encrypt.c

#include "api.h"
#include "endian.h"
#include "permutations.h"

#define PA_ROUNDS 12
#define PB_ROUNDS 8
#define IV                                                            \
  ((uint64_t)(8 * (CRYPTO_KEYBYTES)) << 56 |                          \
   (uint64_t)(8 * (ASCON_RATE)) << 48 | (uint64_t)(PA_ROUNDS) << 40 | \
   (uint64_t)(PB_ROUNDS) << 32)

int crypto_aead_encrypt(uint8_t* c, uint64_t* clen, const uint8_t* m,
                        uint64_t mlen, const uint8_t* ad, uint64_t adlen,
                        const uint8_t* nsec, const uint8_t* npub,
                        const uint8_t* k) {
  const uint64_t K0 = U64BIG(*(uint64_t*)k);
  const uint64_t K1 = U64BIG(*(uint64_t*)(k + 8));
  const uint64_t N0 = U64BIG(*(uint64_t*)npub);
  const uint64_t N1 = U64BIG(*(uint64_t*)(npub + 8));
  state_t s;
  uint32_t i;
  (void)nsec;

  /* set ciphertext size */
  *clen = mlen + CRYPTO_ABYTES;

  /* initialization */
  s.x0 = IV;
  s.x1 = K0;
  s.x2 = K1;
  s.x3 = N0;
  s.x4 = N1;
  P12();
  s.x3 ^= K0;
  s.x4 ^= K1;

  /* process associated data */
  if (adlen) {
    AD();
    for (i = 0; i < adlen; ++i, ++ad)
      if (i < 8)
        s.x0 ^= SETBYTE(*ad, i);
      else
        s.x1 ^= SETBYTE(*ad, i % 8);
    if (adlen < 8)
      s.x0 ^= SETBYTE(0x80, adlen);
    else
      s.x1 ^= SETBYTE(0x80, adlen % 8);
    P8();
  }
  s.x4 ^= 1;

  /* process plaintext */
  PT();
  for (i = 0; i < mlen; ++i, ++m, ++c) {
    if (i < 8) {
      s.x0 ^= SETBYTE(*m, i);
      *c = GETBYTE(s.x0, i);
    } else {
      s.x1 ^= SETBYTE(*m, i % 8);
      *c = GETBYTE(s.x1, i % 8);
    }
  }
  if (mlen < 8)
    s.x0 ^= SETBYTE(0x80, mlen);
  else
    s.x1 ^= SETBYTE(0x80, mlen % 8);

  /* finalization */
  s.x2 ^= K0;
  s.x3 ^= K1;
  P12();
  s.x3 ^= K0;
  s.x4 ^= K1;

  /* set tag */
  *(uint64_t*)c = U64BIG(s.x3);
  *(uint64_t*)(c + 8) = U64BIG(s.x4);

  return 0;
}