigInt(msgLen * 8), tagLen);
+    const expectedTag = state.finalize(ad.length, msgLen, tagLen);
     if (!constantTimeEqual(tag, expectedTag)) {
         data.fill(0);
         return false;
@@ -355,26 +380,11 @@ export const AEGIS_256_KEY_SIZE = 32;
  */
 export function aegis256Encrypt(msg, ad, key, nonce = null, tagLen = 16) {
     const actualNonce = nonce ?? randomBytes(AEGIS_256_NONCE_SIZE);
-    const state = new Aegis256State();
-    state.init(key, actualNonce);
-    const adPadded = zeroPad(ad, 16);
-    for (let i = 0; i + 16 <= adPadded.length; i += 16) {
-        state.absorb(adPadded.subarray(i, i + 16));
-    }
-    const nonceSize = AEGIS_256_NONCE_SIZE;
-    const result = new Uint8Array(nonceSize + msg.length + tagLen);
+    const { ciphertext, tag } = aegis256EncryptDetached(msg, ad, key, actualNonce, tagLen);
+    const result = new Uint8Array(AEGIS_256_NONCE_SIZE + ciphertext.length + tagLen);
     result.set(actualNonce, 0);
-    const fullBlocks = Math.floor(msg.length / 16) * 16;
-    for (let i = 0; i < fullBlocks; i += 16) {
-        state.encTo(msg.subarray(i, i + 16), result.subarray(nonceSize + i, nonceSize + i + 16));
-    }
-    if (msg.length > fullBlocks) {
-        const lastBlock = zeroPad(msg.subarray(fullBlocks), 16);
-        const encBlock = state.enc(lastBlock);
-        result.set(encBlock.subarray(0, msg.length - fullBlocks), nonceSize + fullBlocks);
-    }
-    const tag = state.finalize(BigInt(ad.length * 8), BigInt(msg.length * 8), tagLen);
-    result.set(tag, nonceSize + msg.length);
+    result.set(ciphertext, AEGIS_256_NONCE_SIZE);
+    result.set(tag, AEGIS_256_NONCE_SIZE + ciphertext.length);
     return result;
 }
 /**
@@ -407,11 +417,11 @@ export function aegis256Decrypt(sealed, ad, key, tagLen = 16) {
 export function aegis256Mac(data, key, nonce = null, tagLen = 16) {
     const state = new Aegis256State();
     state.init(key, nonce ?? new Uint8Array(32));
-    const dataPadded = zeroPad(data, 16);
-    for (let i = 0; i + 16 <= dataPadded.length; i += 16) {
-        state.absorb(dataPadded.subarray(i, i + 16));
+    const dataPadded = zeroPad(data, RATE);
+    for (let i = 0; i + RATE <= dataPadded.length; i += RATE) {
+        state.absorb(dataPadded, i);
     }
-    return state.finalize(BigInt(data.length * 8), BigInt(tagLen * 8), tagLen);
+    return state.finalize(data.length, tagLen, tagLen);
 }
 /**
  * Verifies a MAC computed using AEGIS-256.
@@ -442,4 +452,3 @@ export function aegis256CreateKey() {
 export function aegis256CreateNonce() {
     return randomBytes(AEGIS_256_NONCE_SIZE);
 }
-//# sourceMappingURL=aegis256.js.map